BUY-NOW-PAY-LATER AND DIGITAL CREDIT IN NIGERIA: LEGAL CONSIDERATION FOR FINTECH OPERATORS AND FINANCIAL INSTITUTIONS

1. Introduction

Access to credit in Nigeria has traditionally been subject to stringent requirements, including extensive documentation, credit assessments and, in some cases, collateral. These requirements have often made formal credit less accessible to the average consumer. Technological advancement and the growth of fintech, however, are changing this landscape by enabling consumers to access credit through simplified and largely digital processes.

A notable product of this transformation is Buy-Now-Pay-Later (“BNPL”), a financing arrangement that allows consumers to obtain goods or services immediately and defer payment, typically through installment payments over an agreed period. BNPL has expanded the use of consumer credit beyond traditional financing of significant assets to everyday purchases such as household goods, electronic devices and personal services.

While BNPL presents opportunities for financial inclusion and increased consumer access to credit, its rapid growth also creates legal and regulatory concerns. These include responsible lending, consumer protection, data privacy, electronic contracting, credit reporting, payment regulation and debt recovery. The ease and speed with which digital credit can be obtained may also increase the risk of consumer over-indebtedness and abusive recovery practices.

This paper examines the legal and regulatory framework governing BNPL and digital credit in Nigeria, with particular focus on the obligations and risks applicable to fintech operators and financial institutions.

2. The Regulatory Framework for BNPL and Digital Consumer Lending in Nigeria

The regulation of Buy-Now-Pay-Later (“BNPL”) arrangements in Nigeria is principally situated within the broader framework governing consumer protection and digital consumer lending. At the foundation of this framework is the Federal Competition and Consumer Protection Act 2018 (“FCCPA”), which establishes the general legal regime for the protection of consumers and the promotion of fair and competitive markets.

Section 104 of the FCCPA is particularly significant as it establishes the Act as the principal legislation governing consumer protection in Nigeria. This provides the statutory foundation upon which the rights of consumers and the obligations of businesses providing consumer-facing services are to be considered. With respect to BNPL, this provision is relevant because the digital nature of the transaction does not exclude it from the application of general principles of consumer protection.

The FCCPA further recognizes specific rights available to consumers. Sections 125 and 127, among others, provide important protections relevant to credit transactions, including protections relating to the quality and suitability of services, fair dealing and the treatment of consumers in their dealings with suppliers. These protections assume greater significance in BNPL transactions, where consumers may accept credit terms through digital platforms without direct interaction with the lender or an opportunity for conventional negotiation.

The increasing use of technology in consumer lending has consequently necessitated a more specific regulatory framework. In July 2025, the Federal Competition and Consumer Protection Commission (“FCCPC”) introduced the Digital, Electronic, Online, or Non-Traditional Consumer Lending Regulations 2025 (“DEON Regulations”), pursuant to its powers under the FCCPA. The Regulations establish a framework for digital and electronic consumer lending, while the accompanying Digital, Electronic, Online, or Non-Traditional Consumer Lending Guidelines 2025 (“DEON Guidelines”) provide further clarification on their administration and operation.

The significance of the DEON framework to BNPL is apparent from its broad regulatory approach. The Guidelines apply to persons, entities and institutions engaged in the provision, facilitation or administration of digital, electronic, online or other non-traditional consumer lending services, whether directly or through digital platforms, agents or intermediaries. They expressly extend to cross-border digital consumer lending services offered to consumers in Nigeria. More importantly, the regulatory landscape expressly recognizes online platforms offering “Buy Now, Pay Later” or Embedded credit facilities among the businesses potentially affected by the Regulations.

The framework therefore moves beyond regulating conventional digital loan applications and captures the wider ecosystem through which consumer credit is delivered digitally. This is particularly relevant to BNPL arrangements, which may involve a fintech operator, merchant, payment provider and financial institution in a single transaction. The legal obligations applicable to each participant will consequently depend, among other things, on its role in providing, facilitating or administering the credit facility.

A notable feature of the DEON framework is its recognition that digital consumer lending may operate alongside existing sector-specific regulation. The Guidelines exclude financial institutions duly licensed and regulated by the Central Bank of Nigeria from their general application, while permitting such institutions to provide consumer lending services within the scope of their licenses and applicable laws. However, a financial institution intending to provide certain consumer lending services outside conventional lending activities is required to notify the Commission and provide details of the proposed service, its scope, any partnership and the relevant license.

This creates an important regulatory consideration for BNPL operators: the legal and regulatory treatment of a BNPL product cannot be determined solely by the label attached to the product or the technology through which it is delivered. Rather, consideration must be given to the substance of the arrangement, the parties involved and the manner in which the credit is provided or facilitated.

The DEON framework consequently represents a significant development in the regulation of consumer credit in Nigeria. It seeks to ensure that digital lending services are provided in a manner that is transparent, accountable, fair and competitive. For BNPL operators and financial institutions, compliance therefore extends beyond the ability to provide the underlying credit. It encompasses the manner in which the product is structured, marketed, documented, administered and enforced.

3. Consumer Protection and Responsible Lending

The accessibility of BNPL is one of its principal advantages of DEON Consumer Lending Regulations 2025, but it also presents a corresponding consumer-protection concern. The ease with which consumers can obtain credit may encourage borrowing without sufficient consideration of the consumer's ability to repay. Consequently, the regulatory framework increasingly places emphasis not only on access to credit, but also on the manner in which credit is offered, disclosed and recovered.

The Federal Competition and Consumer Protection Act 2018 provides the broader consumer-protection framework within which BNPL transactions operate. The DEON Consumer Lending Regulations 2025 build upon this framework by imposing obligations intended to promote transparent and responsible conduct in digital consumer lending. The FCCPC has identified exploitative lending practices, abusive recovery methods, privacy violations and misleading practices as some of the concerns underlying the DEON framework.

For BNPL operators, transparency is particularly important because the apparent simplicity of the product may obscure its actual cost to the consumer. The consumer should therefore be able to understand the amount payable, applicable interest or other charges, repayment dates and the consequences of default before entering into the arrangement. This is especially relevant where a BNPL product is marketed as “interest-free”, but generates revenue through processing charges, late-payment fees or other costs.

Responsible lending also requires consideration of the consumer's ability to meet the repayment obligation. This is particularly significant where the same consumer may obtain credit from several digital lenders simultaneously. A regulatory approach that focuses solely on the speed of disbursement, without adequate consideration of repayment capacity, may increase the risk of over-indebtedness and default.

The consumer-protection obligations therefore extend beyond the initial approval of the credit facility. They apply throughout the lifecycle of the transaction, including marketing, onboarding, disclosure of terms, repayment, treatment of default and debt recovery. The FCCPC's regulatory approach accordingly seeks to ensure that digital lending remains commercially viable without compromising the rights and dignity of consumers.

For BNPL operators and financial institutions, the practical implication is that consumer protection should be incorporated into the product design itself. Credit assessment procedures, contractual terms, pricing structures, customer communications and recovery mechanisms should be reviewed from the outset to ensure that the product does not merely facilitate access to credit, but does so on fair and transparent terms.

4. Data Protection and Digital Credit Assessment

The digital nature of BNPL also creates significant data-protection considerations. Unlike traditional credit arrangements, digital lending platforms may rely extensively on personal and financial information to identify consumers, assess creditworthiness, determine credit limits and monitor repayment behaviour. The convenience of automated credit assessment therefore comes with a corresponding obligation to ensure that consumer data is collected and processed lawfully and securely.

The DEON Guidelines expressly require lending applications to demonstrate compliance with applicable data-protection legislation and relevant information-security and authentication standards. The registration requirements further contemplate compliance with the Nigeria Data Protection Act 2023, including the submission of relevant data-protection compliance documentation and privacy impact assessment materials.

This is particularly significant in relation to credit scoring. BNPL operators may use information generated from a consumer's transactions and other legitimate data sources to determine whether credit should be extended and on what terms. However, the pursuit of efficient credit assessment should not result in excessive or irrelevant data collection. The fact that particular information may be technically accessible through a consumer's device does not, without more, justify its collection or use for debt recovery or credit assessment.

The DEON framework reflects this concern by requiring operators to confirm that their lending applications are not designed to access consumers' call logs, contacts or photo galleries. This represents an important shift from intrusive recovery practices previously associated with some digital lending platforms and reinforces the principle that technological capability should not be confused with legal entitlement.

For BNPL operators, data protection must therefore be considered as part of the product's legal architecture rather than as a separate compliance exercise. Privacy notices, data-collection practices, credit-scoring mechanisms, data-sharing arrangements and recovery processes should all be designed to comply with applicable data-protection requirements.

6. Enforcement, Default and Debt Recovery

The accessibility of BNPL does not eliminate the fundamental credit risk of default. However, the manner in which a lender responds to default is subject to legal and regulatory limitations. The DEON framework places consumer protection at the centre of digital lending and requires lending arrangements to account for default rates, applicable charges and the methods through which default may be recovered.

This is particularly relevant given the history of abusive debt-recovery practices associated with some digital lending platforms. The convenience of digital communication and access to consumer data should not be interpreted as permitting lenders to employ intrusive or coercive recovery methods. Debt recovery must therefore remain within the limits imposed by applicable consumer protection, data protection and other laws.

The contractual framework is equally important. BNPL agreements should clearly establish the consumer's repayment obligations, applicable charges, consequences of default and the mechanisms available to the lender upon non-payment. Where BNPL services are provided through partnerships, the parties should also clearly allocate responsibility for recovery and enforcement. The DEON Guidelines expressly identify default recovery and enforcement methods, alongside interest, fees, data protection and consumer rights, as matters requiring consideration in Consumer Lending Services Agreements.

The regulatory framework also provides consumers with avenues for redress. Licensed consumer-lending undertakings are required to maintain complaints handling frameworks and dedicated channels through which consumers may raise complaints. Consequently, effective compliance requires lenders to establish mechanisms for addressing disputes before they escalate into regulatory or judicial proceedings.

7. Key Legal Considerations for BNPL Operators and Financial Institutions

The regulatory environment creates several considerations for businesses seeking to operate BNPL products in Nigeria.

First, regulatory classification should be determined before the product is launched. An operator should establish whether its proposed arrangement constitutes consumer lending and identify the regulatory approvals applicable to its particular business model.

Second, consumer protection should be incorporated into product design. The terms governing the transaction, including repayment obligations, charges and consequences of default, should be presented in a manner that enables consumers to understand the financial implications of the transaction before accepting it.

Third, data protection must form part of the product architecture. BNPL providers should ensure that the information collected for onboarding, credit assessment and repayment is lawfully obtained, appropriately used and adequately protected. The DEON Guidelines specifically require lending applications to demonstrate compliance with applicable data-protection legislation and information-security standards.

Fourth, partnership arrangements require careful structuring. BNPL products frequently involve several participants, including merchants, fintechs, banks and payment providers. The contractual arrangements should clearly allocate responsibility for consumer disclosures, credit assessment, data protection, complaints, default recovery and regulatory compliance. The DEON framework specifically contemplates these matters in Consumer Lending Services Agreements.

Finally, operators should recognize that compliance with one regulatory framework may not necessarily satisfy all applicable legal requirements. The DEON Guidelines expressly provide that their requirements are additional to, and not a substitute for, compliance with other applicable laws and regulatory frameworks.

8. Conclusion

The development of BNPL represents a significant evolution in Nigeria’s consumer-credit market, with the potential to improve access to credit and expand participation in the digital economy. However, this accessibility must be balanced against the risks of over-indebtedness, inadequate disclosure, inappropriate data practices and abusive recovery methods.

Nigeria’s evolving regulatory framework, particularly the FCCPA and the DEON Consumer Lending Regulations 2025, seeks to promote transparency, accountability and fair treatment in digital lending. For BNPL providers, compliance should therefore be embedded in the product from the outset, with consumer protection, data practices and recovery mechanisms forming part of the overall business model. Ultimately, the success of BNPL in Nigeria will depend not only on how effectively it expands access to credit, but on how responsibly that access is delivered.