91����ԭ��

The New York State Department of Financial Services (NYDFS) is seeking feedback from buy-now-pay-later (BNPL) lenders and other stakeholders in an example of state-level regulation replacing federal oversight.

In an  dated 31 July, the regulator issued a voluntary request for information (RFI) to inform future rulemaking for BNPL products, aiming to ensure they are offered under fair and transparent terms to consumers who reside in the state.

“In accordance with DFS’s mission to develop and implement data-driven regulation and policy, and to avoid imposing undue burdens on either consumers or lenders, DFS is issuing this voluntary Request for Information,” the letter said. “The Department appreciates all responses.”

The move follows the May 2025 passage of the BNPL Act, which established a licensing and supervisory regime for BNPL providers under New York Banking Law Article 14-B. 

Submissions for the RFI are due by August 29, 2025.

Understanding risk

NYDFS said it is particularly interested in gaining insight into business models, fee structures, underwriting practices and how limits on fees and interest may affect BNPL operations more broadly. 

The agency is asking for data and materials that can help it better understand market practices and potential consumer risks associated with the increasingly popular credit products.

The BNPL Act defines a BNPL loan as closed-end credit issued to consumers, excluding auto loans, in connection with the purchase of goods or services. 

Notably, it excludes credit extended directly by a retailer unless the retailer finances the transaction by purchasing goods on the consumer’s behalf and reselling them. 

The scope of the act extends to both lenders and BNPL platforms, except in cases of isolated or incidental activity.

NYDFS said it intends to aggregate and anonymise responses to inform regulatory proposals under New York’s State Administrative Procedure Act. Respondents may request confidentiality under the state’s Freedom of Information Law for trade secrets or commercially sensitive data.

State-by-state regulation

In May, as covered by 91����ԭ��, the Consumer Financial Protection Bureau (CFPB) announced that it would not be prioritising enforcement actions taken on the basis of its own rule, .

The federal regulator, which has been under fire since the Trump administration took office, has said that it will instead keep its enforcement and supervision resources focused on “pressing threats to consumers, particularly servicemen and veterans”. 

It added that it was contemplating taking appropriate action to rescind its BNPL rule, making the creation of a federal legal framework unlikely in the near future, barring a drastic change in mindset. 

This intervention from New York shows that states may be prepared to step in and regulate sectors such as BNPL that the CFPB is backing away from. 

Maryland, Massachusetts, California and Oregon have also legislated in this area or stated their intention to do so in recent years. 

This decentralised approach risks creating a fragmented regulatory environment. 

Increasing complexity

BNPL firms were sceptical about the federal rules for BNPL, which organisations such as  have previously questioned.

However, although a growing patchwork of state rules may benefit consumers locally, it introduces significant complexity for firms operating nationwide. 

Payments and lending providers will soon find themselves navigating varying state-level requirements around licensing, disclosures, fee caps and data use – an increasingly burdensome task as more states move to fill the regulatory gap.

This has previously happened in areas such as data protection, where the US lacks a federal framework like the EU’s General Data Protection Regulation (GDPR).

With the CFPB maintaining a hands-off approach, states are likely to become the primary drivers of fintech regulation in areas such as BNPL, earned wage access and digital wallets. 

In the short term, this may lead to a system where state enforcement becomes the dominant force in US consumer finance, though whether this shift is temporary or long-term remains to be seen. 

Greater compliance challenges

The challenges of increased regulatory fragmentation are far reaching, and will make it difficult for firms to maintain uniform compliance. 

For example, a product legally offered in one state might be restricted or reclassified in another. 

Licensing requirements alone can mean dozens of separate applications, renewals and reporting obligations, and such issues will strain resources and slow market entry. 

This decentralisation also increases costs, as firms must hire compliance experts with state-specific knowledge and often redesign product features such as repayment schedules and fee structures to meet local requirements.

This erodes the economic benefits of scalability and delays product innovation.

Legal uncertainty also adds another layer of risk. Some states classify BNPL as credit, others as small loans, and some do not define it at all. 

This is especially problematic for BNPL platforms that do not issue loans directly, but act as intermediaries, as they may fall within regulatory scope in one state but not another.

This requires systems that can dynamically adjust based on a user’s location (for example, adapting repayment terms or fee structures), as well as separate agreements with merchants in different states. 

Firms also face exposure to multi-state enforcement and litigation. Attorneys general, particularly in blue states, are increasingly assertive, and a company that complies with federal guidance could still be fined or sued under state law. 

For smaller players, the complexity and cost of navigating this environment may be too high, discouraging innovation and entrenching the dominance of large incumbents.

Although the CFPB’s step back has reduced the federal burden, it has created challenges elsewhere. Any firm that thinks deregulation will be effective and helpful may have a wake-up call in the coming years.