CFPB Withdrew Its BNPL Interpretive Rule: What Compliance Teams Should Actually Change

Corrected September 10, 2026. An earlier version of this article described the interpretive rule as still on the books and presented a 2025 event as current news. The CFPB withdrew the rule in May 2025, and I revised the guidance below to match.

The Consumer Financial Protection Bureau withdrew the interpretive rule that classified Buy Now, Pay Later providers as credit card issuers under the Truth in Lending Act. A Federal Register notice published May 12, 2025 listed “Use of Digital User Accounts to Access Buy Now, Pay Later Loans” (89 FR 47068) among the guidance documents withdrawn, applicable as of that date. The Bureau said the withdrawn guidance “should not be enforced or otherwise relied upon by the Bureau while this review is ongoing,” and added: “Such withdrawal is not necessarily final.”

For a compliance function that built Regulation Z workflows, the first instinct runs toward relief. The second instinct should run toward documentation, because the Bureau itself calls the withdrawal not necessarily final.

What the Withdrawal Actually Covers

The interpretive rule brought BNPL products under the credit card issuer obligations in Regulation Z: specific disclosure formats, dispute resolution procedures, and the billing error framework that governs traditional card products.

With the interpretive rule withdrawn, the Bureau no longer enforces or relies on that reading while its guidance review continues.

Two things the withdrawal does not do. It does not settle the question for good, since the Bureau called it not necessarily final. And it does not touch state-level regulation, which operates independently.

Why the Relief May Prove Temporary

The Bureau withdrew the guidance pending a review to decide whether it “should ultimately be retained,” and a withdrawal the Bureau itself calls not necessarily final can reverse. That possibility drives the practical guidance below.

What to Change, and What to Keep

Reasonable to deprioritize now: the Regulation Z credit card disclosure formats and the dispute resolution workflows built specifically to satisfy the interpretive rule. Engineering capacity tied up maintaining formats nobody enforces has better uses.

Keep running regardless:

Baseline consumer protection practices. Clear terms, accessible dispute handling, and accurate fee presentation survive any federal posture, and state regulators examine them.
The audit trail. Log what you changed, when, and on what basis. A compliance posture change made without a documented rationale looks like negligence in hindsight rather than like judgment.
State-level compliance. Several states regulate BNPL directly, and none of them paused anything.
Data handling controls. Keep them independent of any single federal rule. The Bureau’s digital payment app oversight rule shows why: Congress nullified it in 2025.

What Engineering Built, and What to Do With It

Compliance rules become code, and code outlives the rule that produced it. Most BNPL engineering organizations built three things for Regulation Z.

Disclosure rendering. Templates producing specific formats at specific points in the flow, usually with locale handling and a versioning scheme so you can prove what a customer saw on a given date.

A dispute state machine. Intake, acknowledgment deadlines, investigation windows, provisional credit logic, and resolution notices, each with a clock.

An evidence trail. Records proving the first two ran correctly for any given account.

Do not delete any of it. Feature-flag the disclosure rendering rather than removing the code, since restoring a deleted flow under a compliance deadline costs many times what maintaining a dormant one does. Record an owner and a review date against the flag so it does not become the permanent branching nobody understands two years from now.

Keep the dispute machinery running outright. State law, card network rules, and ordinary customer expectation all demand a working dispute process regardless of what the Bureau enforces, and a company that dismantles dispute handling because a federal rule went away will discover the other three sources quickly.

The State Patchwork Nobody Paused

Federal enforcement posture changed. State authority did not.

Several states regulate installment and BNPL products directly through lending license requirements, disclosure mandates, or consumer protection statutes of general application. State attorneys general also pursue unfair and deceptive practice claims without needing a federal rule to point at.

The practical exposure map runs by state of the borrower rather than by state of incorporation, which means a national BNPL product answers to the strictest regime it touches. That calculus did not shift with the withdrawal, and the compliance architecture that satisfies it looks nothing like the Regulation Z formats the interpretive rule required.

If your compliance program treated the federal interpretive rule as the ceiling, the withdrawal exposes how much of your posture rested on one rule. If it treated the rule as one input among several, the withdrawal changes little.

The Documentation Step Teams Skip

Write a memo. One page. It records that the Bureau withdrew the interpretive rule on a stated date, that your organization adjusted specific controls in response, and that a named person owns reassessment on a stated cadence.

That memo costs an hour. Its absence costs a great deal during an examination that asks why controls lapsed, because the honest answer, offered two years later from memory, sounds identical to the answer a company gives when it simply stopped trying.

What This Signals About the Broader Environment

The BNPL withdrawal sits inside a wider regulatory rollback. For product and engineering teams the read runs in two directions at once.

Near term, the permissive environment lowers a barrier. Features shelved on compliance grounds deserve a second look, with counsel involved.

Medium term, volatility itself becomes the risk. Building a product on a regulatory position that changes with an administration means rebuilding it when the position changes back. Architectures that isolate compliance logic behind a configuration boundary weather that better than architectures that scatter it through the codebase.

We covered the underlying compliance architecture in the fintech compliance guide, and the same principle applies here: separate the rule from the plumbing that enforces it, so a rule change becomes a configuration change rather than a release.

Where AI Fits

Compliance teams increasingly use AI to track regulatory change, and this episode illustrates both the value and the limit.

The value: an automated sweep surfaces a Federal Register notice on the day it lands rather than in a quarterly review. Our coverage of AI for compliance workflows covers the tooling.

The limit: no model tells you whether a withdrawn rule justifies dismantling a control. That judgment weighs litigation posture, state exposure, and institutional risk tolerance, and it belongs to a person whose name goes on the memo.

The Takeaway

The federal interpretation came off the books. State law did not. Deprioritize the workflows built solely for the interpretive rule, keep the baseline practices that satisfy state regulators and ordinary consumer protection, and write the memo that explains the change while you still remember the reasoning.

Regulatory relief that the Bureau calls not necessarily final can leave the same way.