October 23, 2026 · Jurisdiction Briefing

Qatar’s BNPL Regulation: the KYC, AML and fraud duties of a Buy-Now-Pay-Later provider

Buy-Now-Pay-Later is usually discussed in Qatar as a consumer credit product: caps on borrowing, credit bureau checks, late fees. All of that is in the Qatar Central Bank's Buy-Now-Pay-Later Regulation. But the same text also makes a BNPL provider a fully…

Buy-Now-Pay-Later is usually discussed in Qatar as a consumer credit product: caps on borrowing, credit bureau checks, late fees. All of that is in the Qatar Central Bank’s Buy-Now-Pay-Later Regulation. But the same text also makes a BNPL provider a fully fledged AML/CFT subject, with its own MLRO, a ban on dealing with listed individuals, identification before any credit is given, fraud reporting to the QCB and a 15-year record-keeping rule. This briefing pulls those duties out of the credit rules so a compliance officer can see them in one place.

The regulation carries the short title “BNPL Regulation” for 2023 and states that it enters into force as of 6 August 2023. Its subtitle is “Licensing and Regulating BNPL Providers”. No entity may offer a BNPL product or service without a prior licence from the QCB.

Who it reaches, and who it does not

The regulation applies to any person providing a BNPL product or service in Qatar. A product falls in scope only if it meets all of the following criteria:

it is provided to an individual customer to buy products or services from Qatar or non-Qatar based merchants;
it is an interest free short term credit facility, with payments split into instalments spread over 12 months or less, with or without a fixed service charge;
the provider takes the complete credit risk; and
it is unsecured.

It does not matter whether the product is offered at checkout or as an upfront credit limit, or whether it sits on a merchant’s store or on the provider’s own platform aggregating several merchants. BNPL credit can only be disbursed to individuals who are residents of Qatar and aged 18 years or above.

Two scope points matter for group structures. First, the regulation applies to any BNPL provider operating in Qatar irrespective of whether its commercial registration was issued by the Ministry of Commerce and Industry, the Qatar Financial Centre, the Qatar Science and Technology Park, or any other free zone authority or commercial licensing entity. Second, it does not apply to banks and finance companies licensed by the QCB.

In my reading, the first point is the one to flag internally: a QFC- or QSTP-registered company offering BNPL in Qatar should not assume its free zone registration takes it outside the QCB’s licensing regime.

Prohibited from the start: listed individuals, cash, prohibited transactions

Section 5, headed Prohibited Activities, contains the regulation’s first financial crime rule. A BNPL provider is prohibited from dealing with any listed individuals as mentioned in QCB’s instructions on screening of an individual, in line with the provisions of the Anti-Money Laundering and Combating Terrorism Financing Instructions for Financial Institutions issued by the QCB in May 2020 and any amendments to them.

The same section also prohibits a provider from providing cash to customers and from facilitating any transactions that are prohibited by the QCB.

The screening rule is not restated in detail; it points back to the QCB’s screening instructions and the May 2020 AML/CFT instructions. Those are the documents that define what “listed” means and how screening is done.

Identify and verify before the first instalment plan

The customer identification duty sits inside section 14, on creditworthiness and suitability assessments, rather than in a separate KYC chapter. Section 14.1.6 says:

> “Prior to providing a Customer with a BNPL Product or Service, the Customer > shall be identified and verified in accordance with the provisions of Law no. > (20) Of 2019 on Combating Money Laundering and Terrorism Financing”

The provision continues with Law No. (27) of 2019 on Combating Terrorism, the AML/CFT instructions issued in May 2020, and any other relevant guidance issued by the QCB.

The same section allows credit decisioning rules that vary with the transaction amount: reduced assessment levels may be carried out for low value transactions, with assessment levels increasing for higher values. That flexibility is written for credit assessment. Section 14.1.6 sets no transaction amount below which identification and verification may be skipped.

The credit side adds data a compliance team can use. The provider must become a registered member of the Qatar Credit Bureau, and where the transaction amount is more than QAR 4,000 it must perform credit checks with the bureau before providing the product. It must periodically report all lending transaction information to the bureau, including customer profile and QID (Qatar ID) information. The maximum credit at any point in time is QAR 25,000 per customer across all BNPL providers.

The AML/CFT framework applies in full

Section 25, Compliance with Secondary Regulations, names the instruments a provider must comply with “along with this regulation”, and any subsequent amendments. Under the heading Know Your Customer, Anti-Money Laundering, Combating Financing of Terrorism and Financing of Weapons of Mass Destruction Proliferation, it lists:

the provisions of Law No. (20) of 2019 on Combating Money Laundering and Terrorism Financing;
the instructions related to AML/CFT issued in May 2020, QCB guidelines; and
any other circulations issued by the controllers and law enforcement bodies in Qatar.

Where a provider onboards customers digitally, it must comply with the security principles for e-KYC issued by the QCB. At licensing, the applicant must disclose its e-KYC policies and procedures and details of the customer onboarding process.

As with the Payment Services Regulation covered in part 21, the BNPL Regulation does not restate the reporting of suspicion. For when and how to report, look to the law and instructions that section 25 names.

Governance: an MLRO, a framework and fit and proper owners

Named roles. An applicant must appoint, as critical personnel, a CEO, a Chief Financial Officer, a Chief Risk Officer, a Head of Compliance, an Anti-Money Laundering Officer (MLRO), and a Sharia Advisor if Islamic products are offered. Key management personnel responsible for managing the conduct of the provider must be residents in Qatar.

Fit and proper. Board members, major shareholders (those holding 5% or more of the shares) and key management personnel are deemed fit and proper if, among other things, they have a record of fairness and integrity, have not been convicted for any offence involving moral turpitude, and have not been prohibited or debarred from accessing or dealing in any financial system by any regulatory authority. A fit and proper form is submitted for all board members and staff.

The written framework. The internal governance arrangements must, as a minimum, include a statement of the security policy with a detailed risk assessment of the BNPL service that includes risks of fraud and exposure to sensitive personal data. They must also include a general framework of AML/CFT: the AML/CFT and proliferation financing guidelines, the mechanism applied for a risk-based methodology, and the systems to be applied to control money laundering and terrorist financing.

The licence file. The application must include an analysis of operating risks and the precautions to mitigate them. The risks listed include fraud risk and financial crimes risks, alongside credit default, liquidity, technology, cybersecurity and settlement risk. Policy documents submitted at licensing cannot be changed without the QCB’s prior approval.

Outsourcing: possible, but only with prior approval

A BNPL provider shall not outsource compliance, AML/CFT, financial control or core customer-facing business functions unless prior approval from QCB is taken. Support activities, processes and systems under those functions may be outsourced; the examples given are call centres, data processing, credit recoveries and cyber security. Strategic decision-making, and managing and bearing responsibility for the principal risks of those functions, must remain with the provider.

This is worth reading against the QCB’s Payment Services Regulation, which says in section 15.11 that the functions of Compliance and AML/CFT Department may not be outsourced, with no approval route. A group holding both licences has two different rules for the same function.

Merchants: monitoring rather than pre-approval

The BNPL Regulation does not copy the payment services rule that requires QCB approval for each new merchant. What it does require is that the provider review and monitor how merchants are using its BNPL product or service, and it may consider changing the way its services are sold if found unsuitable. Merchant promotion of BNPL is to be covered by contracts that specify the qualifying products, merchant fees, settlement period and each party’s rights and obligations. Settlement of funds to merchants must be carried out within 3 to 5 calendar days of the transaction, unless a specific settlement period has been contractually agreed.

Fraud, logs and 15-year records

Fraud reporting. Among the reports a provider must submit to the QCB, at the frequency the QCB instructs, are incidents of fraud that have occurred and a quarterly report on customer complaints and incidents. Any civil or criminal prosecution against the provider must be reported immediately.

Logs. A provider should maintain log files or audit trails for all BNPL credit transactions according to the relevant laws. On the technology side, it must enable logs on all systems to monitor security events, restrict access to those logs to prevent modification or deletion, and monitor their integrity continuously. All payment transactions must be executed in a secured manner after obtaining the appropriate authentication.

Retention. Electronic records, books, documents, statements and contract notes referred to in the regulation must be retained for at least 15 years from the end of the year to which they relate. Where records relate to legal disputes pending a court decision, they are kept until the court disposes of the case. Complaint records have their own rule: 15 years after the date the complaint was received.

What happens when it goes wrong

If the QCB has evidence that a provider committed a violation, it may issue a formal warning with a deadline to rectify, suspend operations (for longer on repeated violations, with a public announcement), and, on failure to rectify, cancel the approval and revoke the licence. A provider whose licence is cancelled cannot apply for a new one for a period the QCB sets.

The QCB can also call on the performance guarantee, which must be not less than 2% of the capital requirement or QAR 200,000, whichever is higher, where a provider does not pay a QCB penalty on time. And if a provider is found guilty of fraud, or is convicted of a criminal offence, the QCB shall cancel the licence and suspend operations without any prior notice, and the provider must immediately cease operating in Qatar.

Three things worth doing

Map section 14.1.6 into the onboarding flow. Put identification and verification ahead of the credit decision in the customer journey, and check that the “reduced assessment” path for low-value transactions changes only the credit steps, not the KYC steps.
Show where listed-person screening happens. Section 5.3 is a prohibition, not a monitoring duty. Be ready to show that a customer is screened before the first instalment plan is created, and against which list.
Check what sits with vendors. If any compliance or AML/CFT activity is done by a group company or a vendor, confirm whether the QCB’s prior approval was obtained, and document why what remains in-house covers the strategic decisions and principal risks.

Sources

This article draws on the following sources. Follow the links for the original text.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator qatar