Buy Now Pay Later Regulation in India: PPI, Credit Lines and RBI Rules

Buy now pay later regulation in India has moved from a grey zone to a defined rulebook over the past few years. What started as a checkout-page convenience — split a purchase into three or four instalments — is now stitched into RBI's digital lending framework, its prepaid payment instrument (PPI) directions, and credit bureau reporting norms. For JAIIB and CAIIB candidates, BNPL is a favourite exam trap because it sits across three different regulatory boxes depending on who is actually extending the credit. Get the structure wrong and you get the compliance answer wrong. This article walks through the three BNPL models, why RBI shut the door on PPIs funded by credit lines, and what a bank must control when it partners a BNPL fintech.

📊 The Three Structures Behind Every BNPL Checkout

Every BNPL product you see at a checkout page fits into one of three structures, and the structure decides who regulates it. The first is merchant-funded deferred payment: the merchant simply lets the buyer pay in 30 or 60 days, absorbing the cost as a discount to the payment aggregator or fintech. No regulated entity (RE) is lending here, so this model has historically sat outside RBI's direct lending perimeter, though the underlying payment flow still runs through licensed payment systems.

The second is a credit line or short-tenor loan from a regulated lender — a bank or an NBFC sanctions an actual credit facility, and a fintech acts only as its loan service provider (LSP) at the front end. Because an RE is extending credit, this structure falls squarely inside RBI's digital lending rulebook, including disclosure, fair-practice and reporting obligations.

The third is a PPI-based BNPL product, where a bank or authorised non-bank PPI issuer loads a pay-later limit onto a prepaid wallet. This model is governed by the Master Direction on Prepaid Payment Instruments and comes with its own loading restrictions, which is exactly where most BNPL controversy in India began. Candidates studying the overview of digital banking chapter should map each BNPL variant to its regulator before attempting scenario-based questions, since the exam rarely names the structure directly — it describes the fund flow and expects you to classify it.

🚫 Why RBI Barred PPIs From Being Loaded by a Credit Line

The single most tested fact in this topic is a narrow but consequential RBI clarification: a prepaid payment instrument cannot be loaded or reloaded using a credit line. A PPI may only be topped up from cash, a debit to a bank account, or a credit/charge card in the holder's own name — not from a borrowed credit facility sanctioned by a third party. RBI's reasoning is straightforward: PPI issuers are authorised to issue payment instruments, not to originate or intermediate credit, and allowing a credit line to sit behind a wallet effectively let unlicensed or loosely supervised entities run a lending book while dressing it up as a prepaid product.

This single clarification reshaped the Indian BNPL market. Several fintechs that had built pay-later wallets funded by NBFC credit lines had to either convert the product into a direct loan or credit-line disbursed straight to the borrower's bank account, or shut the wallet-funded version altogether. It is a clean litmus test for exam purposes: if a question describes a wallet being "topped up" by a lender's credit line so the customer can tap-and-pay later, the correct answer is that the arrangement breaches RBI's PPI-loading rule, regardless of how the product is marketed. Chapters on mobile banking and prepaid instruments are worth revisiting alongside this rule, since PPI questions frequently overlap with mobile-wallet mechanics.

⚠️ Common Mistake: Students assume any wallet-based BNPL product is automatically compliant because it looks like a prepaid instrument. Always check the funding source first — if a credit line sits behind the wallet, it fails RBI's loading rule.

📋 Key Fact Statement, All-Inclusive APR and the Cooling-Off Period

Where BNPL is structured as a genuine credit line or short-tenor loan from an RE, it is treated as digital lending in every respect, and RBI's Digital Lending Directions apply in full. Before the loan is executed, the lender — directly or through the BNPL fintech acting as LSP — must hand the borrower a standardised Key Fact Statement (KFS). The KFS must present the principal, tenor, and every charge in one place, culminating in a single all-inclusive Annual Percentage Rate (APR) that folds in interest, processing fees, platform fees and any other recurring or one-time charge. A "zero-cost" or "interest-free" BNPL label does not exempt the lender from disclosing the APR; if a processing or convenience fee is baked into the merchant price, it must still surface in the KFS.

The Directions also give the borrower a cooling-off (look-up) period right after disbursal, during which the loan can be exited by repaying only the principal and the proportionate APR for the days the loan was actually live — no prepayment penalty, no hidden exit charge. For a candidate, the exam-relevant point is that this right exists specifically because digital loans, including BNPL credit lines, are disbursed and accepted almost instantly, leaving little time for the borrower to reconsider terms before money moves. The Retail Banking – Digital Banking class material links this cooling-off concept directly to the broader digital lending consent architecture.

💰 Direct Fund Flow and Default Loss Guarantee Limits

Two structural safeguards protect the borrower once a BNPL credit line is sanctioned. First, disbursement must flow directly into the borrower's own bank account — never through a pool or escrow account controlled by the LSP or the BNPL fintech. Repayments must flow back the same way, directly to the regulated lender, not routed through the fintech's collection account. This closes the door on the old pass-through model where a fintech could co-mingle customer repayments with its own working capital, a practice that made reconciliation opaque and increased operational risk if the fintech ran into trouble.

Second, where the BNPL fintech offers the lender a Default Loss Guarantee (DLG) — effectively agreeing to absorb a slice of defaults on the portfolio it sourced — RBI caps that guarantee at a fixed percentage of the underlying loan portfolio outstanding, and the lender can invoke the guarantee only within a defined window once an account turns overdue. A DLG structured to cover unlimited losses, or invoked without a time limit, does not meet the RBI framework and effectively makes the fintech an unlicensed risk-absorbing lender in substance.

💡 Exam Tip: If a question describes an LSP guaranteeing losses beyond the RBI-prescribed portfolio cap, or a repayment routed through the fintech's own account, treat both as compliance failures — not as product features.

📈 Credit Bureau Reporting and Over-Indebtedness Concerns

Every BNPL account originated by a regulated entity — however small the ticket size or short the tenor — must be reported to Credit Information Companies (CICs), the same way a personal loan or credit card account would be. This was a genuine early gap: several small-ticket, short-duration BNPL loans went unreported for a period, leaving thin-file borrowers with no visible credit trail, until a cluster of missed instalments suddenly surfaced as defaults with no prior track record to explain the risk. Consistent bureau reporting is now treated as a basic hygiene requirement for any BNPL book, not an optional extra for larger loans.

The other side of that same coin is over-indebtedness. A single customer can hold several BNPL lines across different apps simultaneously, each individually small and each individually within a soft limit, but collectively pushing the borrower well past a sustainable repayment capacity. Because approvals happen in seconds and each app assesses the customer largely in isolation, stacking risk is harder to catch than with traditional loan underwriting. This is precisely why consistent, near-real-time bureau reporting and consent-based data checks matter — they are the only practical brake on multiple concurrent BNPL exposures.

📌 Remember: BNPL is not exempt from credit reporting just because the ticket size is small — under-reporting is itself flagged as a consumer-protection and prudential lapse.

🏦 What a Bank Must Control When Partnering a BNPL Fintech

When a bank ties up with a BNPL fintech as its LSP, the bank cannot outsource its regulatory accountability along with the customer interface. Ownership of KYC and underwriting decisions must stay with the bank, even though the fintech runs onboarding screens and the checkout experience. The partnership needs a board-approved outsourcing and fintech-partnership policy, a clearly published list of LSPs on the bank's own website, and a grievance redressal mechanism where the bank — not the fintech — is the accountable party of last resort, with a defined turnaround time for escalated complaints.

Operationally, the bank must independently monitor its DLG exposure against the prescribed portfolio cap rather than relying on the fintech's own reporting, verify that no co-branded PPI in the tie-up is being loaded from a credit line, confirm that disbursement and repayment accounts meet the direct-flow requirement, and audit that every originated account, regardless of size, is actually reaching the credit bureaus on schedule. Candidates preparing the Retail Banking – Digital Banking Class 11 material will recognise this as an extension of the same outsourcing-risk principles applied to any technology partnership, just tightened for a product that moves money in seconds. For a broader payments-infrastructure view of where BNPL sits, see this overview of NPCI's role in digital payments, and for the customer-onboarding leg of any BNPL tie-up, this piece on video KYC in digital banking is directly relevant.

This regulatory layering also connects to how banks evaluate technology risk more broadly — a theme covered from a different angle in this note on distributed ledger technology in banking, useful background if your CAIIB paper combines ITDB and Digital Banking questions. For the digital public infrastructure context that underpins consent-based data sharing in lending, see India Stack and digital public infrastructure. You can browse more coverage of this space on the Digital Banking tag hub.

✅ Get Exam-Ready on BNPL and Digital Lending

Buy now pay later regulation in India rewards candidates who can trace the money, not just recall a definition. Identify who is actually extending credit — merchant, bank, NBFC or PPI issuer — and the correct regulatory answer usually follows on its own: whether the Digital Lending Directions apply, whether a KFS and cooling-off period are mandatory, and whether the funding route breaches the PPI-loading rule. Revisit the Retail Banking – Digital Banking Class 10 chapter for the foundational classification, then test yourself with full-length mocks on the CAIIB course page to see how BNPL questions get combined with other digital lending scenarios.

🧠 Practice MCQs: Buy Now Pay Later Regulation in India

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions

For the RBI's official regulatory framework on digital lending and prepaid instruments, refer to the Reserve Bank of India website.