NY DFS Unveils Proposed BNPL Regulations

On July 15, the New York Department of Financial Services (DFS) published proposed regulations that would establish a comprehensive licensing and regulatory framework for buy now, pay later (BNPL) lending in New York. The Proposed Rules follow—and make several significant changes to—the draft regulations DFS released for informal comment in February 2026.

The proposal comes as federal oversight of BNPL products has receded following the CFPB's withdrawal of its 2024 interpretive rule treating certain BNPL products as credit cards under Regulation Z. New York's approach would impose a broad state regulatory regime that combines licensing requirements with substantive obligations concerning underwriting, disclosures, fees, disputes, unauthorized transactions, data use, customer service, and other aspects of BNPL products.

The Proposed Rules implement BNPL legislation enacted as part of New York's Fiscal Year 2026 budget. Comments are due September 14, 2026. Once adopted, the regulations would become effective after 180 days, with a transition process for existing providers.

What Changed Since February?

Notably, the formal proposal differs in several respects from the February pre-proposal draft. Market participants that analyzed the February draft should therefore review the July proposal independently, rather than assume that the requirements remain unchanged. Key changes include:

• Mortgage loans are excluded from the definition of "BNPL loan."[1]
• Delivery of a notice of the due date for a payment at least seven days (but not more than one statement cycle) before the due date is required before lenders may consider the payment late and before they may impose a late payment fee.
• BNPL lenders must provide consumers with a reasonably accessible interface through which a consumer can make payments on their outstanding BNPL loans with that lender, and which: (1) allows the consumer to allocate their payments; (2) allows the consumer to prepay any amount of their BNPL loans; and (3) discloses certain information with respect to each of the consumer's outstanding BNPL loans.
• Unallocated payments are applied to due and payable principal, then to due and payable interest, then to due and payable fees, and finally to any other principal.
• Periodic statements are now limited to including BNPL loans between a BNPL lender and a consumer for which the consumer has a debit or credit balance of more than $0 or on which a finance charge has been imposed, and any BNPL loans payable in one installment made between a BNPL lender and the consumer, during the statement cycle.

Scope of the Proposed Rules

The Proposed Rules would apply to persons that offer BNPL loans to consumers in New York, subject to certain exemptions discussed below. A BNPL loan generally includes closed-end credit provided to a consumer in connection with the purchase of goods or services, where the consumer is required to repay the credit in four or more installments. The definition encompasses both interest-free and interest-bearing products, although the Proposed Rules establish separate category permissions for each. Certain transactions, including specified motor vehicle financing arrangements and isolated, incidental, or occasional transactions, are excluded from the regulatory framework.

The Proposed Rules also address "payment delay transactions," generally encompassing arrangements under which a BNPL lender permits a consumer to defer or modify a scheduled payment.[2] These provisions impose separate requirements governing the circumstances in which a lender may offer such an arrangement and any associated charges. Accordingly, BNPL providers should consider not only whether their core financing products fall within the definition of a BNPL loan, but also whether servicing features such as payment extensions, rescheduling, or other payment accommodations trigger additional requirements under the Proposed Rules.

The scope provisions warrant particular attention for bank partnerships and other multi-party BNPL programs. Companies should assess the regulatory status of each participant in the program structure, rather than assume that only the entity formally extending the credit is subject to the Proposed Rules.

Licensing

The authorization required to offer BNPL loans in New York would depend on the nature of the provider. Certain federally regulated financial institutions qualify as "Exempt Organizations" and are not subject to the Proposed Rules.[3]

Certain entities already regulated under the New York Banking Law, including New York banking organizations and licensed lenders, may obtain category permission to operate as "authorized BNPL lenders" without obtaining a separate BNPL license.[4] Other covered providers generally must obtain a BNPL license.[5]

An authorized BNPL lender may obtain permission to offer one or more specified categories of BNPL loans. Authorized BNPL lenders may obtain category permission to offer interest-free BNPL loans, interest-bearing BNPL loans, or both.[6] Authorized BNPL lenders must clearly and conspicuously disclose their category permissions, name, and address on their consumer interfaces.[7]

Unless a person is an authorized BNPL lender or an exempt organization, it must obtain a license from DFS before it may offer BNPL loans in New York.[8] Licensees must clearly and conspicuously display specified license information on their consumer interfaces and include that information in their BNPL loan terms and conditions. A licensee also must obtain prior DFS approval before undergoing a change of control.

Regulatory Requirements

Beyond licensing, the Proposed Rules would impose extensive substantive requirements governing virtually every stage of the BNPL lifecycle, from underwriting and marketing through servicing, disputes, and collections. Several requirements could require significant changes to existing BNPL product design and operations.

Advertising and Marketing

The Proposed Rules establish content standards for BNPL loans requiring certain disclosures, such as requiring licensees to disclose that they are licensed to offer BNPL loans by DFS.[9] The Proposed Rules also generally prohibit BNPL lenders from making any false, misleading, or deceptive representations or omissions in advertising and marketing materials.[10] All BNPL lenders must maintain all advertising and marketing materials for a period of at least seven years from the date of their creation for review and examination.[11]

Interest, Charges, and Fees

BNPL lenders must comply with the following limitations on interest, charges, and fees:

• • Interest. A BNPL lender may not charge any interest on a BNPL loan in excess of 16% per year.[12]
  • Penalty fees. Penalty fees generally may not exceed $8 unless DFS approves a higher amount based on the lender's demonstrated costs. The Proposed Rules also: (1) prohibit multiple fees arising from a single event; (2) cap cumulative penalty fees; and (3) restrict late fees where the lender has not provided timely notice of the payment due date.[13]
  • Payment Practices. A BNPL lender may not impose a separate fee to allow the consumer to make a payment by a specific method, unless such payment method involves an expedited service by the BNPL lender's customer service representative.[14] A BNPL lender must, however, affirmatively provide consumers with a readily accessible interface, which displays certain information about the consumers' BNPL loans and allows consumers to allocate their payments or to prepay their loans.[15] Furthermore, a BNPL lender must permit a consumer to prepay any amount of their loan and cannot charge any additional amount for such prepayment.[16] If the consumer does not allocate their payments, then the regulations specify the order in which payments are to be allocated.[17]

Underwriting

A BNPL lender must: (1) perform "reasonable risk-based underwriting which includes, at a minimum, assessing a consumer's income and indebtedness" before providing a BNPL loan to a consumer; (2) maintain written policies and procedures for underwriting BNPL loans; (3) and disclose factors considered in the underwriting process in a clear and conspicuous manner to the consumer.[18] However, a BNPL lender cannot "use the credit worthiness, credit standing, or credit capacity of any member of the consumer's social network for purposes of determining the availability or price of credit that may be issued to the consumer."[19]

The express requirement to assess both income and indebtedness could be particularly consequential for traditional pay-in-four providers that rely on streamlined, transaction-level underwriting rather than conventional ability-to-repay analysis. Depending on how DFS interprets the requirement, providers may need to modify application flows, obtain additional consumer data, and recalibrate automated underwriting models.

Customer Disclosures

The Proposed Rules would establish a detailed disclosure regime spanning the entire BNPL transaction, including mandatory pre-transaction disclosures, post-transaction confirmations, and consolidated periodic statements covering all of a consumer's BNPL loans with the lender.[20] For electronic transactions, the required pre-transaction disclosures must be presented in a manner that the consumer cannot avoid before proceeding, and the consumer must affirmatively acknowledge receipt. The Proposed Rules also would require periodic statements that include all of a consumer's outstanding BNPL loans with the lender into a single statement. The Proposed Rules prescribe detailed requirements governing the timing, format, content, and language of these disclosures.

Data Privacy

The Proposed Rules require affirmative consumer consent before a BNPL lender uses or shares covered consumer data for purposes unrelated to making a particular BNPL loan. Provision of consent cannot be required as a condition of obtaining the loan or a related service, and consumers must be permitted to withdraw consent. Because consent is required for each specific secondary use of covered data, the Proposed Rules could require providers to reassess bundled consents and map individual data uses to separately disclosed consent purposes.

Refunds, Billing Disputes, and Unauthorized Transactions

A BNPL lender must: (1) conform with timing requirements for refunds and credits on a BNPL loan balance; (2) maintain written policies and procedures to provide refunds and credits that are "fair, transparent, and not unduly burdensome to the consumer"; (3) and disclose to consumers, in a clear and conspicuous manner, the process by which they can obtain refunds or credits for goods or services they have purchased in connection with a BNPL loan.[21]

The Proposed Rules establish detailed procedures and timing requirements for investigating and resolving billing errors and restrict certain collection activity while a dispute is pending. A lender that fails to comply with the prescribed procedures may forfeit its right to collect the disputed amount, subject to a $50 cap on the forfeiture. The Proposed Rules also limit consumer liability for unauthorized use.

Complaints and Customer Service

BNPL lenders must maintain written policies and procedures to fairly and timely resolve complaints and clearly and conspicuously provide disclosures related to the receipt of complaints.[22] Any change in the BNPL lender's complaint policies or procedures must be reported to the DFS superintendent within seven days.[23]

With respect to customer service, a BNPL lender must prominently display a toll-free telephone number through which a customer may contact the BNPL lender for customer service issues on any customer interface, which must be operative at least 10 hours per day, Monday through Friday, excluding federal holidays.[24] It must also display an e-mail address through which a customer may contact the BNPL lender for customer service issues on any customer interface.[25]

Finally, a BNPL lender must accept and respond to billing error notices, notices of unauthorized use, and requests for forbearance in English, Spanish, and "any language principally used in any advertisements of the BNPL lender in…New York."[26]

Capital Requirements

A licensee, but not an authorized BNPL lender, must "maintain at all times capital in an amount sufficient to ensure the solvency and financial integrity of a licensee and its ongoing operations…."[27] Such capital amount must be held in the form of a corporate surety bond, though "a licensee may elect to deposit assets in a depository that is acceptable to the superintendent" provided that it "shall execute with the depository a deposit agreement on a form obtained from the department or such other form as is satisfactory to the superintendent."[28]

Reports and Recordkeeping

Licensees would be subject to quarterly and annual financial reporting requirements, including annual audited financial statements, as well as additional reporting requirements prescribed by DFS. They also would be required to notify DFS of specified criminal and insolvency proceedings, designate personnel responsible for legal compliance, maintain policies and procedures concerning loan pricing, and provide DFS with certain third-party audit reports.

Authorized BNPL lenders would generally be subject to similar reporting requirements, although DFS may exempt them from requirements that duplicate reports otherwise submitted to DFS.

BNPL lenders would also be subject to extensive books-and-records requirements, including requirements to maintain records concerning loan applications, consumer accounts, payments, and the allocation of payments among principal, interest, fees, and other charges. Required records must be maintained in a manner that makes them readily accessible for DFS examination.

Additional Servicing and Conduct Requirements

The Proposed Rules also impose several additional conduct requirements, including the following:

• Multiple Loans. A consumer's violation of one BNPL loan agreement may not be a violation of any other existing BNPL loan agreement or subject the consumer to penalties under the terms of any other existing BNPL loan agreement.[29]
• Failed Payments. A BNPL lender may not collect any one amount due using a consumer's payment method without obtaining new and specific authorization for additional attempts.[30]
• Deceptive or Unfair Practices. The New York Banking Law prohibits a BNPL lender from engaging in any deceptive or unfair practice toward any person in connection with a BNPL loan.[31] The Proposed Rules clarify that a practice is "deceptive or unfair" if it would be deceptive or unfair under Section 349 of the New York General Business Law.[32]

Effective Date and Transition Period

The Proposed Rules are subject to a 60-day comment period ending September 14, 2026, and would take effect 180 days after adoption.[33] A provider already offering BNPL loans on the effective date would have 45 days to apply for the required license or category permission and, upon timely application, generally could continue operating on a provisional basis while DFS considers the application.[34] Interested parties may view the Proposed Rules and other proposed banking regulations and submit feedback on the DFS website here.

Takeaways

• An Emerging State Regulatory Patchwork. New York's proposal is part of a broader trend toward increased state scrutiny of BNPL products as the CFPB has retreated from its prior federal approach. States, however, are pursuing different regulatory models: some are adopting BNPL-specific requirements, while others are applying existing consumer-credit licensing laws or pursuing supervisory and enforcement inquiries. The resulting state-by-state patchwork could create significant compliance and operational burdens for providers operating nationally.
• Credit Card-Like Protections Without a Credit Card Regulatory Framework. The Proposed Rules would import many protections familiar from the Regulation Z credit card regime, including periodic statements, billing-error procedures, unauthorized-use protections, payment-allocation requirements, and refund rules. At the same time, they would impose requirements not generally applicable to credit cards, including specific underwriting, data-consent, multilingual disclosure, and customer-service obligations.
• Significant Operational Changes May Be Required. Compliance may require more than revisions to consumer disclosures and terms. Depending on their existing practices, BNPL providers may need to modify underwriting processes, application and payment flows, data-use consent mechanisms, periodic statement capabilities, dispute and refund procedures, and customer-service operations. Providers should begin assessing these requirements across their product and program structures while the rulemaking remains pending.
• Significant Implementation Questions Remain. Despite the proposal's prescriptive requirements, important questions remain concerning the scope of covered BNPL products and entities, the application of underwriting requirements to streamlined pay-in-four products, and how the disclosure and servicing requirements will operate across different product structures. These issues may be significant areas of focus during the comment period.

[1] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.1(f)(2) (proposed).

[2] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.1(p) (proposed).

[3] See N.Y. Comp. Codes. R. & Regs. tit. 3, §§ 423.1(l), 423.2(a) (proposed).

[4] See N.Y. Comp. Codes. R. & Regs. tit. 3, §§ 423.1(b), 423.2(a) (proposed).

[5] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.2(a) (proposed).

[6] See N.Y. Comp. Codes. R. & Regs. tit. 3, §§ 423.1(m), (n) (proposed).

[7] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.3(h) (proposed).

[8] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.2(a) (proposed).

[9] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.8(a) (proposed).

[10] See N.Y. Comp. Codes. R. & Regs. tit. 3, §§ 423.8(c), (e) (proposed).

[11] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.8(b) (proposed).

[12] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.9(a)(1) (proposed). The applicable interest rate is set in § 14-A of the New York Banking Law. See N.Y. Banking Law § 14-a.1.

[13] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.9(b)(2) (proposed).

[14] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.9(c)(1) (proposed).

[15] See N.Y. Comp. Codes. R. & Regs. tit. 3, §§ 423.9(c)(2)(i), (ii) (proposed).

[16] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.9(c)(2)(iii) (proposed).

[17] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.9(c)(3) (proposed).

[18] N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.12(b) (proposed).

[19] Id.

[20] See N.Y. Comp. Codes. R. & Regs. tit. 3, §§ 423.12(a) (proposed).

[21] N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.12(c) (proposed).

[22] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.13 (proposed).

[23] N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.13(c) (proposed).

[24] See N.Y. Comp. Codes. R. & Regs. tit. 3, §§ 423.12(f)(2)(i), (ii) (proposed).

[25] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.12(f)(1)(iii) (proposed).

[26] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.12(f)(1) (proposed).

[27] N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.10(a) (proposed).

[28] N.Y. Comp. Codes. R. & Regs. tit. 3, §§ 423.10(b), (c) (proposed).

[29] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.11(a) (proposed).

[30] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.11(b) (proposed).

[31] See N.Y. Banking Law § 774.2(b).

[32] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.11(c) (proposed).

[33] Proposed Regulations, Regulatory Activity – Banking Law, NY Dep't of Fin. Servs. (last updated July 15, 2026), https://www.dfs.ny.gov/industry_guidance/regulatory_activity/banking.

[34] See N.Y. Comp. Codes. R. & Regs. tit. 3, § 423.14 (proposed).