NY: AFC Response to New York Buy Now Pay Later Rulemaking

September 14, 2026
Kaitlin Asrow
Acting Superintendent
New York State Department of Financial Services
1 State Street
New York, NY 10004

Re: Response to New York Buy Now Pay Later Rulemaking

Dear Acting Superintendent Asrow,

On behalf of The American Fintech Council (AFC),  I am submitting this comment letter in response to the New York State Department of Financial Services’ (NYDFS or the Department) proposed addition of Part 423 to Title 3 of the New York Codes, Rules and Regulations and amendment to Part 101 of Title 23 concerning Buy-Now-Pay-Later (BNPL) lenders (Proposed Regulation).

On behalf of more than 150 member companies and partners, AFC promotes an innovative, transparent, inclusive, and customer-centric financial system by fostering responsible innovation in financial services and advancing sound public policy. AFC’s membership includes innovative banks, nonbank lenders, payments companies, financial technology firms, loan servicers, credit bureaus, personal financial management companies, and other financial services participants operating across a broad range of financial activities. Together, AFC members are expanding responsible access to credit, increasing competition in financial services, lowering the cost of financial transactions, and developing high-quality, affordable financial products that better serve consumers and businesses throughout the United States.

AFC recognizes the Department’s substantial work to develop a dedicated regulatory framework for BNPL products and supports the establishment of clear rules that promote transparency, responsible underwriting, effective dispute resolution, and appropriate consumer protections. AFC particularly supports the Department’s effort to address disproportionate penalty fees through standards that tie permissible charges to reasonable limits or demonstrable costs, an approach that directly targets a recognizable source of consumer harm. The final framework, however, should remain carefully calibrated to the products and risks it is intended to govern. BNPL has evolved into a diverse segment of the consumer credit market that includes both interest-free and interest-bearing products, different repayment structures, and a range of bank and nonbank delivery models. That diversity, however, should not result in a definition so expansive that it captures forms of closed-end installment credit that do not possess the defining attributes of a BNPL product. Federal Reserve research similarly recognizes that BNPL encompasses multiple product structures while retaining a defining connection to financing a particular retail purchase, often at or near the point of sale.  Recent federal research also provides important context regarding consumer outcomes. The Congressional Research Service reported that product-level charge-off rates for “Pay in 4” loans remained approximately 2 percent between 2019 and 2023, notwithstanding significant growth in originations during that period.

Against that backdrop, the final rule should focus regulatory obligations on demonstrable risks while preserving flexibility for responsible underwriting, established bank and fintech lending models, and consumer-friendly digital servicing practices. AFC therefore respectfully offers the following recommendations.

I. AFC Recommends that NYDFS Tailors its Licensing and Authorization Framework to Provide Regulatory Certainty and Preserve Established Lending Channels

As a threshold matter, the final rule should more precisely delineate the credit products that fall within the BNPL framework. As drafted, the definition of a “BNPL loan” could be read to encompass a broad range of closed-end installment credit merely because the credit finances a particular purchase of goods or services, including products that do not share the attributes ordinarily associated with BNPL lending. Such a broad construction risks subjecting traditional installment lending and other purchase-specific credit products to a regulatory framework designed for a distinct form of point-of-sale financing. The Department should therefore narrow and clarify the definition so that Part 423 applies to products that meaningfully reflect the defining characteristics of BNPL, including a direct connection to a discrete retail transaction, origination in connection with the consumer’s purchase, and a repayment structure characteristic of BNPL financing. Credit products that lack those defining characteristics should not fall within Part 423 merely because the proceeds are used to finance the purchase of goods or services.

That same principle of careful statutory calibration should govern the rule’s definition of the entities subject to the BNPL framework. Article 14-B defines a BNPL lender as a person that offers BNPL loans and provides that, in the platform context, an entity falls within that definition when the primary purpose of the platform, software, or system with which the consumer interacts is to allow third parties to offer BNPL loans.  The Proposed Regulation instead uses a broader formulation, capturing a platform where a substantial purpose of the consumer’s interaction is to obtain BNPL loans. That change introduces a meaningful difference between the statutory and regulatory standards and could sweep into the framework multipurpose platforms whose principal function is not BNPL lending.

The final rule should therefore conform Section 423.1(d) to the Legislature’s “primary purpose” standard. The Proposed Regulation provides no apparent basis for replacing that standard with the materially lower “substantial purpose” threshold. Retaining the statutory standard would provide an objective limiting principle for multipurpose marketplaces, financial platforms, and software providers while preserving the Department’s authority over platforms genuinely designed to facilitate BNPL lending. This clarification would also reduce uncertainty concerning technology providers whose systems may incidentally facilitate credit, but whose predominant function lies elsewhere.

Relatedly, the final rule should address circumstances in which more than one entity could satisfy the regulatory definition of a BNPL lender with respect to the same transaction. In a bank-fintech or other platform-based arrangement, both the entity extending credit and the platform through which the consumer obtains that credit may potentially fall within the rule’s definition. Applying every transaction-level disclosure, servicing, reporting, and operational obligation independently to each entity could result in duplicative communications and conflicting compliance responsibilities without providing additional protection to the consumer. Accordingly, the Department should clarify that, where multiple regulated entities participate in the same BNPL transaction, the applicable obligations may be allocated among those entities by agreement so long as each required obligation is satisfied, the allocation is appropriately documented, and no gap in consumer protection results.

The Department should likewise clarify that passive ownership of a BNPL receivable does not, without more, transform a secondary market participant into a BNPL lender. The Proposed Regulation adds to the definition of BNPL lender “a person to whom ownership of a BNPL loan is transferred.” That language is not necessary to regulate the consumer-facing entities responsible for originating, offering, servicing, or administering BNPL credit, and it could inadvertently capture institutional investors, securitization vehicles, warehouse financing participants, or other capital markets entities that acquire economic interests in receivables without offering credit to consumers. Article 14-B itself centers the statutory definition on whether a person offers BNPL loans. The final rule should preserve that focus by expressly excluding a transferee that does not originate, market, service, administer, or otherwise participate in offering the loan to the consumer.

Greater clarity is also warranted for entities that are already licensed and supervised under the Banking Law. Article 14-B establishes an authorization pathway, rather than a duplicative BNPL licensing requirement, for banking organizations, qualifying foreign banking corporations, and lenders licensed under Article IX.  The final rule should make clear that this authorization mechanism functions as a streamlined regulatory overlay for entities that are already subject to substantive licensing and supervision by the Department. Existing licensees should not be required to reproduce information, governance materials, financial records, or supervisory submissions already maintained by NYDFS merely because the same institution offers a BNPL product.

Section 423.7(i) recognizes this principle by permitting the Department to exempt an authorized BNPL lender from duplicative reporting.  AFC recommends extending that same principle throughout the regulatory framework, including the authorization application process, financial reporting, examination materials, and other supervisory requirements where NYDFS already possesses substantially equivalent information. Such an approach would also advance the Legislature’s express direction that, when implementing Article 14-B, the Superintendent considers other provisions of the Banking Law for the purpose of avoiding conflicting requirements.

The Department should also narrow the affiliate scope of the audit requirement. As drafted, Section 423.7(h) extends to audit reports concerning affiliates of the licensee, which could compel production of materials for entities the Department does not supervise and that may have no involvement in BNPL lending. The final rule should limit the requirement to reports that address the licensee’s own BNPL activities or, where affiliate operations are relevant, to the specific portions of such reports that bear on the licensee’s compliance with Article 14-B and Part 423.

Additionally, avoiding conflicting requirements is particularly important given the different statutory treatment of federally chartered and New York-supervised banking institutions. Article 14-B expressly exempts national banks and certain other federally chartered institutions from the BNPL licensing framework, while requiring New York banking organizations and certain other institutions already supervised by the Department to obtain authorization before offering covered BNPL products. Although that distinction originates in the statute, the implementing regulations should not compound it by subjecting authorized banking organizations to duplicative requirements that provide little incremental supervisory value. This concern is consistent with the broader principle underlying the dual banking system that institutions should be able to choose between state and national charters without suffering a structural competitive disadvantage solely because of that choice. As the Conference of State Bank Supervisors – of which NYDFS is a member – recently observed in a separate interstate-lending context, regulatory differences that place state-chartered banks at a competitive disadvantage relative to national banks can undermine the balance of the dual banking system and distort charter choice.  Where an institution is already subject to comprehensive prudential, compliance, information-security, and examination requirements administered by the Department, the BNPL framework should operate as a targeted product authorization rather than a second, parallel supervisory regime.

Furthermore, the Department should apply the same proportionality to the rule’s numerous posting and notice requirements. The Proposed Regulation requires license or authorization information to appear across mobile applications, websites, other consumer interfaces, loan terms and conditions, and, in certain circumstances, advertising, while other provisions separately require complaint, customer-service, and consumer-protection information to be displayed through many of the same channels. Each disclosure may serve an identifiable purpose when viewed independently, but their cumulative effect could require providers to layer substantial regulatory text onto consumer interfaces in a manner that makes material transaction information more difficult, rather than easier, for consumers to identify and understand. Article 14-B expressly authorizes the Superintendent to provide an alternative form of notice of licensure. The final rule should use that flexibility to permit consolidated or appropriately linked regulatory notices where the required information remains clear, conspicuous, and readily accessible to the consumer.

Finally, the transitional process should provide sufficient time for firms to implement an entirely new licensing and authorization regime without unnecessary disruption to consumers or merchants. To facilitate implementation, NYDFS should also issue compliance guidance or other interpretive materials alongside the final rule to help regulated entities understand the scope and application of their new compliance obligations. Although the Proposed Regulation would become effective 180 days after publication of the Notice of Adoption, Section 423.14 provides existing BNPL lenders only 45 days following the effective date to submit the applicable licensing or category permission application. The Department should extend that filing period to at least 90 days and make the final application forms, instructions, and category permission requirements available sufficiently in advance of the effective date to permit meaningful preparation. NYDFS should also permit applicants to submit materials during the 180-day implementation period and confirm that a complete, timely application preserves provisional authority while Department review remains pending. These measures would facilitate an orderly transition without compromising the Department’s supervisory authority.

II. AFC Recommends that NYDFS Pursues Proportionate Supervisory Reporting Requirements that Preserve Privilege and Protect Confidential Commercial Information

Supervision is most effective when regulators receive information that is relevant to the activities they supervise, while preserving established protections for privileged, confidential supervisory, and commercially sensitive information. Several provisions of Sections 423.6 and 423.7 would benefit from additional limitations and clarification to ensure that the Department receives information necessary to supervise BNPL activity without compelling unnecessarily broad production of information generated for materially different purposes.

First, Section 423.6 requires lenders to maintain information concerning legal actions, settlements, collection expenses, and circumstances in which an attorney has been asked to commence legal action, with the required information made readily accessible for Department examination. The final rule should expressly provide that nothing in Part 423 requires the production or disclosure of information protected by the attorney-client privilege, attorney work-product doctrine, or any other applicable legal privilege or protection, and that compliance with the rule does not constitute a waiver of any such privilege or protection. The Department can obtain the factual information necessary for supervision without creating uncertainty regarding the treatment of privileged legal communications or attorney work product.

Second, the Department should clarify the scope of the annual compliance assessment required by Section 423.7(b). The Proposed Regulation would require audited annual financial statements to include an assessment by management of the licensee’s compliance with all applicable laws, rules, and regulations. That requirement could be read to encompass information extending well beyond the financial condition of the licensee. The final rule should limit the required assessment to financial statement information reasonably relevant to compliance with Article 14-B, Part 423. It should also permit institutions already subject to Department supervision to rely upon substantially equivalent compliance assessments or supervisory submissions already provided to NYDFS.

Sections 423.7(g) and (h) raise related concerns regarding commercially sensitive information. Section 423.7(g) requires licensees to maintain lending policies, pricing exception procedures, pricing matrices, and documents reflecting the establishment of credit grades. Section 423.7(h), in turn, would require a licensee to provide the Department within ten days a certified copy of any audit report received from a lender extending a line of credit, an investor, or a party to a loan purchase agreement. These materials can contain proprietary pricing methodologies, capital-markets information, counterparty terms, risk tolerances, and other competitively sensitive information unrelated to consumer deposit-taking or traditional prudential supervision. The final rule should limit production to information reasonably relevant to the Department’s supervision of the licensee’s BNPL activities and should expressly preserve applicable protections for confidential commercial information and confidential supervisory information.

The third-party audit requirement should be further narrowed. An audit or diligence report prepared for a warehouse lender, investor, purchaser, or other financing counterparty may evaluate matters particular to that commercial relationship and may incorporate confidential information belonging to the counterparty or another contractual partner. Requiring automatic submission of every such report, regardless of its relationship to BNPL compliance, could place licensees in conflict with contractual confidentiality obligations while producing substantial amounts of information that may have limited supervisory relevance. AFC recommends that Section 423.7(h) require production only of third-party audit reports, or relevant portions of such reports, that materially relate to the licensee’s BNPL activities or compliance with Article 14-B and Part 423, and that the Department permit appropriate redaction of information that is immaterial, privileged, or subject to third-party confidentiality restrictions.

III. AFC Supports Flexible, Risk Based Underwriting Standards that Will Protect Consumers While Preserving Responsible Access to Credit

Reasonable underwriting should be centrally predicated on whether a transaction presents an appropriate credit risk without prescribing a single methodology for every product, consumer, and business model. Article 14-B reflects precisely that approach. Section 746 requires BNPL lenders to perform “reasonable risk-based underwriting,” maintain appropriate policies and procedures, and disclose the factors considered in the underwriting process. It does not require the lender to assess the nuances of every particular data element in each transaction.

Section 423.12(b), by contrast, would require reasonable risk-based underwriting to include, “at a minimum,” an assessment of a consumer’s income and indebtedness.  This prescription risks transforming a flexible statutory standard into a de facto ability-to-repay requirement that is not contained in the enacted statute. That distinction is particularly significant given the legislative history. An earlier BNPL proposal, Assembly Bill 9588A, expressly required lenders to make a reasonable determination of a consumer’s “ability to repay.”   The enacted framework ultimately adopted the materially different formulation of “reasonable risk-based underwriting.”      That progression supports preserving the flexibility inherent in the language ultimately enacted by the Legislature.

The practical characteristics of BNPL lending reinforce the value of a risk-based approach. Providers may evaluate transaction amount, payment history, prior performance with the provider, cash flow information, fraud indicators, consumer-permissioned account information, credit bureau information, or other risk variables depending upon the product and consumer. Federal Reserve research similarly observes that BNPL providers employ differing credit assessment practices, including soft credit inquiries, depending upon product structure.  Requiring income and indebtedness to be assessed in every transaction could compel providers to obtain additional data that may not materially improve the credit decision for a particular low-dollar transaction, while increasing friction, operational expense, and the amount of sensitive consumer information collected.

AFC therefore recommends that Section 423.12(b) track the statutory standard and require “reasonable risk-based underwriting” without prescribing income and indebtedness as mandatory elements. The Department can preserve robust supervisory oversight by requiring lenders to maintain written underwriting policies that identify the factors relevant to their products, document the rationale for those factors, test portfolio performance, and adjust underwriting practices when performance indicates heightened consumer or credit risk. This approach would regulate the quality and effectiveness of underwriting rather than mandate a uniform set of inputs.

The available performance data further counsels against imposing a prescriptive underwriting requirement without a corresponding analysis of its incremental benefits and costs. The Congressional Research Service found that Pay in 4 charge-off rates remained around 2 percent at the product level from 2019 through 2023, with reported charge-off rates of approximately 1.7 percent in 2022 and 0.9 percent in 2023.  These figures do not eliminate the need for responsible underwriting, but they support evaluating whether a mandatory income and indebtedness assessment would materially improve consumer outcomes relative to flexible underwriting practices already employed in the market.

That inquiry is also important under the New York State Administrative Procedure Act (SAPA). SAPA Section 202-a requires a regulatory impact statement to detail projected implementation and continuing compliance costs to regulated persons, identify the information and methodology supporting the cost analysis, and provide the agency’s best estimate where a complete cost statement cannot be produced.  The Department has not provided a sufficiently clear estimate of the incremental costs associated with requiring income and indebtedness assessments for every BNPL transaction, even though compliance with that requirement will necessarily impose additional operational and data-related costs on regulated providers.

This omission is especially significant because the income and indebtedness mandate represents a regulatory specification beyond the text of Article 14-B. Depending on how the Department interprets the requirement to “assess” income and indebtedness, compliance could require providers to obtain new data sources, modify underwriting infrastructure, establish new verification procedures, and incur substantial recurring data acquisition expenses. The relevant inquiry is therefore not simply whether regulated entities will experience some compliance expense. It is whether the incremental expense associated with this particular mandate is proportionate to a demonstrated incremental consumer benefit.

Information provided by AFC members demonstrates that the costs associated with a more prescriptive interpretation of the proposed underwriting requirement could be substantial. One member estimated that developing a more rigorous income and indebtedness verification program could require approximately $250,000 in one-time technology development costs and approximately $100,000 in recurring annual data expenses. Another member estimated that requiring credit-report inquiries and third-party income verification across its New York application volume could result in approximately $39 million in additional annual costs, or nearly $4 in incremental cost for each originated loan.

The potential effects would extend beyond direct compliance expenditures. Member estimates indicate that the additional per-transaction costs associated with mandatory verification could cause millions of otherwise viable loans to become uneconomic to originate, potentially reducing the amount of credit available to New York consumers by more than $500 million annually.  These estimates are provider-specific and depend upon the precise scope of the Department’s ultimate requirement, but that variation itself underscores the importance of regulatory clarity. An obligation to assess income and indebtedness using information already incorporated into an existing underwriting process presents a materially different cost structure from a requirement to independently obtain or verify that information for every application.

Against this backdrop, AFC respectfully recommends that the Department remove the requirement that reasonable risk-based underwriting include an assessment of a consumer’s income and indebtedness from Section 423.12(b). Article 14-B does not prescribe those factors as mandatory elements of every underwriting decision, and the record does not demonstrate that requiring their assessment in every BNPL transaction would produce consumer benefits sufficient to justify the resulting costs, operational burdens, and potential reduction in access to credit. The final rule should instead adhere to the Legislature’s performance-based standard and permit lenders to determine, through reasonable risk-based underwriting, which factors are appropriate to the particular product, transaction, and consumer.

If the Department nevertheless determines that some form of mandatory income or indebtedness assessment should be retained, it should, at a minimum, undertake and publish a specific assessment of the incremental costs and economic effects of that requirement before adopting it in the final rule. That analysis should consider differences among interest-free Pay in 4 products, longer-term installment products, transaction sizes, underwriting models, application volumes, and providers that do not presently obtain or independently verify income or comprehensive indebtedness information. It should also distinguish between requiring lenders to consider information reasonably available through their existing underwriting processes and requiring lenders to obtain or independently verify additional information for each application. SAPA separately requires an agency’s assessment of public comment to address submitted cost estimates that differ significantly from those presented by the agency, further underscoring the importance of developing a complete record if the Department elects to retain this requirement.

Removing the mandatory income and indebtedness assessment and preserving a flexible, risk-based underwriting standard would honor the Legislature’s chosen framework, maintain the Department’s ability to supervise underwriting effectiveness, and avoid imposing data collection and compliance costs that may ultimately be reflected in reduced product availability or higher costs for consumers.

IV. AFC Supports Consumer Disclosure and Servicing Requirements that Will Provide Actionable Information Without Creating Redundant Communications or Unnecessary Data Sharing

Consumer disclosures typically garner greater efficacy when they present relevant information at the time and in the format most useful to the target consumer. BNPL products are generally obtained and managed through digital interfaces that already provide consumers immediate access to transaction histories, payment schedules, balances, and upcoming payment information. The final regulatory framework should build on those capabilities rather than replicate statement practices developed for fundamentally different credit products.

Section 423.12 would require a pre-transaction disclosure before consummation, a post-transaction confirmation within one business day, and recurring periodic statements for statement cycles of no more than 30 days.  The periodic statement should aggregate all covered BNPL loans made between the BNPL lender and the consumer. The cumulative framework should be carefully calibrated to ensure that each required communication provides meaningful incremental value to consumers and does not simply duplicate information already available through existing digital interfaces.

A related disclosure issue concerns consumer reporting. The Proposed Regulation would require lenders to disclose whether and under what circumstances BNPL information is furnished to consumer reporting agencies, but disclosure alone does not address the broader informational limitations created when BNPL obligations are not reflected in consumer reporting systems. It could even make the problem worse, by causing consumers who see a disclosure from one BNPL lender that it reports to the credit bureaus to switch to another lender that doesn’t report. That would result in the consumers who are concerned about their ability to repay a loan – who are also the ones whose debt is most important to be captured in a credit report – becoming the least likely to have their loans reported. AFC recommends that the Department instead consider establishing a consistent reporting requirement for licensed BNPL lenders, subject to applicable consumer reporting requirements and appropriate standards concerning accuracy and disputes. Consistent reporting could provide lenders with greater visibility into consumers’ outstanding BNPL obligations and thereby reduce the risk that consumers accumulate overlapping obligations across multiple providers.

The same need for product-specific calibration applies to the proposed billing-error framework. AFC supports clear and effective mechanisms through which consumers can dispute unauthorized transactions, undelivered goods or services, payment-crediting errors, and other legitimate billing issues. The final rule, however, should account for the closed-end and transaction-specific nature of BNPL credit when establishing the procedures through which those rights are exercised. Requirements structured around recurring statement cycles, together with mandatory acceptance of billing-error notices through multiple channels, can create operational complexity that is not necessary to preserve substantive dispute protections. The Department should therefore align the dispute framework with the characteristics of BNPL products and permit lenders to establish accessible, reliable, and documented channels for receiving and resolving disputes without prescribing procedures that depend upon an open-end account model.

Similar clarification is warranted for the unauthorized-use provisions in Section 423.12(d)(10). The Proposed Regulation defines an “access device” broadly to include cards, login credentials, account numbers, codes, and other means by which a consumer may obtain or use funds from a BNPL loan, and conditions consumer liability in part upon the lender having employed “effective and appropriate measures” to authenticate and verify the identity of the user immediately before credit is extended. AFC supports effective protections against unauthorized use, but the final rule should provide greater clarity regarding how these concepts apply to the varied ways in which BNPL transactions are initiated. In particular, the Department should clarify the circumstances in which a credential, account identifier, or merchant-facing mechanism constitutes an access device and provide a flexible standard under which reasonable, risk-based authentication methods may satisfy the identity-verification requirement. The rule should recognize that appropriate authentication may vary based upon the transaction, channel, device, existing customer relationship, and fraud risk rather than require a particular verification technology or repeated collection of additional consumer information.

Distinct but related concerns arise from the rule’s language requirements. Section 423.12 would require covered disclosures to be translated into Spanish regardless of whether the lender markets or conducts the transaction in Spanish, while separately requiring lenders to accept and respond to billing-error notices, unauthorized-use notices, and requests for forbearance in Spanish and in any language principally used in the lender’s New York advertising.  Providing consumers with understandable information is an important objective, particularly when a lender has chosen to market or conduct business in a particular language. A categorical language mandate imposed solely because a product qualifies as BNPL, however, would subject BNPL lenders to obligations that do not generally apply across other financial products offered in New York. The Department should not impose a heightened language requirement on BNPL products absent a demonstrated, product-specific basis for treating BNPL differently from other forms of consumer credit. Any language-access requirement should instead be applied consistently across comparable financial products or tied to the languages in which a lender elects to market, offer, or conduct the relevant consumer relationship.

The operational burden extends well beyond document translation. Section 423.12(f)(1)(iii) requires lenders to “completely and accurately” respond to billing-error notices, unauthorized-use claims, and forbearance requests in Spanish and in any language principally used in New York advertising. That standard effectively mandates multilingual dispute-resolution staffing or contracting, not merely the translation of written materials. For digital-first providers that do not currently advertise or negotiate in Spanish, this requirement would compel them to build or procure live-agent servicing capabilities in a language unrelated to the language in which the consumer relationship was established. AFC therefore recommends that the Department remove the categorical Spanish-language requirement and instead tie any mandatory translation and language-servicing obligations to the languages in which the lender markets, offers, or conducts the relevant consumer relationship. If the Department nevertheless elects to impose a language requirement on BNPL products that is not imposed comparably across other financial products in New York, it should identify the BNPL-specific consumer need that warrants that differential treatment and assess the associated implementation and continuing compliance costs.

The same principle of tailoring consumer communications to the manner in which consumers actually interact with BNPL products should inform the Department’s consideration of whether a separate periodic statement requirement is necessary. Many BNPL consumers already have continuous electronic access to transaction histories, outstanding balances, payment schedules, and upcoming payment information through provider applications and online accounts. Where those tools provide the information required by Section 423.12(a)(4) in a form that consumers can retain or download and are accompanied by appropriate payment notices, the Department should permit those existing digital tools to satisfy the applicable ongoing information requirements rather than require an additional periodic communication.

More fundamentally, the Department should not require providers to replace or supplement digital tools that already present the relevant information in real time unless it can demonstrate that the prescribed periodic statement format would materially improve consumer understanding. Many BNPL consumers can currently view outstanding loans, transaction amounts, upcoming payment dates, and other material information directly through a provider’s application or online account. If the Department believes an additional periodic communication is warranted, it should first compare consumer understanding of those existing interfaces with understanding produced by the proposed statement framework. Such testing would help ensure that the final rule is designed around the information consumers actually find useful rather than the statement architecture traditionally associated with materially different forms of credit.

If the Department nevertheless retains a periodic statement requirement, it should at minimum limit any consolidation requirement to BNPL loans administered through the same consumer-facing program, platform, or servicing relationship. This clarification is particularly important in bank partnership models. A single regulated financial institution may support multiple BNPL programs operated through unrelated technology providers or merchant platforms. If the requirement to include “all BNPL loans made between a BNPL lender and a consumer” is interpreted at the legal-entity level, compliance could require unrelated program managers to exchange consumer-level information solely so that a bank or service provider can generate a consolidated statement.

That result would be operationally complex and could require data sharing that would not otherwise occur. It would also create unnecessary cybersecurity, privacy, and competitive sensitivity concerns without necessarily improving the consumer’s understanding of any particular loan. The final rule should expressly provide that consolidation is required only for BNPL loans administered through the same consumer-facing program, platform, or servicing relationship. Where the same legal lender supports unrelated programs, each program should be permitted to provide the consumer with the information for the loans it actually services or administers.

The rule’s payment-allocation provisions warrant similar attention. Section 423.9(c) would prescribe not only the functionality of a lender’s payment interface, but also the sequence in which allocated and unallocated payments must be applied across principal, interest, fees, and multiple outstanding BNPL loans.  Although consumers should retain a meaningful ability to direct payments and prepay outstanding obligations, a uniform regulatory waterfall may require substantial changes to servicing systems and may not correspond to the contractual structure or operational design of every BNPL product. The Department should therefore preserve the consumer’s ability to direct a payment to a particular obligation while allowing lenders to employ reasonable and clearly disclosed methodologies for allocating payments that the consumer does not specifically direct. Such a principles-based approach would protect consumer control without prescribing a single servicing architecture for materially different products and platforms.

The failed-payment provisions in Section 423.11(b) would similarly benefit from alignment with existing industry standards. NACHA Operating Rules already impose limits on the number of times a returned electronic payment may be reinitiated and establish timeframes for doing so. Rather than introduce a separate, potentially inconsistent framework, the Department should permit compliance with applicable NACHA rules to satisfy the requirements of Section 423.11(b) with respect to payment retry limits and procedures.

The Department should similarly reduce unnecessary repetition between pre-transaction and post-transaction disclosures. The final rule could permit a post-transaction confirmation to reproduce the transaction-specific terms, including the amount financed, payment schedule, applicable fees, merchant, and transaction date, while incorporating unchanged standardized consumer protection disclosures through a clear reference or readily accessible electronic link. Consumers would continue to receive the information necessary to document each transaction without receiving duplicative blocks of standardized text immediately after acknowledging substantially the same information before consummation.

Furthermore, the Department should also calibrate the complaint-policy notification requirement in Section 423.13(c). As drafted, the provision would require a BNPL lender to report any change in its complaint policies or procedures within seven days, without distinguishing material changes from routine operational updates. Complaint-management programs necessarily evolve as providers adjust internal workflows, personnel responsibilities, escalation procedures, technology, and other operational details. Requiring regulatory notice for every such modification would generate frequent submissions without necessarily providing meaningful supervisory information. AFC recommends limiting the notification obligation to material changes that could reasonably affect the manner in which consumer complaints are received, investigated, escalated, resolved, or reported, and providing at least 30 days following implementation of such a change for notification to the Department.

Taken together, these recommendations would preserve substantive consumer protections while ensuring that the regulatory framework delivers those protections in a practical, efficient, and operationally workable manner. Consumers would continue to receive clear terms before entering a transaction, confirmation of their obligations after consummation, ongoing access to balances and transaction histories, meaningful control over payments, and effective mechanisms for addressing disputes, unauthorized transactions, refunds, and other servicing concerns. The difference is that the regulatory framework would focus on the accessibility, clarity, and effectiveness of those protections rather than prescribe communications and operational processes that may not correspond to the structure of modern BNPL products.

V. AFC Supports a Harmonized Consumer Data Framework that Will Protect Consumer Privacy While Preserving Legally Required and Operationally Necessary Uses of Data

Strong consumer privacy protections are fully compatible with a financial system in which regulated entities must process, retain, and share limited information for legitimate operational, compliance, fraud prevention, servicing, and legal purposes. As such, the final rule should distinguish those necessary functions from unrelated commercial uses of consumer data. Section 423.12(e) would establish a granular affirmative consent framework for the use, sale, and sharing of covered data outside the making of a particular BNPL loan.  It also provides that, upon expiration or withdrawal of consent, covered data not required in connection with making a particular BNPL loan must be deleted by the lender and by third parties with whom the information was shared within 30 days. AFC certainly supports transparent consumer choice concerning uses of data unrelated to the financial product the consumer requested. The rule, however, should expressly recognize uses and disclosures already permitted or required under the Gramm-Leach-Bliley Act and Regulation P. Regulation P contains established exceptions for information used to process or service a consumer-requested transaction, maintain an account, conduct securitizations or secondary market transactions, prevent fraud, manage institutional risk, resolve consumer disputes, furnish information to consumer reporting agencies where legally permissible or required under the final regulatory framework, and comply with federal, state, or local law and regulatory process.  A New York-specific consent regime should not inadvertently interfere with these established functions.

Accordingly, AFC recommends that the final rule provide that affirmative consent is not required for the use or sharing of covered data to the extent the activity is necessary to originate, underwrite, process, service, administer, enforce, transfer, audit, or maintain a BNPL loan; protect against fraud or unauthorized transactions; comply with applicable law or regulatory requirements; respond to consumer disputes; or perform another activity permitted without consumer opt-in under applicable federal privacy law. For uses outside these functions, the Department should align consumer choice requirements as closely as practicable with the existing federal privacy framework rather than create overlapping consent requirements for the same information.

The deletion requirement warrants comparable clarification. The Proposed Regulation generally limits affirmative consent to a one-year period and, upon expiration or withdrawal of consent, requires covered data that is not required in connection with making a particular BNPL loan to be deleted within 30 days. Financial institutions and their service providers, however, are subject to recordkeeping, examination, litigation preservation, fraud prevention, consumer reporting, tax, and other legal obligations that may require records to be maintained substantially longer. Article 14-B itself requires BNPL lenders to preserve books, accounts, and records for at least six years after the final entry relating to a BNPL loan.  An unconditional 30-day deletion obligation therefore risks creating uncertainty as to which information remains lawfully or reasonably necessary to satisfy those obligations.

Additionally, the final rule should expressly exempt data that the lender or another regulated entity is required or reasonably necessary to retain under federal or state law, regulation, supervisory requirement, legal process, litigation hold, fraud prevention obligation, or a documented record-retention policy implementing such requirements. The Department should further clarify that expiration or withdrawal of consent terminates the discretionary use or sharing authorized by that consent but does not require destruction of records that remain necessary for a legitimate legal, regulatory, security, fraud-prevention, servicing, or supervisory purpose. Once the applicable retention justification no longer exists, deletion can proceed in accordance with the consumer’s request. New York has employed a comparable approach in other data-protection contexts by coupling data-minimization and deletion requirements with express retention periods for information that remains necessary to demonstrate regulatory compliance.

More broadly, harmonization in this area is itself a consumer protection. Conflicting privacy standards can require providers to develop parallel data architectures, consent flows, and retention rules for a single financial product based solely upon jurisdiction. A framework that distinguishes optional commercial uses from necessary financial and legal functions would provide consumers meaningful control over their information while allowing regulated entities to meet the obligations that protect account integrity, facilitate dispute resolution, prevent fraud, and support effective supervision.

* * *

AFC appreciates the opportunity to comment on the Department’s Proposed Regulation and recognizes NYDFS’s continued efforts to establish a thoughtful framework for the responsible provision of BNPL products in New York. A final rule that closely tracks Article 14-B, preserves flexible and effective underwriting, delivers consumer information in a practical digital format, harmonizes data protections with existing law, and provides a workable transition to the new supervisory regime can advance meaningful consumer protections without unnecessarily constraining responsible access to credit.

As the Department continues its work to finalize this framework, AFC remains ready to serve as a resource in support of a regulatory approach that promotes consumer protection, regulatory clarity, and responsible innovation in New York’s financial services market.

Sincerely,

Ian P. Moloney
Chief Policy Officer
American Fintech Council

‍
[1] American Fintech Council’s (AFC) membership spans banks, non-bank lenders, payments providers, EWA providers, loan servicers, credit bureaus, and personal financial management companies.
[2] New York State Department of Financial Services, Proposed New 3 NYCRR Part 423 and Amendment to 23 NYCRR Part 101: Buy-Now-Pay-Later (BNPL) Lenders (2026).
[3] Nina R. Acree, Kayleigh Barnes, Alexander Bruce, and Simona M. Hannon, “‘Buy Now, Pay Later’ Beyond ‘Pay in 4’: A Comprehensive Product Overview,” FEDS Notes (Washington, DC: Board of Governors of the Federal Reserve System, June 5, 2026), Federal Reserve.
[4] Karl E. Schneider and Paul Tierno, Buy Now, Pay Later: Policy Issues and Options for Congress, CRS Report No. R48858 (Washington, DC: Congressional Research Service, February 18, 2026), 9, Congress.gov.
[5] N.Y. Banking Law § 736(3) (McKinney 2026).
[6] See N.Y. Banking Law § 737(1)–(2) (2026).
[7] New York State Department of Financial Services, Proposed New 3 NYCRR Part 423 and Amendment to 23 NYCRR Part 101: Buy-Now-Pay-Later (BNPL) Lenders (2026), 7.
[8] Please see attached Appendix I, Conference of State Bank Supervisors, letter to French Hill, Chairman, and Maxine Waters, Ranking Member, U.S. House Committee on Financial Services, regarding the American Lending Fairness Act of 2026, September 1, 2026, 1–2.
[9] New York State Department of Financial Services, Proposed New 3 NYCRR Part 423 and Amendment to 23 NYCRR Part 101: Buy-Now-Pay-Later (BNPL) Lenders (2026), 18.
[10] New York State Assembly, A. 9588-A, 2023–2024 Leg., Reg. Sess. (N.Y. 2024), https://www.nysenate.gov/legislation/bills/2023/A9588/amendment/A.
[11] Nina R. Acree, Kayleigh Barnes, Alexander Bruce, and Simona M. Hannon, “‘Buy Now, Pay Later’ Beyond ‘Pay in 4’: A Comprehensive Product Overview,” FEDS Notes (Washington, DC: Board of Governors of the Federal Reserve System, June 5, 2026), https://www.federalreserve.gov/econres/notes/feds-notes/buy-now-pay-later-beyond-pay-in-4-a-comprehensive-product-overview-20260605.html.
[12] Karl E. Schneider and Paul Tierno, Buy Now, Pay Later: Policy Issues and Options for Congress, CRS Report No. R48858 (Washington, DC: Congressional Research Service, February 18, 2026), https://www.congress.gov/crs-product/R48858.
[13] N.Y. State Admin. Proc. Act § 202-a (McKinney 2026), New York State Senate
[14] Confidential information provided to the American Fintech Council by member companies in September 2026, on file with AFC. AFC has aggregated or rounded certain figures to protect competitively sensitive information. Estimates reflect member-specific assumptions concerning existing underwriting practices, application and origination volumes, third-party data costs, and the scope of income and indebtedness verification that could be required under the Proposed Regulation.
[15] Id. One member estimated that the incremental underwriting costs associated with a more prescriptive verification requirement could render millions of otherwise viable loans uneconomic and reduce annual credit availability to New York consumers by more than $500 m
[16] New York State Department of Financial Services, Proposed New 3 NYCRR Part 423 and Amendment to 23 NYCRR Part 101: Buy-Now-Pay-Later (BNPL) Lenders (2026), 16.
[17] New York State Department of Financial Services, Proposed New 3 NYCRR Part 423 and Amendment to 23 NYCRR Part 101: Buy-Now-Pay-Later (BNPL) Lenders (2026), 13.
[18] New York State Department of Financial Services, Proposed New 3 NYCRR Part 423 and Amendment to 23 NYCRR Part 101: Buy-Now-Pay-Later (BNPL) Lenders (2026), 11.
[19] New York State Department of Financial Services, Proposed New 3 NYCRR Part 423 and Amendment to 23 NYCRR Part 101: Buy-Now-Pay-Later (BNPL) Lenders (2026), 23.
[20] 12 C.F.R. §§ 1016.14–1016.15 (2026).
[21] N.Y. Banking Law § 743(1) (McKinney 2026), New York State Legislature.
[22] New York State Office of the Attorney General, “Part 700. SAFE for Kids Act,” 13 N.Y.C.R.R. § 700.7(a)(4), (b) (2026) (requiring covered operators generally to retain compliance-related data only for the minimum time necessary and thereafter delete it, while requiring specified records to be retained for no less than five years).

‍

‍

‍

‍

‍

‍