NYDFS Drops the BNPL Rulebook: What the July 2026 Proposed Regulation Requires

TL;DR

• On July 15, 2026, NYDFS published a formal NPRM implementing New York’s Buy-Now-Pay-Later Act — the first comprehensive state BNPL licensing and consumer protection regulation in the country.
• All BNPL providers operating in New York must obtain a NYDFS license and a separate “category permission” for each product type (interest-free or interest-bearing). Banking-law entities get a streamlined authorization track but are not exempt from the substantive rules.
• The rule imposes ability-to-repay underwriting, a $8 late fee cap, credit-card-style periodic statements, data privacy consent requirements, and dispute resolution obligations.
• Comment period closes September 14, 2026. Final rule likely mid-2027. If your BNPL program touches New York consumers, the compliance clock is running.

The CFPB rescinded its BNPL interpretive rule in May 2025. That was supposed to be a win for the industry. Instead, it handed the regulatory pen directly to state regulators — and New York’s NYDFS just used it.

On July 15, 2026, the New York Department of Financial Services published a proposed regulation implementing the New York Buy-Now-Pay-Later Act (BNPLA), which Governor Hochul signed in May 2025. The proposed rule is comprehensive in a way that CFPB’s interpretive rule — which treated BNPL as a credit card analogue for limited purposes — never was. This one governs licensing, underwriting, disclosures, fee structures, periodic statements, data privacy, dispute resolution, and capital. It is, effectively, a state-level consumer credit framework built from scratch for BNPL.

The comment period closes September 14, 2026. If you operate a BNPL product in New York and are not already building your compliance program, you are behind.

Why NYDFS Is Writing the BNPL Rules Instead of the CFPB

The federal regulatory picture matters here because it explains the gap NYDFS is filling.

In 2024, the CFPB published an interpretive rule finding that most “pay-in-four” BNPL products are credit cards for purposes of Regulation Z, which would have triggered billing dispute rights, periodic statement requirements, and investigation timelines. The CFPB rescinded that rule in May 2025 under the new administration — effectively withdrawing federal consumer protection standards for BNPL.

The CFPB’s position was that BNPL did not need its own framework because existing rules were sufficient. New York’s legislature disagreed. The BNPLA was enacted one week after the rescission, and NYDFS spent the year since drafting rules to implement it.

The result is a regulation that goes considerably further than what the CFPB had proposed. Where the CFPB’s interpretive rule mapped BNPL onto credit card infrastructure, NYDFS has built a purpose-built BNPL-specific framework with its own licensing tracks, underwriting standards, and fee caps.

For practitioners: this is what “state-level deregulation fill” looks like in practice. The federal pullback did not eliminate compliance obligations. It transferred them to Superintendent Harris’s office in New York.

The Two-Track Licensing Framework

The proposed rule creates two distinct compliance paths depending on the type of entity offering BNPL products.

Track 1: Licensed BNPL providers. Any entity not already supervised under New York banking law must obtain a BNPL license from NYDFS before operating in New York. This covers fintechs, standalone BNPL platforms, payment companies, and any other non-bank entity originating BNPL credit to New York consumers. License applicants must satisfy capital requirements, demonstrate operational capacity, and comply with all substantive BNPLA obligations from day one of licensure.

Track 2: Authorized banking-law entities. Institutions already supervised under New York banking law — state-chartered banks, credit unions, and licensed money transmitters, among others — are classified as “exempt organizations” and do not need a separate BNPL license. Instead, they must obtain written authorization from NYDFS specifying which product categories they are permitted to offer.

Federally chartered national banks and federal savings associations are likely exempt from the licensing requirement under federal preemption, but NYDFS has been deliberate in applying the BNPLA’s substantive consumer protection provisions to all BNPL credit extended to New York consumers, regardless of the lender’s charter. That distinction — licensing exemption versus substantive rule exemption — will be a live issue in comments and potentially in litigation.

Category Permissions: One License Does Not Cover Everything

One of the more operationally significant aspects of the proposed rule is the “category permission” structure. Even after a provider is licensed (or authorized, for banking-law entities), it must obtain a separate permission for each product type it intends to offer:

This structure matters because interest-bearing BNPL products require a materially different disclosure stack — one that closely resembles credit card disclosures under Regulation Z. Providers offering both product types need separate authorizations and separate disclosure templates.

The practical consequence: a BNPL provider that currently offers both interest-free and interest-bearing products under a single marketing brand will need to segregate its disclosure infrastructure and ensure each product type gets the correct regulatory treatment.

Core Compliance Obligations

Underwriting: The Ability-to-Repay Requirement

The proposed rule requires BNPL lenders to conduct “reasonable risk-based underwriting” before extending credit. This is not a rubber-stamp requirement. NYDFS is explicit: lenders must assess the borrower’s income, outstanding loan obligations, and capacity to repay. The rule prohibits approvals that ignore existing debt load — a direct response to consumer advocates’ arguments that BNPL stacking (consumers holding multiple simultaneous BNPL obligations across providers) has contributed to payment failures.

What “reasonable” means in practice will depend on NYDFS’s examination approach, but practitioners should expect examiners to ask:

• What data sources does your underwriting process use?
• How do you assess existing outstanding installment obligations?
• What happens when a consumer’s debt-to-income ratio exceeds your threshold?
• How are those decisions documented?

BNPL providers that currently approve based solely on bank account balance or payment history without assessing existing installment debt are going to need to redesign their decisioning logic.

Disclosures

Both product tracks require clear disclosures before the consumer accepts credit, covering:

• Payment schedule (amount and due dates of each installment)
• All fees and penalties, including late fees
• Consequences of missed payments
• Dispute and refund rights
• Unauthorized-use rights

Interest-bearing products add APR and total finance charge. Disclosures must be in plain language and provided before the consumer completes the transaction — not buried in terms and conditions or surfaced post-checkout.

Periodic Statements

This is where the regulation most directly mirrors credit card requirements. For any billing cycle in which there is an outstanding balance greater than zero or a finance charge, the provider must send a periodic statement. The statement must include current balance, payment due date, minimum payment, and a description of any fees incurred.

The practical operational lift here is significant. Most BNPL providers have designed their products to avoid the periodic statement infrastructure entirely — one of the competitive advantages over traditional credit cards. The proposed rule eliminates that advantage for New York customers.

The $8 Late Fee Cap

The proposed rule caps late fees at $8 per missed payment. This is a hard statutory cap, not a safe harbor. BNPL providers currently charging $10, $15, or other amounts will need to adjust their fee structures for New York consumers.

The cap also creates consumer communication obligations. If your terms and conditions state a late fee amount that exceeds $8, those terms need to be revised before the rule takes effect, and any existing customer agreements that conflict must be updated.

Data Privacy

The proposed rule includes provisions requiring separate consumer consent before a BNPL provider may use, share, or sell “covered consumer data” for purposes beyond servicing the credit account. This is a standalone privacy obligation layered on top of existing GLBA requirements — and it applies specifically to BNPL transaction data.

Practically, this means BNPL providers that monetize purchase data or share it with marketing partners need to audit their consent flows and data-sharing agreements. Consent obtained at account opening for general data use may not satisfy this provision if it does not specifically address BNPL transaction data.

Consumer Liability for Unauthorized Use

The regulation caps consumer liability for unauthorized BNPL transactions at $50 — the same cap that applies to credit cards under Regulation Z. Providers must notify consumers of this protection and maintain dispute resolution processes that comply with the limitation.

Illinois Is Right Behind New York

New York is not acting alone. On June 25, 2026, Illinois enacted its Buy-Now-Pay-Later Loan Consumer Protection Act, making it the second state with a comprehensive BNPL licensing law. Illinois compliance is required by January 1, 2028. The Illinois law covers DFPR licensing, ability-to-repay underwriting, TILA-style disclosures, and similar late fee restrictions.

This is the pattern. When federal consumer financial protection pulls back, state regulators fill the gap — sometimes in coordination, sometimes independently, almost always creating a patchwork that is harder to manage than a single federal rule. BNPL providers operating nationally should now assume they will need state-specific compliance frameworks in every major market, with New York and Illinois as the first two live requirements.

What Your BNPL Compliance Program Needs Before This Rule Takes Effect

The comment period gives NYDFS an opportunity to refine the proposal. Providers should submit comments on elements that create operational ambiguity — particularly around the category permission structure, the underwriting methodology, and the periodic statement content requirements. The September 14 deadline is not just a notice date; it is your opportunity to shape the final rule.

Meanwhile, build now:

Licensing and authorization. Map your entity structure against the two-track framework. If you are not a banking-law entity, start the licensing application process early — NYDFS licensing timelines can run six to twelve months.

Underwriting redesign. Audit your current credit decision model against the ability-to-repay standard. Document what data you use, how you assess outstanding obligations, and what your denial logic looks like at various debt-load thresholds.

Disclosure infrastructure. Build separate disclosure templates for interest-free and interest-bearing products. Test consumer consent flows for the data privacy provision.

Fee structure audit. Review all fee provisions in your current agreements for New York consumers. Flag anything above $8 for remediation before the final rule’s effective date.

Periodic statement operations. If you don’t currently generate periodic statements, start scoping that capability now. The billing cycle, content, and delivery channel requirements will need to match the rule.

As you’re building out your BNPL product compliance framework, the New Product Risk Assessment Template ($59) includes a BNPL worked example with a 58-item pre-launch checklist mapped to state licensing and consumer protection requirements.

So What?

BNPL was supposed to escape credit regulation by being fast, frictionless, and categorically different from traditional credit. New York’s proposed rule makes that escape route unavailable.

The disclosure stack, the underwriting requirement, the periodic statements, the $8 cap, the data privacy consent — these collectively redesign BNPL as a licensed consumer credit product operating under supervision. That’s a materially different compliance posture than most BNPL providers have built for.

The practitioners who need to pay attention first are not just the BNPL pure plays. This affects any fintech, neobank, or payments company that has layered BNPL onto an existing product — embedded finance integrations, “pay later” features inside point-of-sale apps, and installment overlays in e-commerce checkouts. If New York consumers can access BNPL credit through your platform, this rule applies.

State-level enforcement of consumer financial protection is already intensifying beyond BNPL. The CFPB’s pullback from earned wage access and BNPL supervision did not create a regulatory holiday — it created a state competition to fill the gap. New York went first, and it went hard.

The background on what the CFPB’s interpretive rule did and did not require — and why its rescission left a gap — is covered in our earlier post on the CFPB BNPL rule rescission. For practitioners building a BNPL compliance program that satisfies both state and federal expectations, the tension between state consumer protection law and potential federal preemption arguments is the live issue going into 2027.

Sources

• NYDFS Proposes Rules to Enact Buy Now, Pay Later Statute — Cooley Finsights
• NY DFS Unveils Proposed BNPL Regulations — Steptoe
• NYDFS proposes rule to implement state BNPL licensing and consumer protection framework — Orrick InfoBytes
• From Statute to Supervision: Preparing for New York’s New BNPL Regulatory Regime — Holland & Knight
• New York Proposes Licensing and Credit Standards for BNPL Lenders — ACA International