Overview
On February 23, 2026, the New York State Department of Financial Services (NYDFS) published a proposed regulation (the Proposed Regulation) implementing the state’s Buy Now, Pay Later (BNPL) Act, which was signed into law by Governor Kathy Hochul on May 9, 2025. The Proposed Regulation would require state-level licensing and oversight of BNPL providers and comes amid an ongoing policy debate about whether BNPL products should be treated more like credit cards and subject to credit-card-like compliance.
At the federal level, the Consumer Financial Protection Bureau (CFPB) addressed this issue in May 2024 via an interpretive rule, stating that certain BNPL products are covered by Regulation Z (CFPB Interpretive Rule), which the CFPB later withdrew in May 2025. Against that backdrop, New York is moving forward with a BNPL-specific regulatory framework that is tailored to products that, in several respects, is more prescriptive than the CFPB’s now-withdrawn interpretive approach. The Proposed Regulation particularly incorporates concepts reflected in the CFPB Interpretive Rule and would require licensing for BNPL lenders, impose fee caps, mandate consumer disclosures, include robust data privacy protections, and establish a dispute resolution procedure.
High-level takeaways
- Broad definitions: The Proposed Regulation broadly defines “BNPL lender,” “BNPL loan,” and “offer,” potentially capturing not only entities that make BNPL loans, but also entities that operate the platforms, software, and systems where consumers can obtain BNPL credit and entities to whom ownership of a BNPL loan is transferred.
- Licensing and supervision framework: The Proposed Regulation provides a first-ever licensing and supervision regime for BNPL products in New York.
- Credit-like compliance: The Proposed Regulation includes Truth in Lending Act (TILA)/Regulation Z-like requirements for disclosures, periodic statements, and dispute resolution.
- Prohibited fees: The Proposed Regulation prohibits excessive fees, such as convenience charges, and limits late fees and other types of penalty fees.
- Underwriting requirements: The Proposed Regulation requires “reasonable, risk-based” underwriting, including assessing a consumer’s income and indebtedness.
- Data privacy: The Proposed Regulation includes prohibitions regarding the use and sale of consumer data and requires consumer disclosures.
In Depth
Scope and coverage
The Proposed Regulation broadly defines key coverage terms, including “BNPL lender,” “BNPL loan,” and “offer.” As defined in the Proposed Regulation, a “BNPL lender” is a person who offers BNPL loans in New York, including a person who makes BNPL loans, and a person to whom ownership of a BNPL loan is transferred. For purposes of the definition of BNPL lender, “offer” includes extending credit directly to a consumer and operating a platform, software, or system with which a consumer interacts directly or indirectly where a substantial purpose of the consumer’s interaction is to obtain BNPL loans from third parties (which may be relevant for certain platform and bank-partner models). The definition also includes an exception for isolated, incidental, or occasional transactions. Importantly, federally chartered banking institutions and foreign banking corporations licensed by the Office of the Comptroller of the Currency (Exempt Organizations) that otherwise meet the definition of BNPL lender are exempted from the requirements of the Proposed Regulation.
A “BNPL loan” is closed-end credit provided to a consumer in connection with the consumer’s particular purchase of goods and/or services, excluding motor vehicles, and subject to specified exclusions (including certain seller-credit structures and credit extended other than for personal, family, or household use). This scope is broader than the CFPB Interpretive Rule, which stated that for purposes of that interpretive rule “BNPL” refers to a consumer loan for a retail transaction repaid in four (or fewer) interest-free installments with no finance charge.
Licensing, authorization, and supervision
The Proposed Regulation would establish two frameworks for BNPL lenders.
The first is the “Authorization Framework,” which requires New York-chartered banking organizations; foreign banking corporations licensed by NYDFS to transact business in New York or originate loans from a branch in New York; and lenders licensed under Article 9 of the Banking Law to obtain written authorization from NYDFS to offer BNPL loans (each such authorized lender is considered an “authorized BNPL lender”).
The second is the “Licensing Framework,” which requires a BNPL lender who is not otherwise an authorized BNPL lender to obtain a license with NYDFS. Licensed BNPL lenders also must post their license across consumer interfaces and in BNPL terms and conditions.
Authorized BNPL lenders and licensed BNPL lenders must have a category permission for the category of BNPL loans they offer (e.g., interest-free, interest-bearing, or both). Authorized BNPL lenders have an additional obligation to post that they are authorized and list their category permissions on the interfaces where their BNPL loans are offered or advertised.
The Proposed Regulation also includes ongoing supervisory hooks that go beyond the initial license, such as prior superintendent approval for a “change of control”; reporting of changes in principals, officers, or directors; and books-and-records expectations designed to make loan files readily accessible for NYDFS review/examination.
Finally, under the Proposed Regulation, entities already acting as BNPL lenders in New York will need to apply for a BNPL lender license within 45 days of the effective date to become a “provisional licensee,” pending NYDFS action.
Fee caps
In response to growing concerns that BNPL lenders were charging excessive or “junk fees,” the Proposed Regulation also fee caps, including limiting the interest rate that can be offered, limiting fees for violation of a BNPL loan agreement to $8, prohibiting charging multiple fees for a single event, and putting limitations on the solicitation of tips.
Disclosures
The Proposed Regulation requires both pre- and post-transaction disclosures and periodic statements. The disclosure requirements are very similar to the requirements for creditors under TILA/Regulation Z.
Underwriting
The Proposed Regulation also requires BNPL lenders to engage in reasonable risk-based underwriting, which must include, at a minimum, assessing a consumer’s income and indebtedness. The policies and procedures for underwriting BNPL loans shall be maintained in writing and disclose factors considered in the underwriting process.
Notably, the Proposed Regulation’s underwriting requirements for BNPL lenders go beyond any federal framework, as they are absent from both TILA and the CFPB Interpretive Rule. This shows that New York is not merely filling the void left by federal inaction but is staking out a more expansive vision of consumer protection in the BNPL space.
Refunds
When a retail seller agrees to issue a refund, the BNPL lender must make reasonable efforts to ensure the seller sends a credit statement to the BNPL lender within seven business days of that agreement. Once the BNPL lender receives the credit statement, they have three business days to apply the refund to the consumer’s account.
Dispute resolution procedure, billing errors, and unauthorized use
The Proposed Regulation also imposes new requirements for billing errors. Under the Proposed Regulation, consumers can submit a billing error notice and, while that dispute is pending, a BNPL provider may not attempt to collect any portion of any required payment, threaten to harm the person’s credit standing, or accelerate any part of the consumer’s indebtedness. The dispute resolution, billing errors, and unauthorized use sections broadly track TILA, including giving consumers a 60-day window from receipt of the first periodic statement with an error to submit a billing notice and limiting consumer liability for unauthorized use to $50.
Data privacy
For a BNPL lender to use, sell, or share covered data (other than in connection with making a particular BNPL loan to the consumer), affirmative, informed consent is needed for each specific use case. The BNPL lender must also disclose to the consumer what they intend to use the data for.
The right to use, sell, or share the data expires after one year and can be renewed. Consumers also maintain the right to withdraw consent.
The inclusion of robust data privacy protections in what is primarily a lending regulation is notably unusual but reflects the documented concerns about BNPL apps specifically. Research has found that BNPL apps collect an average of 14 data types concerning their users and share an average of five data types with third parties, including sensitive information. New York’s decision to embed these protections directly into a financial services regulation signals that regulators view data exploitation as an inherent risk of the BNPL business model.
Looking ahead
The Proposed Regulation signals that, even in the wake of the now-withdrawn CFPB Interpretive Rule, the broader regulatory direction has not disappeared. New York is moving forward with a BNPL-specific framework that, in several respects, reflects similar credit-like concepts and operationalizes them through a state licensing and supervision regime. The proposal would particularly treat BNPL more like a regulated consumer credit product by layering in credit card-style compliance expectations in areas such as disclosures, periodic-statement-type requirements, billing error and dispute processes, and refund/credit mechanics. For BNPL providers, merchants, and bank partners, the key takeaway is that BNPL compliance planning increasingly needs to account for state-by-state requirements, especially where program design, servicing workflows, fee practices, and data-use models could trigger New York-style expectations.
The Proposed Regulation is currently in the formal 60-day public comment period. We will continue to closely follow any developments.
If you have questions concerning this client alert or would like assistance in preparing and submitting a comment, please contact your regular McDermott Will & Schulte lawyer or one of the authors.