BNPL Licensing Requirements by State: What the New York and Illinois Laws Mean for Your Compliance Program

For years, the compliance conversation around buy now, pay later (BNPL) centered on a single question: does this product trigger the federal Truth in Lending Act? The answer was usually no. The original pay-in-four structure—four equal installments over six weeks, no periodic interest, no finance charge—was deliberately designed to sit outside TILA's scope and outside many state consumer lending statutes that used similar four-installment thresholds.

That gap is closing. Two states now have dedicated BNPL licensing laws. Meanwhile, the Consumer Protection Financial Bureau (CFPB) has stepped back from the space Most BNPL providers operating in the other 48 states are already subject to state consumer lending statutes based on how their products have evolved — they may just not know it yet.

Here is where things stand as of late June 2026.

New York enacted the Buy-Now-Pay-Later Act in May 2025, the first state-specific BNPL licensing law in the country. The New York Department of Financial Services (NYDFS) published proposed rules in March 2026. The law takes effect 180 days after NYDFS adopts final rules, which have not yet been finalized at the time of publication.

Illinois signed the Buy-Now-Pay-Later Loan Consumer Protection Act on June 26, 2026, becoming the second state with a dedicated BNPL framework. The law is effective immediately; full compliance is required by January 1, 2028.

The CFPB announced in May 2025 that it would not prioritize enforcement of its 2024 interpretive rule applying Regulation Z to BNPL digital accounts and subsequently rescinded the rule. Federal oversight in this space has effectively paused, shifting regulatory momentum to states.

This guide covers the New York and Illinois laws, how existing state consumer lending statutes apply to BNPL products in the other 48 states, how product structure determines licensing exposure, and what compliance teams need to do now.

‍

The federal pullback and why states are filling the gap

The CFPB's 2024 interpretive rule declared that BNPL digital accounts—the consumer-facing app or account used to access BNPL credit—qualified as credit cards under Regulation Z. The rule would have required BNPL providers to send periodic statements, handle billing disputes like credit card issuers, and apply refund credits to outstanding balances. Industry groups argued it was structurally mismatched: BNPL products are closed-end installment credit, not revolving credit, so treating them like credit cards created obligations that did not fit how the products work.

The rule was contested, and in May 2025 the CFPB announced it would not prioritize enforcement and would pursue rescission. The rule has since been formally rescinded.

With no federal framework, the BNPL regulatory landscape is now entirely a state-by-state question. That is not new: state consumer lending statutes have always applied to BNPL products that crossed certain product structure thresholds. What is new is that the two most significant states by consumer population have now enacted product-specific licensing regimes, and more are watching.

The regulatory vacuum creates three distinct compliance categories:

States with dedicated BNPL licensing laws: New York and Illinois, as of this writing. Both states have product-specific statutes with their own license types, fee caps, disclosure requirements, and underwriting standards.

States where existing consumer lending statutes already apply: the majority of states. The licensing analysis here depends on the specific product structure (interest-bearing or not, term length, origination model) and the state statute's coverage thresholds.

States where the original pay-in-four structure may still fall within a licensing exemption: a shrinking category as BNPL products have diversified beyond the original design.

The compliance mistake most BNPL providers make is treating these as mutually exclusive. A provider can be covered by New York's new law, already subject to California's Finance Lender License requirements under the existing CFL, and potentially exempt in Texas: all simultaneously.

‍

New York: the first dedicated BNPL licensing law

The law and its timeline

New York enacted the Buy-Now-Pay-Later Act as part of Senate Bill S3008C, signed by Governor Hochul on May 9, 2025, and codified as Article 14-B of the New York Banking Law. The law does not take effect until 180 days after NYDFS promulgates the regulations.

NYDFS published proposed rules in March 2026, opening a 60-day public comment period. Final rules have not yet been adopted as of late June 2026. The compliance timeline—180 days from final rule adoption—is not yet running.

For providers already operating BNPL products in New York at the time the law becomes effective, a transitional period will apply. The specific terms are to be established in the final rules.

Who is covered

The New York BNPL Act defines a "BNPL lender" broadly: any person that makes BNPL loans (companies that directly originate transactions) and any person that operates a platform, software, or system with which a consumer interacts where a substantial purpose of that interaction is to obtain BNPL loans. This definition is explicitly designed to capture technology platforms and point-of-sale intermediaries that facilitate BNPL transactions but do not directly extend credit themselves.

The coverage of platform operators is the most significant definitional question for embedded finance companies. A retailer that integrates a licensed BNPL provider's checkout widget and merely offers it as a payment method is likely outside the scope; the statute includes language suggesting that "isolated, incidental or occasional" transactions and pure brokerage arrangements without a platform primarily intended for BNPL may not be covered. But a company that builds and operates a BNPL platform, even if a bank partner originates the loans, likely meets this definition.

The line between operating a BNPL platform and merely offering one as a checkout option will be drawn in the pending regulations. BNPL providers with bank partnership structures should plan for coverage, not exemption, until those regulations provide clarity.

Exemptions. Retailers that offer credit directly to consumers for their own goods and services are exempt (the "creditor is the seller" carve-out). Nationally chartered banks are not subject to the state licensing requirement, though they may be subject to other provisions.

What the proposed NYDFS rules require

The proposed regulations go significantly further than the statute's baseline requirements. Key provisions:

Category permissions. Each BNPL lender must obtain a separate "category permission" for each type of BNPL product it offers: interest-free BNPL loans, interest-bearing BNPL loans, or both. A license must specify which category the provider is approved for.

Interest cap. BNPL lenders may not charge interest in excess of 16% on any BNPL loan. The definition of interest is broad — it includes origination charges and finance charges as defined under Regulation Z, not just periodic rate interest. This is intended to prevent fee structures designed to evade the rate cap.

Late fee cap. A safe harbor allows late fees of no more than $8 per late payment or other violation. Any fee above this must be approved by NYDFS and shown to represent a reasonable proportion of the lender's costs. The aggregate dollar amount of all fees charged for violating the loan terms may not exceed the original loan amount, effectively capping fee stacking.

Underwriting. Providers must assess consumer income and indebtedness before extending credit. This requirement directly targets the practice of approving multiple simultaneous BNPL loans across providers without any assessment of the consumer's total debt load.

Pre-transaction disclosures. Consumers must see key terms, credit reporting policies, and dispute rights before accepting a BNPL loan.

Dispute resolution. Timely resolution standards for consumer disputes, modeled on credit card dispute rights under TILA. This was a central element of the federal Regulation Z approach that New York has now enacted at the state level.

Data privacy. BNPL lenders may use, sell, or share consumer covered data beyond what is needed to provide the loan only with the consumer's affirmative, informed consent. Consent is valid for no longer than one year and must be renewed. Lenders may not condition loan availability on the consumer's consent to data sharing. Upon withdrawal or expiration of consent, the lender must delete covered data within 30 days.

Banking Law entities—banks and licensed lenders already supervised by NYDFS—must obtain written authorization from the Superintendent to offer BNPL loans rather than a full new license. This two-track structure (new license for fintechs, written authorization for existing NYDFS-supervised entities) is a design feature likely to influence how other states structure their frameworks.

What to do now

Track the NYDFS rulemaking. The 60-day comment period following publication in the State Register determines when the comment period closes; final rule adoption could come in the second half of 2026 or into 2027. The 180-day compliance clock starts at final rule adoption, and the compliance date will be publicly known before it arrives.

If you operate a BNPL platform with New York borrowers, begin preparation now: review your product structures against the category permission framework, assess your fee structure against the 16% interest cap in addition to the $8 late fee safe harbor, and evaluate whether your bank partnership structure is covered under the platform operator definition. Do not wait for final rules to begin that work.

Related: BNPL Licensing Requirements by State: A Guide to the Emerging Regulatory Landscape

‍

Illinois: the second dedicated BNPL law (enacted June 26, 2026)

Illinois Governor JB Pritzker signed the Buy-Now-Pay-Later Loan Consumer Protection Act on June 26, 2026. The law takes effect immediately, with full compliance required by January 1, 2028.

Who is covered

The Illinois law covers closed-end credit provided to consumers for goods or services that is payable in four or fewer installments or has a term of 120 days or less. This product-scope definition is narrower than New York's and has generated debate: consumer advocates note that by strictly defining BNPL products as loans repayable in 120 days or less, the law creates a potential structural evasion path. Providers offering longer-term monthly payment products—Klarna's "pay monthly" products, for example—fall outside the definition and are not covered by the Illinois Act.

Key exemptions. The law exempts merchants that merely offer BNPL financing through licensed providers and do not originate, underwrite, service, or hold an interest in the loans. It also exempts passive investors that do not originate, underwrite, or service loans. This is significant for the embedded commerce ecosystem: a retailer integrating a licensed BNPL platform's checkout button is likely exempt; a company that holds economic interests in the loans, underwrites them, or services them is not.

Relationship to existing Illinois lending law. Loans made under the Buy-Now-Pay-Later Loan Consumer Protection Act are not required to comply with the Consumer Installment Loan Act or the Payday Loan Reform Act. This carve-out from existing lending statutes was one of the more contested aspects of the legislation. Consumer advocates at the Woodstock Institute argued it removes BNPL lenders from Illinois's existing loan database, which has historically been used to identify predatory lending patterns. The law as enacted includes this carve-out; the compliance obligation for covered BNPL loans is the BNPL Act, not CILA.

Core requirements

Registration. BNPL providers must register with the Division of Financial Institutions of the Illinois Department of Financial & Professional Regulation (IDFPR). The registration framework is less prescriptive than New York's full licensing requirement; implementing regulations will establish the specific registration process.

Disclosures. Full disclosure of all costs before the transaction, including total amount due, number and timing of installments, any interest or finance charges, and any fees that could apply.

Underwriting. Lenders must take into consideration the financial ability of the borrower to repay the loan in the time and manner provided in the loan contract. This is an ability-to-repay standard, though the Illinois formulation is less prescriptive about methodology than New York's proposed rules.

Dispute resolution. Fair, transparent dispute resolution and refund procedures. Rulemaking will define what "fair and transparent" means operationally—this is one of the areas the Woodstock Institute identified as punting too much to regulators.

Credit reporting. Providers must comply with specified federal laws regarding accurate data that may be reported to credit reporting agencies.

Existing operators: the provisional licensee runway

If you are already offering BNPL products to Illinois borrowers, you benefit from a provisional licensee provision: providers that were operating in Illinois before January 1, 2028, and that submit a registration application by that date, may continue operating while their application is pending.

This runway is real, but January 1, 2028, is not a distant deadline: it is 18 months away. Registration preparation, application submission, and any back-and-forth with IDFPR take time. Begin the registration process in 2027 at the latest and track IDFPR rulemaking for the specific registration requirements.

‍

Most states: how existing consumer lending statutes apply to BNPL

For the 48 states without dedicated BNPL laws, the licensing analysis runs through existing consumer lending statutes. The outcome depends almost entirely on the specific product structure.

Why the original exemption no longer covers many BNPL products

When BNPL loans first entered US markets, the pay-in-four structure was specifically designed to sit within exemptions from federal TILA and many state consumer lending statutes—four installments, no periodic interest, no finance charge. As BNPL providers innovated beyond the original structure, introducing interest-bearing variants, longer repayment terms, monthly payment options, and bank partnership origination models, the original exemption logic stopped applying to significant portions of the BNPL market.

Today's BNPL market includes products at very different points on the licensing spectrum:

Traditional pay-in-four (0% interest, four installments, six-week term). In many states, this product may still fall within the consumer lending license exemption for transactions with no finance charge and four or fewer installments. However, the exemption depends on the specific state statute language — several states have modified their exemption thresholds—and does not protect against the facilitation trigger in states that license program operators rather than their direct lending-focused peers.

Interest-bearing pay monthly. Any BNPL product that charges interest eliminates the 0% exemption argument and likely triggers the consumer lending license requirement in most states that require a license for consumer loans above a rate threshold. This includes all "pay monthly" products with an APR.

Bank-partnership BNPL. A bank originates the loan, meanwhile the platform markets, facilitates, and services it. The bank's charter preempts state lending law for the bank's origination activities—but the facilitation and servicing activities of the BNPL platform face separate analysis under each state's consumer lending or true lender statutes. In states like Connecticut, Nebraska, Maine, and the now-enacted Illinois and Washington frameworks, economic interest holders and program operators face licensing exposure regardless of the bank's originating role.

The common licensing triggers for BNPL in non-BNPL states

State consumer lending license triggers commonly include: offering credit to consumers for personal, family, or household purposes; charging rates above state usury thresholds; offering loans below certain dollar amounts covered by small-loan provisions; and marketing or facilitating consumer loans even without directly disbursing funds.

For BNPL products, the triggers that most frequently apply are:

The interest trigger. A 0% pay-in-four product may not trigger a license based on rate alone in states with rate-based thresholds. An interest-bearing BNPL product—even at 6% APR—typically triggers the consumer lending license requirement in states that require a license for any consumer loan with interest above a defined threshold.

The facilitation trigger. States that require licensing for entities that "facilitate," "arrange," or "broker" consumer loans may reach BNPL platforms that originate through bank partners. Connecticut, Maine, Nebraska, and Washington have extended licensing to non-bank program participants.

The dollar amount trigger. States with small loan acts covering loans under a specific principal threshold—typically $5,000 or $10,000—may capture BNPL transactions under that amount regardless of product structure.

State-by-state BNPL licensing reference

The following table reflects general guidance as of late June 2026. Requirements vary by product structure and business model. Confirm with qualified legal counsel before operating in any state.

This table is a general reference only. BNPL licensing analysis is product-structure-specific. Confirm requirements with qualified legal counsel.

‍

Three product structures and their licensing implications

Product structure is the single most important variable in BNPL licensing analysis. The same company may have different licensing obligations depending on which product it offers to which borrowers.

Structure 1: Traditional pay-in-four, 0%, four installments, six-week term

The original BNPL structure. In most states, this product may still fall within the consumer lending license exemption for transactions with no finance charge and four or fewer installments. The exemption holds when: the state statute includes an explicit exemption for transactions with no finance charge; the transaction falls within any applicable installment count threshold; and the product is not offered through a bank-partnership structure in a state that has extended licensing to platform operators based on economic interest or program control.

Confirm the exemption language explicitly in every borrower state. Do not assume it is universal.

Structure 2: Interest-bearing BNPL or pay monthly

Any BNPL product that charges interest—periodic rate, origination fee treated as interest, or finance charge—eliminates the 0% exemption and almost certainly triggers the consumer lending license requirement in states that apply rate-based licensing thresholds. This includes all monthly payment products with an APR and all "pay in X months" products with finance charges.

Treat these products as consumer loans for licensing purposes in every state and run the full licensing analysis. The consumer lender license requirements by state guide covers this analysis state by state. The same NMLS application process applies.

Structure 3: Bank-partnership BNPL

A bank originates the loan; the BNPL platform markets, facilitates, services, and in most cases holds economic interests in the receivables. The bank's federal charter preempts state lending law for the bank's origination activity. It does not preempt the platform's facilitation, program control, or servicing activities.

This structure faces the most complex licensing analysis. States with true lender statutes or broad program participant licensing requirements—Connecticut, Nebraska, Maine, Washington, and now Illinois under the BNPL Act's coverage of platform operators—may require the BNPL platform to be licensed regardless of the bank's originating role. New York's proposed rules explicitly include platform operators within the BNPL lender definition.

The compliance approach for bank-partnership BNPL: run the state licensing analysis as if the bank partnership did not exist, then identify the specific states and license types where a documented preemption argument applies. That approach surfaces fewer surprises than assuming bank charter coverage and discovering gaps at examination.

‍

States to watch: the next wave of BNPL legislation

New York and Illinois will not be the last states to enact BNPL-specific legislation. The CFPB's retreat has created a regulatory vacuum that state legislators and attorneys general are actively working to fill.

Massachusetts considered BNPL licensing legislation last session—bills creating licensure and disclosure requirements were introduced but did not pass. Massachusetts has not yet reintroduced similar bills in 2026, but its generally aggressive consumer finance regulatory posture and the CFPB vacuum make it a high-probability next state.

California has not enacted BNPL-specific legislation, but the DFPI's ongoing expansion of its regulatory perimeter under the California Consumer Financial Protection Law—including invitations for comment on additional industries to bring under registration and reporting requirements—suggests BNPL-specific guidance or rulemaking is possible. California BNPL providers should not wait for DFPI action to confirm their CFL licensing obligations.

Minnesota, Colorado, and Washington have each enacted or proposed legislation targeting bank-fintech partnerships and expanding consumer lending licensing requirements to platform operators. All three are plausible candidates for BNPL-specific legislation modeled on New York and Illinois.

The New York proposed rules' data privacy framework—consent-based data sharing, one-year consent validity, 30-day deletion obligation—is the most advanced consumer data protection requirement in any BNPL-specific regulation and may become the template for future state legislation.

What the next-wave laws are likely to look like: Dedicated license type (not a general consumer lending license), ability-to-repay underwriting requirement, fee caps (modeled on New York's $8 late fee safe harbor), mandatory pre-transaction disclosures, dispute resolution standards, and data privacy provisions. Providers that build compliance programs around the New York model will be better positioned than those that wait for each state to enact its own framework.

‍

What compliance teams need to do now

Map your product structures against the licensing framework. Pay-in-four at 0%, interest-bearing pay monthly and bank-partnership BNPL face different licensing analyses in most states. Do not treat BNPL as a single product category for compliance purposes. The structure—not the label—determines the licensing trigger.

Identify your borrower state concentration. Licensing follows the borrower's location. Your highest-priority states are where your current or projected borrower volume is highest: 

• California requires a California Finance Lender License for most BNPL providers under the existing CFL; confirm your status. 
• New York's BNPL Act will be effective 180 days after NYDFS adopts final rules; begin preparation now. 
• Illinois requires full compliance by January 1, 2028; begin preparation for this state as well.

For New York: track NYDFS rulemaking actively. The 60-day comment period following publication in the State Register starts the clock toward final rule adoption. When final rules are adopted, you will have 180 days to comply. That 180-day period will go faster than it looks. Assess your products against the proposed rules now—the category permission framework, the 16% interest cap, the $8 late fee safe harbor, the underwriting standard, and the platform operator definition all require substantive compliance review.

For Illinois: use the provisional licensee runway, but plan ahead. If you are already offering BNPL products to Illinois borrowers, you are protected by the provisional licensee provision—but only if you submit a registration application by January 1, 2028. Track IDFPR rulemaking for the specific registration requirements as they are promulgated. Begin the registration process in 2027 to allow adequate time for application review.

For bank-partnership BNPL: run the true lender analysis in every borrower state. The bank's charter protects the bank. It does not protect the platform's facilitation, program management, or servicing activities in states with true lender statutes or broad program participant licensing requirements. Run a full licensing analysis as if the bank partnership did not exist and then identify where a documented preemption argument applies.

Brico tracks BNPL licensing requirements across all 50 states, monitors NYDFS and IDFPR rulemaking updates, and maintains the licensing calendar that BNPL compliance teams need to stay ahead of New York and Illinois compliance dates. See how Brico can help.

‍