A cross-market guide for merchants

On 20 November 2026, the playing field for e-commerce will change permanently. The EU’s second Consumer Credit Directive (CCD2) starts to apply, and each EU member state is writing it into national law. If you offer invoice, instalment or “buy now, pay later” (BNPL) options at checkout, this is not a dry compliance exercise, it changes checkout economics, margins and your own regulatory exposure.

For merchants, this is not a dry legal compliance check. It is an executive business challenge that directly impacts checkout economics, net profit margins and liability.

The good news for merchants selling across several of our markets: the core change is the same almost everywhere. This guide explains that shared story first, then the handful of places where a specific country goes further. Where we can, we speak generally; where a market differs, we say so plainly.

The one shift that matters everywhere

CCD2 pulls BNPL into the regulated world and with it the merchant who offers that credit and is paid for doing so. If a creditor pays you to present its credit at checkout, a commission, a revenue share or a “kickback”, you can become a regulated credit intermediary. The payment need not be cash: a rebate, a bonus, or a discounted processing fee could count too. If you simply accept a payment method in your checkout without being paid to present a credit, you are generally not caught.

For any merchant, the analysis is a short chain of three questions:

1. Am I a credit intermediary? In other words, am I paid to offer a creditor’s credit at checkout?
2. If yes, am I small enough to be exempt? Most markets leave small businesses that arrange credit only as a side activity outside the licensing net. However, you still need to follow certain conduct rules.
3. If not exempt, what authorisation do I need, by when, and from whom? This is where the markets differ, mostly on timing and on who issues the licence.

Two shifts for your checkout economics

1.  Revenue and conversion impact

Under CCD2, credit assessments must be more comprehensive and are carried out in the consumer's interest. Crucially, CCD2 also widens the net: it narrows the old exemptions for short-term and small-value credit, so much of the BNPL and installment credit that previously escaped regulation is now in scope and subject to these assessments. Genuinely interest-free invoices repaid within a short window (broadly up to 50 days, or 14 days for larger distance sellers) remain carved out.

Stricter credit checks will naturally result in lower credit approval rates. This strikes directly at checkout conversion within credit-based payment methods, while simultaneously eroding secondary revenue streams, such as revenue share agreements, installment conversions, late fee margins and payment reminders.

At the same time, the economics of credit kickbacks and subsidised fees come under scrutiny. In several markets they are restricted in form, or must be disclosed to the shopper, that is, merchants must disclose to the shopper what revenue the merchant receives from the creditor for the shopper using the creditor’s payment method

2.  Legal liability and credit intermediation

The second critical issue is corporate liability. A merchant that actively offers, highlights or promotes credit-based payments in the checkout can be classified as a credit intermediary under the new legal framework. 

This classification is influenced by company size and whether the merchant receives compensation, commission, revenue share or subsidized payment flows tied to consumer credit. 

Enterprise merchants, companies that meet the EU enterprise threshold (250+ employees, OR >€50 million turnover or >€43 million balance sheet) face direct authorization and/or registration requirements from their relevant supervisory authority. Above that line, you are likely in scope where you offer credit in your checkout and receive remuneration for this.. This carries operational burdens, formal reporting requirements and potential personal liability for management and board members depending on the region you are operating in.

What is the same across all markets

Before the differences, it is worth seeing how much is shared, because for most merchants the shared rules are the whole story:

• The same trigger: being paid to offer a third party’s credit is what turns a merchant into a credit intermediary, everywhere.
• The same date: in the EU markets the rules apply from 20 November 2026 (excluding Norway).
• The same small-business logic: an “ancillary SME” exemption (broadly the 250-staff / €50m / €43m test above, for credit offered only as a sideline) lifts the licensing duty in the EU markets. (Austria is the current exception, see below).
• The same baseline conduct rules: which come from CCD2 and therefore apply in every EU market, so they are not points of difference: a mandatory advertising warning that credit costs money, and  a ban on inferring consent through pre-ticked boxes.

Where the markets differ

The differences are modest, and mostly about timing and one or two national add-ons. The table gives the at-a-glance picture; the notes below draw out what matters.

The Nordics look most alike

Sweden, Finland and Denmark implement CCD2 in much the same way, a registration or licence for larger intermediaries, and an exemption for small ones that offer credit only as a sideline. The main difference is timing: Finland and Denmark are slightly ahead of Sweden. Finland’s early-registration window has already closed and Denmark requires registration by 20 November 2026 with no grace period, whereas Sweden gives existing firms until 20 November 2027.

Germany goes further on disclosure

Germany’s stand-out rule is transparency to the shopper: a German merchant acting as an intermediary must disclose the amount of commission it earns from the creditor, something no other market here requires. Authorisation is a trade licence with a competence exam, granted by the local Chamber of Commerce rather than the financial regulator.

The Netherlands is still a moving target

No Dutch law has been adopted yet, so the details can still change. Two things stand out in the bill: an absolute ban on offering BNPL to anyone under 18 (which a parent’s consent cannot cure), and a rule on the form of the commission, only the creditor may pay it (never the consumer), and it must be an ongoing commission rather than a one-off per-sale fee.

Austria is the strictest on small merchants for now

Austria has enacted the consumer-protection rules but not yet the exemption that would spare small merchants. That means even a small Austrian shop that takes a kickback currently needs the full trade licence, the kind of small-business exemption merchants in other countries can rely on is not in force there yet. A later amendment is expected to add one, but it is not law today.

Norway sits outside all of this

As an EEA  (not EU) country, CCD2 does not apply in Norway, and we have seen no change driven by it. That is not the same as “no rules”: Norway is already strict on affordable lending (hard limits on how much a consumer can borrow relative to income), and since March 2025 its consumer regulator has treated BNPL as credit, expecting proper affordability checks and credit-marketing compliance.

Your readiness check

To determine your business exposure ahead of CCD2, your management team should evaluate four core questions:

1. Are you crossing the enterprise threshold?
   
   1. Do you have 250+ employees, >€50M turnover or >€43M balance sheet total? 
   2. Do you actively offer, highlight, or market credit options in your store? 

If yes, your business may require licensing and supervision from Finansinspektionen.

2. Are you receiving credit kickbacks?
   
   1. Do you receive revenue share, commissions or volume bonuses on credit orders?
   2. Are your transaction fees subsidized because credit returns finance your payment flow?

If yes, your net margins face immediate pressure as regulatory caps take effect.

3. Can your checkout convert without credit?
   
   1. Can your checkout optimize sales across non-credit payment methods?
   2. Can you steer shoppers to alternative payment options if credit is declined?

If not, your overall conversion rate will take a hit as credit approval rates drop.

4. Which markets do you sell into?  

The core rules are shared, but give a second look to Germany (you must disclose your commission amount), the Netherlands (still a bill; under-18 ban; commission-form rule), Austria (no small-merchant exemption yet) and Norway (outside CCD2, but already strict).

Where Kustom fits

Kustom is an independent checkout orchestrator. We do not issue credit, and our business model is not built on downstream debt revenue or kickbacks. Under CCD2 that matters in three practical ways:

• No kickback, no trap.  Because we do not pay you to push credit, using Kustom does not, by itself, drag you into the “credit intermediary” classification that a lender kickback creates.
• Built to convert without forcing credit.  Our checkout is designed to show a strong non-credit path first and never pre-select credit, the exact conduct CCD2 is steering the market toward.
• Transparent economics.  There is no hidden commission baked into the flow to disclose or restructure, which is precisely what markets like Germany and the Netherlands are now policing.

A fair caveat: using Kustom does not remove obligations you take on separately, for example if you receive credit kickbacks from a lender, or cross a size threshold in a given market. But it removes a large source of the risk, and it puts your checkout on the right side of where CCD2 is heading.

Want to understand how CCD2 affects your checkout?

Talk to us, we will walk through your markets, your payment mix and where you stand. No friction. All conversion.