New York State Proposal Aimed At Reining In Buy Now, Pay Later Loans

New York has proposed “nation‑leading” regulations to bring buy now, pay later (BNPL) providers under a formal licensing, supervision, and consumer‑protection regime, implementing a BNPL statute enacted in the FY 2026 state budget.

Core structure of the proposal

• The rules implement Article 14‑B of the New York Banking Law, the state’s new “Buy‑Now‑Pay‑Later Act,” which was included in the FY 2025‑26 budget and whose effective date is tied to this rulemaking.

• DFS has issued a new proposed Part 423 of Title 3 of the NYCRR, covering both interest‑free “pay‑in‑4” style products and interest‑bearing BNPL installment loans offered to New York consumers.

• The proposal is in a pre‑proposal comment phase (10 days), to be followed by a 60‑day formal comment period once published in the State Register; the law and regulation take effect 180 days after adoption, with a short transition for incumbents.

Licensing and supervision

• Any non‑exempt BNPL lender making BNPL loans to New York consumers must obtain a BNPL license under Banking Law Article 14‑B.

• In addition, state‑chartered banks, state credit unions, and New York‑licensed lenders must obtain DFS “category permission” authorizing them to make interest‑free and/or interest‑bearing BNPL loans, even though they are already regulated; federally chartered banks and credit unions are exempt from these licensing/category‑permission requirements.

• Licensees must meet ongoing supervisory obligations including quarterly unaudited financials, annual audited financials with management attestations, periodic regulatory reports, and special reports upon DFS request; changes of control require prior DFS approval and changes in principal officers/directors must be reported within 30 days.​

Product‑level limits and disclosures

• The rules cap interest on BNPL loans at 16 percent APR unless the lender already holds, or obtains, another DFS license that allows rates up to 24.99 percent; in practice this ties BNPL pricing to existing New York usury and licensing frameworks.​

• Late fees are capped at 8 dollars per missed payment, and “excessive fees,” including many convenience and penalty charges, are prohibited.

• Lenders must provide clear, pre‑transaction disclosures of key terms, including whether the BNPL loan will be reported to consumer reporting agencies, and must issue a post‑transaction confirmation within one business day.

• Periodic statements are required for any cycle with a positive balance or finance charge and must consolidate all of a consumer’s BNPL loans with that lender; timing for statement delivery mirrors Regulation Z standards (e.g., at least 14 days before the payment due date for cycles of 30 days or more).​

Underwriting, servicing, and dispute handling

• Lenders must use “reasonable risk‑based underwriting” and assess a borrower’s ability to repay, addressing concerns that low‑friction BNPL can lead to over‑extension.

• The rules establish standards for timely resolution of consumer disputes and refunds, and require policies and procedures, plus a “readily available and prominently disclosed” method for consumers to file disputes with the BNPL lender.

• BNPL lenders must accept and respond to billing error notices, unauthorized‑use notices, and forbearance requests in English, Spanish, and any language used in New York‑targeted advertising, and must provide live toll‑free customer service and an email channel.​

• The regime is explicitly framed to align many BNPL dispute‑resolution and servicing protections with those that apply to credit cards, including protections when consumers seek refunds for defective or undelivered goods.

Data privacy, scope, and transition

• The proposal includes explicit consumer‑data protections, limiting misuse or exploitation of purchase and repayment data and subjecting BNPL lenders to DFS oversight on data practices.

• The definition of BNPL under the statute and rule generally excludes direct in‑house financing by retailers where no third‑party lender is involved, focusing the regime on third‑party BNPL providers operating at point of sale or online.

• Existing BNPL lenders (other than exempt entities and Banking Law entities) must apply for a license and relevant category permissions within 45 days after the rule’s effective date in order to continue operating; good‑faith applicants are provisionally authorized while DFS reviews applications.​

• Consumer advocates, including Consumer Reports, characterize the package as providing the strongest, most comprehensive state‑level BNPL protections to date, and as a model for other states.