New York Unveils Sweeping Regulatory Framework for Buy-Now-Pay-Later Lenders

The New York State Department of Financial Services (DFS) has proposed regulations implementing the New York Buy-Now-Pay-Later (BNPL) Act, enacted in May 2025, to require BNPL lenders doing business in New York to obtain licensure and comply with prescriptive fee, disclosure, and underwriting requirements, and strong consumer protections. The Proposal builds on New York's view that BNPL has matured into a mainstream consumer credit product that warrants oversight similar in many respects to traditional consumer credit regulation. If adopted as proposed, the regulations would impose significant operational, compliance, and data-governance obligations on BNPL providers offering both interest-free and interest-bearing loans in New York. These regulations are similar in some respects to those applicable to credit cards under federal law, but potentially more onerous in that it would require unavoidable disclosures, underwriting of each transaction, and significant limitations on the collection and use of consumer data.

Initial comments on the Proposal are due March 5, 2026, but if the DFS elects to formally propose the regulations, as we expect, there will be a subsequent opportunity to submit comments.

The regulations would take effect 180 days after adoption, but existing BNPL lenders would have 45 days from the effective date to apply for a license and category permission, which would allow them to continue operating while their application is pending.

Key Takeaways

• Filling the CFPB's void: New York has sought to play a leading role in counterbalancing the deregulatory approach of the federal financial regulators since the start of the second Trump Administration. The Proposal imposes many of the same credit card issuer obligations the CFPB's Biden-era interpretive rule applied to certain BNPL loan products which was rescinded in May 2025.
• First-in-the-nation state licensing regime: The Proposal would establish a licensing framework specific to BNPL lenders, as set forth in the BNPL Act. The Proposal would both require those who make BNPL loans as well as platform operators and loan transferees to obtain a license. By doing business in New York and applying to become licensed, BNPL lenders would agree to be subject to supervision by the DFS.
• TILA-like open-end disclosures: The Proposal would impose disclosure and periodic statement requirements that are similar to open-end credit requirements found in subpart B of Regulation Z, which implements the federal Truth-in-Lending Act. BNPL lenders will need to map these requirements onto their products, which may not be a neat fit given the differences between closed-end BNPL products and open-end products subject to subpart B of Regulation Z.
• Expanded consumer protections: The Proposal would prescribe extensive credit-card-style consumer safeguards covering loan fees, underwriting factors, dispute resolution, and data privacy.
• New BNPL Unit: The DFS intends to establish a new BNPL Unit to process all license, authorization, and category permission applications.
• Open questions: The Proposal, like the BNPL Act, leaves many key questions unanswered, especially concerning the broad definition of "BNPL loan," alignment of disclosure and statement requirements with product structure, and underwriting transparency. Industry participants should consider submitting comments to the DFS seeking resolution to the gaps in the Proposal, particularly in areas of ambiguity or significant compliance challenges.

Scope and Covered Products

The Proposal would broadly define a covered "BNPL loan" as closed-end consumer credit tied to a particular purchase of goods or services, excluding motor vehicles, where the creditor is generally not the seller of the goods or services.

The Proposal applies to any person that offers BNPL loans to New York residents, including entities that make BNPL loans and entities that acquire BNPL loans after origination. The definition of "offer" is broad and captures platforms or software that facilitates BNPL loans where a "substantial purpose" of the consumer's interaction is to obtain BNPL credit even when those providers rely on bank partners to originate loans to their customers.

License vs. Authorization

The Proposal would establish a parallel licensure and authorization regime for BNPL lenders. All persons, except for "exempt organizations," as defined in the BNPL Act,[1] and "authorized BNPL lenders" would be required to obtain a license.

The Proposal would separately require banking organizations, as defined in section 2 of the Banking Law, foreign banking corporations licensed to transact business in New York or originating BNPL loans from a New York branch, and licensed lenders, other than "exempt organizations," to obtain written authorization from the DFS to offer BNPL loans, instead of a separate license. An authorized BNPL lender would be required to post clearly and conspicuously on any "platform, software, or system" over which it offers consumers or advertises BNPL loans that it is an authorized BNPL lender, its BNPL loan category permissions, and its name and address.

Category Permissions

The Proposal would require licensed and authorized BNPL lenders to also obtain "category permission" for each type of BNPL product they offer: interest-free BNPL loans, interest-bearing loans, or both.

The DFS would be permitted to revoke or suspend category permission under standards similar to those used for license enforcement.

Limits on Interest and Fees

• Interest: The Proposal would impose a 16% interest rate cap on BNPL loans inclusive of origination charges, finance charges as defined in Regulation Z, and charges characterized as fees but that function as interest.
• Penalty fees: The Proposal would cap penalty fees at $8. A lender would be able to impose a higher fee amount if specifically approved by DFS based on a showing that the higher fee represents a reasonable proportion of the total costs incurred by the lender as a result of the violation. Additionally, the Proposal would not permit a BNPL lender to impose penalty fees that exceed the dollar amount associated with the violation, multiple fees for a single event or transaction, and aggregate penalty fees that exceed the original amount financed. It would also prohibit late fees if the consumer did not receive a timely periodic statement.
• Convenience fees: The Proposal would prohibit BNPL lenders from imposing a fee to allow consumers to make payments via alternate means (e.g., mail, electronic, or telephonic payments), unless such method involves an expedited service by a customer service representative of the BNPL lender.
• Prepayment fees: The Proposal would prohibit BNPL lenders from charging a fee for prepayment of principal or interest.

Consumer Disclosures and Statements

The Proposal would create a detailed disclosure framework that borrows heavily from the requirements that apply to open-end credit under subpart B of Regulation Z:

• Pre-transaction disclosure: BNPL lenders would be required to furnish a disclosure to consumers before consummation of each loan that is "unavoidable" when the disclosure is presented electronically (i.e., could not be provided via a link that did not require the consumer to click on it). The disclosure would be required to include, as applicable, the BNPL lender's name, the amount financed, the finance charge, the annual percentage rate, the payment schedule, a description of and the amount of all fees, a statement on dispute and refund rights, and a description of protections against unauthorized use.
• Post-transaction confirmation: The Proposal would require BNPL lenders to mail or deliver a post-transaction confirmation within one business day following the consummation of the loan.
• Periodic statements: The Proposal would require BNPL lenders to mail or deliver a periodic statement for each billing cycle in which an account has a balance or a finance charge has been imposed. Statements would have to be sent at least 14 days before the payment due date for billing cycles of 30 days or more or at least seven days for shorter cycles.

Underwriting Requirements

Before extending a BNPL loan to a consumer, the Proposal would require BNPL lenders to perform "reasonable, risk-based underwriting," including assessment of income and indebtedness. The Proposal would require that lenders maintain written underwriting policies and procedures and disclose underwriting factors to consumers. BNPL lenders would also be prohibited from "using" the "credit worthiness, credit standing, or credit capacity of any member of the consumer's social network" in the underwriting process—the BNPL Act explains that this means "collect, evaluate, report, or maintain in the file on a borrower" such information.

Refunds, Billing Errors, and Unauthorized Use Protections

The Proposal imports many dispute and unauthorized use protections provided under federal law to consumers who use credit cards.

• Refunds: The Proposal would require BNPL lenders to make reasonable efforts to cause a retail seller to transmit a credit to the lender within seven business days of an agreement to provide a refund. The BNPL lender would then have three business days to credit the refund to the consumer's account.
• Billing errors: Consumers would be required to submit a billing error notice within 60 days of receiving a post-transaction confirmation or periodic statement that reflects the billing error. The BNPL lender would be required to acknowledge the notice within 30 days of receipt and resolve the dispute within the shorter of two billing cycles or 90 days. Until resolved, the Proposal would prohibit a BNPL lender from collection activities, making an adverse credit report, or accelerating the debt. If the consumer had enrolled in an automatic payment plan and submitted a dispute at least three days prior to a scheduled debit, the lender would be prohibited from deducting the disputed amount.
• Unauthorized use: The Proposal would limit the amount of consumer liability for unauthorized use of a BNPL loan to the lesser of $50 (including any down payment) or the amount of property or services obtained by the unauthorized use before notification to the BNPL lender.

Data Privacy and Use of Consumer Data

The Proposal would establish an extensive data governance framework that mimics many of the new state comprehensive consumer data privacy laws.

• BNPL lenders may use, sell, or share "covered data," other than in connection with the making of a particular BNPL loan to the consumer, only with the consumer's separate, informed, and affirmative consent for each specific use case signed by the consumer electronically or in writing. The Proposal would define "covered data" as "any non-public information of a consumer" and include any "personally identifiable information, transaction or account-level consumer information, and any consumer metadata collected or maintained." To keep using data, BNPL lenders would be required to obtain the consumer's renewed consent each year.
• The Proposal explains that "targeted advertising of non-requested products or services, determining individualized pricing of non-requested products or services, cross-selling of non-requested products or services, and the sale of covered data" would not be considered "in connection with the making of a particular BNPL loan."
• The Proposal would not allow BNPL lenders to make the consumer's consent a condition or requirement for obtaining a BNPL loan, set affirmative consent as the default option, present the options to provide consent or refuse consent with unequal prominence, prevent consumers from declining all requests for consent collectively, or provide the option to accept more than one request for consent at one time.
• BNPL lenders would be required to provide consumers with a method to withdraw consent that is as easy to access and operate as the initial consent method.
• Within 30 days of the expiration or withdrawal of a consumer's consent, the BNPL would be required to cease its use, sale, or sharing of the consumer's covered data and delete it, and cause any third party with whom it sold or shared the data to delete it.

Our Take

The Proposal operationalizes the regulatory framework created by the BNPL Act. However, the Proposal would not resolve many of the compliance concerns raised by the BNPL Act in the first instance. Given the structural differences between closed-end BNPL credit and open-end credit cards, the regulatory concepts that the CFPB (and the Federal Reserve before it) has refined over decades for credit cards are not necessarily easily applicable to closed-end BNPL credit products. For example, monthly statements make sense for open-end credit products because they establish consumer payment and dispute obligations. But, when closed-end loans have different repayment schedules, a monthly statement may cause consumer confusion.

How DFS addresses these issues before it finalizes the rulemaking, and ultimately through supervision and enforcement if it does not address them, will be critical to determining whether New York's first-in-the-nation BNPL regulatory regime promotes consistent consumer protection without unduly disrupting the BNPL industry.

+++

Eric Goldberg and Michael Treves have extensive experience spanning financial compliance, regulatory counsel, and enforcement matters, providing insights to help clients navigate complex challenges in the financial services sector. For more insights, contact Eric, Michael, or another member of Davis Wright Tremaine's Financial Services team or sign up for our alerts.