For those operating within Malaysia’s fintech scene, especially those within the buy now, pay later (“BNPL”) industry, it should now be clear that BNPL has officially entered a new and fully regulated chapter. Following the recent implementation of the Consumer Credit Act 2025 (“CCA 2025”) and the commencement of the new licensing regime administered by the Consumer Credit Commission or Suruhanjaya Kredit Pengguna (“Commission” or “SKP”), the days of the “Wild-wild West” are effectively over for the BNPL industry.
The key question is therefore no longer simply whether a BNPL provider is required to obtain a licence to carry on a BNPL business under the CCA 2025. Instead, the more important question is whether the BNPL provider is truly ready to make sure that its entire business model, product structure and day-to-day operations comply with the CCA 2025 and the broader regulatory framework introduced by SKP.
Last month, SKP released the Conduct Standards alongside the Authorisation Standards. While the Authorisation Standards primarily regulate the process and requirements for obtaining the relevant licence or registration, the Conduct Standards go much further by prescribing how an authorised BNPL entity must actually conduct and operate its business when dealing with credit consumers. What is particularly crucial about the Conduct Standards is their extraordinary breadth because in many respects, the Conduct Standards regulate practically the entire BNPL business and the full lifecycle of a BNPL product, pretty much from how the product is advertised, promoted and explained to credit consumers, to how consumers are assessed and onboarded, how contractual terms are presented, how interest, fees and charges are calculated, how repayments are managed, and what happens when a consumer misses a payment or experiences genuine financial hardship. The requirements also extend to the broader customer journey, product terms, technology systems, merchant arrangements, recovery procedures and debt collection practices adopted by BNPL providers.
In fact, when compared with many other regulated fintech services, the regulatory framework imposed on BNPL providers is arguably even more comprehensive and operationally intensive. It is even safe and accurate to say that BNPL services now sit among the more closely regulated segments of Malaysia’s fintech industry, with regulatory compliance expected to be embedded across the entire organisation rather than confined solely to the legal or compliance function.
Therefore, against this backdrop, this article sets out the top 10 key takeaways that companies and in-house counsel should pay close attention to if their organisations are currently operating, or intend to provide, BNPL services in Malaysia under the new regulatory framework. We trust that these takeaways will provide a helpful and practical starting point for fintech businesses navigating this important new phase of BNPL regulation.
Key Takeaway 1: BNPL Must Not Be Marketed as “Free” Without Clear Conditions
The first and most important takeaway concerns the way BNPL products are advertised and promoted to credit consumers.
As we are already seeing in the market, many BNPL providers promote their services using attractive descriptions such as “interest-free”, “zero interest”, “free” or “zero cost” to encourage customers to use their products. From a commercial perspective, this is understandable because the absence of interest or upfront charges is often one of the most appealing features of a BNPL product. However, these descriptions may not always provide the complete picture because typically such a “zero interest” offer may only apply if the full amount is repaid within a particular instalment period, while interest, late payment charges or other fees may become payable if the credit consumer fails to comply with the applicable repayment conditions. Therefore, describing a BNPL product simply as “interest-free”, “zero interest”, “free” or “zero cost”, without properly qualifying the relevant conditions, may give credit consumers an inaccurate or misleading impression of the true nature and cost of the product.
For that reason, the Conduct Standards make it clear that a BNPL entity must not misrepresent or give the false impression that a BNPL service is free from interest, fees, charges or qualifications without clearly disclosing the specific conditions or eligibility criteria that must be fulfilled to qualify for the relevant offer. This means that if there are any underlying repayment conditions, eligibility requirements, fees, charges or disclaimers, those conditions must then be clearly disclosed to the credit consumer. More importantly, the Conduct Standards go beyond merely requiring the BNPL provider to include those conditions somewhere within the advertisement, as the relevant conditions and disclaimers must also not be obscured or disguised by the content or design of the advertisement or promotional material.
In practical terms, this means that placing the words “zero interest” prominently at the top of an advertisement while placing all the material conditions in small print at the bottom may not be sufficient if the overall impression created by the advertisement still remains misleading. After all, the purpose of the disclosure is not merely to ensure that the conditions technically appear somewhere in the advertisement, but to ensure that the credit consumer can actually see, understand and appreciate the conditions attached to the offer.
Therefore, BNPL providers should carefully review all customer-facing materials, including social media posts, digital advertisements, merchant banners, and promotional videos to make sure that the key conditions are not be hidden within fine print that an ordinary credit consumer is unlikely to notice or understand, especially where the overall advertisement continues to create the impression that the BNPL service is entirely free from interest, fees or charges.
Key Takeaway 2: Disclosure Materials Must Be Available in at Least Two Languages
The second key takeaway concerns the language in which information must be provided to credit consumers.
Under the Conduct Standards, disclosure materials must be made available in at least two languages, which must comprise Bahasa Malaysia and any other language that meets the needs of the BNPL provider’s existing and targeted customer segments.
The requirement is actually extremely broad because disclosure materials may include advertisements, illustrations, comparisons, promotional or marketing materials, as well as written or oral sales presentations. Therefore, BNPL providers should not assume that the two-language requirement only applies to formal product disclosure sheets or legal documents. It may also affect the language structure of websites, mobile applications, onboarding screens, frequently asked questions, repayment illustrations and other customer-facing communications.
However, there is a slightly different requirement for legally enforceable documents. Credit agreements must be made available in either Bahasa Malaysia or English, based on the language that the credit consumer understands and chooses. In practical terms, the BNPL provider should provide a genuine language option and should retain a proper record of the language selected by the consumer.
Therefore, BNPL providers should identify all materials that fall within the disclosure lifecycle, determine which materials require at least two languages, prepare legally and commercially consistent translations, and ensure that updates are reflected across every language version.
Key Takeaway 3: Written Acknowledgement Cannot Be Auto-Filled or Pre-Ticked
The third key takeaway concerns the consumer’s acknowledgement of the BNPL terms and conditions.
There is certainly no surprise that the Conduct Standards make it clear that BNPL providers must clearly explain the key terms and conditions of the credit agreement to credit consumers by providing adequate and comprehensible information.
However, what is more crucial to take note of is that the Conduct Standards go beyond merely requiring the BNPL provider to explain the relevant terms and conditions, but the BNPL provider must also obtain written acknowledgement from the credit consumer confirming the credit consumer’s understanding of those terms and conditions. Such acknowledgement should be documented within the credit agreement itself or in a separate accompanying document, and more importantly, the Conduct Standards are absolutely clear that the acknowledgement must not be presented in the form of an auto-filled or pre-ticked box.
This clear acknowledgement requirement will definitely have direct implications for the digital onboarding processes adopted by many BNPL providers. At present, many online BNPL platforms may rely on pre-selected checkboxes, deemed acceptance, bundled consent or a single general button stating that the credit consumer agrees to all the relevant terms and documents. However, such practices may no longer be sufficient under the Conduct Standards. Instead, the BNPL provider should be able to demonstrate that the credit consumer has provided an active and affirmative acknowledgement of their understanding of the relevant terms and conditions, rather than relying on silence, inactivity or a choice that has already been made by the system. Therefore, BNPL providers should carefully review their digital onboarding flows and ensure that the relevant acknowledgement requires a clear and deliberate action from the credit consumer, supported by proper records of when and how that acknowledgement was obtained.
Key Takeaway 4: Interest, Fees and Charges Must Be Fair, and Flat Rate and Rule of 78 Are Prohibited
The fourth key takeaway concerns the pricing and calculation of BNPL products.
If there is one area under the Conduct Standards that may still create some confusion or uncertainty for BNPL providers, it is certainly the question of how interest, profit, fees and charges may be imposed on credit consumers. Unlike certain other regulatory frameworks, such as the Moneylenders Act 1951, the Conduct Standards do not prescribe a specific ceiling or maximum rate that may be charged for BNPL products.
Instead, the Conduct Standards impose two clear rules. First, any interest or profit, as well as fees and charges payable by credit consumers under a credit agreement, must be fair and must not be excessive or unreasonable. Second, a BNPL provider must not offer a credit product where the interest or profit is calculated using a flat rate or the Rule of 78 method.
Therefore, rather than imposing a specific maximum rate, the direction taken under the Conduct Standards is to assess whether the relevant interest, profit, fee or charge is fair and proportionate based on its actual substance and purpose. In this regard, a fee or charge may be regarded as excessive or unreasonable where it is disproportionate to the actual cost incurred by the BNPL provider, relates to general internal operating or risk-management improvements that are not specifically connected to the relevant BNPL product, or is otherwise determined by SKP to be excessive. However, this does not mean that BNPL providers are prohibited from charging interest or profit altogether. The Conduct Standards allow a BNPL provider to use a fixed or variable rate on a reducing balance basis. Under this approach, interest or profit is charged on the remaining outstanding principal after the payments appropriated towards the principal have been deducted from the original principal amount.
In view of the above, this means that pricing is no longer a purely commercial decision to be determined solely by reference to market demand, profitability or what the credit consumer may be willing to pay. BNPL providers will now need to ensure that all fees and charges, including processing fees, membership fees, service fees, administrative fees, late payment charges and any other amounts imposed on credit consumers, are assessed based on their actual substance, purpose and proportionality. More importantly, the BNPL provider should be able to properly explain why each fee or charge is imposed, how it is calculated, what cost or service it relates to, and whether the amount reasonably reflects that cost or service. Therefore, BNPL providers should carefully review their entire pricing structure, calculation methodology, contractual terms, repayment schedules and customer disclosures to ensure that they are fully aligned with the Conduct Standards.
Key Takeaway 5: Repayment Reminders and Account Suspension Must Be Built into the BNPL System
The fifth key takeaway concerns repayment reminders and the suspension of accounts following missed payments.
Under the Conduct Standards, a BNPL provider must send a repayment reminder to the credit consumer at least 3 calendar days before any repayment becomes due. The reminder may be delivered through any communication channel that is considered effective in reaching the credit consumer, such as a mobile application notification, short messaging service or email. This requirement is actually understandable because credit consumers should be given sufficient notice of an upcoming repayment before any late payment charge or other consequence becomes applicable.
However, what is particularly important is that the Conduct Standards go beyond merely requiring BNPL providers to send repayment reminders. After the relevant reminder has been sent and the credit consumer subsequently misses up to two consecutive payments, the BNPL provider must suspend the consumer’s account from being used for any new transactions until both the missed payments and any applicable late payment charges have been fully settled. The Conduct Standards even allow a BNPL provider to adopt a more prudent approach by suspending the consumer’s account after a single missed payment. This is particularly significant because a credit consumer should not be allowed to continue accumulating further BNPL obligations while existing payments remain overdue, especially where this may increase the consumer’s risk of over-indebtedness.
This directly means that repayment reminders, missed-payment tracking, account suspension and account reactivation should be built directly into the BNPL provider’s technology systems and operational workflow. These requirements should not depend entirely on manual monitoring or intervention by the customer service or collection teams, therefore, BNPL providers should ensure that their systems can accurately identify consecutive missed payments, suspend the relevant account promptly, prevent new transactions from being processed, calculate late payment charges on the correct basis, and reactivate the account only after the missed payments and applicable late payment charges have been fully settled.
Key Takeaway 6: Credit Must Not Be Offered Where Repayment Risk Is Too High
The sixth key takeaway is that a BNPL provider cannot extend credit simply because a customer wishes to use the product.
With the new regulatory framework now in place, BNPL providers have a clear obligation to assess the creditworthiness of credit consumers and, where necessary, reject an application for credit or refuse to increase an existing credit limit. In particular, the Conduct Standards make it clear that a BNPL provider must not offer credit or increase an existing credit limit if the credit consumer is:
- (i) insolvent;
- (ii) likely to default on the repayment obligations; or
- (iii) expected to face significant difficulty in fully repaying the credit.
More importantly, this assessment must begin at the point of onboarding, where the BNPL provider must assess the creditworthiness of the credit consumer before granting any credit. At a minimum, the assessment must consider the credit consumer’s repayment history and insolvency status.
To properly understand the financial standing of the credit consumer, the BNPL provider should also obtain relevant information on the consumer’s financial means, including the amount, sources and stability of income, as well as the consumer’s existing and outstanding credit obligations and repayment history. Depending on the circumstances, supporting materials may include EPF statements, income tax returns, bank statements, employer-issued income statements or payslips.
The Conduct Standards also recognise that some credit consumers may not have conventional income documents or an established credit history. In those circumstances, the BNPL provider may assess the consumer’s repayment capacity by considering recurring payment obligations, such as utility bills, rental payments and insurance premiums, or through self-attestation of financial means supported by appropriate verification measures.
This new form of creditworthiness assessment imposed on BNPL providers will certainly represent a meaningful shift for the BNPL industry. While speed, convenience and a seamless onboarding experience remain commercially important, these considerations cannot come at the expense of a proper and responsible creditworthiness assessment. Therefore, BNPL providers should establish clear credit acceptance criteria, determine the information required for different customer segments, identify how that information will be verified, and properly document the reasons for approving or rejecting an application or increasing an existing credit limit. Ultimately, the credit decision should be based on the credit consumer’s ability and willingness to repay, rather than solely on commercial growth, transaction-conversion objectives or the desire to onboard as many customers as possible.
Key Takeaway 7: An Affordability Assessment Is Mandatory Above RM1,000
The seventh key takeaway concerns the new affordability threshold for BNPL products.
In addition to the creditworthiness assessment described above, a BNPL provider must also conduct an affordability assessment if the credit limit offered to a credit consumer exceeds RM1,000. Therefore, BNPL providers should understand that the creditworthiness assessment and affordability assessment are related, but separate, regulatory requirements.
It is also important to clarify that the RM1,000 threshold is not intended to operate as a maximum credit limit. A BNPL provider may still offer a credit limit exceeding RM1,000. However, RM1,000 represents the maximum credit limit that may be offered to a credit consumer without the need to conduct an affordability assessment.
According to the Conduct Standards, a proper affordability assessment should consider whether the proposed credit limit is appropriate to the credit consumer’s financial circumstances and whether the credit consumer has sufficient ability to meet the repayment obligations without facing undue financial difficulty throughout the tenure of the credit agreement. For this purpose, the Conduct Standards refer to prudent Debt Service Ratio and minimum net disposable income thresholds, together with other relevant considerations such as the credit consumer’s repayment history, credit score, cost of living, nature of employment, sources and stability of income, lifestyle and number of dependants.
The introduction of the RM1,000 affordability threshold means that BNPL providers must have the appropriate policies, systems and assessment mechanisms in place to conduct a proper affordability assessment whenever the proposed credit limit exceeds RM1,000. Therefore, BNPL providers should determine what financial information must be obtained from the credit consumer, how that information will be verified, what Debt Service Ratio and minimum net disposable income thresholds will apply, and how the outcome of the assessment will be documented. The relevant technology system should also be capable of identifying when the RM1,000 threshold is exceeded and ensuring that the required affordability assessment is completed before the higher credit limit is granted.
Key Takeaway 8: BNPL Must Not Be the Default Payment Mode
The eighth key takeaway concerns how BNPL is presented to credit consumers at the point of purchase.
Where a BNPL provider is not a registered merchant acquirer, the Conduct Standards require the BNPL provider to ensure that its merchants do not set BNPL as the default payment mode for credit consumers.
In practical terms, this means that BNPL should only be presented as one of the available payment options that the credit consumer may actively select, rather than as a pre-selected or automatic payment method. The underlying principle is actually quite straightforward, as a credit consumer should consciously choose to enter into a credit arrangement and should not be guided into using BNPL merely because the merchant’s checkout journey has already selected it as the default payment option.
The Conduct Standards make it clear that in circumstances where a BNPL provider discovers that a merchant has imposed BNPL as the default payment mode, the BNPL provider must, on a best-effort basis, take the necessary corrective measures, and these measures may include suspending the merchant’s ability to accept BNPL payments.
Therefore, BNPL providers should carefully review their merchant agreements and checkout requirements, making sure that these merchant agreements clearly prohibit the merchant from making BNPL the default payment method, require the merchant to cooperate with any monitoring, investigation and remediation exercise, and give the BNPL provider sufficient rights to require corrective action or suspend the merchant’s acceptance of BNPL payments where necessary.
Key Takeaway 9: At Least Seven Days’ Written Notice Must Precede Recovery Action
The ninth key takeaway concerns the recovery process after a payment has become overdue.
Let us say that a credit consumer fails to make the required BNPL repayment and the BNPL provider intends to commence recovery action. Under the Conduct Standards, the BNPL provider cannot immediately proceed with the relevant recovery action. Instead, the BNPL provider must first issue a written recovery notice to the credit consumer at least seven calendar days before the recovery action commences.
At a minimum, the written recovery notice must disclose:
- (i) the outstanding amount, including interest or profit and any other fees or charges;
- (ii) the missed repayment due date;
- (iii) the date on which recovery action will commence;
- (iv) the extended repayment due date;
- (v) the name and contact details of the recovery department or appointed external debt collector; and
- (vi) any change in the appointment of the external debt collector.
More importantly, merely preparing and sending the recovery notice may not necessarily be sufficient. The BNPL provider must also use its best efforts to contact the credit consumer and ensure that the recovery notice reaches the consumer, and this may include sending the notice to the consumer’s latest known residential address, correspondence address or email address.
The BNPL provider should also retain proper records of all communication attempts to demonstrate that reasonable steps were taken using the most recent and reliable contact information available. Therefore, where an email is undeliverable, correspondence is returned or the credit consumer cannot be reached through the usual communication channel, the BNPL provider should be able to show what further reasonable attempts were made to contact the consumer.
These requirements will certainly introduce additional operational challenges to the debt recovery process adopted by BNPL providers. Recovery action can no longer be treated as a straightforward process that begins automatically once a repayment becomes overdue. The BNPL provider must first ensure that the prescribed notice has been issued, all mandatory information has been included, the seven-calendar-day notice period has been observed, and reasonable efforts have been made to ensure that the notice reaches the credit consumer.
Therefore, BNPL providers will need to establish a proper system to manage the entire recovery-notice process. The system should be able to identify missed payments accurately, generate a compliant recovery notice, calculate the seven-calendar-day notice period, record all delivery and communication attempts, and prevent recovery action from commencing prematurely. Without a proper system and clear operational workflow in place, BNPL providers may face significant difficulty demonstrating compliance with these requirements.
Key Takeaway 10: Financial Hardship Assistance Must Be Properly Considered
The tenth and final key takeaway is that BNPL providers must have a proper framework for assisting credit consumers who experience genuine financial hardship.
If there is one requirement under the Conduct Standards that may genuinely catch some BNPL providers by surprise, it is certainly the requirement to consider granting financial hardship assistance. Under the Conduct Standards, a BNPL provider must consider granting relief from existing financial obligations where a credit consumer experiences genuine financial hardship or circumstances that materially affect the consumer’s ability to meet their repayment obligations during the tenure of the credit agreement.
For this purpose, the Conduct Standards specify the following financial hardship circumstances in which a credit provider must assess and consider whether financial hardship assistance should be granted:
- (i) critical illness;
- (ii) critical injury;
- (iii) non-voluntary loss of income;
- (iv) natural disaster;
- (v) death of a breadwinner; or
- (vi) any other reasonable cause as may be determined by SKP.
More importantly, the BNPL provider must maintain a prominently displayed and easily accessible point of contact for credit consumers seeking financial hardship assistance. This means that credit consumers should be able to identify clearly where and how they may submit an application, rather than being required to navigate through a general customer service or debt collection channel without any clear assistance process.
Once an application is received, the BNPL provider must issue a written acknowledgement no later than the next business day and communicate its decision within 30 calendar days from the date of acknowledgement. The BNPL provider must also ensure that the entire end-to-end financial hardship assessment is completed within 90 calendar days.
Financial hardship assistance may involve an alternative repayment plan, an extended repayment period, a temporary payment deferral, a reduced instalment amount or another reasonable modification that reflects the credit consumer’s changed financial circumstances without unduly increasing the consumer’s financial burden. However, this does not mean that a credit consumer who experiences financial hardship will automatically be entitled to debt forgiveness, an indefinite moratorium or a blanket waiver of interest or other amounts payable. The requirement imposed on the BNPL provider is to assess the application properly, consider whether reasonable assistance should be granted and communicate its decision clearly and fairly to the credit consumer.
This financial hardship assistance requirement will certainly introduce another new operational requirement and challenge for BNPL providers to take into account. BNPL providers can no longer treat every missed payment simply as an ordinary recovery or collection matter, especially where the credit consumer may be facing genuine financial hardship. Therefore, BNPL providers should establish clear eligibility criteria, assessment procedures, approval authorities, appeal mechanisms, communication templates and record-keeping requirements for financial hardship applications. Ultimately, a proper financial hardship framework must be built into the BNPL provider’s broader operational and recovery processes.
Closing Thoughts
Taken together, the Conduct Standards mark a major turning point for Malaysia’s BNPL industry. BNPL has grown rapidly because it makes credit feel simple, immediate and almost invisible at the point of purchase. The new regulatory framework does not remove that convenience, but it makes clear that convenience must be supported by transparent advertising, understandable terms, responsible credit decisions, fair pricing and proper treatment of consumers throughout the credit lifecycle.
Given the breadth and relative novelty of the new requirements, BNPL providers may wish to obtain legal and regulatory support from counsel with experience in fintech, consumer credit, technology and financial services regulation. This would help ensure that the legal documentation, policies, operating model and technology controls are developed as one coherent regulatory framework, rather than as separate compliance exercises.
If you have any questions on the Consumer Credit Act 2025, BNPL licensing, the Conduct Standards or the structuring of BNPL products and arrangements in Malaysia, please feel free to reach out to the partners in our Technology Practice Group, Ong Johnson and Lo Khai Yi, for a consultation. We have extensive experience advising on fintech, financial services, consumer credit, digital platforms, technology arrangements and regulatory licensing matters in Malaysia, and would be happy to assist businesses in navigating this new regulatory framework.
The Technology Practice Group of Halim Hong & Quek continues to be recognised by leading legal directories and industry benchmarks. Recent accolades include FinTech Law Firm of the Year at the ALB Malaysia Law Awards (2024, 2025 and 2026), Law Firm of the Year for Technology, Media and Telecommunications by the In-House Community, FinTech Law Firm of the Year by the Asia Business Law Journal, a Band 2 ranking for FinTech by Chambers and Partners, and a Tier 3 ranking by Legal 500. The strength of the practice is further reflected in the individual recognition of its partners, including a Band 1 ranking for FinTech by Chambers and Partners within the Technology Practice Group.
About the authors
Ong Johnson
Partner
Head of Technology Practice Group
Fintech, Data Protection,
Technology, Media & Telecommunications (“TMT”),
IP and Competition Law
johnson.ong@hhq.com.my
◦
Lo Khai Yi
Partner
Co-Head of Technology Practice Group
Technology, Media & Telecommunications (“TMT”), Technology
Acquisition and Outsourcing, Telecommunication Licensing and
Acquisition, Cybersecurity
ky.lo@hhq.com.my.
More of our Tech articles that you should read:
- • Managing Liability in Agentic AI Deployment
- • Automated Decision-Making and Profiling under the PDPA: Top 7 Key Takeaways Every Organisation Should Know
- •White-Label Arrangements: Top 5 Key Takeaways for Technology Providers
