Buy Now Pay Later Under Regulatory Fire

Buy Now Pay Later was supposed to democratise consumer credit — frictionless, fast, and untethered from the legacy plumbing of traditional banking. For a while, it delivered on that promise. Then regulators started paying attention. Across the Gulf, Southeast Asia, and emerging Europe, the same question is now being asked inside finance ministries and central bank boardrooms: has BNPL grown too fast, too loosely, and with too little accountability to the consumers it claims to serve? The answer is hardening into policy. And that policy is already determining which fintech players survive the next cycle.

The Valuation Peak Meets the Regulatory Floor

Tabby's ascent has been one of the more remarkable stories in regional fintech. The UAE and Saudi-based BNPL platform hit a $4.5 billion valuation following a secondary share sale in October 2025 — making it the most valuable fintech startup in MENA and the clearest signal yet that Gulf consumers had genuine appetite for deferred payment products at scale. Total funding now stands at $604 million. But the more consequential development came in 2026, when Tabby secured a Stored Value Facilities licence from the Central Bank of the UAE. That single regulatory instrument tells you everything about where CEO Hosam Arab intends to take the business.

The SVF licence allows Tabby to hold customer funds, issue payment cards, and build money management tools. It moves the company from credit facilitator to financial institution — with real balance sheet obligations to match. Arab has said plainly that Tabby has no interest in staying a BNPL app indefinitely. That strategic shift, though, is not purely a product ambition. It is a regulatory accommodation. Operating consumer credit products without a proper licensing framework is no longer a viable position in the UAE, and the Central Bank made that reality explicit. Tabby read the room and responded intelligently.

SAMA Tightens the Framework as Open Banking Matures

Saudi Arabia's regulatory evolution is running on two tracks at once, and both carry real consequences for BNPL operators. In March 2026, SAMA granted its first live open banking licences to commercial operators — ending the sandbox phase and opening the door to full API-driven data sharing between banks and licensed fintechs. For responsible lenders, this is a genuine breakthrough. Real-time income verification, account-level behavioural data, granular credit assessment — none of that was possible before at this level. For BNPL platforms that built their businesses on thin identity checks and soft credit pulls, the same infrastructure becomes a compliance burden rather than a competitive edge.

SAMA's posture toward consumer credit has hardened considerably since 2024. Debt-to-income disclosure requirements, mandatory cooling-off periods, and stricter reporting standards for deferred payment facilities are now embedded in the framework. Industry estimates suggest that as many as 30 percent of active BNPL accounts across the GCC carry balances that would fail a conventional affordability assessment. That is a significant figure. Regulators in Riyadh and Abu Dhabi are no longer willing to treat it as an acceptable side effect of financial inclusion.

Islamic Finance Principles and the BNPL Compliance Question

For Gulf-based BNPL operators, the regulatory challenge compounds a structural one: Sharia compliance. Most BNPL products in the GCC charge no explicit interest, relying instead on merchant-side fee models or commodity murabaha structures. But as regulators scrutinise fee schedules with greater precision, the line between a legitimate service charge and a disguised financing cost is coming under real pressure.

The emergence of genuinely AI-native Islamic financial infrastructure signals that the market is now building credit products designed for Sharia compliance from the ground up — not retrofitting conventional models after the fact. Mal, the Abu Dhabi-based platform that raised $230 million in seed funding in January 2026 led by BlueFive Capital, is the clearest example. Its leadership, drawn from Revolut and Nubank alumni, is already in licensing conversations across the UAE, Bangladesh, Indonesia, and Pakistan. The platform embeds programmable compliance into product logic rather than layering it on through advisory sign-off. That distinction matters.

The same principle appeared in Saudi Awwal Bank's August 2025 execution of the first blockchain-based Islamic repurchase agreement, built with digital-asset infrastructure provider Oumla. That transaction used smart contracts and tokenised collateral to achieve T+0 settlement with programmable Sharia compliance, integrated with Chainlink's Cross-Chain Interoperability Protocol. Compliance as code, not compliance as process. Applied to consumer credit, it offers BNPL operators a model that Gulf regulators may find considerably easier to licence and supervise. Few outside the region have connected these dots. They should.

Southeast Asia and Africa: Different Timelines, Same Direction

The pressure on BNPL is not a Gulf story. In Indonesia and the Philippines, Otoritas Jasa Keuangan and the Bangko Sentral ng Pilipinas have both introduced or signalled enhanced consumer protection frameworks for deferred payment products since late 2025. Vietnam's State Bank has moved more slowly on formal rules but issued supervisory guidance that effectively requires BNPL operators above certain transaction thresholds to register as financial institutions. The direction across these markets is consistent: informal credit facilitation is becoming a licensed activity, and operators who built businesses on regulatory ambiguity are being forced to make structural choices.

Africa is tracking the same arc. Kenya's Central Bank has moved to bring digital credit providers — including BNPL-adjacent products — under the Credit Act framework. Nigeria's Central Bank introduced a revised framework for non-bank financial institutions in early 2026 that captures most consumer-facing BNPL models. Egypt and Morocco, both seeing growing BNPL adoption driven by unbanked consumer segments, sit at an earlier stage of regulatory development. But the standard-setting work being led by the Basel Committee and IOSCO is pulling domestic frameworks in a predictable direction. The timing differs. The destination does not.

What This Means for Investors and Family Offices

For private investors and family office principals assessing fintech exposure in 2026, the BNPL regulatory moment deserves careful attention. The asset class is splitting in two. Platforms that anticipated regulatory scrutiny — securing proper licences, investing in compliance infrastructure, broadening beyond deferred payments — are becoming fundable, bankable financial institutions. Platforms that did not are facing an existential reckoning that no user growth chart will paper over.

Tabby's SVF licence, Mal's $230 million seed round, and SAMA's open banking rollout collectively point toward a regional fintech environment where regulatory credibility is a prerequisite for capital access — not an afterthought. The numbers tell a complicated story, but the direction of travel is clear. The most sophisticated private investors across the Gulf and Southeast Asia are already repositioning toward platforms building Sharia-compliant, data-driven, institutionally structured businesses — not consumer apps wearing fintech branding. The era of regulatory arbitrage in consumer credit is closing. What replaces it will be more durable, more defensible, and considerably more interesting to the patient capital that has always defined this region at its best.