From Statute to Supervision: Preparing for New York's New BNPL Regulatory Regime

Gov. Kathy Hochul and the New York Department of Financial Services (DFS) on February 23, 2026, issued a Draft Proposal that would, for the first time, establish a comprehensive regulatory framework for buy-now-pay-later (BNPL) lenders operating in New York.¹ The Draft Proposal would take effect 180 days after publication of the Notice of Adoption in the State Register.

The Draft Proposal addresses a wide range of subjects, including licensing, disclosure requirements, interest rate caps, fee limitations, billing dispute rights and underwriting standards. They also contain strict limitations on use of consumer data, creating obligations that go well beyond existing federal frameworks and may require fundamental changes to how BNPL lenders collect, use and monetize consumer data.

Background

BNPL products have become a common point‑of‑sale financing option, often allowing consumers to split purchases into multiple installments without interest. That structure historically placed many BNPL offerings outside the core federal Truth in Lending Act (TILA) and Regulation Z disclosure regime, which generally applies when credit is subject to a finance charge or payable in more than four installments.² As discussed in a previous Holland & Knight alert on New York's BNPL Act, BNPL's growth has prompted regulatory focus on consumer overextension, fee practices, dispute handling, credit reporting and data use.³

In New York, the BNPL Act, enacted in 2025, established a state‑level licensing and oversight framework and directed the DFS to implement the statute through regulation.⁴ The Draft Proposal is intended to operationalize that framework by defining covered lenders and products and setting detailed requirements for licensing, supervision and consumer protections.⁵

Key Takeaways

• Counterbalancing the CFPB's Rollback: New York is one of the key states that has played an active role in attempting to respond to and fill in some of the gaps left by the deregulatory approach of the federal financial regulators, including the Consumer Financial Protection Bureau (CFPB), during the second Trump Administration. New York's proposed regulations adopt many of the same consumer protection requirements that the CFPB's Biden-era interpretive rule applied to certain BNPL products (which was rescinded in May 2025).
• Broad Coverage and "First-Mover" Licensing Scope: The Draft Proposal would require licensure (or DFS authorization for certain New York Banking Law entities) and applies not only to BNPL originators, but also to platform operators and entities that acquire BNPL loans after origination.⁶ New York would be the first state to impose such a licensing regime.
• Onerous (and Potentially Business-Changing) Restrictions on Consumer Data Use: Outside uses "in connection with" making a BNPL loan, the proposal would generally require affirmative, purpose‑specific opt‑in consent for covered data uses, with limits on duration, renewal, withdrawal and deletion obligations.⁷
• Prescriptive Disclosure and Statement Requirements: The Draft Proposal would mandate "unavoidable" pre‑transaction disclosures, post‑transaction confirmations and consolidated periodic statements, along with multilingual disclosure obligations tied to New York advertising practices.⁸
• Underwriting Standards: BNPL lenders would be required to conduct reasonable risk‑based underwriting, including assessing a consumer's income and indebtedness, supported by written policies and consumer‑facing disclosure of underwriting factors.⁹
• Fee Limits and Dispute Protections: The Draft Proposal includes an $8 penalty‑fee safe harbor, restrictions on fee stacking and cumulative penalty fees, and detailed billing‑error, dispute‑resolution and unauthorized‑use protections that limit collection and adverse reporting while disputes are pending.¹⁰

Scope

Who Is Covered?

The Draft Proposal would define "BNPL lender" to include persons who "offer" BNPL loans in New York. A person "offers" BNPL loans if it makes or acquires ownership of BNPL loans or operates a platform, software or system with which individual New York residents (Consumers) interact, substantially for the purpose of obtaining BNPL loans from third parties (including providers that rely on bank partners to originate loans to their customers).¹¹

What Products Are Covered?

A covered "BNPL loan" would be broadly defined as closed‑end consumer credit provided in connection with a consumer's particular purchase of goods and/or services, excluding motor vehicles. The definition generally excludes seller‑extended credit (subject to a resale‑style exception) and credit extended other than for personal, family or household use.¹²

Licensing and Category Permissions

The Draft Proposal requires BNPL lenders to 1) be licensed by the DFS, 2) post their licenses clearly and conspicuously on all of their mobile applications, websites and other consumer interfaces, and 3) list in the terms and conditions of all BNPL loans they make their name, address, date and jurisdiction of their incorporation or formation (or if a general partnership, the names of the partners), and the category or categories of BNPL loans they are authorized to offer. However, federally chartered banking institutions and foreign banking corporations licensed by the Office of the Comptroller of the Currency (Exempt Organizations) are exempted from all of the above requirements.¹³

New York-chartered banking organizations, foreign banking corporations licensed by DFS to transact business in New York or originate loans from a branch in New York, and lenders licensed under Article 9 of the Banking Law (authorized BNPL lenders) are exempted from the first two of the requirements above (although they still need written authorization from the DFS to offer BNPL loans to Consumers).¹⁴

BNPL lenders, except exempt organizations, must apply to the DFS for permission to offer whatever category of BNPL loans they wish to offer to Consumers. Any such permission will be listed on the BNPL licensee's license or authorized BNPL lender's written authorization. For now, there are only two categories of BNPL loans for which a BNPL lender may seek permission to offer ─ "interest‑free BNPL loans" and "interest‑bearing BNPL loans," although the DFS may create other Categories by regulation.¹⁵

The Draft Proposal contemplates a dedicated DFS "Buy‑Now‑Pay‑Later Unit" for licensing and category‑permission applications.¹⁶

Key Operational Requirements

The following requirements appear to apply to all BNPL lenders, including exempt organizations, assuming the requirements are not preempted by federal law as to such entities.

Novel Data Processing Restrictions

The Draft Proposal would require BNPL lenders to obtain affirmative consent for uses of "covered data" outside of processing BNPL loan transactions, servicing consumer accounts or complying with legal obligations. This framework is significantly more restrictive than the Gramm-Leach-Bliley Act (GLBA) and its implementing Regulation P, which generally permits financial institutions to share consumer information with affiliates and, subject to opt-out rights, with certain nonaffiliated third parties. Under the Draft Proposal, these activities require affirmative opt-in consent. Use of covered data for purposes such as personalizing advertising would also require consent.

The regulation defines "covered data" extremely broadly to include any nonpublic information of a consumer, encompassing "personally identifiable information," "transaction or account-level consumer information" and "any consumer metadata collected or maintained." Notably, the definition captures derived data: Any list, description or grouping of consumers, even one based on publicly available information, is considered "covered data" if it was derived using any nonpublic information. This means that BNPL lenders cannot circumvent the regulation by combining nonpublic data with public sources and then treating the output as unregulated.

Each BNPL lender would also be required to maintain written policies and procedures regarding its use, sale and sharing of covered data. Though the Draft Proposal does not prescribe specific content requirements, the breadth and complexity of the data privacy framework strongly suggest that these policies will need to be comprehensive and regularly updated.

Underwriting

Before providing a BNPL loan, a BNPL lender would need to perform reasonable risk‑based underwriting that, at minimum, assesses the applicant's income and indebtedness. It would also be required to maintain written underwriting policies and procedures and clearly and conspicuously disclose to Consumers the factors it considered when making credit decisions (which may not include Consumers' social‑network credit attributes).¹⁷

Interest, Charges and Fees

For interest‑bearing BNPL loans, the Draft Proposal prohibits any BNPL lender from charging interest in excess of the rate permitted by New York's general usury provisions and treats certain amounts as "interest" for this purpose regardless of characterization.¹⁸ The Draft Proposal also limits fees tied to payment method (with a narrow expedited‑service exception), requires lenders to permit prepayment at any time without charge and addresses the treatment of certain payment‑delay transactions.¹⁹

Penalty Fees and Payment Practices

Penalty fees would be constrained by an $8 safe harbor; fees above $8 would require DFS approval and need to reflect a reasonable proportion of costs. The Draft Proposal would prohibit fee stacking (more than one fee for a single event or transaction), cap aggregate penalty fees at the original amount financed and restrict the assessment of late fees when periodic statements are not timely delivered.²⁰

Disclosures and Periodic Statements

Pre‑transaction disclosures must be delivered to the Consumer before consummation and, if electronic, must be "unavoidable," with DFS model forms contemplated. Post‑transaction confirmations must be delivered within one business day. Periodic statements must follow defined timing rules and consolidate all BNPL loans between the lender and Consumer. Disclosures must be available in English, Spanish and any language principally used in the lender's New York advertisements.²¹

Refunds, Billing Errors and Unauthorized Use

The Draft Proposal includes requirements governing refunds and credits for goods or services purchased with BNPL proceeds, including timing for retailers to transmit credit statements to lenders and lenders to credit accounts and refund credit balances.²²

The Draft Proposal also establishes a detailed billing‑error and dispute‑resolution framework. Consumers would have 60 days to submit notice of a billing error. BNPL lenders must acknowledge the notice within 30 days and resolve the dispute within two billing cycles, not to exceed 90 days. During a good-faith dispute, lenders may not collect disputed amounts, report a customer account as delinquent, or accelerate or restrict an account solely because of the dispute. Consumer liability for unauthorized use is generally limited to the lesser of $50 or the amount obtained before notice.²³

Looking Ahead

DFS may refine the Draft Proposal before formal adoption, including after the public comment period. DFS outreach comments were due by March 5, 2026. If DFS formally proposes the regulations, there will be a subsequent opportunity to comment.²⁴

In the meantime, BNPL lenders, platforms and participants in BNPL loan transfers should consider beginning internal readiness assessments, including licensing posture, underwriting, disclosures, dispute handling, fee practices and data governance, given the proposal's breadth and prescriptiveness, and submit comments as appropriate.

Holland & Knight will continue to monitor New York's BNPL rulemaking and related guidance. If you have any questions, please contact one of the authors or another member of Holland & Knight's Financial Services Regulations Team.

Notes

¹ New York Department of Financial Services press release, Governor Hochul Announces New Nation-Leading Regulation to Establish Comprehensive Consumer Protections For Buy Now, Pay Later Loans (Feb. 23, 2026.

² Truth in Lending Act, 15 U.S.C. § 1601 et seq.; 12 C.F.R. § 1026.2(a)(17).

³ Jeff Larrimore et al., "The Only Way I Could Afford It": Who Uses BNPL and Why, Bd. of Governors of the Fed. Rsrv. Sys., FEDS Notes (Dec. 20, 2024); Holland & Knight alert, "Know Now or Pay Later: Navigating New York's Buy‑Now‑Pay‑Later Act," July 8, 2025.

⁴ Holland & Knight, supra note 8.

⁵ N.Y. Comp. Codes R. & Regs. tit. 3, pt. 423, § 423.

⁶ Proposed 3 N.Y.C.R.R. §§ 423.2(a), (e), 423.3(a)-(c) (2026).

⁷ Proposed 3 N.Y.C.R.R. § 423.12(e) (2026).

⁸ Proposed 3 N.Y.C.R.R. § 423.12(a)(2)(i)–(ii), (a)(3)(ii), (a)(4)(iii)–(iv), (a)(1)(ii) (2026).

⁹ Proposed 3 N.Y.C.R.R. § 423.12(b) (2026).

¹⁰ Proposed 3 N.Y.C.R.R. § 423.9(a)(1)-(4) (2026); Proposed 3 N.Y.C.R.R. § 423.9(c)(1)-(2), (a)(5)-(6) (2026).

¹¹ Proposed 3 N.Y.C.R.R. § 423.1(d) (2026).

¹² Proposed 3 N.Y.C.R.R. § 423.1(f) (2026).

¹³ Proposed 3 N.Y.C.R.R. § 423.3(2026).

¹⁴ Id.

¹⁵ Id; N.Y. Banking Law § 736(3).

¹⁶ Supra note 13.

¹⁷ Supra note 4.

¹⁸ Proposed 3 N.Y.C.R.R., supra note 5.

¹⁹ Proposed 3 N.Y.C.R.R. § 423.9(c)(1)-(2), (a)(5)-(6) (2026). Payment-delay transactions are transactions in which the lender agrees, for a fee, to delay or forbear the payment date for one or more installments of an outstanding BNPL loan; Proposed 3 N.Y.C.R.R. § 423.1(p) (2026).

²⁰ Proposed 3 N.Y.C.R.R. § 423.9(b)(1), (b)(2) (2026).

²¹ Proposed 3 N.Y.C.R.R. § 423.12(a)(2)(i)–(ii), (a)(3)(ii), (a)(4)(iii)–(iv), (a)(1)(ii) (2026).

²² Proposed 3 N.Y.C.R.R. § 423.12(c) (2026).

²³ Proposed 3 N.Y.C.R.R. § 423.12(d)(2)(i), (d)(3)(i)–(ii), (d)(4)(i)–(iii), (d)(10)(iv)–(v) (2026).

²⁴ Supra note 6.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.