New York has taken a significant step toward comprehensive regulation of buy now, pay later (BNPL) by requiring licensure and disclosures designed for credit cards, even though BNPL transactions are closed end.
The New York Department of Financial Services (NYDFS) recently published proposed rules to implement legislation that establishes a licensing and supervision framework for entities that provide BNPL services. The first-of-its-kind legislation, signed by Gov. Kathy Hochul as a part of her FY26 budget, will go into effect after the adoption of NYDFS regulations.
Beyond setting forth the licensing requirement for BNPL providers, the comprehensive proposed regulations also set forth rules covering fees, disclosures, underwriting, dispute resolution, recordkeeping, advertising and marketing, and capital requirements.
Who and what is covered
Under the proposed rules, a “BNPL loan” is defined as closed-end credit provided to consumers in connection with a purchase of goods or services (excluding motor vehicles). The definition excludes credit extended directly by sellers, such as credit sales and retail installment contracts, and credit extended for commercial purposes.
A “BNPL lender” is any person that makes BNPL loans (i.e., companies that originate BNPL transactions), as well as persons that operate a platform, software or system with which a consumer interacts directly or indirectly where a substantial purpose of that interaction is to obtain BNPL loans (i.e., third parties that support or facilitate BNPL transactions). This expansive definition is designed to capture technology platforms and point-of-sale intermediaries that facilitate BNPL transactions but do not directly extend credit.
Licensing requirement and category permissions
Under the proposed regulations, no person – other than an exempt organization[1] or an authorized BNPL lender – may act as a BNPL lender without obtaining a license. Banking Law entities[2] – including banks and licensed lenders already supervised by NYDFS –must obtain written authorization from the superintendent to offer BNPL “loans” and be considered an “authorized BNPL lender.”
In addition, each BNPL lender must obtain a “category permission” for each type of BNPL product it offers: interest-free BNPL loans, interest-bearing BNPL loans or both. A BNPL license or authorization must specify which category of BNPL loans the BNPL lender has received approval to offer.
Fee limits
The regulations restrict the fees BNPL lenders can charge.
- Interest cap. A BNPL lender may not charge interest on any BNPL loan in excess of 16%. The definition of interest is broad and includes origination charges and finance charges as defined under Regulation Z.
- Late or penalty fees. The rules impose a safe harbor that allows fees of no more than $8 per late payment or other violation of the BNPL loan agreement terms. Any fee above this threshold must be approved and shown to represent a reasonable proportion of the lender’s costs.
- Aggregate cap. The aggregate dollar amount of all fees charged for violating the terms of a BNPL loan agreement, such as late fees, may not exceed the original amount financed.
- No convenience fees or prepayment penalties. A BNPL lender may not impose a separate fee to allow a consumer to make a payment by any particular method (e.g., mail, electronic or telephone payments), unless the payment method involves an expedited service by a customer service representative of the BNPL lender. Prepayment penalties are not permitted.
- No tips. A BNPL lender may not solicit a tip or other gratuitous payment unless, among other conditions, the lender clearly and conspicuously discloses at the time the payment is solicited that the payment is entirely voluntary, and the payment or nonpayment of any amount will not affect the terms and conditions upon which the BNPL lender offers BNPL loans.
Disclosure requirements
The regulations establish a disclosure framework modeled after Regulation Z, including certain requirements that are typically limited to open-end credit:
- Pre-transaction disclosures – Before consummation of each transaction, including the amount financed, finance charge, annual percentage rate (APR) and payment schedule.
- Post-transaction confirmations – Within one business day after the consummation of a transaction.
- Periodic statements – For each billing cycle at the end of which an account has a debit or credit balance of more than $0.00, or on which a finance charge has been imposed, tracking requirements applicable to open-end credit under Regulation Z.
Additionally, BNPL lenders must accurately translate required disclosures into Spanish and into any language principally used in any advertisements of the BNPL lender in New York.
Underwriting standards
Before providing a BNPL loan to a consumer, a BNPL lender must perform reasonable risk-based underwriting that includes, at a minimum, assessing a consumer’s income and indebtedness. A BNPL lender must maintain written policies and procedures for underwriting BNPL loans and must clearly disclose factors considered in the underwriting process. Notably, no BNPL lender may use the creditworthiness, credit standing or credit capacity of any member of the consumer’s social network to determine the availability or price of credit that may be issued to the consumer.
Dispute resolution
The regulations establish a comprehensive billing error dispute process. Consumers may submit a billing error notice within 60 days of receiving the relevant statement, and lenders must acknowledge receipt within 30 days and resolve the dispute within two complete billing cycles (but no later than 90 days). Consumer liability for unauthorized use of a BNPL loan is capped at the lesser of $50 or the amount obtained before the consumer notifies the lender. Each BNPL lender must also establish and maintain written policies and procedures to timely resolve complaints.
Data privacy
One of the most significant aspects of the new regulation is its data privacy framework. BNPL lenders may use, sell or share a consumer’s “covered data” – which encompasses all nonpublic consumer information – beyond what is needed to provide the loan itself only with the consumer’s affirmative, informed consent. Consent is effective for no longer than one year and must be renewed thereafter. Importantly, a lender may not condition the availability or terms of a BNPL loan on the consumer’s consent to data sharing. Consumers must be provided with an easy method to withdraw consent, and upon withdrawal or expiration, the lender must delete covered data within 30 days.
Timing and next steps
The proposed regulation is open to a preproposal comment period through March 5, 2026, followed by a 60-day public comment period upon publication in the State Register. The law and regulation will take effect 180 days after the rule is adopted. Existing BNPL lenders must apply for a license and any applicable category permissions within 45 days of the effective date to continue operating lawfully during the transitional period.
What this means
The proposed BNPL regulations are the latest example of New York’s efforts to further consumer protection, particularly given the reduced enforcement and supervisory efforts of the Consumer Financial Protection Bureau (CFPB) and other federal agencies. With federal BNPL regulation remaining unsettled – including the CFPB’s rescission of a Biden-era interpretive rule, which stated that providers of certain BNPL products were subject to specified Regulation Z requirements, including the disclosure and billing dispute provisions – state-level activity in the BNPL space is accelerating.
For BNPL lenders and fintech platforms, New York’s proposed regulations represent a significant compliance undertaking that may even exceed the compliance burden faced by closed-end consumer lenders. If enacted in their current form, the regulations could complicate – and perhaps stifle – BNPL providers’ ability to offer such products in New York. We expect to see significant pushback, and comment submissions, from industry participants regarding the proposed requirements.
That said, New York’s framework may serve as a template for other states seeking to regulate the product. New York’s approach, combining credit card-style disclosures with novel data privacy and fee restrictions, sets a high bar that practitioners and compliance teams across the US should monitor closely.
[1] “Exempt organizations” are national banks, federal savings banks, federal savings and loan associations, federal credit unions, federal trust companies and foreign banking corporations licensed by the Comptroller of the Currency to transact business in New York. N.Y. Banking Law § 736(5).
[2] “Banking Law entity” means any banking organization as defined in section 2 of the Banking Law, any foreign banking corporation licensed by the superintendent to transact business in this State [New York] under section 26 of the Banking Law or originating BNPL loans from a branch in this State subject to article V-C of the Banking Law, or any licensed lender licensed by the superintendent under article IX of the Banking Law, but does not include any exempt organization.