Hunton Retail Law Resource

On Feb. 23, 2026, New York Governor Kathy Hochul announced that the New York Department of Financial Services (“NYDFS”) had published proposed rules implementing the state’s Buy Now, Pay Later (“BNPL”) law.  The proposal would establish the nation’s first comprehensive regulatory framework for the rapidly growing pay-over-time consumer market niche. 

The proposal sets out licensing and supervisory regulations that would require all “BNPL” lenders―defined broadly to include not only direct lenders, but also entities that operate a platform or system through which consumers obtain BNPL loans and any entities that facilitate them ―to obtain authorization from the NYDFS before doing business in New York.  Businesses already operating as BNPL lenders in New York when the regulations take effect would be required to  apply for a license within 45 days of the effective date. 

The licensing obligation carries with it transparency requirements and enhanced consumer protections that mirror the federal Truth In Lending Act.  BNPL lenders must publicly display licensing status across online checkout processes and provide detailed disclosures regarding loan terms, payment schedules, costs, credit reporting, and dispute and refund procedures.

The proposed regulations also focus on fee and cost controls.  Among other things, the proposal requires interest-bearing BNPLs to comply with state usury limits; prohibits excessive charges, such as convenience fees for different payment methods; caps late or penalty fees (generally to an $8 safe harbor) unless otherwise approved by the NYDFS; and requires that consumers be permitted to pre-pay at no additional cost.  While these provisions are designed to protect consumers, they may also reduce revenues for BNPL lenders.  As a result, businesses may need to rethink their pricing strategies or renegotiate shared fee or cost structures with their partners.

The proposed regulations also include data privacy, underwriting, and operational and service requirements.  For example, BNPL lenders must obtain affirmative, informed consent before using consumer data in ways that go beyond the servicing of a BNPL transaction, they must disclose each specific use case separately, and they must provide clear consent renewal and withdrawal processes.  BNPL lenders must also perform reasonable risk-based underwriting before extending credit, provide accessible, live customer service (e.g., toll-free phone and email) and comply with comprehensive dispute resolution procedures.

The proposed regulations are currently open for public comment and slated to take effect after the rulemaking process.  In the meantime, BNPL providers, platform operators, and funding partners should evaluate their compliance readiness—e.g., reassessing their BNPL revenue models and partner agreements, preparing any needed updates to their checkout, data consent, underwriting, customer support, and dispute processes and protocols.