On July 15, 2026, the New York Department of Financial Services (NYDFS) issued a formal notice of proposed rulemaking to implement the New York Buy-Now-Pay-Later Act (BNPLA), enacted in May 2025. The first-of-its-kind legislation to regulate buy now, pay later (BNPL) products, the BNPLA will go into effect after the adoption of NYDFS regulations. The proposed rulemaking comes on the heels of a July 2025 request for information and a February 2026 draft pre-proposal comment period.
The proposed rule covers licensing and compliance requirements for BNPL providers, including license application requirements, capital requirements, fee restrictions, disclosure mandates, underwriting standards, dispute resolution and data privacy requirements.
Overview of the formal proposed rule
Who’s covered
As in the draft pre-proposal, the formal proposed regulation would apply to a “BNPL lender,” defined as any person who “offers” BNPL loans to residents of New York, including persons that make loans and persons to whom ownership of a BNPL loan is transferred. This definition, therefore, captures not just BNPL direct lenders but also technology intermediaries that operate platforms or systems through which consumers apply for a BNPL loan, which is subsequently sold to a creditor.
A “BNPL loan” means closed-end credit for a consumer’s specific purchase of goods or services (excluding motor vehicles, credit where the creditor is the seller, commercial-purpose credit and purchase money mortgage loans). The proposed rule adds the mortgage loan exclusion.
National banks, federal savings banks, federal credit unions and other federally regulated entities would be exempt from licensing but remain subject to other BNPLA provisions (exempt organizations).
Licensing and category permissions
All BNPL lenders other than an exempt organization would need to obtain a license from NYDFS. Each BNPL lender would also need to obtain a separate “category permission” for each product type it offers: interest-free BNPL loans and/or interest-bearing BNPL loans. Exempt organizations (i.e., banking law entities) would not be required to obtain a license but must obtain written authorization that sets forth their category permissions.
For existing lenders, any BNPL lender that is not an exempt organization or banking law entity would need to apply for a provisional license within 45 days of the effective date. Similarly, existing lenders would need to apply for applicable category permissions within 45 days of the effective date and would be deemed provisionally authorized to offer those categories pending a decision.
Interest rates and fee restrictions
The proposed rule would largely impose the same interest and fee restrictions as described in the pre-proposal:
- Interest cap. Interest may not exceed the 16% interest rate cap imposed by New York law. Interest includes but is not limited to:
- Any amount charged as a condition of making or originating a BNPL loan.
- Any amount charged for the making of an installment of a BNPL loan.
The proposed rule removes two examples of interest previously included in the pre-proposal: Any finance charge as defined in Regulation Z and any charge included as interest pursuant to statute notwithstanding its characterization as a fee.
- Penalty fee cap. Fees for loan agreement violations (e.g., late payments) are subject to an $8-per-incident safe harbor; fees above $8 require superintendent approval based on costs incurred and annual reevaluation. Aggregate penalty fees on any single loan may not exceed the original amount financed.
- No payment method fees. Lenders may not charge fees based on payment method, except for expedited service by a customer service representative.
- No prepayment penalties. No charges may be imposed for prepayment.
- Failed payment attempts. Lenders may make no more than two attempts to collect via the same payment method for any single due amount, absent new consumer authorization.
Note that the new proposed rule omits the prohibition on soliciting tips previously included in the pre-proposal and adds a requirement that the BNPL lender provide consumers with a reasonably accessible interface through which consumers can make payments on their outstanding BNPL loans.
Disclosures
Similar to the pre-proposal, the proposed rule would impose a Regulation Z-style disclosure framework for BNPL loans, including requirements typically associated with open-end credit products, including pre- and post-transaction disclosures and periodic statements.
Underwriting standards
Under the proposal, before extending a BNPL loan, lenders would need to perform “reasonable risk-based underwriting,” including at minimum an assessment of the consumer’s income and indebtedness. Lenders would need to maintain written underwriting policies and disclose the underwriting factors in a clear and conspicuous manner. Notably, as in the pre-proposal, lenders would not be permitted to use the creditworthiness of any member of a consumer’s social network to determine credit availability or pricing.
Refunds, dispute resolution and unauthorized use
The proposal would establish detailed consumer protection procedures, including:
- Refunds and credits. Sellers must transmit credit statements within seven business days of agreeing to a refund; lenders must credit the consumer’s account within three business days of receipt. Credit balances must be refunded within three business days.
- Billing error disputes. Consumers may submit billing error notices within 60 days of the relevant statement. Lenders must acknowledge receipt within 30 days and resolve disputes within two statement cycles (no later than 90 days). During a dispute, lenders may not collect the disputed amount, make adverse credit reports or accelerate indebtedness. Noncompliance results in forfeiture of the right to collect the disputed amount up to $50.
- Unauthorized use. Consumer liability is capped at the lesser of $50 or the amount obtained before notification, provided the lender has given adequate notice and conducted effective authentication.
Data privacy
Under the proposal, as previously described, BNPL lenders would need affirmative, informed consent to use, sell or share a consumer’s “covered data” – encompassing all nonpublic consumer information, transaction data, account data and consumer metadata – for purposes other than making a particular BNPL loan.
Advertising and marketing
Among other requirements, a lender advertising in New York would be required to include its name and the legend “Licensed to offer BNPL loans by the New York State Department of Financial Services” in all New York advertising. Lenders would also need to prominently display a toll-free telephone number on all consumer interfaces, operative at least 10 hours per day, Monday through Friday (excluding federal holidays), and an email address for customer service matters including billing errors and unauthorized use.
What’s next?
For BNPL lenders and the fintech platforms that support them, the proposal represents one of the most far-reaching state-level compliance undertakings to date. Entities may consider submitting comments ahead of the 60-day public comment period deadline, in particular in response to the significant compliance requirements that would be expected of BNPL lenders.