Navigating New York’s Landmark BNPL Regulation: What Fintech Leaders Need to Know

The Buy Now, Pay Later (BNPL) marketplace is undergoing a significant shift in New York. Governor Kathy Hochul signed the New York BNPL Act into law on May 9, 2025, and the New York State Department of Financial Services (NYDFS) has now released its proposed implementing regulations. Together, these actions mark one of the most comprehensive state-level interventions in the fast-growing Buy Now Pay Later state regulation sector. The proposed BNPL rule, which is currently in a public comment period and not yet final, establishes BNPL licensing requirements in New York and imposes strict BNPL consumer protection requirements, disclosure, fee and BNPL data privacy requirements on BNPL providers.

Scope: Who and What the Rule Covers

Broad BNPL Definition: New York defines BNPL loans broadly as any closed‑end consumer credit used to purchase goods or services (excluding auto loans), capturing even short‑term, zero‑interest “pay‑in‑4” plans and treating BNPL as traditional consumer credit.
Covered Providers: The rule applies to non‑bank BNPL fintech companies, platforms facilitating BNPL transactions and entities purchasing BNPL receivables, effectively anyone offering or enabling BNPL to New York consumers.
Exclusions and Exemptions: Merchants extending their own credit and business‑purpose credit are excluded. Federally chartered institutions (e.g., national banks, federal credit unions) are exempt from licensing, though many state‑chartered lenders are not.

Licensing and Category Permissions

Non‑exempt BNPL providers must obtain a NYDFS license and display it on consumer‑facing platforms. Existing providers have 45 days to apply and may operate provisionally. Lenders must also obtain category permissions for interest‑free, interest‑bearing or both types of BNPL products.

Consumer Protections and Compliance Requirements

The rule aligns with TILA‑style protections, requiring underwriting for income and debt, robust disclosures, dispute and refund rights, and strict limits on fees and interest. Interest is capped at 16% APR (the BNPL APR cap in New York derives from the state’s civil usury law and applies in most cases; federally chartered banks may be exempt due to federal preemption), late fees are limited, and many fees are prohibited. Strong data‑privacy rules require explicit, revocable consumer consent for data use beyond loan servicing.

To provide a handy reference, the table below summarizes which key requirements apply to different BNPL provider categories:

(“Exempt organizations” under NY Banking Law – e.g., federally chartered banks, federal credit unions and similar institutions – are not subject to the state’s BNPL licensing and many operational requirements. However, non-bank fintech companies and out-of-state state-chartered banks should assume full compliance obligations when serving New York consumers.)

Why FinTech Companies Should Pay Attention

Revenue and Margin Pressure: The 16% APR cap and $8 late fee limit restrict traditional revenue sources like interest, late fees and tips. Even interest-free “pay-in-4” models are affected, as limits on late and merchant fees are curtailed, squeezing margins. TILA-style rules for underwriting, disclosures, disputes and data privacy mean fintech companies need stronger compliance systems. Companies should expect more audits and higher standards for controls, which will increase costs for systems, staff and customer support.
Investor Diligence and Valuations: Regulatory compliance is now a key factor for investors. Showing you are ready for a complex market like New York can help with valuations and raising capital. On the other hand, noncompliance can lead to penalties, reputational harm and less investor interest.
Product and Growth Strategy: Required ability-to-pay checks and stronger data consent processes will impact onboarding, conversion rates and product design. Companies entering New York may need to rethink partnerships, licensing or go-to-market plans. Since other states may follow New York’s lead, early compliance could become a competitive advantage.

Industry Impact and Next Steps

New York’s BNPL regulation introduces significant compliance and operational demands for fintech companies. Firms must invest in licensing, customer service, underwriting, disclosures and data privacy systems. Business models reliant on fees, tips or consumer data, especially for interest-free “pay-in-four” products, face new constraints, including the 16% APR cap and an $8 late fee limit.

Data privacy rules require BNPL providers to overhaul consent processes, track expiration and ensure easy opt-outs and data deletion. This could disrupt partnerships involving targeted advertising or cross-selling.

Key strategic considerations:

Non-bank BNPL fintech companies must prepare for full licensing and compliance or consider partnerships with exempt banks.
NY-chartered banks and licensed lenders need authorization but must still meet most consumer protection standards.
Merchants offering in-house BNPL are exempt but may be indirectly affected through their BNPL partners.

Looking ahead, New York’s rule is likely to influence other states. While consumer advocates support the move, industry groups warn it may hinder innovation. The light-touch era for BNPL is ending. Fintech leaders should assess compliance gaps, engage in the rulemaking process and adapt their strategies accordingly.