Credit is no longer offered only by banks. Fintech lenders, buy-now-pay-later (BNPL) apps, retailers with in-house accounts, salary advance platforms and even businesses lending to their own customers all extend credit in some form. Many of them assume the National Credit Act does not apply to them, or that registration is only for large lenders. Both assumptions can be expensive.
The issue is topical. In 2026 the National Credit Regulator (NCR) set out its position on BNPL and directed providers to report consumer payment behaviour to credit bureaus from February 2027. That move signals closer scrutiny of products that have, until now, sat at the edge of credit regulation.
This article explains when a business must register as a credit provider, where BNPL fits, and what happens if you lend without registering.
What the National Credit Act covers
The National Credit Act 34 of 2005 (NCA) regulates credit agreements concluded or having effect in South Africa between parties dealing at arm’s length. A credit agreement is broader than a loan. It includes credit facilities (such as store accounts and overdrafts), credit transactions (such as instalment sales, mortgages and secured loans) and credit guarantees, where payment is deferred and a fee, charge or interest is levied.
There are important exclusions. The NCA does not apply where the consumer is a juristic person whose asset value or annual turnover meets the prescribed threshold (currently R1 million), and it does not apply where the parties are not dealing at arm’s length, for example some loans by a shareholder to their own company. Whether a particular product falls inside or outside the Act depends on its structure, not its label.
Who must register
Section 40 of the NCA requires a person to register as a credit provider if the total principal debt owed to them under credit agreements exceeds the threshold set by the Minister. Since 11 November 2016, that threshold has been nil. In practice, this means that anyone who extends credit under agreements to which the NCA applies must register, whether they have one agreement or thousands, and whatever the amounts involved.
This catches many businesses that do not think of themselves as lenders, including:
- fintech platforms offering personal loans, payday loans or cash advances to individuals;
- retailers and service providers offering instalment plans with interest or monthly fees;
- employers or third-party platforms offering salary advances on terms that include charges; and
- small businesses or individuals making private loans to consumers on commercial terms.
Registration is not a once-off formality. Registered credit providers must comply with conditions of registration, pay annual fees, submit statutory returns and compliance reports, conduct affordability assessments, follow the rules on disclosure and pre-agreement quotations, respect the prescribed caps on interest and fees, and deal with consumer complaints and debt review.
Where buy-now-pay-later fits
A typical BNPL product lets a consumer pay for goods in a few interest-free instalments, with fees charged only if a payment is missed. The NCA contains a category for exactly this kind of arrangement: an incidental credit agreement. Broadly, this is an account where goods or services are provided and a fee, charge or interest becomes payable only if the consumer does not pay on time.
As reported in 2026, the NCR’s view is that BNPL agreements are not credit agreements when they are concluded, but that they may become incidental credit agreements once default charges are levied. Only some provisions of the NCA apply to incidental credit, and a party to incidental credit agreements does not have to register as a credit provider.
That does not mean BNPL is unregulated. Points to watch include:
- Product design. If a BNPL product charges interest, service fees or initiation fees upfront or as part of the instalments, it may no longer be incidental credit, and full NCA compliance and registration may be required.
- Credit bureau reporting. Providers have been directed to report payment behaviour to credit bureaus from February 2027, through a process agreed with the bureaus and industry bodies. Systems, consumer notices and data-handling processes need to be ready.
- Other laws. The Consumer Protection Act 68 of 2008 and the Protection of Personal Information Act 4 of 2013 (POPIA) apply to BNPL marketing, terms and data processing.
The consequences of lending without registering
A credit agreement concluded by a credit provider who was required to be registered, but was not, is unlawful under the NCA. The provider cannot enforce the agreement. In National Credit Regulator v Opperman (2012), the Constitutional Court struck down the provision that also forced unregistered lenders to forfeit the money advanced. The result is that an unregistered lender may still claim back the capital through an unjustified enrichment claim, but loses the interest, fees and contractual protections it bargained for, and faces the cost and uncertainty of litigation.
The NCR can also investigate, refer matters to the National Consumer Tribunal and seek administrative fines. For a fintech business, an unlawful loan book can also derail a funding round or acquisition, because investors’ due diligence will look closely at regulatory status.
Practical steps for lenders and fintechs
- Map your products. List every way your business allows customers to pay later, and identify the fees, interest and charges on each.
- Classify each product. Decide whether it is a credit agreement, incidental credit or outside the NCA, and record the reasoning.
- Check your customers. Confirm whether your customers are individuals, small juristic persons or larger businesses, as this affects whether the NCA applies.
- Register before you lend. If registration is required, apply to the NCR and build its timeline into your launch plan.
- Build compliance into the product. Affordability assessments, disclosure, fee caps, collections and complaints handling should be designed in, not added later.
- Prepare for bureau reporting. BNPL providers should confirm their reporting obligations and update customer terms and privacy notices.
- Review regularly. Product changes, such as adding a monthly fee, can change the legal position overnight.
How O’Reilly Law can help
We advise fintechs, lenders and retailers on whether the National Credit Act applies to their products, assist with NCR registration, and draft credit agreements, BNPL terms and privacy notices. We also review existing loan books and product structures for compliance risk, and assist investors with regulatory due diligence on credit businesses.
Launching a lending or BNPL product? Contact us to confirm your regulatory position before you go live.
Related reading: Crypto asset service provider licences · Legal requirements for online stores
This article is general information and not legal advice. Correct as at October 2026.