From November, Your Checkout Can Say No

On 20 November 2026 the grey area closes. From that date, the new EU Consumer Credit Directive — Directive (EU) 2023/2225, or CCD2 — also covers interest-free instalments, short payment deferrals and small-ticket amounts. Germany's implementing act cleared the Bundestag on 17 April 2026 and the Bundesrat in May. Roughly four months left.

For your shop, that means one thing: clicking "pay later" becomes a credit decision. With a mandatory assessment, documentation duties and extended disclosure requirements — at 39 euros just as much as at 3,900.

BNPL and CCD2 meet in a place most shops haven't touched in years: the checkout. It now has to make decisions. In real time, on the record, and without slowing the purchase down.

What this article covers

• What CCD2 regulates and when it applies

• Why the creditworthiness assessment moves into the checkout

• What false declines actually cost you

• What a checkout looks like when it decides instead of following fixed rules

• The five steps worth starting now

Why BNPL Carries So Much Weight in the Checkout

Buy Now Pay Later worked. According to IFH Köln (2025), BNPL lifts purchase probability from 17 to 26 percent, and the average basket grows by around ten percent. No surprise it ended up in nearly every checkout.

In Germany there's an extra dimension. Buying on invoice is the country's second-strongest online payment method, at 26.1 percent of revenue, just behind PayPal (EHI, Online-Payment 2026). Instalment purchases sat in a niche for years, then doubled their revenue share within three (EHI, Online-Payment 2025).

For many of your customers this is about control more than financing. Try the jeans on first, pay afterwards. People who shop that way plan around it, and they notice the moment it's gone.

The EU didn't tighten the rules for no reason. In a 2026 survey by the German regulator BaFin, one in seven BNPL users said they had lost track of their obligations when several agreements ran in parallel.

For customer experience, that means one thing from November: an assessment decides whether the familiar option appears at all. When it disappears, it disappears in the final step, after the address form, with no warning. Your customers don't see regulation there. They see a shop that doesn't trust them.

What CCD2 demands inside the checkout

CCD2 is the revised EU Consumer Credit Directive. It replaces the 2008 framework and pulls financing models into scope that previously sat outside it.

The creditworthiness assessment evaluates whether repayment as agreed is likely. It has to happen before the contract is concluded, rest on current data, and be documented. Even at 30 euros.

Here's the catch: that assessment runs at the exact moment your customers are least patient. Between basket and thank-you page. Every extra second and every extra field costs measurable conversion right there.

Your most expensive failure mode: false declines

A false decline is a rejected order from a customer who could have paid. They're solvent, but the payment method never appears — or they get pushed out of the flow entirely.

It happens when risk models work too bluntly: thin data on a first-time buyer, an unfamiliar device, a shipping address that differs from the billing address.

The damage lands three times:

• Lost revenue. Many rejected customers don't switch payment method, they switch shop.

• Lost trust. The provider makes the call, your brand takes the blame.

• Wasted media spend. The drop-off happens at the most expensive point of the journey, after every click and retargeting cost.

The stricter the assessment duty gets, the more each imprecise rejection costs.

From a static payment block to a checkout that decides

In most shops, payment method selection is a static list. Configured by country, currency, maybe basket value. That logic won't hold from November 2026.

What you need is a checkout that decides per transaction. Three signals shape the outcome:

• Purchase history: returning customer with a clean record, or first-time buyer with no data trail?

• Basket value: as the amount rises, so does default risk and the depth of assessment required.

• Credit and fraud signals: they run in parallel and answer different questions.

Technically, the payment step needs a decisioning call to the provider before it renders. It needs defined timeouts and a clean fallback when no answer comes back. And it needs a data model that stores the decision along with its timestamp and its basis. Documentation duties can't be fully delegated to your payment provider.

Every architecture is affected, but each fails differently. A classic storefront renders the payment list in the same request that owns the basket, so the trap is caching and render time: an external decisioning call inside a synchronous page build blocks when the provider is slow.

Headless moves the problem elsewhere. Frontend, checkout service and payment orchestration deploy separately and hold their own state. Without clean invalidation, the frontend offers a method the checkout service blocked long ago.

What it means for your team

This isn't a legal-only project. Payment, IT, legal and marketing need one shared roadmap, because contract flow, data flow and advertising all change at once.

How your model is classified depends on how it's built: invoicing a customer yourself is assessed differently from a deferral routed through a provider. That's one for legal review.

Marketing assets are in scope too. Banners, landing pages, newsletters and social ads promoting financing face stricter disclosure rules.

Five steps for the coming months

1. Take inventory. List every payment method with provider, contract model and term. Flag what counts as consumer credit from 20 November 2026.

2. Assign responsibility. Get it in writing with your payment partner: who runs the assessment, who documents it, who handles disclosures.

3. Measure your decline rate. Without a baseline you won't know in November whether your setup got worse. Capture approval rates by method, segment and basket band.

4. Design the decline moment. A rejected method must not be a dead end. Show an available alternative immediately, without losing the basket.

5. Review contract flow and creatives. Anything that advertises or concludes financing needs a check against the new disclosure rules.

Conclusion

Under CCD2, BNPL stops being a payment topic. The assessment moves into the purchase itself, which makes the checkout the component that decides revenue and compliance at the same time.

Strategically, that favours whoever prepares. Under identical regulation, the merchant who assesses risk more precisely rejects fewer paying customers. The difference comes from decision quality. Anyone can simply tighten the rules.

The next stage is already visible: once AI agents buy on behalf of customers, the checkout has to justify its decisions in machine-readable form. Build that logic properly now and the homework is done.

Sound like your November?

We build checkouts that hold up under decisions like these — from Shopware to headless. If you want to know where your setup stands come November, get in touch and we'll look at it with you.

FAQ

What is CCD2?

CCD2 is the new EU Consumer Credit Directive (EU) 2023/2225. It replaces the 2008 directive and applies from 20 November 2026. Newly in scope: interest-free instalments, short payment deferrals and small amounts.

Does every BNPL purchase need a credit check, even at 30 euros?

Yes. A creditworthiness assessment is mandatory before the contract is concluded, regardless of the amount. It has to be based on current data and documented.

What is a false decline?

A false decline is the rejection of a customer who could have paid. It stems from risk models that are too blunt, and it costs revenue directly, because many customers abandon the purchase after being turned down.

Do merchants need a credit intermediary licence?

It depends on the model, and on the member state. Smaller merchants financing only their own sales are generally covered by an SME exemption. Larger merchants and platforms should get legal advice.

Is there enough time until November 2026?

For an audit and alignment with your payment partner, yes. For rebuilding checkout architecture, it's tight — put the inventory on the roadmap now.