On February 23, the New York Department of Financial Services (DFS) issued a proposed new Part 423 to Title 3 of the NYCRR to implement New York Banking Law Article 14‑B for Buy-Now-Pay-Later (BNPL) lenders. The proposal would move BNPL firmly into New York’s credit system, imposing licensing, supervision, disclosure, data privacy, and underwriting requirements on both interest‑free and interest‑bearing BNPL products offered to New York consumers. If adopted, the rule would take effect 180 days after the notice of adoption is published in the State Register, with a short transitional period for existing BNPL providers. DFS is accepting pre-proposal comments through March 5, 2026, after which the proposed rule will be published in the New York state register for a formal 60-day comment period.

Key Points

• Who Is Covered; Product Scope
  • “BNPL lenders” include both originators and acquirers of BNPL loans offered in New York to New York consumers, including platform operators that connect consumers to BNPL credit.
  • Covers closed‑end consumer credit for the purchase of goods or services (other than motor vehicles), including both “zero‑interest” and interest‑bearing BNPL loans.
  • Banks and other “Banking Law entities” do not need a BNPL license but must obtain DFS authorization and “category permissions” to offer BNPL loans. Exempt organizations are carved out consistent with Article 14‑B.
• Licensing, Category Permissions, and Control
  • Non‑exempt BNPL lenders must obtain a BNPL license and pay Banking Law § 18‑a fees. Banking Law entities must obtain written DFS authorization.
  • Lenders must also obtain “category permission” for each BNPL loan type (interest‑free and/or interest‑bearing). DFS can suspend, revoke, or accept surrender of those permissions.
  • Changes of control require prior DFS approval, and changes in principal officers/directors must be reported within 30 days.
• Reporting, Governance, and Capital
  • Licensees must submit quarterly unaudited financials, annual audited financials with management attestations, periodic regulatory reports, and special reports upon DFS request.
  • Licensees must designate a compliance officer and notify DFS of criminal actions or insolvency proceedings involving the lender or key affiliates.
  • Licensees must maintain capital sufficient to cover obligations to consumers, in the form of a surety bond or eligible deposited assets, with DFS able to require more based on risk and business volume.
• Interest, Fees, and Payment Practices
  • Interest on interest‑bearing BNPL loans is capped at 16%.
  • Interest is defined broadly to include not only finance charges under Regulation Z but also certain fees that might otherwise be excluded under that definition.
  • Penalty fees are tightly limited: up to $8 per violation as a safe harbor. Higher amounts require DFS approval and annual cost‑based reevaluation. Total penalty fees cannot exceed the original amount financed.
  • Lenders may not charge multiple fees for a single event, charge a fee higher than the dollar amount associated with the violation, or assess late fees where the consumer did not receive a timely periodic statement.
  • No more than two payment attempts may be made on the same payment method for a given amount due without new, specific consumer authorization.
  • Prepayments must be permitted without penalty.
  • Lenders may not impose a fee on a method of payment or for expedited payments.
  • Oddly, given the lack of association with BNPL products, tips are prohibited.
• Disclosures, Statements, and Dispute Rights
  • Pre‑transaction disclosures (using DFS model forms) must cover key terms required for closed-end credit sales under Regulation Z, including amount financed, finance charge, annual percentage rate (if applicable), payment schedule, total sale price, fees and default consequences.
  • It also requires disclosures regarding consumer reporting and dispute and refund rights.
  • A post‑transaction confirmation must be delivered within one business day.
  • Periodic statements are required for any cycle with a positive balance or finance charge and must consolidate all of a consumer’s BNPL loans with that lender.
  • It adopts delivery timing requirements for periodic statements akin to the open-end requirements of Regulation Z: 14 days prior to the date on which the required payment must be received in order to avoid being treated as late for any purpose for billing cycles of 30 or more days and 7 days for billing cycles of less than 30 days.
  • Similarly, the rules establish detailed billing error, dispute, and unauthorized‑use procedures that closely track credit card error‑resolution frameworks under Regulation Z, including limits on collections and adverse reporting while disputes are pending and forfeiture of up to $50 in disputed amounts and related finance charges for noncompliance.
• Underwriting and Servicing Standards
  • BNPL lenders must conduct reasonable, risk‑based underwriting before making a BNPL loan, at a minimum assessing the consumer’s income and indebtedness.
  • Written underwriting policies are required, and lenders must clearly disclose the factors they consider. Use of a consumer’s social network (e.g., contacts’ or friends’ credit standing) to set BNPL availability or pricing is expressly prohibited.
  • Lenders must maintain fair, transparent refund and credit processes, ensure timely merchant‑to‑lender refund flows, and promptly credit or refund overpayments and credit balances.
  • Cross-defaults among BNPL loan agreements are prohibited.
• Data Privacy, Consent, and Consumer Access
  • “Covered data” means any nonpublic information of consumers, including personally identifiable information, transaction‑ or account-level information, and metadata about consumers.
  • Use, sale, or sharing of covered data for purposes other than providing the specific BNPL product (e.g., targeted advertising, cross‑selling, individualized pricing of non‑requested products) requires granular, affirmative consumer consent for each specific use case.
  • Consent:
    • Cannot be a condition of obtaining BNPL credit;
    • Must be renewed at least annually; and
    • Must be as easy to withdraw as to provide, with no penalty for revocation.
  • Upon consent expiration or withdrawal, lenders must stop the non‑servicing uses and delete covered data not needed to service the BNPL loan (while also causing third parties to delete it) within 30 days.
  • Lenders must accept and respond to billing error notices, unauthorized use notices, and forbearance requests in English, Spanish, and any language used in their New York advertising, and must provide live, toll‑free customer service and an email channel.
• Transition and Enforcement
  • Existing BNPL lenders (other than exempt organizations and Banking Law entities) must apply for a license and applicable category permissions within 45 days of the rule’s effective date to continue operating lawfully. They are provisionally authorized while DFS reviews complete, good‑faith applications.
  • DFS may deem applications insufficient and cut off provisional authority, turning continued BNPL activity into a violation of Banking Law § 737.

Our Take

The proposed rule, if adopted as drafted, will effectively end closed-end BNPL products in New York because it makes such products not economically feasible. Consider, for example, a $100 transaction where the consumer pays $25 at origination and makes three $25 payments every two weeks. With the 16% per annum cap, the maximum that could be charged on this transaction is $0.92. That’s barely enough to cover the cost of funds and loan loss provisions let alone the myriad and expensive protections described above. Overall, this is bad for New York consumers, who will have fewer choices for financing goods and services on a going forward basis.