Buy now pay later rules — check checkout disclosure requirements

20 findings in a 31-line checkout template, 9 of them high, and all of them sitting in markup an EU storefront developer shipped without a second thought. One sentence does most of the damage: "Pay in 4 interest-free instalments." On 20 November 2026 that sentence stops being marketing copy and becomes credit advertising.

Directive (EU) 2023/2225, the second Consumer Credit Directive, applies from that date. It repeals Directive 2008/48/EC, the text every large language model learned consumer credit from. The repeal matters less than the two deletions that come with it. The old directive did not apply to credit below 200 euro, and it did not apply to credit granted free of interest and without any other charges. Buy-now-pay-later lived in the gap between those two exclusions. CCD2 closes it.

That is why a chatbot is the wrong place to ask. Put "does my pay-in-4 widget need an APR?" to a model and it reasons from 2008/48/EC, finds the interest-free carve-out, finds the 200-euro floor, and tells you a 62.25 euro instalment plan at 0% is out of scope.

What attaches instead is Article 8: standard information beside the offer, given by means of a representative example - borrowing rate, total amount of credit, APR, duration, number of instalments, total amount payable, and for a deferred payment the cash price of the goods. All of it clear, concise and prominent, carrying the words "Caution! Borrowing money costs money." Article 10 puts the Standard European Consumer Credit Information form in front of the shopper before they are bound. Article 26 keeps a 14-day right of withdrawal. Article 18 makes the creditworthiness assessment mandatory, which retires "no credit check, guaranteed approval" as a line of copy. Article 14 prohibits tying an add-on to the credit.

Every one of those duties lands on markup somebody wrote. So the check belongs in the editor, next to the markup, not in a slide deck.

BNPL Disclosure Lint is a VS Code extension with 22 rules over **/*.{html,htm,jsx,tsx,liquid}. Eleven are missing-disclosure rules and they are deliberately quiet: they only fire once the file actually offers credit, so a blog template never lights up. The engine looks for a pay-later context first - "buy now pay later", "pay in 3", "instalments", "deferred payment", "Klarna" - and only then asks where the APR went. The other eleven fire on a single line, because the line itself now says something wrong: a citation of 2008/48/EC, a 200-euro exemption, "not regulated as consumer credit", a pay-later radio that ships checked, an aria-hidden="true" wrapper around the representative example, an APR set in 9px.

The numbers in the first line are measured, not estimated. Two fixtures ship with the extension. _fixtures/clean.html is a compliant 39-line pay-in-3 block and returns 0 findings. _fixtures/dirty.html is 31 lines and returns 20: 9 high, 9 medium, 2 low. Run either one today, 17 September 2026, and the report closes with the countdown - 64 days to 20 November 2026.

The same file, ext/engine.js, is also the whole free web version. It has no editor dependency, so the 22 rules run in a browser on one page: paste markup, read findings, nothing leaves the tab.

Free finishes a file. Run CCD2: Check this file and every missing disclosure comes back named with its rule id and its Article - enough to fix and ship that template. The licence key moves along a different axis, scope and ownership: one pass over the whole storefront folder, and a dated evidence report with per-file findings and rule ids that stays in your audit file.