Anyone following the current debate around Buy Now, Pay Later (BNPL) could easily come away with the impression that responsible lending begins with the EU’s new Consumer Credit Directive, CCD II. I believe that is a misconception.

Not because the directive is unimportant. On the contrary, it creates a more level playing field and strengthens consumer trust. But anyone who concludes from this that reputable providers have simply been waiting for lawmakers to act overlooks a basic fact: it is in everyone’s economic interest to prevent customers from becoming overindebted. No provider makes money from credit that is not repaid, and no merchant wants customers who fail to pay on its platform.

Responsibility Begins with the Business Model, Not with Regulation

Let us start by putting the issue into context. In Germany, when we talk about Buy Now, Pay Later, we are usually not referring to long-term consumer loans, but to the traditional purchase-on-invoice model, with payment due within 14 to 30 days.

This payment method has existed for decades and, as a rule, it is not a product through which consumers can easily accumulate excessive debt — at least not when the provider takes its own risk seriously.

The reason lies in the business model. Providers of invoice and instalment payments generally also assume the risk of default, sometimes referred to as credit risk. The payment service provider buys the receivable from the merchant, pays the merchant and then waits for the customer to settle the invoice. If the customer does not pay, the loss is borne not by the merchant, but by the payment service provider.

For that reason alone, payment service providers have a strong financial incentive to approve guaranteed invoice and instalment payments only after carrying out a careful assessment.

No One Sees Everything

Responsible lending, however, requires an ability to assess a customer’s financial situation. This is where one persistent misconception remains: that payment service providers have a complete picture of that situation.

Unfortunately, we do not have structured visibility of the outstanding amounts a customer may owe to other providers at the same time. We do not know how much they are currently financing through credit cards. Credit bureaus also provide only part of the overall picture. In most cases, payment problems are only reported once a debt collection process has taken place. Such information is often not recorded until 180 days after the original due date.

This is not a failure on the part of individual companies. It is a consequence of how today’s payments system works. No market participant can see what financial obligations a borrower may take on tomorrow. CCD II will not change that.

This information gap often leads to a simple conclusion in the public debate: providers must take responsibility for ensuring that customers do not enter into obligations they are unlikely to be able to meet. The concern is that people with outstanding invoices across several providers may be accumulating debt without anyone noticing.

Yet even if we could see every outstanding amount, the picture would be more difficult to interpret than it might initially appear. In Germany, purchase on invoice is not only a payment method, but also a form of consumer protection: the goods come first, payment follows.

In practice, this means that a customer who orders three pairs of shoes in different sizes, keeps one and returns two may temporarily have three outstanding invoices. That does not mean she is overindebted. She has simply ordered several pairs and intends to keep the one that fits.

Or consider a customer who orders the same expensive jumper in four different colours. Does he intend to keep one or several? Should he be allowed to make another purchase only after returning the items he does not want?

How Good Decisions Are Made

More information does not automatically create greater clarity. What matters is how providers deal with this uncertainty, particularly because every credit decision is ultimately a probability-based decision.

Payment service providers such as Unzer have been working with statistical models for many years. Long before artificial intelligence became a buzzword, scorecards were already helping providers assess risk systematically. Artificial intelligence now complements these models. Its greatest value lies in identifying patterns that are barely visible to conventional methods.

In my view, this creates a major opportunity for risk management. Good models identify problematic transactions without unnecessarily rejecting creditworthy customers.

Current reporting usually focuses on only one side of the issue: the credit that should not have been granted. But a transaction that is wrongly declined also has consequences. Customers may feel they have been unfairly rejected and abandon the purchase, while the merchant loses the sale.

Good risk management therefore means making as many correct decisions as possible. Through years of refining our risk management, Unzer can offer purchase on invoice to more than nine out of ten customers, while fewer than 0.5 per cent of receivables result in a loss.

What CCD II Actually Changes

Against this background, the directive is easier to assess. It introduces two significant changes.

First, the existing threshold of €200 will be removed. In future, creditworthiness will generally need to be assessed regardless of the amount of credit involved. For many payment service providers, this is not a new approach. They already make their decisions on this basis today.

Second, the assessment must show that the customer is likely to be able to repay the credit. For certain forms of financing, this may require additional information about income or the customer’s financial circumstances.

The key principle, however, is proportionality. The scope and depth of the assessment must be appropriate to the type, amount, duration and risk of the credit.

For traditional purchase-on-invoice transactions, this means that an income assessment will continue to be neither necessary nor appropriate in most cases. The scale of the issue becomes clear when we look at our own portfolio: around 80 per cent of all invoice purchases are below €200. Requiring income verification for these transactions would create bureaucracy without providing any meaningful additional protection.

The situation is different for longer-term financing involving several thousand euros. Very few people can pay for a high-quality kitchen, an e-bike or new home furnishings entirely from their monthly income. In those cases, it is reasonable to assess how much money the customer has available each month for repayments.

Unzer makes targeted use of open banking for this purpose. When a risk assessment requires additional information, the customer can share the relevant account data in just a few steps. We assess this information automatically within seconds, so the customer does not need to submit bank statements or complete additional forms.

Common Standards Build Trust

This shows both what regulation can achieve and where its limits lie. It cannot give a provider access to information that is simply not available. Nor can it make the decision on the provider’s behalf. But it can establish binding rules that everyone must follow.

That, in my view, is the real value of CCD II. It does not eliminate uncertainty from lending; no regulatory framework could do that. But it ensures that all providers make decisions under comparable conditions, including those that may previously have carried out less rigorous assessments.

This strengthens consumer protection, creates fairer competitive conditions and supports trust in a payment method that has been established for decades.

Responsible lending is therefore nothing new. CCD II will, however, make it a common standard. How responsibly providers ultimately act will continue to depend on how seriously they take their own role and the risks they assume.