New York Is Writing ‘Buy Now, Pay Later’ Rules in 2026—Here’s the data trail you didn’t know you were agreeing to (and why it changes your credit even when it’s ‘0%’)
NYDFS is moving BNPL from “checkout feature” to supervised consumer credit—while targeting the quiet cost most users miss: the behavioral data pipeline behind “0%.”
By TheMurrow Editorial
March 8, 2026
Key Points
- 1Track the timeline: Article 14‑B (May 9, 2025) plus NYDFS’s NEW 3 NYCRR 423 draft (Feb. 23, 2026) rewires BNPL as supervised credit.
- 2Expect a data crackdown: non-essential use, sharing, or sale of “covered data” would require an affirmative expression of informed consent—not buried checkboxes.
- 3Prepare for friction and accountability: broad “BNPL lender” definitions reach platforms and loan transfers, bringing licensing, exams, audit trails, and privacy governance.
At the checkout screen, “Pay in 4” looks like a small choice. A few taps, a soft promise—no interest, no fuss—and the purchase glides through. For millions of Americans, buy now, pay later (BNPL) has become less like a loan and more like a user interface.
New York is preparing to disagree. In 2026, the state’s financial regulator is moving BNPL out of the realm of “feature” and into the realm of supervised consumer credit—licensed, examined, and governed by rules that treat BNPL lenders like lenders.
The most telling part isn’t just the familiar concerns about fees and disputes. It’s data. New York’s draft proposes that consumers shouldn’t have to trade away a detailed behavioral dossier just to split a purchase into installments—and that if BNPL companies want to use or monetize consumer data beyond what’s needed to provide the loan, they should have to ask plainly, and get a meaningful yes.
“New York’s message to BNPL is blunt: if you act like a lender, you will be regulated like one—and if you harvest data like an ad-tech firm, you’ll have to justify it.”
— — TheMurrow Editorial
New York’s BNPL timeline: how a checkout feature became a regulated product
New York’s push is not a vague policy direction. It’s built on a tight sequence of legal steps, anchored to specific dates and a clear effective-date mechanism.
On May 9, 2025, Governor Kathy Hochul signed the BNPL Act into law, adding Article 14‑B to the New York Banking Law. That statute is titled plainly: “Buy‑now‑pay‑later Lenders.” The naming matters. New York isn’t treating BNPL as a novelty; it’s placing it inside the state’s supervised credit system. (Source: New York Banking Law Article 14‑B, and coverage summarized by Orrick.)
Then on February 23, 2026, the New York Department of Financial Services (NYDFS) announced and posted draft regulations titled “NEW 3 NYCRR 423”—rules specifically for Buy‑Now‑Pay‑Later Lenders. NYDFS described the effort as building a “nation-leading” regulatory framework. (Source: NYDFS press release and draft regulation page.)
The effective date is intentionally delayed, and tied to the regulatory process rather than a calendar date. Under the draft, the regulation would take effect “180 days after publication of the Notice of Adoption in the State Register.” Article 14‑B uses a similar delayed structure, becoming effective 180 days after DFS promulgates rules. In other words, New York set the statute up to “wake up” with the rulemaking.
On May 9, 2025, Governor Kathy Hochul signed the BNPL Act into law, adding Article 14‑B to the New York Banking Law. That statute is titled plainly: “Buy‑now‑pay‑later Lenders.” The naming matters. New York isn’t treating BNPL as a novelty; it’s placing it inside the state’s supervised credit system. (Source: New York Banking Law Article 14‑B, and coverage summarized by Orrick.)
Then on February 23, 2026, the New York Department of Financial Services (NYDFS) announced and posted draft regulations titled “NEW 3 NYCRR 423”—rules specifically for Buy‑Now‑Pay‑Later Lenders. NYDFS described the effort as building a “nation-leading” regulatory framework. (Source: NYDFS press release and draft regulation page.)
The effective date is intentionally delayed, and tied to the regulatory process rather than a calendar date. Under the draft, the regulation would take effect “180 days after publication of the Notice of Adoption in the State Register.” Article 14‑B uses a similar delayed structure, becoming effective 180 days after DFS promulgates rules. In other words, New York set the statute up to “wake up” with the rulemaking.
May 9, 2025
Governor Kathy Hochul signed the BNPL Act into law, adding Article 14‑B (“Buy‑now‑pay‑later Lenders”) to the New York Banking Law.
Feb. 23, 2026
NYDFS announced and posted draft regulations titled “NEW 3 NYCRR 423,” positioning the framework as “nation-leading.”
180 days
The proposed countdown to the regulation’s effective date would begin after the Notice of Adoption is published in the State Register.
Key numbers readers should notice
Even before getting into policy, the architecture tells a story.
- May 9, 2025: Article 14‑B signed into law.
- Feb. 23, 2026: NYDFS publishes draft NEW 3 NYCRR 423.
- 180 days: the proposed countdown to the regulation’s effective date after a Notice of Adoption.
- 14‑B: the statute’s article number—New York’s formal decision to give BNPL its own lending category.
- May 9, 2025: Article 14‑B signed into law.
- Feb. 23, 2026: NYDFS publishes draft NEW 3 NYCRR 423.
- 180 days: the proposed countdown to the regulation’s effective date after a Notice of Adoption.
- 14‑B: the statute’s article number—New York’s formal decision to give BNPL its own lending category.
“The 180‑day delay isn’t hesitation. It’s a runway—built for licensing, compliance, and exams.”
— — TheMurrow Editorial
The legal scaffolding: Article 14‑B signals supervision, not suggestions
Article 14‑B reads less like a consumer-tech policy memo and more like a classic New York banking statute. The law includes sections addressing licensing/authorization, examinations, prohibited acts, consumer protections, penalties, and more. That’s the language of supervised financial services.
A key editorial point: New York is not merely adding guardrails to marketing. It is building a legal category—BNPL lenders—with the expectation that providers will be subject to ongoing oversight. That approach matters because much of the public conversation about BNPL has focused on whether it “counts” as credit. New York’s answer is procedural: if it functions as a consumer-credit product, it belongs inside a consumer-credit regulatory system.
From a consumer perspective, the promise is consistency. Licensing and examination regimes can create baseline expectations around disclosures, handling of complaints, and operational controls. From an industry perspective, the tradeoff is clear: more certainty and legitimacy, but also more cost and less flexibility.
A key editorial point: New York is not merely adding guardrails to marketing. It is building a legal category—BNPL lenders—with the expectation that providers will be subject to ongoing oversight. That approach matters because much of the public conversation about BNPL has focused on whether it “counts” as credit. New York’s answer is procedural: if it functions as a consumer-credit product, it belongs inside a consumer-credit regulatory system.
From a consumer perspective, the promise is consistency. Licensing and examination regimes can create baseline expectations around disclosures, handling of complaints, and operational controls. From an industry perspective, the tradeoff is clear: more certainty and legitimacy, but also more cost and less flexibility.
Multiple perspectives: protection versus friction
Supporters of regulation will argue that BNPL has outgrown its “low stakes” reputation and should be monitored like other credit products. They’ll point to the opacity of certain fees, the ease of taking multiple plans across providers, and the thin line between “installments” and “debt.”
Skeptics will argue that heavy regulation could reduce access for consumers who use BNPL as a budgeting tool—especially interest-free products—and that compliance burdens may raise prices or narrow offerings. Those concerns aren’t frivolous. A licensing model changes who can compete.
NYDFS’s draft suggests New York wants that tradeoff: fewer gray areas, more responsibility.
Skeptics will argue that heavy regulation could reduce access for consumers who use BNPL as a budgeting tool—especially interest-free products—and that compliance burdens may raise prices or narrow offerings. Those concerns aren’t frivolous. A licensing model changes who can compete.
NYDFS’s draft suggests New York wants that tradeoff: fewer gray areas, more responsibility.
Key Insight
New York’s approach isn’t just “guardrails.” It creates a supervised lending category—BNPL lenders—built for licensing, exams, prohibited-acts enforcement, and penalties.
NYDFS draft “NEW 3 NYCRR 423”: a broad definition of who counts as a BNPL lender
The proposed regulation’s definitions are where the state shows its hand. The draft defines BNPL lender broadly—capturing not only the entity that “makes” a BNPL loan, but also entities to whom ownership of a BNPL loan is transferred, and even the platforms or systems that a consumer interacts with “to obtain” the BNPL loan.
That breadth aims at a familiar problem in modern finance: responsibility can be sliced across product design, underwriting, servicing, and ownership. BNPL is often embedded at checkout, while the funding, risk, and account management may sit elsewhere. New York’s draft looks designed to keep key actors from slipping through definitional cracks.
The draft also defines a BNPL loan as closed-end credit tied to a specific purchase of goods or services—while carving out certain exclusions. The research notes mention exclusions including motor vehicles and certain seller-credit situations. The takeaway is that New York is targeting the mainstream BNPL model without claiming jurisdiction over every installment arrangement imaginable.
That breadth aims at a familiar problem in modern finance: responsibility can be sliced across product design, underwriting, servicing, and ownership. BNPL is often embedded at checkout, while the funding, risk, and account management may sit elsewhere. New York’s draft looks designed to keep key actors from slipping through definitional cracks.
The draft also defines a BNPL loan as closed-end credit tied to a specific purchase of goods or services—while carving out certain exclusions. The research notes mention exclusions including motor vehicles and certain seller-credit situations. The takeaway is that New York is targeting the mainstream BNPL model without claiming jurisdiction over every installment arrangement imaginable.
Category permissions: interest-free and interest-bearing BNPL aren’t treated the same
NYDFS’s framework contemplates “category permissions” for different BNPL categories, including interest-free and interest-bearing products. That detail matters because it acknowledges what consumers already sense: a four-installment, no-interest plan is not experienced the same way as an interest-bearing loan.
Regulators often struggle when a single label covers multiple economic realities. “Category permissions” suggest New York is trying to regulate in proportion to risk—without collapsing every BNPL product into the same box.
Regulators often struggle when a single label covers multiple economic realities. “Category permissions” suggest New York is trying to regulate in proportion to risk—without collapsing every BNPL product into the same box.
“New York isn’t only defining a product. It’s defining who is responsible for it—even when the product is embedded, outsourced, or sold.”
— — TheMurrow Editorial
The data clause: New York targets the invisible cost of BNPL
The most distinctive element of New York’s 2026 proposal is its focus on the consumer data trail. BNPL doesn’t only create repayment obligations; it creates a record of what you buy, when you buy, how reliably you repay, and potentially how you browse and respond to prompts.
NYDFS’s draft proposes a BNPL-specific data privacy regime. In plain terms, the draft would limit a BNPL lender’s ability to use, sell, or share “covered data” for purposes beyond what is “reasonably necessary” to make or provide the BNPL loan—unless the consumer gives consent.
The heart of the proposal is the requirement of an “affirmative expression of informed consent” for non-essential data uses. That language matters. It implies that passive acceptance, bundled permissions, or consent hidden behind friction may not satisfy the spirit of the rule.
NYDFS’s draft proposes a BNPL-specific data privacy regime. In plain terms, the draft would limit a BNPL lender’s ability to use, sell, or share “covered data” for purposes beyond what is “reasonably necessary” to make or provide the BNPL loan—unless the consumer gives consent.
The heart of the proposal is the requirement of an “affirmative expression of informed consent” for non-essential data uses. That language matters. It implies that passive acceptance, bundled permissions, or consent hidden behind friction may not satisfy the spirit of the rule.
Why this matters to readers who never miss a payment
Many BNPL users think of themselves as careful: they split a purchase, pay on time, move on. Data policy can feel like someone else’s concern—until it isn’t.
A data-centric regulatory approach recognizes a basic truth: consumers may “pay” for BNPL not only in fees or interest, but in information—information that can be used for marketing, targeting, and monetization in ways that consumers do not naturally associate with “credit.”
New York’s proposal doesn’t claim all data use is illegitimate. It draws a boundary: what is reasonably necessary to provide the loan versus what is not. Then it puts the burden on the lender to ask.
A data-centric regulatory approach recognizes a basic truth: consumers may “pay” for BNPL not only in fees or interest, but in information—information that can be used for marketing, targeting, and monetization in ways that consumers do not naturally associate with “credit.”
New York’s proposal doesn’t claim all data use is illegitimate. It draws a boundary: what is reasonably necessary to provide the loan versus what is not. Then it puts the burden on the lender to ask.
Editor’s Note
The draft doesn’t just regulate repayment terms. It targets the data pipeline BNPL can create: purchase details, repayment behavior, and potentially browsing and prompt-response signals.
Consent, but what kind? The hard problem of “informed” permission
A consent requirement sounds straightforward until you imagine it on an actual phone screen. “Informed” is doing a lot of work here.
If New York means what it says, the compliance challenge won’t be merely collecting a checkbox. It will be designing consent prompts that are:
- Specific about what data is being used or shared
- Clear about purposes beyond servicing the BNPL loan
- Optional in a way that doesn’t punish consumers who say no
- Traceable so a company can demonstrate consent later
That last point matters. In a supervised framework, companies may need to show regulators not only what their policy says, but what the consumer actually agreed to.
If New York means what it says, the compliance challenge won’t be merely collecting a checkbox. It will be designing consent prompts that are:
- Specific about what data is being used or shared
- Clear about purposes beyond servicing the BNPL loan
- Optional in a way that doesn’t punish consumers who say no
- Traceable so a company can demonstrate consent later
That last point matters. In a supervised framework, companies may need to show regulators not only what their policy says, but what the consumer actually agreed to.
Multiple perspectives: privacy advocates vs. product designers
Privacy advocates will welcome the approach, especially given how often consumers are nudged into data sharing without a real understanding of tradeoffs. A BNPL loan can reveal spending patterns that are more intimate than a generic credit card statement—because it is tied to individual purchases and often linked to merchant and platform interactions.
Product and growth teams will warn about complexity. BNPL thrives on low friction. If the regulatory environment forces more screens, more explanations, and more consent decisions, conversion rates may drop. That could reduce BNPL adoption, and by extension reduce a payment option that many consumers prefer.
New York’s draft is effectively choosing a side: consumers should not have to give up broad data rights to access short-term installment credit.
Product and growth teams will warn about complexity. BNPL thrives on low friction. If the regulatory environment forces more screens, more explanations, and more consent decisions, conversion rates may drop. That could reduce BNPL adoption, and by extension reduce a payment option that many consumers prefer.
New York’s draft is effectively choosing a side: consumers should not have to give up broad data rights to access short-term installment credit.
What “informed” consent would have to look like in practice
- ✓Be specific about what data is being used or shared
- ✓Be clear about purposes beyond servicing the BNPL loan
- ✓Be optional without punishing consumers who say no
- ✓Be traceable so companies can demonstrate consent later
What changes for BNPL companies: licensing, exams, and operational discipline
New York’s move also signals a cultural shift for BNPL providers operating in the state. Article 14‑B’s structure—authorization, examinations, prohibited acts, penalties—points toward routine supervision rather than one-off enforcement.
A supervised regime tends to reshape operations in predictable ways. Companies may need to invest in:
- Compliance programs that match other regulated lenders
- Documentation and audit trails for consent, complaints, and disclosures
- Vendor and platform governance if multiple entities touch the consumer experience
- Data governance capable of separating “necessary” from “non-essential” uses
NYDFS’s broad definition of “BNPL lender” also suggests that business models relying on assignment, transfer, or platform layers won’t automatically escape obligations. If ownership of loans is transferred, or if a consumer interacts with a platform “to obtain” the loan, regulators may expect accountability across the chain.
A supervised regime tends to reshape operations in predictable ways. Companies may need to invest in:
- Compliance programs that match other regulated lenders
- Documentation and audit trails for consent, complaints, and disclosures
- Vendor and platform governance if multiple entities touch the consumer experience
- Data governance capable of separating “necessary” from “non-essential” uses
NYDFS’s broad definition of “BNPL lender” also suggests that business models relying on assignment, transfer, or platform layers won’t automatically escape obligations. If ownership of loans is transferred, or if a consumer interacts with a platform “to obtain” the loan, regulators may expect accountability across the chain.
A real-world example: the checkout prompt and the post-purchase marketing loop
Consider a common BNPL flow: a consumer selects BNPL at checkout, approves the plan, and then begins receiving marketing—new offers, reminders, targeted suggestions. Under New York’s draft approach, the question becomes: which parts of that marketing loop are “reasonably necessary” to provide the loan, and which are monetization?
If a lender uses transaction-level purchase data to target new product ads, that may be hard to justify as necessary for loan servicing. New York’s consent requirement aims directly at that kind of quiet expansion in data use.
If a lender uses transaction-level purchase data to target new product ads, that may be hard to justify as necessary for loan servicing. New York’s consent requirement aims directly at that kind of quiet expansion in data use.
A typical BNPL flow NYDFS is implicitly interrogating
- 1.Consumer selects BNPL at checkout and approves a plan
- 2.Lender services repayment schedule and account management
- 3.Company uses transaction-level data to drive post-purchase marketing
- 4.Regulator asks what is “reasonably necessary” vs. monetization requiring consent
What changes for consumers: clearer rights, but also more prompts and fewer “free” perks
For New York consumers, the draft proposal offers a pragmatic promise: if BNPL is credit, consumers should get the kinds of protections they expect from credit—and they should have more say in how their data is used.
Practical implications likely include:
- More explicit disclosures about what BNPL is (closed-end credit tied to a purchase)
- Stronger expectations around conduct given Article 14‑B’s prohibited-acts framework
- More visible privacy choices where non-essential data uses require affirmative consent
- Potentially fewer bundled “perks” if those perks were funded by data monetization
There is also a plausible friction cost. Consent prompts take time. Some consumers will click through; others will pause, read, and opt out. That is the point—yet it may change the feel of BNPL from effortless to deliberative.
Practical implications likely include:
- More explicit disclosures about what BNPL is (closed-end credit tied to a purchase)
- Stronger expectations around conduct given Article 14‑B’s prohibited-acts framework
- More visible privacy choices where non-essential data uses require affirmative consent
- Potentially fewer bundled “perks” if those perks were funded by data monetization
There is also a plausible friction cost. Consent prompts take time. Some consumers will click through; others will pause, read, and opt out. That is the point—yet it may change the feel of BNPL from effortless to deliberative.
A second real-world example: the consumer who opts out
Imagine a consumer who uses BNPL for a single purchase—say, a household appliance—and declines consent for data use beyond what’s necessary to provide the loan. Under NYDFS’s draft concept, the consumer should still be able to obtain the BNPL loan, and the lender should be constrained from using covered data for unrelated targeting without permission.
That kind of opt-out is meaningful only if the product remains functional. The success of the model will depend on whether “consent” becomes a real choice or a disguised toll.
That kind of opt-out is meaningful only if the product remains functional. The success of the model will depend on whether “consent” becomes a real choice or a disguised toll.
What consumers may gain—and what it may cost
Pros
- +clearer disclosures
- +supervised conduct expectations
- +meaningful privacy choices
- +less quiet data monetization
Cons
- -more prompts and friction
- -potentially fewer perks funded by data monetization
- -possible reduced access if offerings narrow
Why New York’s approach could set a national tone—without being the whole story
NYDFS has described its framework as “nation-leading,” and the elements in the draft explain why. New York is trying to integrate BNPL into the established grammar of regulated lending while also confronting the modern reality that consumer finance runs on data.
Even so, readers should resist the temptation to treat one state’s draft as the final word. The draft rules are still draft rules, and the effective date depends on adoption and the subsequent 180-day countdown. Companies will likely engage in the comment process, and the final contours may shift.
What feels durable is the underlying theory: BNPL is not just a payment plan. It is a credit product embedded in commerce, and it can become a data pipeline. New York is regulating both.
The larger question is whether other states—or federal actors—adopt similar logic. For now, New York is building a model that other regulators can copy: clear definitions, licensing hooks, and privacy rules that treat consent as more than a formality.
Even so, readers should resist the temptation to treat one state’s draft as the final word. The draft rules are still draft rules, and the effective date depends on adoption and the subsequent 180-day countdown. Companies will likely engage in the comment process, and the final contours may shift.
What feels durable is the underlying theory: BNPL is not just a payment plan. It is a credit product embedded in commerce, and it can become a data pipeline. New York is regulating both.
The larger question is whether other states—or federal actors—adopt similar logic. For now, New York is building a model that other regulators can copy: clear definitions, licensing hooks, and privacy rules that treat consent as more than a formality.
Practical takeaways (for readers and for businesses)
For consumers in New York:
- Expect BNPL screens to include more explicit choices around data use.
- Treat BNPL as credit, not merely “installments,” especially when terms vary.
- Watch for whether consent is truly optional or tied to access.
For BNPL providers and platforms:
- Prepare for broad coverage under the definition of BNPL lender, including transfers and platforms.
- Build systems to distinguish necessary data uses from non-essential ones.
- Plan for licensing and supervision dynamics implied by Article 14‑B.
- Expect BNPL screens to include more explicit choices around data use.
- Treat BNPL as credit, not merely “installments,” especially when terms vary.
- Watch for whether consent is truly optional or tied to access.
For BNPL providers and platforms:
- Prepare for broad coverage under the definition of BNPL lender, including transfers and platforms.
- Build systems to distinguish necessary data uses from non-essential ones.
- Plan for licensing and supervision dynamics implied by Article 14‑B.
Conclusion: the real price of “Pay in 4” may be information—and New York wants that price labeled
BNPL’s success has always depended on a certain kind of quiet. Quiet credit checks, quiet borrowing, quiet repayment—and, often, quiet data collection. The consumer sees a schedule. The company may see a profile.
New York’s 2026 draft takes that quiet away. By placing BNPL under a dedicated lending statute (Article 14‑B) and proposing detailed rules (NEW 3 NYCRR 423), NYDFS is attempting to make BNPL legible: as supervised credit, and as a data practice that must be justified to the people it profiles.
The debate won’t be simple. Regulation can reduce harm and increase trust, but it can also add friction and reduce access. Yet the core idea is hard to argue with: when a product touches credit and personal data, consumers deserve more than a friendly button at checkout. They deserve clarity—and a real say.
New York’s 2026 draft takes that quiet away. By placing BNPL under a dedicated lending statute (Article 14‑B) and proposing detailed rules (NEW 3 NYCRR 423), NYDFS is attempting to make BNPL legible: as supervised credit, and as a data practice that must be justified to the people it profiles.
The debate won’t be simple. Regulation can reduce harm and increase trust, but it can also add friction and reduce access. Yet the core idea is hard to argue with: when a product touches credit and personal data, consumers deserve more than a friendly button at checkout. They deserve clarity—and a real say.
T
About the Author
TheMurrow Editorial is a writer for TheMurrow covering business & money.
Frequently Asked Questions
What is New York’s BNPL Act (Article 14‑B)?
Article 14‑B is a section of the New York Banking Law titled “Buy‑now‑pay‑later Lenders.” Governor Kathy Hochul signed it into law on May 9, 2025. It establishes a framework that includes licensing/authorization concepts, examinations, consumer protections, prohibited acts, and penalties—signaling New York’s intent to supervise BNPL more like other consumer-credit products.
What did NYDFS release in February 2026?
On Feb. 23, 2026, the New York Department of Financial Services (NYDFS) announced and posted draft regulations called “NEW 3 NYCRR 423” for BNPL lenders. NYDFS described the proposal as part of a “nation-leading” BNPL regulatory framework. The draft contains definitions, regulatory requirements, and a notable focus on data privacy and consumer consent.
When would the NYDFS BNPL regulation actually take effect?
Under the draft, the regulation would take effect 180 days after publication of the Notice of Adoption in the State Register. Article 14‑B is also structured with a delayed effective date tied to DFS rulemaking. Practically, that means the clock starts after the rules are finalized and formally adopted, not at the moment the draft is released.
Who counts as a “BNPL lender” under the NYDFS draft?
The draft definition is broad. It can include entities that make BNPL loans, entities to whom ownership of a BNPL loan is transferred, and even platforms or systems that consumers interact with “to obtain” BNPL loans. The intent is to prevent key actors in the BNPL chain—origination, platform, ownership—from evading accountability through structure.
How does New York define a BNPL loan?
NYDFS’s draft defines a BNPL loan as closed-end credit tied to a specific purchase of goods or services, with certain exclusions (the draft notes exclusions including motor vehicles and some seller-credit situations). The emphasis is on the mainstream BNPL model: a defined purchase, a defined amount, and a defined repayment schedule.
What is the big deal about data in the New York proposal?
NYDFS proposes that BNPL lenders may use, sell, or share “covered data” for purposes beyond what is reasonably necessary to make or provide the BNPL loan only with the consumer’s consent. The draft calls for an “affirmative expression of informed consent” for non-essential data uses—aiming to limit quiet data monetization that consumers may not associate with credit.
