meta_id 3327686

On June 30, 2026, the New York State Department of Financial Services (NYSDFS) promulgated new Part 423 to Title 3 and amended Part 101 of Title 23 of the Official Compilation of Codes, Rules and Regulations of the State of New York, establishing a comprehensive regulatory framework for buy-now-pay-later (BNPL) lenders. The regulation takes effect 180 days after publication in the State Register. The new framework requires BNPL lenders—defined as persons offering closed-end credit for consumer purchases of goods and services (excluding motor vehicles)—to obtain licenses from the superintendent unless they qualify as exempt organizations or banking entities. BNPL lenders must apply within 45 days of the effective date and will be deemed provisional licensees pending approval. The regulation distinguishes between interest-free and interest-bearing BNPL loans, each requiring separate category permission. Licensees must maintain minimum capital, post corporate surety bonds, and file unaudited quarterly financial statements within 45 days of quarter-end and audited annual statements within 90 days of fiscal year-end. All BNPL lenders must establish compliance officer positions and maintain detailed records of loans, pricing matrices, and credit grades. The framework imposes strict consumer protections, including mandatory pre-transaction and post-transaction disclosures substantially similar to department-provided model forms. Periodic statements must be provided within 30-day cycles. BNPL lenders cannot charge late fees exceeding $8 under a safe harbor provision, or higher amounts without superintendent approval demonstrating reasonable cost proportionality. Interest rates are capped at the rate permitted under General Obligations Law section 5-501. The regulation prohibits deceptive advertising, requires Spanish-language disclosures and customer service in Spanish and other languages used in advertisements, and mandates toll-free customer service lines operative at least 10 hours daily, Monday through Friday. Data privacy protections require affirmative consumer consent for any use, sale, or sharing of covered data beyond loan origination, with consent effective for one year only. Consumers retain dispute rights, unauthorized use liability capped at $50, and refund rights processed within three business days of credit statement receipt. BNPL lenders must post licenses conspicuously on all platforms and websites and maintain advertising materials for seven years. The regulation also amends the fee structure under Banking Law section 18-a and modifies the licensed financial services providers group definition to include BNPL lenders, establishing BNPL loan origination and platform volume as the industry financial basis for fee distribution.