The Credit File That Never Was: Buy-Now-Pay-Later and Britain's Monitoring Gap

Buy-now-pay-later has become a familiar feature of the British checkout. It is also becoming a familiar gap in the financial-crime map. The product sits between payments and credit, between merchant acquisition and customer onboarding, and between the supervisory expectations placed on banks and those that have, until now, applied only lightly to instalment credit. That space is not empty. It is simply less observed.

The policy debate around buy-now-pay-later has rightly concentrated on consumer harm: affordability, debt accumulation and the clarity of terms. But the compliance question is broader. A product that grants small amounts of credit quickly, at scale, through merchant partnerships and thin customer files can be useful not only to shoppers but to people moving or obscuring value. The risk is not that buy-now-pay-later is inherently illicit. It is that its controls have been designed for a different problem.

A product built for speed, not suspicion

The customer journey is deliberately frictionless. A shopper selects an instalment option, enters basic details, receives an instant decision and completes a purchase. For most users this is unremarkable. For a criminal group, the attraction is the same as for a legitimate customer: speed, low ticket values and a credit relationship that may not be visible to the customer's main bank.

The sums involved are usually modest. That is precisely what makes them interesting. Large-value monitoring thresholds are not designed to catch a series of plausible purchases across multiple accounts and merchants. Layering does not require a single conspicuous transfer; it can be achieved through refunds, cancellations, stored balances, resale of goods and repeated small defaults. Each event may look like ordinary retail behaviour. The pattern is what matters, and patterns require data that is joined up.

Refund abuse is one area that deserves closer attention. A provider may see a cancellation or a refund as a customer-service event, not as a financial-crime indicator. Yet repeated refunds to different destinations, unusual refund velocity, or a merchant with an abnormally high cancellation rate can be signs of collusion or value transfer. The same is true of account activity that looks like mule behaviour: accounts opened with identities that are thin but not obviously false, purchases of goods that are easy to resell, and defaults that arrive before a full credit history can form.

The merchant is the missing gatekeeper

Much of the financial-crime discussion around buy-now-pay-later focuses on the customer. The merchant portfolio may be the more important supervisory frontier. Providers acquire merchants at pace, often through partner platforms and intermediaries. The due diligence can be light-touch: company details, bank account, website, anticipated volume. That may be adequate for commercial risk. It is not adequate for sanctions, fraud or money-laundering risk.

A merchant can be a shell, a front, or simply a business whose refund practices are being used to move value. If the provider does not understand who ultimately owns the merchant, which jurisdictions are involved and whether the goods or services are consistent with the stated business, then the onboarding process is not a control. It is a registration exercise. The same logic applies to merchants selling high-resale goods, digital services or anything whose value is easy to realise without a clear audit trail.

This is not an argument for treating every small retailer as suspect. It is an argument for risk-based merchant due diligence that mirrors the expectations already placed on payment institutions and acquiring banks. Beneficial ownership checks, adverse media, sanctions screening and ongoing monitoring of refund and chargeback ratios should be part of the merchant relationship, not an afterthought.

Monitoring tuned to credit losses

Buy-now-pay-later providers are sophisticated users of data. They model default, fraud and customer behaviour continuously. The compliance question is whether those models are tuned to the right outcome. A system optimised for credit loss will look for signals of non-payment. A system optimised for financial crime will also look for signals of value movement: device reuse across accounts, shipping and billing mismatches, refund patterns, merchant concentration, multiple identities sharing a phone number or address, and sudden changes in purchasing behaviour.

Some of these indicators sit in the provider's own data. Others sit with banks, card issuers, payment processors and fraud-sharing bodies. The gap is often one of connection rather than collection. A bank may see a customer's salary and spending; a buy-now-pay-later provider may see a cluster of small purchases and refunds. Neither sees the whole picture. As the sector prepares for fuller regulation, the ability to share intelligence lawfully and proportionately will matter as much as the ability to onboard customers quickly.

Affordability checks are part of this picture, but they are not a substitute for financial-crime controls. Open-banking data can show income and obligations, yet it can also be gamed where mule accounts, synthetic identities or manipulated statements are in play. The point is not to distrust affordability data. It is to recognise that consumer-protection checks and AML checks answer different questions.

The regulatory handover

As buy-now-pay-later moves further into the regulatory perimeter, providers will need to show that their financial-crime risk assessments are board-level documents, not compliance appendices. That means a clear view of customer risk, merchant risk, product risk and geographic risk. It means suspicious activity reporting arrangements that work in practice, including where fraud and money laundering overlap. And it means a relationship with supervisors that is proactive rather than reactive.

The sector should not wait for final rules to begin behaving as though they apply. The providers that will fare best are those that can demonstrate, now, that they know who their merchants are, what their refund data shows and how they would detect a mule network that never breaches a credit threshold. The absent credit file is not an absence of risk. It is an absence of evidence.

What to watch in 2026

Three issues deserve particular scrutiny. First, merchant portfolio reviews: how many providers can show a risk-based refresh of their merchant base rather than a one-off onboarding check? Second, refund and cancellation analytics: are these treated as customer-service metrics or as financial-crime intelligence? Third, data-sharing arrangements with banks and card issuers: can a provider escalate a concern in a way that produces action, rather than a closed ticket?

Buy-now-pay-later is not a dirty product. It is a low-friction one. In the wrong hands, low friction is useful. The compliance task for 2026 is to make sure that the speed of the checkout is matched by the persistence of the controls behind it.