Following the publication of our last article regarding the Consumer Credit Bill 2025, many clients, especially those in the fintech space, have reached out seeking to understand how the Consumer Credit Bill 2025 will impact and affect their organizations.
Given the extensive and broad nature of the Consumer Credit Bill 2025, instead of using one article to explain everything in one go, which would certainly be too overwhelming, we will use this article to address the highest demand inquiry we have received so far from our clients in the fintech space, specifically those operating a Buy Now Pay Later (“BNPL”) business.
Therefore, in this article, we will deep dive into how the Consumer Credit Bill 2025 will impact BNPL businesses and how they should prepare for this with the top 10 key takeaways. Whether you are an early-stage BNPL provider or a more established credit player integrating BNPL into your suite of offerings, this is a timely opportunity to re-evaluate your regulatory roadmap.
Key Takeaway 1: Understanding the Definition of BNPL Under the Consumer Credit Bill 2025
The first key takeaway is to understand what constitutes a BNPL scheme as defined under the Consumer Credit Bill 2025.
There has always been confusion regarding the actual mechanism of a BNPL scheme and which transactions fall within its scope. According to the Consumer Credit Bill 2025, a BNPL scheme refers to “an arrangement, by whatever name called, entered into between a credit consumer and a third-party credit provider for the purchase of goods or services by the credit consumer from a seller where: (i) the third-party credit provider provides credit to the credit consumer; and (ii) the payment due by the credit consumer to the third-party credit provider is deferred and may be made in a single payment or by instalments in accordance with the terms and conditions of the arrangement.”
One key thing to note is that the BNPL arrangement must involve a credit consumer and a ‘third-party credit provider’. This means that if credit is provided directly by the seller, rather than through a third-party credit provider, it does not fall within the definition of a BNPL scheme. This is crucial because some organizations, which act as both the seller and the credit provider, may refer to their arrangements as BNPL, but under the Consumer Credit Bill 2025, such arrangements would technically not be classified as BNPL schemes. This clarification is essential, particularly in the fintech space, where the provision of credit is often intertwined with sales.
Key Takeaway 2: Mandatory Licensing Requirements for BNPL Businesses
The second key takeaway is that under the Consumer Credit Bill 2025, a mandatory licensing requirement will now be in place for organizations in carrying out BNPL businesses, meaning that no organization can carry out or hold itself out as offering BNPL services unless it is a licensed credit provider. Failure to comply with this requirement could result in severe penalties, including a fine of up to RM5,000,000, imprisonment for up to five years, or both.
The consequences of providing BNPL scheme without licenses are extremely severe, signaling that the Consumer Credit Bill 2025 aims to prohibit organizations from offering BNPL services unless they are licensed credit providers. With the increasing presence of fintech startups providing micro-financing in the form of BNPL schemes, this shift means that once the bill is passed, such organizations must be licensed to operate legally. All BNPL service providers should closely monitor the development of the bill and ensure they are prepared to meet the licensing requirements.
Key Takeaway 3: Navigating the Structured Licensing Process
The third key takeaway is that to legally conduct BNPL business, organizations must submit a licensing application to the Consumer Credit Commission. It is important to note that the application process is not a simple or straightforward procedure, as the Commission requires that all applications be submitted in accordance with the manner prescribed by the Commission, including the payment of prescribed fees and submission of all required documents and information.
The Commission may also conduct an inquiry and request additional information or documents as deemed necessary. If the applicant fails to provide the requested documentation, the application process cannot proceed, and the fees paid will not be refunded. Given the seriousness of the process, organizations should ensure they are fully prepared and cannot afford to take the application process lightly.
Key Takeaway 4: Minimum Financial Requirements
The fourth key takeaway is that in order to be successfully licensed to operate a BNPL business, there are minimum financial requirements that must be satisfied by the applicant. More importantly, even upon obtaining the licence, the organization must at all times continue to comply with these minimum financial requirements in order to carry out BNPL business, unless it has received prior written consent to deviate from such minimum financial requirements.
This requirement will inevitably impose a certain degree of financial burden on BNPL providers, both at the licensing stage and on an ongoing basis, to ensure continuous compliance. This may be especially challenging for fintech startups with a relatively short runway or limited financial resources. With that being said, it is important to appreciate that the imposition of minimum financial requirements is intentional, and we would even argue essential, to safeguard and ensure the stability of the entire credit ecosystem as they help ensure that only players with sufficient financial resilience are permitted to operate in the space, thereby protecting consumers and strengthening confidence in the market.
Key Takeaway 5: Fit and Proper Requirements
The fifth takeaway is that, in addition to minimum financial requirements, BNPL operators must also comply with “fit and proper” requirements. These fit and proper requirements extend to its directors, partners and senior management of the organization, and the fit and proper criteria include key attributes such as personal integrity, reputation, competency, capability, and financial soundness.
In fact, the Consumer Credit Bill 2025 expressly provides that the director, partner or senior management must at all times comply with these fit and proper requirements. Where any director, partner or member of senior management fails to satisfy these requirements, the organisation is obligated to remove them from office immediately. Failing to do so constitutes an offence, and upon conviction, may result in a fine of up to RM500,000 or imprisonment for up to three years, or both.
This clearly signals that individuals running BNPL businesses must meet a high standard of accountability and integrity. While BNPL companies may not be financial institutions per se, the increasing reliance of consumers on BNPL services justifies the need for such standards. It is also noteworthy that the appointment of a CEO is subject to the prior written approval of the Commission, thereby underscoring the need for all stakeholders and senior management involved in BNPL businesses to be serious, competent, and compliant.
Key Takeaway 6: Restrictions and Approval for Controller
The sixth takeaway is arguably one of the most significant, concerning the position of the “controller” of a BNPL business. Under the Consumer Credit Bill 2025, no person may become a controller or exercise control over a BNPL business unless that person fulfils the fit and proper requirements and obtains prior written approval from the Commission.
A person is deemed to be a “controller” if: (i) they are entitled to exercise not less than 33% of the voting rights, (ii) they have the power to appoint a majority of the directors of the BNPL company, or (iii) they possess the ability to make key decisions regarding the BNPL business.
This definition of “controller” is intentionally broad, as it is not confined solely to legal shareholding and can be extended to persons with equitable or beneficial ownership who can exert influence or control over the company. The law takes this so seriously that if a controller no longer satisfies the fit and proper requirement, the organization must notify the Commission immediately, and the controller must then either dispose of the shareholding that renders them a controller or otherwise cease to have control over the company. The penalties for contravening these provisions are significant, as upon conviction, a fine of up to RM500,000 or imprisonment of up to three years, or both, may be imposed.
Such approach definitely elevates the importance of fit and proper compliance to a whole new level, and it will certainly affect the current and future shareholding structures of BNPL operators, especially those involving venture capital or private equity investors, as if such investors fall within the definition of a controller, they too would be subject to the same regulatory scrutiny and approval process.
Key Takeaway 7: Approval for Acquiring Substantial Interests
The seventh key takeaway is also particularly significant as it relates to the acquisition of interest in BNPL businesses. Under the Consumer Credit Bill 2025, no person shall acquire any interest in a BNPL company if such acquisition would result in the person holding in aggregate more than 33% of shares in a BNPL business, unless prior written approval has been obtained from the Commission. A contravention of this provision is a serious offence, and any person found liable may be subject to a fine of up to RM500,000, imprisonment for up to three years, or both.
This requirement has major implications for BNPL companies that are fundraising or undergoing equity restructuring. As equity is often offered during capital raising or expansion stages, it is crucial that such transactions be carefully assessed from a regulatory standpoint, as the implications of share acquisition, changes in control, and restructuring must be fully understood to avoid inadvertent breaches. Accordingly, BNPL operators should seek proper legal advice when structuring shareholder arrangements or onboarding new investors.
Key Takeaway 8: Licence To Operate BNPL Business Is Non-Transferrable
The eighth key takeaway is that the licence to operate a BNPL business is non-transferable. A BNPL company is prohibited from transferring or assigning its licence to any other person, or from allowing any third party to use the licence to carry out BNPL activities. This is especially notable because, in other industries, it is not uncommon for business licences to be transferred or used by third parties under certain circumstances, however, this is not permitted for BNPL businesses.
Additionally, the Consumer Credit Bill 2025 is clear that, unless prior written approval is obtained from the Commission, a BNPL company is not allowed to sell, dispose of, lease, assign or transfer, whether in whole or in part, its business to another party. It also cannot merge or amalgamate its BNPL business with another person. This demonstrates the highly regulated nature of BNPL operations, where virtually any transaction that affects the ownership, control, or structure of the business falls within the regulatory scope of the Consumer Credit Bill 2025.
Key Takeaway 9: Unlicensed BNPL Agreements Will Be Unenforceable
Under the Consumer Credit Bill 2025, any BNPL agreement or arrangement entered into by an unlicensed entity is unenforceable.
This is a critical point for companies currently conducting BNPL business. Once the licensing regime is in force and applications are opened, it is imperative that BNPL operators promptly submit their licensing applications. Otherwise, any BNPL arrangements they enter into during that period may be rendered invalid and legally unenforceable.
Key Takeaway 10: Licensing is Not Guaranteed
The last key takeaway is that an application for a BNPL licence does not guarantee automatic approval. As even if an applicant meets the minimum financial requirements and submits all the requisite documents, the Commission still retains discretion in granting the licence.
Specifically, under the Consumer Credit Bill 2025, the Commission may refuse an application on five key grounds: (i) the application is not submitted in accordance with the law; (ii) the applicant fails to comply with any applicable regulations, standards, guidelines, or legal requirements; (iii) the applicant, or its controller, directors, partners, or senior management, fails to meet the fit and proper criteria; (iv) the documents or information submitted are false or misleading; or (v) the Commission is of the view that granting the licence would be contrary to public interest.
This illustrates that the licensing process is rigorous and highly scrutinized. As such, it is strongly advisable for companies seeking to enter or continue operating in the BNPL space to seek proper legal guidance, particularly from legal professionals who are familiar with the fintech regulatory landscape and have experience dealing with the relevant authorities in managing licensing applications.
◦ The Technology Practice Group at Halim Hong & Quek frequently advises and represents companies in relation to financial technology or FinTech matters, including BNPL scheme, factoring service and earned wage access that utilise technology in their offerings. If you are interested to know more about the Consumer Credit Bill 2025 or if you need any legal assistance with regard to your FinTech business, please do not hesitate to reach out to the Technology Practice Group. Halim Hong & Quek has been awarded Fintech Law Firm of the Year in 2024 and ranked as Tier 3 in Fintech and financial services regulatory by Legal 500, Band 2 in Fintech by Chambers and Partners.
About the authors
◦Ong Johnson Partner Head of Technology Practice Group Technology, Media & Telecommunications (“TMT”), Fintech, TMT Disputes, TMT Competition, Regulatory and Compliance [email protected]
◦ Lo Khai Yi Partner Co-Head of Technology Practice Group Technology, Media & Telecommunications (“TMT”), Technology Acquisition and Outsourcing, Telecommunication Licensing and Acquisition, Cybersecurity [email protected].
The Impact of the Consumer Credit Bill 2025 on Buy Now Pay Later (BNPL) Businesses: 10 Key Takeaways
Following the publication of our last article regarding the Consumer Credit Bill 2025, many clients, especially those in the fintech space, have reached out seeking to understand how the Consumer Credit Bill 2025 will impact and affect their organizations.
Given the extensive and broad nature of the Consumer Credit Bill 2025, instead of using one article to explain everything in one go, which would certainly be too overwhelming, we will use this article to address the highest demand inquiry we have received so far from our clients in the fintech space, specifically those operating a Buy Now Pay Later (“BNPL”) business.
Therefore, in this article, we will deep dive into how the Consumer Credit Bill 2025 will impact BNPL businesses and how they should prepare for this with the top 10 key takeaways. Whether you are an early-stage BNPL provider or a more established credit player integrating BNPL into your suite of offerings, this is a timely opportunity to re-evaluate your regulatory roadmap.
Key Takeaway 1: Understanding the Definition of BNPL Under the Consumer Credit Bill 2025
The first key takeaway is to understand what constitutes a BNPL scheme as defined under the Consumer Credit Bill 2025.
There has always been confusion regarding the actual mechanism of a BNPL scheme and which transactions fall within its scope. According to the Consumer Credit Bill 2025, a BNPL scheme refers to “an arrangement, by whatever name called, entered into between a credit consumer and a third-party credit provider for the purchase of goods or services by the credit consumer from a seller where: (i) the third-party credit provider provides credit to the credit consumer; and (ii) the payment due by the credit consumer to the third-party credit provider is deferred and may be made in a single payment or by instalments in accordance with the terms and conditions of the arrangement.”
One key thing to note is that the BNPL arrangement must involve a credit consumer and a ‘third-party credit provider’. This means that if credit is provided directly by the seller, rather than through a third-party credit provider, it does not fall within the definition of a BNPL scheme. This is crucial because some organizations, which act as both the seller and the credit provider, may refer to their arrangements as BNPL, but under the Consumer Credit Bill 2025, such arrangements would technically not be classified as BNPL schemes. This clarification is essential, particularly in the fintech space, where the provision of credit is often intertwined with sales.
Key Takeaway 2: Mandatory Licensing Requirements for BNPL Businesses
The second key takeaway is that under the Consumer Credit Bill 2025, a mandatory licensing requirement will now be in place for organizations in carrying out BNPL businesses, meaning that no organization can carry out or hold itself out as offering BNPL services unless it is a licensed credit provider. Failure to comply with this requirement could result in severe penalties, including a fine of up to RM5,000,000, imprisonment for up to five years, or both.
The consequences of providing BNPL scheme without licenses are extremely severe, signaling that the Consumer Credit Bill 2025 aims to prohibit organizations from offering BNPL services unless they are licensed credit providers. With the increasing presence of fintech startups providing micro-financing in the form of BNPL schemes, this shift means that once the bill is passed, such organizations must be licensed to operate legally. All BNPL service providers should closely monitor the development of the bill and ensure they are prepared to meet the licensing requirements.
Key Takeaway 3: Navigating the Structured Licensing Process
The third key takeaway is that to legally conduct BNPL business, organizations must submit a licensing application to the Consumer Credit Commission. It is important to note that the application process is not a simple or straightforward procedure, as the Commission requires that all applications be submitted in accordance with the manner prescribed by the Commission, including the payment of prescribed fees and submission of all required documents and information.
The Commission may also conduct an inquiry and request additional information or documents as deemed necessary. If the applicant fails to provide the requested documentation, the application process cannot proceed, and the fees paid will not be refunded. Given the seriousness of the process, organizations should ensure they are fully prepared and cannot afford to take the application process lightly.
Key Takeaway 4: Minimum Financial Requirements
The fourth key takeaway is that in order to be successfully licensed to operate a BNPL business, there are minimum financial requirements that must be satisfied by the applicant. More importantly, even upon obtaining the licence, the organization must at all times continue to comply with these minimum financial requirements in order to carry out BNPL business, unless it has received prior written consent to deviate from such minimum financial requirements.
This requirement will inevitably impose a certain degree of financial burden on BNPL providers, both at the licensing stage and on an ongoing basis, to ensure continuous compliance. This may be especially challenging for fintech startups with a relatively short runway or limited financial resources. With that being said, it is important to appreciate that the imposition of minimum financial requirements is intentional, and we would even argue essential, to safeguard and ensure the stability of the entire credit ecosystem as they help ensure that only players with sufficient financial resilience are permitted to operate in the space, thereby protecting consumers and strengthening confidence in the market.
Key Takeaway 5: Fit and Proper Requirements
The fifth takeaway is that, in addition to minimum financial requirements, BNPL operators must also comply with “fit and proper” requirements. These fit and proper requirements extend to its directors, partners and senior management of the organization, and the fit and proper criteria include key attributes such as personal integrity, reputation, competency, capability, and financial soundness.
In fact, the Consumer Credit Bill 2025 expressly provides that the director, partner or senior management must at all times comply with these fit and proper requirements. Where any director, partner or member of senior management fails to satisfy these requirements, the organisation is obligated to remove them from office immediately. Failing to do so constitutes an offence, and upon conviction, may result in a fine of up to RM500,000 or imprisonment for up to three years, or both.
This clearly signals that individuals running BNPL businesses must meet a high standard of accountability and integrity. While BNPL companies may not be financial institutions per se, the increasing reliance of consumers on BNPL services justifies the need for such standards. It is also noteworthy that the appointment of a CEO is subject to the prior written approval of the Commission, thereby underscoring the need for all stakeholders and senior management involved in BNPL businesses to be serious, competent, and compliant.
Key Takeaway 6: Restrictions and Approval for Controller
The sixth takeaway is arguably one of the most significant, concerning the position of the “controller” of a BNPL business. Under the Consumer Credit Bill 2025, no person may become a controller or exercise control over a BNPL business unless that person fulfils the fit and proper requirements and obtains prior written approval from the Commission.
A person is deemed to be a “controller” if: (i) they are entitled to exercise not less than 33% of the voting rights, (ii) they have the power to appoint a majority of the directors of the BNPL company, or (iii) they possess the ability to make key decisions regarding the BNPL business.
This definition of “controller” is intentionally broad, as it is not confined solely to legal shareholding and can be extended to persons with equitable or beneficial ownership who can exert influence or control over the company. The law takes this so seriously that if a controller no longer satisfies the fit and proper requirement, the organization must notify the Commission immediately, and the controller must then either dispose of the shareholding that renders them a controller or otherwise cease to have control over the company. The penalties for contravening these provisions are significant, as upon conviction, a fine of up to RM500,000 or imprisonment of up to three years, or both, may be imposed.
Such approach definitely elevates the importance of fit and proper compliance to a whole new level, and it will certainly affect the current and future shareholding structures of BNPL operators, especially those involving venture capital or private equity investors, as if such investors fall within the definition of a controller, they too would be subject to the same regulatory scrutiny and approval process.
Key Takeaway 7: Approval for Acquiring Substantial Interests
The seventh key takeaway is also particularly significant as it relates to the acquisition of interest in BNPL businesses. Under the Consumer Credit Bill 2025, no person shall acquire any interest in a BNPL company if such acquisition would result in the person holding in aggregate more than 33% of shares in a BNPL business, unless prior written approval has been obtained from the Commission. A contravention of this provision is a serious offence, and any person found liable may be subject to a fine of up to RM500,000, imprisonment for up to three years, or both.
This requirement has major implications for BNPL companies that are fundraising or undergoing equity restructuring. As equity is often offered during capital raising or expansion stages, it is crucial that such transactions be carefully assessed from a regulatory standpoint, as the implications of share acquisition, changes in control, and restructuring must be fully understood to avoid inadvertent breaches. Accordingly, BNPL operators should seek proper legal advice when structuring shareholder arrangements or onboarding new investors.
Key Takeaway 8: Licence To Operate BNPL Business Is Non-Transferrable
The eighth key takeaway is that the licence to operate a BNPL business is non-transferable. A BNPL company is prohibited from transferring or assigning its licence to any other person, or from allowing any third party to use the licence to carry out BNPL activities. This is especially notable because, in other industries, it is not uncommon for business licences to be transferred or used by third parties under certain circumstances, however, this is not permitted for BNPL businesses.
Additionally, the Consumer Credit Bill 2025 is clear that, unless prior written approval is obtained from the Commission, a BNPL company is not allowed to sell, dispose of, lease, assign or transfer, whether in whole or in part, its business to another party. It also cannot merge or amalgamate its BNPL business with another person. This demonstrates the highly regulated nature of BNPL operations, where virtually any transaction that affects the ownership, control, or structure of the business falls within the regulatory scope of the Consumer Credit Bill 2025.
Key Takeaway 9: Unlicensed BNPL Agreements Will Be Unenforceable
Under the Consumer Credit Bill 2025, any BNPL agreement or arrangement entered into by an unlicensed entity is unenforceable.
This is a critical point for companies currently conducting BNPL business. Once the licensing regime is in force and applications are opened, it is imperative that BNPL operators promptly submit their licensing applications. Otherwise, any BNPL arrangements they enter into during that period may be rendered invalid and legally unenforceable.
Key Takeaway 10: Licensing is Not Guaranteed
The last key takeaway is that an application for a BNPL licence does not guarantee automatic approval. As even if an applicant meets the minimum financial requirements and submits all the requisite documents, the Commission still retains discretion in granting the licence.
Specifically, under the Consumer Credit Bill 2025, the Commission may refuse an application on five key grounds: (i) the application is not submitted in accordance with the law; (ii) the applicant fails to comply with any applicable regulations, standards, guidelines, or legal requirements; (iii) the applicant, or its controller, directors, partners, or senior management, fails to meet the fit and proper criteria; (iv) the documents or information submitted are false or misleading; or (v) the Commission is of the view that granting the licence would be contrary to public interest.
This illustrates that the licensing process is rigorous and highly scrutinized. As such, it is strongly advisable for companies seeking to enter or continue operating in the BNPL space to seek proper legal guidance, particularly from legal professionals who are familiar with the fintech regulatory landscape and have experience dealing with the relevant authorities in managing licensing applications.
◦
The Technology Practice Group at Halim Hong & Quek frequently advises and represents companies in relation to financial technology or FinTech matters, including BNPL scheme, factoring service and earned wage access that utilise technology in their offerings. If you are interested to know more about the Consumer Credit Bill 2025 or if you need any legal assistance with regard to your FinTech business, please do not hesitate to reach out to the Technology Practice Group. Halim Hong & Quek has been awarded Fintech Law Firm of the Year in 2024 and ranked as Tier 3 in Fintech and financial services regulatory by Legal 500, Band 2 in Fintech by Chambers and Partners.
About the authors
◦Ong Johnson
Partner
Head of Technology Practice Group
Technology, Media & Telecommunications (“TMT”),
Fintech, TMT Disputes, TMT Competition, Regulatory
and Compliance
[email protected]
◦
Lo Khai Yi
Partner
Co-Head of Technology Practice Group
Technology, Media & Telecommunications (“TMT”), Technology
Acquisition and Outsourcing, Telecommunication Licensing and
Acquisition, Cybersecurity
[email protected].
More of our Tech articles that you should read: