Daily FinTech Lesson — When a rule names your supplier, read it as if it named you.
Start with the mistake, because it is the common one. When a new regulation lands, the first question most operators ask is a binary: does this apply to me? If the rule names a category you do not belong to, the file closes. The instinct is efficient and, often, wrong — because regulation rarely respects the tidy line between the party it names and the parties whose systems it moves through.
The current worked example. From 15 July, Buy Now, Pay Later becomes regulated deferred payment credit, and the obligation to authorise, assess affordability and disclose sits with the lender. A retailer offering BNPL at checkout is expressly outside that perimeter. By the binary test, the retailer is done: not named, not regulated, next item. Yet the lender’s mandatory disclosures have to appear somewhere, and the somewhere is the retailer’s checkout. The retailer’s own customer journey now has to carry information it did not write, to a standard it does not set, with consumer-law consequences if the combined result misleads. The rule named the lender. The work landed on the merchant.
Why the binary test fails. It measures the wrong thing. Regulation attaches liability to a party, but it operates through a journey — the sequence of screens, scripts, terminals and hand-offs a customer actually moves through. Whoever owns a step in that journey inherits a share of the obligation, whether or not the rule addresses them by name. The exemption you were granted is an exemption from authorisation. It is almost never an exemption from the journey.
The better test, and how to run it. Replace “does this name me?” with “which parts of the affected customer journey do I own?” Take the new rule and trace the end-to-end path it governs. At each step, ask who controls the screen, the script, the document, the refund. Everywhere the answer is “I do”, you have inherited an obligation, regardless of where the perimeter line sits. This turns a compliance question into an operational map — and an operational map is something a finance or operations lead can actually cost, staff and schedule. It also surfaces the second-order exposure the binary test hides entirely: the general law that keeps applying to your part of the journey even after the specialist regime has excused you from the rest.
The move to build in permanently. Whenever a regulation targets a partner, supplier or platform you depend on, do not file it under theirs. Pull the customer journey, mark the surfaces you control, and treat every one of them as in scope until proven otherwise. The party a rule names is rarely the only party a rule reaches.
And the principle it leaves you with. Rules are written against entities; risk travels along processes. The two do not line up, and the gap between them is where unpriced obligations accumulate — quietly, on the desks of people who assumed the exemption was the end of the matter rather than the beginning of a narrower one. The operators who stay ahead are not the ones who read regulation to find out whether they are named. They are the ones who read it to find out where, in the journey they already own, the work has just moved.
