On February 23, 2026, the New York State Department of Financial Services (DFS) proposed new regulations to implement the Buy-Now-Pay-Later Act enacted in May of last year. If adopted, the proposed rule would regulate the activities of persons who originate, hold, and operate platforms for the provision of BNPL products (regardless of whether such products are interest-bearing). Specifically, the proposed rule would create a licensing and supervision regime for providers of BNPL products, impose fee limitations, mandate advertising and disclosure requirements, require the implementation of dispute processes, and impose robust privacy obligations. The proposed rule is subject to a 10-day preproposal comment period, which will be followed by a 60-day public comment period to commence upon publication of the proposed rule in the State Register. The final rule would take effect 180 days after adoption.
Rulemaking Authority
On May 9, 2025, Governor Hochul signed into law the BNPL Act, codified as New York Banking Law Article 14-B (the Act). The Act established the nation’s first comprehensive regulatory framework specifically designed for traditional “pay-in-four” interest-free BNPL loans and subjects all BNPL providers to oversight and supervision by the DFS. The Act directed the DFS to promulgate rules implementing the Act, and the DFS issued the proposed rule consistent with this directive.
The Act constitutes the first attempt to impose significant additional regulatory requirements on traditional pay-in-four interest-free BNPL products since the CFPB’s ill-fated interpretive rule, issued in May 2024, which asserted that such BNPL products are closed-end digital credit cards subject to certain provisions of TILA and Regulation Z regulating card issuers. Following a litigation challenge and the change in administration, the CFPB reversed course and formally rescinded the interpretive rule in May 2025.
It is broadly anticipated that additional states will follow New York’s lead in implementing standalone regulatory compliance requirements specific to the BNPL industry, given the absence of federal regulation.
Summary of the Proposed Rule
Scope and Definitions
The proposed rule applies to “BNPL loans” defined to mean “closed-end credit provided to a consumer in connection with such consumer’s particular purchase of goods and/or services, other than a motor vehicle.” The definition of “BNPL loans” excludes:
- Credit extended where the creditor is the seller of the goods or services being purchased, unless the credit is “pursuant to an agreement whereby, at a consumer’s request, the creditor purchases a specific good and/or service from a seller and resells such specific good and/or service to such consumer on closed-end credit”; and
- Credit extended other than for personal, family, or household use (e.g., commercial-purpose credit).
The definition of “BNPL loan” encompasses more than traditional no-interest “pay-in-four” BNPL products; it also covers traditional installment loans offered in connection with the purchase of goods or services. Reflecting this sweep, the proposed rule further defines two categories of BNPL loans:
- “Interest-free BNPL loan” means a BNPL loan that is not subject to interest charges.
- “Interest-bearing BNPL loan” means a BNPL loan that is subject to interest charges in accordance with the interest limitations set forth within the proposed rule.
The proposed rule is applicable to “BNPL lenders” defined to mean “a person who offers BNPL loans in this State, including (1) a person who makes BNPL loans, and (2) a person to whom ownership of a BNPL loan is transferred.” Offering BNPL loans includes not only extending credit directly to a consumer, but “operating a platform, software or system with which a consumer interacts directly or indirectly and a substantial purpose of the consumer’s interaction with such platform, software or system is to obtain buy-now-pay-later loans from third parties.” As a result, if implemented, the proposed rule will regulate the activities of fintechs operating in a traditional bank partnership model.
The proposed rule is expressly inapplicable to any “exempt organization” which is defined to include any “national bank, federal savings bank, federal savings and loan association, federal credit union, federal trust company, or foreign banking corporation licensed by the comptroller of the currency to transact business in” New York.
License Obligations
Any BNPL lender that is not otherwise exempt from the licensing requirement is required to obtain a license to offer BNPL loans in New York. Additionally, the license must specify which category of BNPL loans (interest-free, interest-bearing, or both) the BNPL lender is authorized to provide. The term “BNPL lender” is defined to mean “a person who offers BNPL loans in [New York], including (1) a person who makes BNPL loans, and (2) a person to whom ownership of a BNPL loan is transferred.” “Offering” BNPL loans includes both “extending credit directly to a consumer” and “operating a platform, software or system with which a consumer interacts directly or indirectly and a substantial purpose of the consumer’s interaction with such platform, software or system is to obtain buy-now-pay-later loans from third parties.”
Examination Authority, Recordkeeping and Reporting, and Complaints Management
Licensees will be subject to substantial oversight by the DFS including requirements relating to change of control, examinations, recordkeeping, reporting, and complaint handling. Key obligations set forth in the proposed rule include the following:
- Examinations and Recordkeeping Obligations. BNPL lenders must maintain required records in connection with each BNPL loan such that the records are readily accessible for review and examinations.
- Reporting Obligations. BNPL lenders must file quarterly unaudited financial statements with the DFS along with annual audited financial statements. Other quarterly and special reports may be required.
- Complaints-Management Obligations. BNPL lenders are required to (i) establish and maintain written policies and procedures to fairly and timely resolve complaints; (ii) disclose clearly and conspicuously — on all mobile applications, websites, and interfaces as well as in physical locations — the BNPL lender’s contact information and the right of customers to bring complaints to the attention of the DFS; and (iii) report any changes in their complaint policies or procedures to the DFS within seven days.
Marketing and Advertising
The proposed rule would subject licensees to advertising requirements and restrictions, including the following:
- A requirement to disclose the licensee’s licensed status in all advertising materials.
- A requirement to maintain advertising materials for a period of seven years for purposes of review and examination by DFS.
- A prohibition on false, misleading, or deceptive representations or omissions in marketing and advertising materials, including a specific prohibition on the use of terms such as “as low as” or “from” without prominently and contemporaneously disclosing meaningful information about the likelihood of obtaining the advertised credit terms.
- A requirement that any advertisement that states a periodic payment amount also include, equally prominently, the total of payments and time to repay.
Interest and Fee Limitations
With respect to interest-bearing BNPL loans, the proposed rule imposes limitations on interest, fees, and tips. Specifically:
- BNPL loans are subject to a 16% interest-rate limitation, consistent with New York’s general usury law.
- The proposed rule defines “interest” broadly to include all origination costs and finance charges.
- The proposed rule expressly permits the imposition of certain fees including a fee for violating the terms of the BNPL loan agreement not to exceed $8 or a greater amount approved by the DFS.
- The proposed rule also prohibits or substantially limits certain fees including: (i) fees related to method of payment (permitted in limited circumstances); (ii) fees for prepayment; and (iii) tips (which are permitted subject to specific disclosure requirements and restrictions).
Capital Requirements
The proposed rule requires licensees to maintain capital sufficient at all times to cover any outstanding consumer obligations, such as refunds. If the DFS determines that this minimum capital is inadequate based on factors including business volume, risk profile, and operational complexity, the licensee may be required to hold additional capital. Capital generally must be maintained through a corporate surety bond acceptable to the DFS. However, licensees may opt instead to deposit eligible assets in an approved depository under a formal deposit agreement, subject to DFS approval.
Practice Restrictions and Consumer Protection Obligations
The proposed rule sets forth specific practice restrictions and consumer protection obligations, which in some cases mirror those typically found in laws regulating consumer lending and payday lending. For instance, the proposed rule imposes the following requirements:
- Failed Payments: The proposed rule provides that a BNPL lender may not make more than two attempts to obtain a payment via the same payment method absent a new authorization from the consumer. This restriction appears to be modeled on restrictions imposed on certain loans under the CFPB’s payday lending rule.
- Disclosures: The proposed rule imposes disclosure requirements at three critical points in time: (i) pre-transaction; (ii) post-transaction; and (iii) periodic statements.
- Pre-Transaction Disclosures: The proposed rule imposes a pre-transaction disclosure requirement for which a model form will be provided. Information required to be included in the disclosure mirrors that required by the closed-end credit provisions of TILA/Regulation Z, and includes the identity of the creditor, amount financed, finance charge, itemization of finance charge, APR, payment schedule, total sale price, fees, default provisions, circumstances in which consumer reporting will occur, dispute rights, refund rights, impacts of unauthorized use, and a reference to the contract for further information. The proposed rule expressly states that all applicable information required to be disclosed under the Regulation Z closed-end credit disclosure provisions must be included — even though a traditional no-interest BNPL would be excluded from Regulation Z’s closed-end disclosures requirements, since it carries no finance charge and is payable in four or fewer installments.
- Post-Transaction Disclosures: Within one business day of consummation, the BNPL lender must mail or deliver a confirmation for each consummated transaction containing all pre-transaction disclosures, the identity of the consumer, and the identification of the transaction and retail seller.
- Periodic Statements: For each billing cycle, a BNPL lender must provide a periodic statement disclosing, for all outstanding BNPL loans with that consumer, the previous balance, identification of each BNPL transaction including the amount financed, transaction date, seller name, any credits during the cycle including amount and crediting date, each periodic interest rate expressed as an annual percentage rate, the balance on which interest is computed with an explanation of how that balance is determined, all interest charges itemized and totaled, all fees itemized and totaled, the telephone number and address for billing‑error notices including at least one digital submission method, the billing‑cycle closing date and new balance, the next due date and applicable late‑payment costs including any increased APRs, the consumer’s dispute rights, the consumer’s refund rights, and the consumer’s rights regarding unauthorized use. A billing cycle cannot be longer than monthly, but it can be shorter. The proposed rules would impose timing requirements that prevent loans from being treated as late for any purpose unless the relevant periodic statement was received at least 7 days prior (for billing cycles that are shorter than 30 days) or 14 days prior (for billing cycles that are 30 days or longer) to the date on which a payment is required.
- Underwriting: BNPL lenders are required to perform reasonable risk-based underwriting which includes, at a minimum, assessing a consumer’s income and indebtedness.
- Credits and Refunds: BNPL lenders must make reasonable efforts to obtain a retail seller’s credit statement within seven business days of the seller agreeing to a refund, must credit the consumer’s account within three business days of receiving that statement, must either refund any resulting credit balance within three business days or apply it to the consumer’s account upon request, must make good‑faith efforts to return any remaining credit balance older than six months, must maintain fair and transparent written refund‑and‑credit policies, and must clearly disclose to consumers how to obtain refunds or credits.
- Billing Errors: In the event of an alleged billing error, the proposed rule provides that a consumer may submit a billing‑error notice within 60 days of the BNPL Lender’s disclosure of the error, and the BNPL lender must acknowledge receipt within 30 days, resolve the issue within two billing cycles (no later than 90 days), maintain standardized error‑resolution procedures, and refrain from collections, adverse credit reporting, account restrictions, or accelerating debt related to the disputed amount while the investigation is pending. The timelines set forth in the proposed rule mirror the credit card dispute timelines set forth in Regulation Z.
- Unauthorized Use: Liability for unauthorized use is capped at the lesser of $50 or the value of goods or services obtained before the notification of unauthorized use, similar to the Regulation E limitation for unauthorized use reported within two business days.
- Data Privacy: BNPL lenders may use, sell, or share non‑public consumer data only with the consumer’s informed, written or electronic, one‑year‑limited, use‑case‑specific consent; must provide clear and conspicuous disclosures for each specific data use; must allow consumers to separately opt in or refuse each use or sale of data; must not condition BNPL credit on providing consent; must offer an easy, penalty‑free method for withdrawing consent; must cease and delete covered data (and ensure third‑party deletion) when consent expires or is withdrawn; and must maintain written policies and procedures governing all data‑handling practices.
- Language Requirements: A BNPL lender must accept and respond to billing error notices, notices of unauthorized use, and requests for forbearance completely and accurately in the English language, in the Spanish language, and in any language principally used in any advertisements of the BNPL lender in the State of New York.
Procedural Posture
The DFS is currently accepting input on the proposed rule during a short pre‑proposal outreach period that began February 23, 2026. The proposed rule is slated to be published in the State Register at the end of the 10-day pre-proposal outreach period, and once published will be subject to a 60-day public comment period. Once finalized, the rule will become effective 180 days after adoption. However, BNPL lenders operating prior to any final rule coming into effect will be provided with an additional 45 days from the effective date of the rule to come into compliance with all requirements, including applying for a license (note that the application must be submitted, but not approved, within the 45-day period and the applicant will be considered a provisional licensee until application approval or denial).
Next Steps
BNPL providers should closely review the proposed rule to evaluate its impact on their material business operations. Providers may consider submitting comment letters identifying any provisions that may be impractical, technologically burdensome, operationally disruptive, or otherwise require substantial changes to business practices. This is particularly important in light of the fact that the proposed rule may function as a blueprint for regulators in other states.
Given the policy posture reflected in the DFS’s announcement, it appears likely that the proposed rule will take effect without major revisions. As a result, BNPL providers should begin assessing compliance requirements and preparing internal systems, policies, and workflows to facilitate a smooth transition into the new compliance framework.