New York's Proposed Regulations for Buy Now, Pay Later Consumer Finance Services

Who must be licensed turns on the definition of a BNPL loan. A “BNPL loan” is defined as closed-end credit provided to an individual New York resident consumer in connection with a particular purchase of goods or services other than a motor vehicle, and may be either interest-free or interest-bearing.  BNPL lenders that are not banks must obtain a license from the DFS. Federally chartered financial institutions are exempt.[1] Banks that are not exempt must obtain a written authorization from the superintendent to provide BNPL loans and “category permission.”

*****

[1] Exempt organization" means any national bank, federal savings bank, federal savings and loan association, federal credit union, federal trust company, or foreign banking corporation licensed by the
comptroller of the currency to transact business in this state. Buy-Now-Pay-Later Act, 2 CLNY Art. 14-B, Section 736(5). 

BNPL lenders must also have a “category permission” to offer either interest-free or interest-bearing BNPL loans or both, as approved by the superintendent, which will be indicated on their licenses.

A licensee must post its license “clearly and conspicuously” on all of its mobile apps, websites and “other consumer interfaces” showing the information specified for display in the license. It is not clear whether and how this posting requirement would apply to retailers’ displays that offer the option to finance purchases through the BNPL plan. The proposal does not appear to require posting by a bank that offers BNPL loans.[1]

*****

[1] See Section 423.2(e).

Any change of control of a licensee must have the prior approval of the superintendent. “Control” generally means ownership of at least 10% of the voting stock or otherwise has power to direct the management and policies of the license.[1]  Changes of directors and principal officers must be reported within 30 days. “Principal officer” means executive managers, including (but not limited to) the chief executive, financial, operating, and compliance officers, president, general counsel, managing partner, general partner, controlling partner, and trustee.

*****

[1] Section 423.1(j).

The proposal includes detailed specific records that must be kept for each consumer’s application and account, including transactions and collection activity.

Licensees must prepare and file with the DFS unaudited quarterly and audited annual financial reports, including specified minimum data. Annual reports must be certified by a principal officer attesting to their accuracy. Additional quarterly and special reports, with (as yet) unspecified information, must also be submitted. Any criminal action or insolvency proceeding against the BNPL lender, affiliates, directors, principal stockholders, or principal officers must be reported immediately.

Non-exempt banks must make the same reports as licensees, except that the superintendent may exempt reports that duplicate reports the bank is otherwise required to make to the DFS.

Licensees must designate a “qualified individual” responsible for directing and monitoring compliance activities. The NY DFS typically has required relatively strong credentials and experience for individuals to be deemed “qualified.”

Licensees must submit any audit report (including audits of affiliates) conducted by the licensee’s lenders, investors or loan purchasers, within 10 days of the licensee’s receipt of the report.

All advertisements of BNPL loans must name the licensee and include the legend: “Licensed to offer BNPL loans by the New York State Department of Financial Services.” Advertising must not contain any “false, misleading, or deceptive representations or omissions.”

Specific required disclosures:

• Ads that state a periodic payment amount must also state the total of payments and the time period for repayment, equally prominently to the periodic payment amount.
• Pricing terms such as “as low as” or “from” must “prominently and contemporaneously” disclose the likelihood of getting the specified terms.

Licensees and non-exempt banks must maintain all advertising materials in every medium for 7 years, including “website captures” and audio and video scripts.

• Interest on interest-bearing BNPL loans appears to be limited to 16% per annum, although the applicable rate is not clear because of ambiguous cross-references in the cited statutes.[1]
• Penalty fees for late payments or other agreement violations may be the higher of $8 or an amount approved by the superintendent related to the lender’s total costs of the violation but not including collection costs.
• Penalty fees may not exceed the dollar amount of the missed payment and may not be charged at all for a violation not associated with a specific dollar amount.
• Not more than one penalty fee may be charged in respect of one event or transaction.
• The total of all penalty fees for violation of one loan agreement may not exceed the original amount financed.
• Late fees may not be charged unless the consumer received a timely periodic statement.
• Fees may not be charged related to the method of payment (i.e., no surcharges) unless the payment is expedited by the BNPL lender’s customer service representative.
• Principal and accrued interest may be prepaid at any time without any charge for prepayment.
• The regulation prescribes the order of allocation of payments.

*****

[1] Proposed Section 423.9. See N.Y. General Obligations Law, § 5-501; N.Y. Banking Law § 14-a(1). (This reference in Section 5-501 appears to lead to banking laws relating to student loans. It is also not clear if the Banking Law rate would apply to non-bank BNPL licensees. Possible revisions to the proposed regulation might well clarify the applicable usury rates for banks and non-bank BNPL lenders.)

Tips must be disclosed as voluntary and non-payment must not affect the terms of the BNPL loan. Tips may only be solicited once in connection with a transaction. The default tip must be $0 and it must not be difficult for the consumer to avoid paying a tip.

Licensees must post a corporate surety bond in an amount sufficient to cover outstanding obligations to consumers, “e.g. refunded amounts,” subject to the superintendent’s power to require a greater amount.

• Violation of one loan agreement may not default another agreement, i. e., no cross-defaults.
• Lender may not make more than 2 attempts to collect a payment, e. g., submit a card transaction, without a new authorization by the consumer.

The form, timing and content of disclosures are specified in proposed Section 423.12. English language disclosures must also be provided in Spanish and any language “principally used” in advertisements.

Pre-transaction disclosures

1. Timing – before consummation
2. Format – electronic disclosures must be unavoidable and in the form of the Model Form.
3. Acknowledgement – the consumer must acknowledge receipt.
4. Content –
   • Creditor. The identity of the BNPL lender making the disclosure.
   • Amount financed, calculated in the prescribed manner.
   • Finance charge, such as “the dollar amount the credit will cost you.”
   • Itemization of finance charge.
   • Annual percentage rate (if there is a finance charge) and a brief description such as “the cost of your credit as a yearly rate.”
   • Payment schedule – The number, amounts, and timing of payments scheduled to repay the obligation.
   • Total sale price, calculated as prescribed.
   • Fees – the amount of any fees other than finance charges.  
   • Default – consequences of defaulting, such as reporting delinquency to consumer reporting agencies and referral to a debt collector.
   • Consumer reporting – what information would be furnished to a reporting agency or not; disclosure that a transferee of the loan may not be bound.
   • Dispute rights – outline of consumer’s rights to dispute charges, as prescribed.
   • Refund rights – outline of the consumer’s rights to a refund, as prescribed.
   • Unauthorized use – outline of the consumer’s remedies for unauthorized use, as prescribed.
   • Contract reference - the appropriate contract document for further information.
   • Additional information, as applicable, that would be required under 12 C.F.R. § 1026.18 (Truth in Lending Act, Regulation Z, Closed-end credit disclosures).

Post-transaction confirmation

The BNPL lender must provide a confirmation within one business day after consummation of a transaction, containing the following information:

• All contents of the pre-transaction disclosures
• Consumer name and address
• Date of the transaction and retail seller’s name

Periodic statements

A BNPL lender must provide statements at least monthly for each billing cycle for which the account balance is more than $0. The statement must be provided at least 14 days prior to the payment due date if the billing cycle is 30 days or more and at least 7 days prior to the payment due date if the billing cycle is less than 30 days. The statement must include all existing BNPL loans to the consumer in one statement. Statements must include:

• Previous balance.
• Identification of transactions, including at least the amount financed, date of the transaction, and the retail seller’s name.
• Credits during the billing cycle, the amount and the date of crediting.
• Periodic rates. Each periodic rate that may be used to compute the interest charge expressed as an annual percentage rate and using the term annual percentage rate.
• Balance on which finance charge computed and an explanation of how that balance was determined, using the term “balance subject to interest rate.”
• Charges imposed –
  • Interest, using the term interest charge, must be grouped together under the heading “Interest Charged,” itemized and totalled by BNPL loan, and a total of finance charges attributable to periodic interest rates, using the term “total interest” for the statement period and calendar year to date.
  •  Fees other than charges attributable to periodic interest rates must be grouped together under the heading “Fees,” identified consistent with the feature or type, and itemized, and a total of charges, using the term “fees,” for the statement period and calendar year to date.
• Telephone number and address for notice of billing errors, with at least one address for consumers to submit notices digitally.
• Closing date of billing cycle; new balance. The closing date of the billing cycle and the account balance outstanding on that date.
• Due date; late payment costs.
  • Any due date in the next billing cycle.
  • The amount of any late payment fee and any increased periodic rate(s) (expressed as an annual percentage rate(s)) that may be imposed on the BNPL loan as a result of a late payment.
• Dispute rights.
• Refund rights.
• Unauthorized use.

BNPL lenders must use risk-based underwriting for each consumer based on their income and debts and other factors. Written underwriting policies must be disclosed to consumers clearly and conspicuously. Credit metrics regarding “members of the consumer’s social network” may not be used for underwriting the consumer. 

BNPL lenders must cause retailers to send them a credit within 7 business days of granting the credit and the lender must credit the consumer’s account within 3 business days of receipt. Credit balances must be refunded unless the consumer requests that the amount be credited to their account. The lender must maintain fair and “transparent” written policies and procedures for refunds and must disclose the process clearly and conspicuously to consumers.

The regulation defines a long list of billing errors, including charges that were “not authorized by the consumer.” The regulation prescribes the procedures and timing for the consumer’s billing error notice to the lender and for the lender’s resolution of the asserted error, depending upon whether the billing error occurred or did not occur as asserted. Procedures prohibit collection of disputed amounts or adverse credit reports until the resolution procedures are completed. The lender may not accelerate any part of the consumer’s debt or close the consumer’s account solely in retaliation for asserting a billing error. A lender is specifically permitted to collect any undisputed amount and to note the disputed amount and related finance charges on a periodic statement so long as it is noted that it is not payable until the pending dispute is resolved. If a consumer disputes a finding that the billing error did not occur, the lender may not report that the amount due is delinquent unless it reports that the amount is in dispute and meets other conditions. However, a lender is not required to take further action regarding the same asserted billing error with regard to the same transaction. A lender who fails to comply with the billing error procedures forfeits the amount in dispute, limited to $50.

A consumer’s loss for unauthorized use is limited to $50, if the unauthorized use is timely reported and other conditions are met. The lender must meet certain conditions of disclosure and consumer authentication to impose liability for the amount below the consumer’s limit of liability.

A BNPL lender must have written policies and procedures regarding its use, sale and sharing of covered data. The policy should address the following requirements:

1. Consent. Lender’s must obtain the consumer’s written consent to share or make any use of non-public personally identifiable information, transaction or account level consumer information and metadata, except as reasonably necessary to provide the consumer’s requested product or service. Expressly not “reasonably necessary”: targeted marketing or cross-selling of non-requested products or services or the sale of covered data. Consent is valid for only 1 year.
2. Disclosures.  Prominent, clear and conspicuous disclosures must accompany the request for consumer’s consent on the same “interface” on which the consent is requested, i. e., (perhaps) not by a link. Disclosures must include –
   • Consent to sell or share data is optional and not required to obtain the BNPL loan
   • For each individual use, the type of data to be shared and the intended use, e.g. for targeted marketing of non-requested products, for individualized pricing, disclosure to affiliates, etc.
   • The names of parties that will have access to shared data
   • Expected duration of the data sharing and statement that it will not last more than a year after consent
   • The method for consumer’s withdrawal of consent
3. Choices. Consumers must be given the choice to refuse the disclosure separately for each individual use and for targeted marketing, to limit dates of shared data. Consent must not be the default or more prominently displayed option and there must be an option to decline all requests collectively.
4. Tying Prohibited. Consent for sharing or use of covered data may not be made a condition for providing a BNPL loan and the BNPL lender must so notify the consumer if consent is requested.
5. Withdrawal of Consent/Deletion of Data. A BNPL lender must provide a costless method for withdrawing consent to data sharing and use that is as easy as the method for giving initial consent. (The regulation does not address charges not imposed by the lender, such as mobile network charges.) If consent is withdrawn or expires without renewal, the lender must cease all use, delete the covered data and cause any transferees to delete the covered data (that was not required in connection with making the BNPL loan) within 30 days.

BNPL lenders must accept and respond to billing error notices, notices of unauthorized use and requests for forbearance in English, Spanish and any language “principally used” in advertisements.

BNPL must maintain and prominently display on all consumer interfaces a toll-free telephone number and email address for consumer contacts regarding all customer service issues. The telephone number must be operative at least 10 hours a day, except weekends and holidays.

A BNPL lender must have written policies and procedures for resolving complaints fairly and timely. The lender must display at all consumer interfaces and at other locations as the superintendent may direct:

• The telephone number, email address and website where complaints will be received
• A statement that the DFS will also accept complaints and the DFS’ mailing address, website, and telephone number
• Other information the superintendent may prescribe

The lender must notify the DFS of any changes to the policy or procedures within 7 days.

Existing non-bank BNPL lenders doing business within the state or with NY residents must apply for a license within 45 days of the effective date of the regulation. Upon submitting a substantially complete and accurate application, a BNPL lender is deemed a provisional licensee until the application is accepted or denied. Non-bank and state bank BNPL lenders must also apply for category permission within 45 days of the effective date and will receive provisional approval in the categories requested.