BNPL Is Now Regulated Credit in Malaysia. Here Is What That Changes for You

About this guide: This explainer uses an incident reported on 2026-06-05 as a starting point. The legal rules below are general; they do not decide anyone's guilt, liability or individual case.

What happened

Buy now, pay later used to feel more like a checkout feature than a loan. You saw four small instalments beside the full price, tapped a button and left with the item. In 2026, Malaysia put a clearer legal frame around that experience. The Consumer Credit Act 2025 came into force on 1 March, created the Consumer Credit Commission, or SKP, and brought previously unregulated non-bank credit activities into a dedicated system.

The practical switch began on 1 June 2026. BNPL, leasing and factoring businesses must go through licensing, while debt collectors, buyers of impaired loans and debt-counselling or management businesses must register. The Star reported on 5 June that SKP had issued its Authorisation Standards and Conduct Standards for these six activities. The standards are not a future policy wish: SKP’s official copy says the Conduct Standards took effect on 5 June.

The timing makes sense when you look at how common BNPL has become. Malay Mail reported a Finance Ministry parliamentary reply saying Malaysia had eight million active BNPL account holders in the first quarter of 2026, with RM5.3 billion outstanding. The same report put overdue balances at RM181 million. Those national figures do not say that every user is in trouble, but they show why a small-looking checkout option now needs proper rules.

Existing providers were not expected to complete licensing overnight. The Finance Ministry announced a six-month transition, and its later parliamentary reply said existing BNPL providers had until 30 November 2026 to submit applications. That distinction matters. Applications opening is not the same as every provider already holding a final licence. During the transition, check the provider’s current status rather than treating the logo in an app as proof of approval.

The legal insight: what law applies

The main law is the Consumer Credit Act 2025, Act 873. It was gazetted on 31 December 2025 after Royal Assent on 22 December. SKP’s official timeline says most of the Act commenced on 1 March 2026, while the licensing and registration stage began on 1 June. This is an Act in operation, not the earlier Consumer Credit Bill that Parliament debated in 2025.

The Act’s purpose is wider than handing out licences. It establishes SKP and protects a ‘credit consumer’. SKP explains that this includes an individual obtaining credit for personal, domestic or household purposes. It can also include a qualifying micro or small enterprise receiving credit up to RM300,000, and an individual acting as a social guarantor. For an ordinary shopper, the simplest point is that postponing payment for a household purchase is still consumer credit even when the marketing avoids the word ‘loan’.

The Conduct Standards translate that broad law into day-to-day duties for authorised businesses. SKP’s official summary covers marketing, disclosure, fair contract terms, interest or profit rates and fees, creditworthiness and affordability checks, debt collection, hardship assistance, complaint handling, staff competence and protection of consumer information. ‘Affordability’ means asking whether the customer can realistically make the repayments, not merely whether an automated system can approve the transaction.

Clear disclosure matters because zero interest does not mean zero consequence. A plan may still have late-payment charges, a fixed schedule and consequences for missed payments. SKP tells consumers to review instalment amounts, repayment dates, fees and the result of non-payment before clicking agree. Its standards also call for key credit information, including the effective interest or profit rate where applicable, to be accessible in plain language.

The rules also deal with what happens after payment becomes difficult. SKP says regulated providers must have a structured financial-hardship process and dedicated complaint channels. Debt collection must be conducted with sufficient notice and without threats, force or excessive harassment. These protections do not erase a valid debt. They control how credit is offered, managed and collected, and give the consumer a process for asking for help or challenging misconduct.

The system remains phased. SKP says banks continue under Bank Negara Malaysia in Phase I, while existing regulators remain responsible for their sectors. So a single complaint door does not replace every other regulator. The correct channel depends on who provided the credit and what kind of product it is. The new SKP framework is especially significant for non-bank activities that previously lacked this consolidated oversight.

How does this impact me?

For a shopper, the biggest change should be better information before the tap. You should be able to see the real payment schedule, charges and key terms without hunting through vague screens. Take a screenshot or download the agreement before confirming. If the checkout page and the final agreement say different things, preserve both versions and raise the difference promptly.

Do not confuse regulation with a government guarantee. A licensed provider can still offer a product that does not suit your budget. SKP itself warns that several small instalments across different apps can pile up. Put every BNPL payment into one calendar and add the monthly total. The useful question is not whether one RM40 instalment feels cheap; it is whether all instalments can be paid on their due dates after rent, food, transport and existing debts.

If your income drops, contact the provider before simply missing payments. Ask for its financial-hardship process in writing and explain what you can currently afford. A request is not an automatic right to the exact extension or write-off you want, but the standards require an organised assistance process. Keep the request, supporting documents and response together.

If a collector contacts you, ask for the creditor’s name, the account reference, the amount claimed and a written breakdown. Do not pay a new bank account supplied only through an unexpected message until you verify it through the provider’s official channel. Ethical collection rules do not stop legitimate reminders, but threats, force and excessive harassment are not acceptable collection methods.

What this incident teaches us

The incident teaches a useful language lesson: convenience can hide the nature of a transaction. BNPL breaks one price into smaller numbers, but the legal and financial reality remains a promise to pay. Calling it a checkout option does not refill your future salary. Regulation helps make the promise clearer; it cannot make the future money appear.

It also shows why affordability checks and personal budgeting must work together. A provider sees the information available to it. You know about the family expense next week, the irregular freelance income and the car repair that cannot wait. Approval is therefore not a recommendation to buy. Treat it only as access to credit, then make your own stricter decision.

The transition period deserves careful reporting. The Act commenced in March, applications opened in June, the conduct standards took effect on 5 June, and existing providers had a later application deadline. Those are separate milestones. It would be wrong to say BNPL remained completely unregulated until December, but also wrong to assume every existing provider had already completed the licensing process in July.

Finally, evidence becomes valuable before there is a dispute. A neat file containing the offer, agreement, repayment schedule, receipts and complaint reference can turn a confusing argument into a clear timeline. The new framework gives regulators and providers stronger processes. Consumers get more from those processes when they can show exactly what was promised and what happened.

The verdict

Malaysia has finally placed BNPL inside a dedicated consumer-credit framework. That means licensing, clearer information, affordability duties, hardship and complaint processes, and limits on abusive collection. It is a meaningful protection, not a free pass. Before using BNPL, total every instalment, read the charges and save the terms. If things go wrong, raise the issue early and keep the paper trail.

What can I do if this happens to me?

• Before confirming a BNPL purchase, save the full payment schedule, fees, late-payment terms and provider’s legal name.
• Add all BNPL instalments across every app into one monthly total and compare it with money left after essential expenses.
• Check the provider’s current authorisation information through SKP’s official website, especially during the 2026 transition period.
• If you may miss a payment, contact the provider early and request its financial-hardship process and proposed arrangement in writing.
• For a disputed charge, use the provider’s dedicated complaint channel and keep the case number, screenshots, receipts and replies.
• Verify any debt collector through the original provider and request a written account breakdown before making payment.
• Escalate unresolved conduct or authorisation concerns through the regulator responsible for that provider; SKP’s official site explains its covered sectors and contact routes.