Klarna
Global BNPL: pay in 3, pay later and financing in e-commerce
A provider that defers payment at the merchant checkout. And must sustain consumer credit and payments at once.
What CCD, PSD2/SCA, the GDPR and DORA ask of a BNPL, and how it can onboard more merchants without standing up a new technical department.
Technical case study
The insight of the case
In the same checkout sit credit and payments: affordability and pre-contract information alongside SCA, PSPs and fraud. Treating only one side leaves gaps that merchants and supervisors notice.
Globodain reading of Spain’s Ley 16/2011, RDL 19/2018 and Directive (EU) 2023/2225
The challenge
A dual perimeter, the same team and more merchants.
What this profile costs today
- Scoring, fraud and identity in milliseconds at checkout
- SCA and PSD2 flows without breaking merchant conversion
- Pre-contract information and collections aligned with CCD
- CCD2 ahead: tougher affordability and transparency duties
- Plugins and APIs per platform, without growing tech debt
- GDPR and, where it applies, DORA resilience on the same stack
Its market
BNPL in Spain, with a dense competitive set.
What public sources show about the sector and who competes at checkout.
20 Nov 2026
CCD2 application date in the EU; companies in the sector are preparing
EUR-Lex · Directive 2023/2225
11.6%
estimated annual growth of Spain’s BNPL market into 2025
BusinessWire · PayNXT360
SCA
strong customer authentication required of PSPs for e-payments (PSD2)
RDL 19/2018 art. 68
Companies in the sector
Scalapay
Short BNPL in 3 or 4 instalments; Spain as a priority market
Aplazame
Instalments at checkout; up to 36 months (WiZink group)
PayPal
Pay in 3 and instalments; communicating CCD2 readiness
Oney
3/4 split and longer plans depending on the merchant
SeQura
Spanish BNPL: checkout, instalments and a shopper app
The profile that combines its own scoring, merchant integrations and a credit–payments dual perimeter carries more technical surface than a generic instalment button.
What we propose
One technology partner for the BNPL dual stack.
A single interlocutor covers fraud, SCA, data, resilience and integrations so the team can serve more merchants.
Leadership
A single interlocutor
One conversation on credit, payments and risk instead of several vendors.
Product
Checkout without friction
SCA, scoring and plugins aligned so compliance does not kill conversion.
Technical team
Capacity that adds
Reinforcement in security, data and compliance, without replacing the team.
Expected impact
More merchants served with the same team.
What changes when fraud, SCA, data and compliance stop consuming the team.
- ×1.9
- merchants it can serve by the end of the period, versus staying without a partner
- −24 pts
- of technical time going back to product and merchants
- 6 → 1
- technical areas, a single interlocutor
Illustrative scenario, not a forecast. Index 100 = merchants it can serve at the start of the period. Assumption: freed time goes back to product and merchant onboarding.
How we would solve it
A continuous rhythm, not a project with an end date.
Each turn leaves evidence and sets the priority of the next.
- 01
Diagnosis
Checkout, scoring, SCA, data, plugins and infrastructure.
- 02
Audit
A report leadership, risk and product can read.
- 03
Implementation
We fix things alongside its team, without replacing it.
- 04
Vigilance
Early warning when CCD2, PSD or DORA move the roadmap.
Benefits and advantages
What this profile gains from the first quarter.
01
Checkout that complies and converts
SCA and credit aligned without lengthening the shopper’s payment.
02
CCD2 with less scramble
Technical evidence ready when the rules apply.
03
More merchants, same headcount
Integrations and risk stop being the bottleneck.
04
Data under control
Architecture and GDPR over scoring, collections and merchants.
05
One partner
One relationship covers fraud, payments, cloud and watch.
06
Team focused on product
Technical time goes back to plans, the app and verticals.
Three ways to cover it
| In-house hire | Several vendors | Globodain as partner | |
|---|---|---|---|
| Time to start | Months of hiring | Weeks per vendor | From the diagnosis |
| Interlocutors | One, with gaps | One per area | One, for everything |
| Cost | Fixed and high | Scattered | Predictable |
| Credit + payments view | Depends on the hire | Fragmented | Complete |
| Evidence for audit | To be built | Separately | In one report |
Why Globodain
Capabilities that apply to a BNPL with a dual perimeter.
01
Cybersecurity
Security and access on checkout, scoring and collections data.
02
Technical audit
Data, CI/CD, plugins, PSPs, infrastructure and code.
03
Compliance
A technical reading of CCD, PSD2, GDPR and DORA on its stack.
04
Cloud and DevOps
Infrastructure ready for more merchants without tech debt.
05
Integrations
APIs, plugins and PSPs connected securely and operably.
06
Vigilance
Early warning of regulatory changes that hit the BNPL.
Scope note: the mention of regulated environments describes applicable capabilities, not an accredited track record in deferred payments.
Scope and limits
So it is clear from day one.
What we bring
- Technical audit, implementation and continuous vigilance
- A report with findings and priorities
- A stable interlocutor, not a one-off vendor
What we do not do
- We do not certify regulatory compliance
- We do not issue certificates or seals to third parties
- We do not replace legal advice: we complement it
Certifications and legal advice belong to authorised third parties. We provide technology support: audit, implementation and vigilance.
Does your case look like this profile? Let's analyse it.
This study was built from public sources on the sector. If yours looks similar, Rubén Ayuso will analyse it with you and prepare one for you.
Technical study prepared by Globodain Technology Corporation from public sources on the sector. It does not describe a specific company and was not prepared with one. The companies named are examples from the sector: this does not imply a commercial relationship or their participation. Not a contract: figures and scenarios are indicative.
