BNPL Is Now Regulated Credit: Fix Your Payment Plan Page

Key Takeaways

• Buy now pay later contracts became regulated credit under the National Credit Code from 10 June 2025, following the Treasury Laws Amendment (Responsible Buy Now Pay Later and Other Measures) Act 2024.
• ASIC published Regulatory Guide 281 (Low cost credit contracts) on 8 May 2025, five weeks ahead of commencement.
• From 10 June 2025, any business providing BNPL-style credit must hold an Australian credit licence with the right authorisations and be a member of AFCA.
• A “low cost credit contract” (LCCC) is a defined term under section 13E of the National Credit Code. Providers of LCCCs can elect to comply with a modified, lighter version of the standard responsible lending obligations.
• Embedding a licensed BNPL provider’s widget (Afterpay, Zip, humm) does not put the credit licence obligation on the clinic. Running your own in-house instalment plan might.
• In 2024, ASIC accepted a court enforceable undertaking from BNPL provider Elepay after it lent $13.748 million to 1,658 retail clients without holding the required Target Market Determinations.
• The build consequence for a clinic website is disclosure and attribution: the page has to make it clear who the actual credit provider is, and that is not always the clinic’s own brand.

Buy now pay later stopped being a marketing feature and became regulated credit on 10 June 2025, under the National Credit Code. If your clinic’s price page still reads “flexible payment plans, get started today” with an Afterpay badge bolted on, that copy predates a real regulatory shift, and the page underneath it needs a second look.

What changed, and where the answer sits

Here’s the thing web developers keep missing about BNPL: the rule change did not touch the widget. It touched who is legally allowed to offer the credit behind it.

Before 10 June 2025, a BNPL provider could operate in Australia without an Australian credit licence, because BNPL contracts sat outside the definition of “credit” in the National Credit Code. That gap closed with the Treasury Laws Amendment (Responsible Buy Now Pay Later and Other Measures) Act 2024, which brought BNPL contracts inside the Code as a new, defined category: the low cost credit contract, or LCCC.

ASIC’s own guidance page states plainly that from 10 June 2025, “anyone engaging in credit activities involving buy now pay later contracts must hold an Australian credit licence with appropriate authorisations,” and that BNPL providers must also become members of the Australian Financial Complaints Authority (AFCA). ASIC backed that commencement date with Regulatory Guide 281, published 8 May 2025, which sets out how the modified responsible lending obligations in Chapter 3 of the National Consumer Credit Protection Act 2009 apply to LCCC providers specifically.

An LCCC is not just any deferred payment. Under section 13E of the National Credit Code, a contract only qualifies if it meets the BNPL contract definition and satisfies the fee and term limits set out in the regulations. That distinction matters more than it sounds: a licensed BNPL provider’s LCCC status is what lets it use the lighter, modified disclosure regime. A clinic’s own home-grown “6 weeks, no interest, just pay us direct” plan does not automatically get the same treatment just because it looks similar on the page.

Takeaway: the credit licence obligation from 10 June 2025 sits with whoever is actually extending the credit, and that is the first question a payment plan page has to answer clearly.

What that means for the build

This is where it gets concrete. A payment plan section on a clinic website is usually one of three things, and each one carries a different build obligation.

Scenario 1: an embedded third-party BNPL widget. Afterpay, Zip, humm and similar providers hold their own Australian credit licence as of 10 June 2025. When you embed their checkout widget or “as low as $X a week” badge, you are not the credit provider. The build task is attribution, not licensing: use the provider’s official badge markup and copy exactly as supplied in their merchant integration docs, link the badge to their current Product Disclosure Statement (PDS) or terms page, and never rewrite their disclosure copy in your own words on the procedure page. If your CMS lets a content editor free-type “pay in 4 easy instalments with Afterpay” next to a hand-rolled logo image, that is a maintenance risk waiting for the provider’s terms to change under it.

Scenario 2: an in-house instalment plan. Some clinics run their own “pay a deposit, then three fortnightly payments direct to us” plan with no BNPL provider involved. If that plan charges a fee for the deferral, even a flat admin fee, it starts looking like the kind of credit contract the National Credit Code was built to catch. The build consequence: the page copy needs to stop implying this is a BNPL-style product if it is not licensed as one, the checkout flow needs a field capturing informed consent to the actual payment terms (not just a checkbox next to “I agree to T&Cs”), and the terms themselves need a plain-English breakdown of every date, amount and fee, stored against the patient record, not just displayed once at checkout and forgotten.

Scenario 3: pay in full, deposit only. No credit is being extended at all if the patient pays the full amount up front or forfeits a booking deposit against the final invoice. No credit licence question arises, but the deposit terms still fall under standard consumer guarantee and refund rules, which is a separate compliance surface from BNPL.

The field-level build task, in order: identify which of the three scenarios your payment section actually is, confirm the credit provider’s name and licence status if scenario 1 or 2 applies, and make sure the on-page copy names that provider rather than blurring it into the clinic’s own brand voice.

Decision matrix: who holds the obligation

Worked example: a $2,400 treatment package

Picture a Perth cosmetic clinic selling a lip filler and skin course bundle priced at $2,400. The price page currently offers three ways to pay, and each one now needs different on-page treatment.

Pay in full. Straightforward, no credit involved, standard deposit and refund copy applies.

4 x Afterpay. The clinic’s checkout embeds Afterpay’s own widget. The build task is confirming the integration still pulls Afterpay’s current disclosure text at render time rather than a cached screenshot or static copy block from two years ago, since Afterpay itself is the licensed party managing that wording.

6-week in-house plan. The clinic charges a flat $50 admin fee across six fortnightly payments taken by direct debit. That $50 fee is the detail that matters. It is the kind of charge that can tip an informal payment arrangement into something that looks like a credit contract under the National Credit Code, which is exactly why this scenario needs individual legal advice rather than a template answer.

The following chart illustrates how those three options compare on total cost to the patient for this example package. The figures are illustrative for this worked example only, not real pricing data from any clinic.

Takeaway: the moment an in-house plan adds a fee on top of the treatment price, the page has crossed from “payment convenience” into territory the credit licensing regime was built to cover.

What to check on your own site

• Open every procedure or price page that mentions a payment plan and note which of the three scenarios above it is.
• If a BNPL provider’s badge or widget is present, confirm the integration is live and pulling current terms, not a static image or copied text block.
• Confirm the credit provider named on the page (Afterpay, Zip, humm, or your own clinic entity) matches the entity actually extending the credit.
• If your clinic runs its own instalment plan, check whether any fee, deposit forfeiture clause, or interest charge is attached. A fee is the detail that most often triggers the credit definition.
• Check that instalment plan terms (dates, amounts, fees) are captured in writing at the point of checkout and stored against the patient record, not shown once and discarded.
• Check your booking or practice management platform’s payment plan module for a built-in disclosure field. Vendors including Cliniko, Halaxy, Power Diary and Pabau each handle instalment plans differently, so confirm your specific platform’s current documentation rather than assuming.
• If the plan is in-house and charges any fee, flag it for review by your medical defence organisation or a credit law specialist before the next site update ships.

Enforcement anchor: the Elepay case

The clearest example of ASIC acting on BNPL disclosure failures predates the 10 June 2025 licensing commencement, but it shows the regulator’s posture toward the sector. In February 2024, ASIC accepted a court enforceable undertaking from BNPL provider Elepay, after finding that between 5 October 2021 and 15 March 2023 it distributed seven credit products without holding the Target Market Determinations required under the Design and Distribution Obligations in the Corporations Act. Over that period Elepay lent $13.748 million to 1,658 retail clients. The undertaking required Elepay to engage an independent expert to check which clients fell outside its target market, refund any fees charged to them, and only resumed lending after obtaining its own Australian credit licence on 23 January 2024.

That case was about distribution obligations under the Corporations Act rather than the credit licensing regime that started in June 2025, so it is not a direct precedent for the new rules. It is still the clearest available evidence that ASIC pursues BNPL-style providers over exactly the kind of disclosure and target-market gaps a poorly built payment plan page can create. As at the date this post was checked, no confirmed ASIC infringement notice specific to the post-10 June 2025 credit licensing regime and named to a clinic or cosmetic BNPL provider was found. If one is published later, this post should be updated to reflect it.

Where this gets hard

The honest limit of this rule sits at scenario 2 in the decision matrix above: the in-house instalment plan. ASIC’s guidance is clear about who needs a licence once a contract qualifies as regulated credit, but whether a specific fee structure, deposit clause, or short-term instalment arrangement actually meets that definition is a legal judgment call, not a build decision. RockingWeb can build the disclosure fields, the consent capture, and the correct attribution copy. Whether your specific in-house plan needs its own credit licence is a different question entirely.

The regulator says a low cost credit contract triggers licensing and modified responsible lending obligations from 10 June 2025. The build consequence is that your payment plan page needs to name the actual credit provider and capture proper consent to the terms. Whether your clinic’s specific in-house plan falls inside that definition is a question for your medical defence organisation or your lawyer.

Status line

The BNPL credit licensing obligation is in force. It commenced 10 June 2025 under the National Credit Code, following the Treasury Laws Amendment (Responsible Buy Now Pay Later and Other Measures) Act 2024 and ASIC’s Regulatory Guide 281, published 8 May 2025.

Frequently Asked Questions

Does adding an Afterpay or Zip widget to my clinic’s website need my own credit licence?

No. The BNPL provider holds the credit licence for its own product, not you. But if your clinic also runs its own instalment plan separate from a BNPL provider, that arrangement may need its own assessment against the National Credit Code.

When did buy now pay later become regulated credit in Australia?

From 10 June 2025, under the National Credit Code, following the Treasury Laws Amendment (Responsible Buy Now Pay Later and Other Measures) Act 2024 and ASIC’s Regulatory Guide 281, published 8 May 2025.

What is a low cost credit contract and why does it matter for a payment plan page?

A low cost credit contract, or LCCC, is a BNPL-style contract that meets fee and term limits set in the National Credit Code. Providers of LCCCs can elect modified responsible lending obligations, which is why an Afterpay or Zip badge on a clinic’s site looks different to a personal loan disclosure.

If your payment plan page hasn’t had a fresh set of eyes since before 10 June 2025, it’s worth a proper audit rather than a guess. Sign up with RockingWeb and we’ll check the build against what the current rules actually require.

Sources and References

1. ASIC, “Buy now pay later credit contracts: Credit licensing” (INFO 285). asic.gov.au. Date checked: 15 August 2026.
2. ASIC, Regulatory Guide 281, Low cost credit contracts, published 8 May 2025. asic.gov.au. Date checked: 15 August 2026.
3. ASIC media release 25-069MR, “ASIC releases new regulatory guidance to support buy now pay later industry reforms.” asic.gov.au. Date checked: 15 August 2026.
4. ASIC media release 24-012MR, “ASIC accepts court enforceable undertaking from buy now, pay later provider Elepay.” asic.gov.au. Date checked: 15 August 2026.
5. Federal Register of Legislation, Treasury Laws Amendment (Responsible Buy Now Pay Later and Other Measures) Act 2024 (C2024A00138). legislation.gov.au. Date checked: 15 August 2026.

Last reviewed: 15 August 2026.