CCD2 hits EU BNPL checkouts on 20 November. Seven days before Black Friday

Buy now, pay later became a checkout default because it was the fastest path in the flow. From 20 November 2026 the EU's second Consumer Credit Directive puts a creditworthiness assessment and a disclosure document into that path — and it does so seven days before Black Friday, inside the window when most retailers have stopped touching their checkout.

What CCD2 is, and what actually changed

Directive (EU) 2023/2225, universally shortened to CCD2, replaces the 2008 Consumer Credit Directive. Member states transpose it into national law and those national rules apply from 20 November 2026.

The change that matters to online retail is one of scope. The 2008 directive covered credit between €200 and €75,000 and carved out interest-free, short-term arrangements — which is precisely the shape buy now, pay later was built in. CCD2 widens the range to €100,000 and pulls interest-free instalments and deferred payment inside the perimeter, including amounts below €200. Member states retain discretion to apply a lighter regime to very small, zero-interest, sub-three-month credit with only insignificant charges, but the default position is inclusion, not exemption.

In plain terms: the thing your checkout calls "pay in 3" is now consumer credit, and it carries consumer credit obligations. There are narrow carve-outs for deferred payment offered directly by a supplier — the classic examples are a hospital or a plumber invoicing after the fact — but those explicitly exclude large online suppliers and service providers with substantial customer bases.

The date problem the compliance guides miss

Everything published about CCD2 has been written by payments lawyers and compliance vendors for lenders. It is accurate and it is almost entirely silent on the thing that will actually cost European retailers money this year, which is where 20 November falls in the calendar.

Seven days. A regulatory change reshapes one of your payment paths seven days before the highest-traffic day of your year, during the window in which your own policy says nobody touches the checkout.

This is the specific reason CCD2 deserves a slot in a conversion plan rather than only a compliance one. A code freeze stops your deploys, not everyone else's, and this is the clearest example of that principle anyone will see this year: your BNPL provider will ship changed screens into your checkout on a date set by the European Parliament, whatever your release calendar says.

What CCD2 adds to the BNPL path at checkout

Today a BNPL selection is typically three or four taps: choose the option, confirm a few details in a provider modal or redirect, get an instant decision, return to a confirmation. It is one of the lowest-friction paths in modern checkout, and that is exactly why it converts.

CCD2 adds obligations that have to surface somewhere in that path. The precise implementation is your provider's to build and will vary, but the obligations themselves are not optional:

1. Pre-contractual standard information. The old multi-page SECCI form is replaced by a shorter, one-page Standard European Consumer Credit Information document explicitly designed to be readable on a phone. Better than what it replaced, and still a document the customer did not previously see.
2. A creditworthiness assessment. Article 18 keeps the assessment obligation and adds explicit categories it must consider — income, expenses, existing liabilities, resilience to financial shocks — requires it to be proportionate to the value, duration and risk of the credit, and permits credit to be extended only where the assessment is positive, with narrow exceptions.
3. The right of withdrawal. A disclosed right to withdraw from the credit agreement, which interacts with your own returns and refunds process in ways worth thinking through before a customer does it for you.
4. Rules on how credit is advertised. This is the one that lands in your codebase rather than your provider's, and it is covered in the next section.

The honest summary: a path optimised over a decade for the fewest possible taps is getting a disclosure document and a substantive affordability check inserted into it, at the same time of year that your traffic triples.

Who is actually responsible: you, your provider, or your platform

This is the most common question and the least well answered anywhere, because the available writing addresses creditors. Most of CCD2 falls on the creditor, which for a typical retailer is the BNPL provider, not the shop. But not all of it, and the parts that fall on you are the parts your provider cannot fix on your behalf.

Read the bold rows and the work becomes concrete rather than alarming. The merchant surface area is marketing surface area: every place you promote instalment payment before the customer reaches checkout, plus the container your provider's screens render inside. Those are content and front-end tasks, they are entirely within your control, and they are the ones nobody is going to do for you.

The conversion exposure model

The number everyone wants is "how much will this cost me". Nobody can tell you, because the missing input is how much drop-off the new steps cause in your checkout, and that has not happened yet. What you can do is build the model now, so that on 21 November you are reading a variance rather than guessing.

The arithmetic is deliberately simple:

Worked through with plausible figures for a mid-sized European store. Every input here is an example, not a benchmark — the point is the shape, and you should replace all four numbers with your own.

Now the useful part, which is not the euro figure. Three of the four inputs are sitting in reports you already have. The fourth — drop-off on the added steps — is unknowable in advance and unknowable afterwards too unless you measure the current path before 20 November. A store that has never instrumented its BNPL funnel will see total conversion fall in late November and will have no way to separate CCD2 from Black Friday traffic mix, discount depth, competitor pricing or a browser release. That is the actual risk: not the friction, but the inability to attribute it.

So the single highest-value thing to do this month costs nothing and is not a compliance task. Instrument four events on the BNPL path now:

• BNPL selection rate — share of checkouts that choose it
• BNPL start-to-complete rate — of those, how many finish
• Time in the BNPL path — median seconds from selection to return
• Decline or negative-assessment rate — if your provider exposes it

Four weeks of baseline before 20 November turns an unanswerable question into a measured one. It is the same discipline that makes any checkout field change assessable rather than arguable.

Should you pause BNPL over peak?

Some merchants will consider pulling BNPL for the peak window rather than risk an untested flow on Black Friday. That can be the right call, and it can be an expensive overreaction. The variables are your BNPL volume, your provider's readiness and your average order value.

A working timeline from here

Ten weeks remain. This sequence assumes an ordinary retailer with a provider-hosted BNPL integration, and front-loads everything that has to happen before a freeze.

1. This week. Instrument the four BNPL funnel events above. Send your provider three questions in writing: what changes in the customer-facing flow, on what date will it be live in production, and when can we test it on staging.
2. By early October. Inventory every on-site surface that advertises instalment payment — product page badges, cart banners, category strips, homepage modules, email templates, paid social creative. You will find more than you expect, and several will be hard-coded in a theme file rather than editable in the CMS.
3. By late October. Test your provider's new flow on staging at 375px width and on a real phone. Provider modals and redirects are where responsive bugs hide, and a flow that works on a desktop preview can be unusable on the device most of your BNPL customers use.
4. By 6 November. Final content pass on every surface from step two. Deploy.
5. 13 November. Freeze. Confirm your four BNPL metrics are visible on a dashboard someone will actually look at during peak.
6. 20–24 November. Watch the dashboard daily. You are looking for a step change in the start-to-complete rate, not in overall conversion — overall conversion will be moving for a dozen reasons that week.

Note what is absent from that list: rewriting your checkout. CCD2 is not a checkout rebuild for most merchants. It is an integration change your provider makes, a content audit you make, and a measurement baseline you need in order to know which of the two caused anything.

Frequently asked questions

What is CCD2 and when does it apply?

CCD2 is Directive (EU) 2023/2225, the second EU Consumer Credit Directive, which replaces the 2008 directive. Member states transpose it into national law and those national rules apply from 20 November 2026. It widens the scope of regulated consumer credit from the old €200 to €75,000 range up to €100,000, and pulls interest-free instalments and deferred payment arrangements inside the perimeter.

Does CCD2 apply to buy now, pay later?

Yes. Bringing BNPL into scope is the central change. The 2008 directive exempted interest-free, short-term credit, which is the structure most BNPL products use. CCD2 removes that default exemption and covers interest-free instalments including amounts below €200. Member states may apply a lighter regime to very small, zero-interest, sub-three-month credit with only insignificant charges, but inclusion is the default and the detail varies by country.

Am I responsible for CCD2 compliance as a merchant, or is my BNPL provider?

Most obligations sit with the creditor, which for a typical retailer is the BNPL provider: the creditworthiness assessment, the pre-contractual standard information form and the credit agreement itself. What sits with you is everything you control on your own site: product page badges and instalment messaging, cart and category promotion of BNPL, checkout copy and option ordering, and whether your theme renders your provider's new screens correctly on a phone. Confirm your specific position with your provider and with counsel.

Will CCD2 hurt my conversion rate?

It will add steps to the BNPL path, and added steps in checkout generally cost some completion. How much is unknown, because it has not happened yet and will vary by provider implementation and by country. The more important risk is attribution: if you have not baselined your BNPL funnel before 20 November, a fall in late-November conversion cannot be separated from Black Friday traffic mix, discounting or anything else moving that week.

What should I measure before 20 November?

Four events on the BNPL path: the share of checkouts that select BNPL, the share of those that complete, the median time spent in the BNPL flow, and the decline or negative-assessment rate if your provider exposes it. Four weeks of baseline before the date turns an unanswerable question into a measured one.

Should I turn BNPL off for Black Friday?

Only if it is a small share of your orders and your provider cannot confirm what changes or when. If BNPL is more than roughly 10% of orders and your provider has given you a tested flow, removing it costs more than the friction it avoids. The middle option is usually right: keep it available, move it out of the default position, and pull back the product-page promotion that pushes customers into a path you have not tested. Never leave instalment badges live on product pages after removing the payment option.

The takeaway

CCD2 is not a checkout rebuild. For most merchants it is three things: an integration change your BNPL provider makes on a date set for them, a content audit of every surface where you advertise instalment payment, and a measurement baseline you need in order to tell those two apart in December. The calendar is what makes it urgent — 20 November sits inside the freeze window and seven days before Black Friday — so the work has to happen in October, not in the week it applies. Start with the four funnel metrics. They cost nothing and they are the only thing you cannot add retrospectively.