Key Points

• New York proposes first-in-the-nation BNPL regulations (Part 423, Title 3 NYCRR), announced February 23, 2026.
• Mandatory licensing for all BNPL lenders, including platform operators and loan transferees, with separate permissions for interest-free and interest-bearing products.
• Strict fee caps, TILA-modeled disclosures and underwriting requirements — including an $8 penalty-fee safe harbor, multilingual disclosures, and income-based ability-to-repay assessments.
• Strong consumer protections for disputes and data privacy, with billing-error rules mirroring federal credit card standards and affirmative opt-in consent required for each data use.

The Proposed Regulations

New York has officially fired the starting gun on what is poised to become the most comprehensive regulatory framework for buy now, pay later lending in the United States.

On Feb. 23, 2026, Gov. Kathy Hochul announced that the New York Department of Financial Services had published proposed rules implementing the state's BNPL law, which the governor signed on May 9, 2025, as part of her FY26 Budget. The proposed regulations — codified as new Part 423 of Title 3 of the New York Codes, Rules and Regulations — would establish a licensing regime, cap fees, mandate detailed consumer disclosures, create robust dispute resolution procedures, and impose some of the strongest data privacy protections yet seen in consumer lending.

The timing is no accident. With the Consumer Financial Protection Bureau significantly weakened by steep budget cuts under the Trump administration, consumer advocates are looking to states to fill the gap. The National Consumer Law Center has already called New York's law a "blueprint" for other state legislatures, while BNPL industry groups have pushed back, warning the rules treat their products too much like credit cards.

For financial services professionals — whether you are a BNPL lender operating in New York, a fintech company evaluating market entry, a bank partner, or a compliance officer — these regulations demand immediate attention. Here is what you need to know.

The Rulemaking Timeline

The proposed regulations are currently in a 10-day pre-proposal comment period, which began on February 24, 2026. After the pre-proposal period closes, the regulations will be formally published in the New York State Register, triggering a 60-day public comment period. Once adopted, the regulations will take effect 180 days after the notice of adoption is published in the State Register. There is an additional transitional period for entities already offering BNPL loans in New York at the time the rules take effect.

Who Is Covered

The regulations define a "BNPL lender" broadly. It encompasses any person who offers BNPL loans in New York, including those who make BNPL loans directly, those who operate a platform or system through which consumers obtain such loans, and any person to whom ownership of a BNPL loan is transferred. The definition explicitly captures platform operators whose systems have "a substantial purpose" of enabling consumers to obtain BNPL loans from third parties. However, isolated, incidental, or occasional transactions are excluded.

A "BNPL loan" is defined as closed-end credit provided to a consumer in connection with a particular purchase of goods or services, excluding motor vehicles. Notably, the definition does not cover credit extended where the creditor is the seller of the goods or services, nor does it cover credit extended for business purposes rather than personal, family, or household use.

Certain entities are treated differently. "Banking Law entities" — including banking organizations, foreign banking corporations licensed by the superintendent, and licensed lenders — are not required to obtain a separate BNPL license but must obtain authorization and category permissions from the superintendent. "Exempt organizations," as defined by the Banking Law, are carved out of many of the regulations' requirements.

Licensing and Category Permissions

The regulations establish a mandatory licensing regime. No person, other than an exempt organization or an authorized BNPL lender, may act as a BNPL lender without a license from the superintendent. The license is non-transferable and non-assignable, and must be posted conspicuously on all mobile applications, websites, and other consumer interfaces.

BNPL lenders must also obtain "category permissions" specifying whether they are authorized to offer interest-free BNPL loans, interest-bearing BNPL loans, or both. This two-category framework reflects the reality that the BNPL market includes both zero-interest, pay-in-four products and longer-term installment loans that carry interest charges.

The superintendent retains broad authority to revoke, suspend, or accept surrender of both licenses and category permissions.

Transitional Period for Existing Providers

Companies already operating as BNPL lenders in New York when the regulations take effect must apply for a license within 45 days of the effective date. Upon submitting a timely application, an existing provider becomes a "provisional licensee" and may continue operating until the superintendent approves or denies its application.

The same 45-day deadline applies to category permission applications. Failure to apply within the 45-day window constitutes a violation of Banking Law section 737.

Fee Caps and Interest Limits

The fee and interest provisions are among the most consequential aspects of the new rules.

Interest-bearing BNPL loans are subject to the interest rate ceiling set by New York General Obligations Law section 5-501, and the regulations adopt a broad definition of what constitutes "interest" — including origination charges, finance charges as defined under federal Regulation Z, and any charge characterized as a fee but functioning as interest.

Penalty fees are tightly constrained. The regulations establish an $8 safe harbor for fees imposed for violating the terms of a BNPL loan agreement. A lender that wishes to charge more than $8 must apply to the superintendent for approval and demonstrate that the fee represents a "reasonable proportion" of costs actually incurred. Approved fees must be reevaluated every 12 months.

Importantly, the rules prohibit penalty fees that exceed the dollar amount of the underlying violation, multiple fees for a single event, and aggregate penalty fees that exceed the original amount financed. No late fee may be imposed if a consumer did not receive a periodic statement within the required timeframe.

Convenience fees are effectively banned. The rules prohibit BNPL lenders from imposing separate fees to allow consumers to make payments by any method — whether mail, electronic, or telephone — unless the method involves expedited service by a customer service representative.

Consumers may prepay any BNPL loan at any time without penalty.

Disclosure Requirements

The regulations impose a layered disclosure framework modeled closely on federal Truth in Lending Act principles.

Pre-transaction disclosures must be provided before the consummation of each loan and must be "unavoidable" when presented electronically. Required content includes the identity of the lender, the amount financed, the finance charge, the annual percentage rate, the payment schedule, the total sale price, a description of all fees, a default statement outlining material consequences (including credit bureau reporting and referral to debt collectors), a statement about dispute and refund rights, and a description of protections against unauthorized use.

Post-transaction confirmations must be mailed or delivered within one business day following the consummation of the transaction.

Periodic statements must be sent for each billing cycle in which an account carries a balance or a finance charge has been imposed, and must be mailed or delivered at least 14 days before the payment due date for billing cycles of 30 days or more (or 7 days for shorter cycles).

All disclosures must be provided in English and accurately translated into Spanish and any other language principally used in the lender's New York advertising.

Underwriting Requirements

BNPL lenders must perform "reasonable risk-based underwriting" before originating a loan, including at minimum an assessment of the consumer's income and indebtedness. Written underwriting policies and procedures must be maintained, and factors considered in the underwriting process must be disclosed to consumers.

Notably, the rules prohibit any use of the "credit worthiness, credit standing, or credit capacity of any member of the consumer's social network" in making credit decisions.

Dispute Resolution and Refunds

The dispute resolution framework is extensive, drawing heavily from the credit card billing error protections in federal law.

A consumer may submit a billing error notice — electronically, orally, or in writing — within 60 days of receiving a post-transaction confirmation or periodic statement reflecting the alleged error. The BNPL lender must acknowledge the notice within 30 days and resolve the dispute within two complete billing cycles (but no more than 90 days).

During the pendency of a dispute, the lender is prohibited from attempting to collect the disputed amount, making adverse credit reports, or accelerating debt. If a consumer has enrolled in automatic payments, the lender must not deduct disputed amounts if the billing error notice is received at least three business days before the scheduled payment date.

On refunds, the rules require BNPL lenders to make reasonable efforts to cause the retail seller to transmit a credit statement within seven business days. The lender must then credit the consumer's account within three business days of receiving the credit statement and issue any resulting credit balance refund within three business days.

Data Privacy Protections

The data privacy provisions are unusually robust and represent a significant compliance lift.

BNPL lenders may use, sell, or share "covered data" — defined broadly as any non-public information of a consumer, including personally identifiable information, transaction or account-level data, and consumer metadata — only with the consumer's affirmative, informed consent, and only for each specific use case separately disclosed.

Consumer consent expires after one year and must be renewed. The regulations explicitly state that targeted advertising, individualized pricing, cross-selling of non-requested products, and the sale of covered data are not considered "reasonably necessary" to provide the consumer's requested product or service.

Critically, consent cannot be a condition of obtaining a BNPL loan — the rules flatly prohibit tying. The regulations also bar lenders from setting affirmative consent as a default option, require that the option to decline be presented with equal prominence, and mandate that consumers be given the ability to decline all consent requests collectively.

Consumers must be provided a method to withdraw consent that is as easy to access as the initial consent mechanism. Upon withdrawal or expiration of consent, the lender must stop using the data and delete it (and cause any third parties to delete it) within 30 days.

Additional Operational Requirements

The regulations impose several further obligations that BNPL lenders should plan for:

• Customer service access. Lenders must prominently display a toll-free telephone number offering live assistance on all mobile applications, websites, and consumer interfaces. The phone line must be operative at least 10 hours per day, Monday through Friday, excluding federal holidays. An email address for customer service must also be displayed.
• Advertising. All BNPL advertising to New York residents must include the licensee's name and a legend stating it is "Licensed to offer BNPL loans by the New York State Department of Financial Services". All advertising materials must be maintained for at least seven years.
• Failed payment limits. A lender may not make more than two attempts to obtain payment via the same payment method for any one due and payable amount, unless the consumer provides new, specific authorization.
• Tips and gratuities. BNPL lenders may not solicit tips unless they clearly disclose that payment is voluntary and will not affect loan terms, solicit no more than once per transaction, and do not set a default amount greater than zero.
• Capital requirements. Licensees must maintain capital sufficient to cover outstanding obligations to consumers, held in the form of a surety bond or deposited assets.
• Reporting. Licensees must file unaudited quarterly financial statements within 45 days of each quarter-end and annual audited financial statements within 90 days of fiscal year-end. A designated compliance officer is also required.

Industry Reaction and the Bigger Picture

The regulations have drawn sharp reactions from both sides. Consumer groups, including the National Consumer Law Center and Consumer Reports, have praised New York's approach. Consumer Reports called the rules "important protections" that would ensure lenders "don't extend credit that consumers cannot afford to repay, charge only reasonable fees, protect data privacy, and treat borrowers fairly". The NCLC has urged other states to adopt similar frameworks, noting that "many Buy Now Pay Later users have subprime credit scores and high debt loads making BNPL loans risky".

The Financial Technology Association, which represents major BNPL providers, has been more measured. While expressing hope that the final rule will be "appropriately tailored to the unique structure and risk profile of buy now, pay later services," the group maintains that BNPL products are fundamentally different from credit cards because many do not charge interest. The association has previously called the underlying legislation a "fundamental misunderstanding of buy now, pay later products".

As BNPL lending continues to expand beyond traditional retail into areas such as rental housing, medical debt, and debt settlement, New York's framework may well serve as the template for a wave of state-level regulation — making these rules significant not only for companies doing business in New York but for any firm in the BNPL ecosystem nationwide.

Takeaways for Industry Participants

• Assess your licensing posture now.
  Any entity meeting the broad definition of "BNPL lender" — including platform operators — should begin evaluating whether it needs a New York BNPL license and appropriate category permissions.
• Budget for compliance infrastructure.
  The disclosure, underwriting, dispute resolution, and data privacy requirements will require significant investment in systems, policies, and procedures.
• Engage in the comment process.
  The 10-day pre-proposal period and subsequent 60-day public comment period are the windows to shape the final rule.
• Watch other states.
  With the National Consumer Law Center and other groups actively promoting the New York model, similar legislation is likely to emerge in other jurisdictions.

For more information on this topic, contact Stephen A. Aschettino at saschettino@foxrothschild.com.

This information is intended to inform firm clients and friends about legal developments, including the decisions of courts and administrative bodies. Nothing in this alert should be construed as legal advice or a legal opinion. Readers should not act upon the information contained in this alert without seeking the advice of legal counsel. Views expressed are those of the authors and not necessarily this law firm or its clients.