If a provider offers Deferred Payment Credit without FCA authorization or valid temporary permission, it is operating unlawfully and risks committing a criminal offense. The provider may also lose the ability to continue lending once the temporary permissions window closes. In practice, this becomes both a licensing problem and a business continuity problem, because the firm cannot lawfully serve UK consumers.
What licensing failure changes in practice for a BNPL provider
A provider that crosses into Deferred Payment Credit without the right FCA status is not just making a paperwork error. The legal effect is that it cannot rely on the temporary permission route once that window closes, so the business may have to stop originating new credit immediately while it untangles its permissions position and customer-facing commitments.
That matters operationally because permission gaps create a hard constraint on revenue, collections, customer onboarding and product continuity. A firm can have a functioning platform, underwriting flow and repayment engine, but still be unable to lawfully use them for UK consumers if the authorisation basis is missing.
Why the issue is both regulatory and business continuity related
This is a governance failure as much as a legal one. The provider has to know whether the product, the entity, and the current permission status all line up, because the risk is not only enforcement. It is also the possibility of abrupt service interruption, remediation cost, contract uncertainty and loss of market access.
For that reason, firms should treat FCA perimeter analysis as a live control, not a one-time launch checklist. The practical question is whether the exact credit product being offered still sits inside the permissions the firm holds today, not whether it once passed an earlier review.
What firms should verify before they keep lending
The first check is whether the offering is actually Deferred Payment Credit as regulated in the UK context, then whether the operating entity has the necessary FCA authorisation or a valid temporary permission that still applies. Where the product is sold through partners or embedded in a broader checkout flow, the firm should verify who is legally making the credit decision and who is the regulated lender.
That control point is often missed when commercial teams describe the feature as “just a payment option”. If the regulated activity is happening, the legal status has to be correct even when the customer journey feels seamless.
Firms that need a structured way to separate product design from permission checks can use NHIMG’s IAM and IGA Basics to think about ownership, entitlement and review disciplines in a broader governance sense, and the Authorisation Models Guide to reinforce why who is allowed to act matters as much as what the system can technically do.
Risk and Threat Considerations
When a firm lends without valid FCA permission, the risk is not limited to enforcement action. It can create immediate exposure around unlawful conduct, forced cessation of lending, customer disruption and downstream disputes over transactions already in flight.
Failure mechanism: The provider operates a regulated credit activity outside its legal permission envelope, then loses the ability to rely on temporary permission once that window expires.
Impact: The firm may have to stop lending, remediate customers and counterparties, and absorb legal, commercial and operational fallout that can outlast the original compliance failure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| ISO/IEC 27001:2022 | A.5.31 — Legal, statutory, regulatory and contractual requirements | BNPL lending without FCA permission is a regulatory compliance failure. |
| A.5.36 — Compliance with policies, rules and standards for information security | Operational controls must prevent service rollout outside approved governance limits. | |
| Recommendation — Map lending permissions to applicable legal and regulatory obligations and review them before launch. Enforce approval gates that block launch when required permissions are missing. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk management strategy | Permission gaps create legal and continuity risk that must be governed explicitly. |
| GV.OV-01 — Oversight of the cybersecurity risk management strategy | Management oversight is needed to stop unlawful credit activity before it reaches customers. | |
| Recommendation — Include regulatory permission failure in the organisation's risk strategy and escalation criteria. Assign board or executive oversight to confirm regulated activities remain within approved status. | ||
| NIST SP 800-53 Rev 5 | PM-9 — Risk Management Strategy | A formal risk strategy should account for operating outside FCA authorisation. |
| CA-2 — Control Assessments | Assessments should verify whether the BNPL operating model still matches permission status. | |
| Recommendation — Document regulatory-authorisation risk in the enterprise risk strategy and review it regularly. Test regulated-activity controls and evidence that authorisation remains valid. | ||
Practitioner Guidance
What to verify: Confirm the exact legal entity, product structure and customer flow that are carrying the credit activity. In BNPL programmes, the common mistake is assuming the front-end experience defines the regulatory status, when the regulated activity may sit deeper in the operating model.
Escalation / exception: If the temporary permission basis is unclear, expired, or dependent on an interpretation that has not been formally signed off, treat the position as a launch blocker for new lending rather than an administrative follow-up.
Practitioner takeaway: The real control objective is not just avoiding a regulatory breach, it is ensuring the firm can prove it is allowed to keep operating before customer lending is put at risk.
OWASP Non-Human Identity Top 10NIST SP 800-53 Rev 5 Security and Privacy ControlsNIST Cybersecurity Framework 2.0
Related resources from NHI Mgmt Group
- What happens when a crypto firm serves UK customers without the right FCA registration or authorization?
- Why is single-provider AI agent governance not enough for enterprise security?
- How should security teams implement authorization-aware search without repeatedly traversing large permission graphs?
- What happens when SAML assertions are accepted without matching the service provider configuration?