NYC DEBT COLLECTION RULE DELAYED AGAIN
The New York City Department of Consumer and Worker Protection (DCWP) has postponed the implementation of its amended debt collection rule, originally slated to take effect October 1, 2025. This marks the third delay, following strong advocacy from ACA International and other industry stakeholders, who raised concerns about misalignment with federal standards and the lack of supporting data. The proposed rule includes changes to communication frequency, definitions, and electronic communication guidelines—many of which industry groups argue could confuse consumers or conflict with broader regulatory frameworks. DCWP has committed to announcing a new effective date at least three months in advance. A revised rule or additional comment period is expected later in 2025 or early 2026.
TEXAS AI GOVERNANCE LAW PASSED WITH FINANCIAL SERVICES EXEMPTIONS
Texas has enacted the Texas Responsible Artificial Intelligence Governance Act (TRAIGA), introducing consumer protections and enforcement powers around AI use. Effective January 1, 2026, the law prohibits AI models that intentionally discriminate, promote self-harm or criminal activity, or infringe on constitutional rights. It also limits government use of AI for biometric surveillance or social scoring. Importantly, federally insured financial institutions are deemed in compliance with TRAIGA if they follow existing federal and state banking laws—effectively exempting them from new requirements. TRAIGA also creates a regulatory sandbox for testing AI systems and establishes a state AI Council. Financial firms using or developing AI tools in Texas should monitor enforcement developments and assess whether any portions of the law may apply beyond existing banking exemptions.
ILLINOIS CRACK DOWN ON UNLICENSED COLLECTION ACTIVITY
The Illinois Department of Financial and Professional Regulation (IDFPR) has issued a cease-and-desist order against One Republic, Inc. for engaging in debt collection without the required state license. The action reinforces Illinois’ strict licensing requirements and its active enforcement posture toward unregistered collection entities.
If your business is collecting, servicing, or purchasing debt across state lines, Cornerstone can help ensure you’re properly licensed and operating with confidence.
BLOG
COLLECTION AGENCY: KEY STEPS TO LICENSING SUCCESS
Do you need a collection agency license—and in which states?
We break down who needs a license (including third-party collectors and debt buyers), what state-specific requirements to expect (like bonds, trust accounts, and background checks), and why compliance is critical to avoid penalties or shutdowns. It also includes a step-by-step guide to getting licensed and maintaining good standing across jurisdictions.
Read the full blog post to understand key licensing obligations and explore our interactive Debt Collection State Licensing Map.
CLICK-TO-CANCEL RULE STRUCK DOWN BY FEDERAL COURT
A federal appeals court has vacated the FTC’s “click to cancel” rule, which would have required businesses to make it as easy for consumers to cancel subscriptions as it is to sign up. The court found that the FTC failed to follow key procedural steps, including a required economic impact analysis, making the rule unenforceable. The rule had been set to take effect July 14 and was designed to curb consumer frustration over complex cancellation processes. While the FTC may attempt to reissue the rule, enforcement is now delayed, likely into 2026.
BLOG
THE NEW RULES OF EARNED WAGE ACCESS: LICENSING IN 2025
As states race to regulate Earned Wage Access (EWA), licensing is quickly becoming mandatory for both direct-to-consumer and employer-integrated providers. New rules in states like California, Nevada, and Wisconsin are redefining EWA as credit, limiting fees and repayment methods, and requiring licensure or registration. Direct-to-consumer models face the most scrutiny, especially those relying on tips or fees. To stay competitive and compliant, providers must reassess their operating model, disclosures, and state coverage.
Read the full blog post to understand how your EWA program may be impacted and what steps to take next.
FEDERAL COURT VACATES CFPB RULE ON MEDICAL DEBT CREDIT REPORTING
A federal judge in Texas has overturned the ruling that aimed to eliminate medical debt from consumer credit reports, stating that the CFPB exceeded its authority under the Fair Credit Reporting Act. The rule, finalized in January 2025, was projected to remove $50 billion in medical debt from the records of 15 million Americans. The ruling underscores growing judicial pushback on CFPB regulatory actions and limits the agency’s ability to enforce broad credit reporting reforms without explicit legislative backing. While states like Oregon and Rhode Island continue advancing their own medical debt protections, this federal decision reinstates uncertainty around national credit reporting practices. Financial services providers and debt collectors should monitor these developments closely and ensure they remain aligned with both federal and emerging state-level requirements.
BLOG POST
LICENSING TRIGGERS: WHEN IS A CONSUMER LENDING LICENSE REQUIRED?
Understanding when a lending license is required is critical for any non-bank lender. This article breaks down the common licensing triggers—like offering consumer credit, charging certain rates, or facilitating loans through partnerships—and how they apply across loan types and jurisdictions. It also explains why some exemptions may not protect you and how misclassifying a loan’s purpose could lead to regulatory penalties. With state regulators expanding definitions of who qualifies as a “lender,” even platforms that don’t originate loans may still need licenses.
Click to read the full blog post and make sure your lending model aligns with today’s licensing landscape.
COLORADO MONEY TRANSMISSION LAW MODERNIZED UNDER MULTISTATE FRAMEWORK
Colorado has adopted the CSBS’s Money Transmission Modernization Act to better align with multistate licensing standards. The law broadens the definition of regulated activity to include digital money movement and payroll processing, expanding the scope of who must be licensed. It introduces updated control thresholds and notification requirements, enhanced exemptions for certain entities, and allows for multistate supervisory coordination. New consumer protection rules require timely fund forwarding, clear disclosures (in the language used for marketing), and refund obligations. Companies operating in Colorado should assess whether their current or planned activities now fall under this expanded regulatory structure.
RHODE ISLAND: NEW LIMITS ON MEDICAL DEBT COLLECTION AND REPORTING
Rhode Island has enacted two new laws significantly impacting how medical debt can be collected and reported in the state. Beginning January 1, 2026, credit bureaus will be prohibited from reporting medical debt, and creditors will be barred from using wage garnishments or placing liens on homes to collect medical judgments. A second law, effective immediately, caps interest rates on newly incurred medical debt at a minimum of 1.5% and a maximum of 4% annually, tied to Treasury yield benchmarks. These changes increase regulatory pressure on healthcare providers and third-party collectors and signal a broader shift toward consumer protections in medical debt at the state level.
BLOG POST
LICENSING READINESS FOR LENDING STARTUPS: BUILDING INFRASTRUCTURE BEFORE MARKET ENTRY
For lending startups, licensing isn’t a post-launch formality—it’s the foundation of your entire business model. This article explains why state-by-state licensing is critical from day one and how fintechs can avoid costly delays by building a phased licensing strategy. It also highlights key infrastructure needs like compliance policies, control persons, and financial audits that states expect before approving applications. Whether you’re launching in 3 states or 30, strategic planning is essential to scale legally and confidently.
Click to read the full blog and start building your licensing roadmap.
OREGON MEDICAL DEBT BANNED FROM CREDIT REPORTS
Oregon, effective January 1, 2026, will prohibit the reporting of medical debt to consumer credit agencies. The law bars hospitals, creditors, and debt collectors from furnishing medical debt information—whether direct charges or balances on medical-purpose credit cards—and requires consumer reporting agencies to suppress any such entries. Courts are also empowered to void debts that appear on credit reports in violation of this statute. The law offers expanded consumer remedies, including statutory damages and attorney’s fees. Oregon now joins states like Maine and Vermont in advancing state-level restrictions following the CFPB’s recent pullback on medical debt guidance.
MAN PLEADS GUILTY TO UNLICENSED CRYPTO MONEY TRANSMITTING
William McNeilly, of New Haven, pleaded guilty to operating an unlicensed money transmitting business and three counts of illegal money transactions. Prosecutors say he used Global Income Marketplace LLC and Global NuMedia LLC to exchange customers’ cash, checks, and money orders for cryptocurrency without a Connecticut license, processing over $1 million. Despite a warning from TD Bank about a fraudulent wire and the need for a license, he continued operating; investigators linked some funds to fraud schemes. He faces charges that could result in up to 35 years of imprisonment.
BLOG POST
BEYOND LICENSING: WHAT STATES EXPECT FROM NON-BANK LENDERS POST-APPROVAL
Getting licensed is only the beginning—non-bank lenders must also stay on top of ongoing requirements like reporting, audits, consumer disclosures, and renewal filings. This article outlines the key post-approval obligations lenders face, including challenges in states like California, New York, and Georgia. It also shares best practices for building a scalable compliance infrastructure to keep your license in good standing while growing your lending business.
Click to read the full blog post and strengthen your post-licensing operations.
MAINE COURT UPHOLDS MEDICAL DEBT AND ECONOMIC ABUSE CREDIT REPORTING LAWS
In a key ruling, the First Circuit Court of Appeals confirmed that Maine’s laws limiting how medical debt and financial abuse impact credit scores are not blocked by federal law. These state laws prevent credit reporting agencies from including certain paid or recent medical debts and protect victims whose credit was damaged by abusive partners. A credit industry group tried to argue that only federal law should apply, but the court disagreed, saying Congress never barred states from adding their own protections. This decision could open the door for more states to strengthen consumer credit reporting rules, especially in areas federal law doesn’t fully address.
STABLECOIN REGULATION BECOMES FEDERAL LAW UNDER THE GENIUS ACT
President Trump has signed the GENIUS Act, establishing a comprehensive federal regulatory framework for stablecoins—digital assets pegged to the U.S. dollar or other reference assets. The legislation defines permissible stablecoin structures, introduces federal oversight for issuers, and sets compliance obligations around reserve requirements, audits, consumer protections, and anti-money laundering. With bipartisan support and a growing emphasis on financial innovation, the Act positions stablecoins as a viable part of the mainstream financial ecosystem. For fintechs, lenders, and payments providers operating with tokenized transactions or embedded crypto features, the new law may introduce direct licensing, chartering, or supervisory pathways that did not previously exist. It also invites further rulemaking from federal agencies like the SEC, OCC, and CFTC—raising the regulatory bar for digital asset products and services nationwide.
CORNERSTONE CAN HELP
NEW HIRE BACKGROUND CHECKS
Cornerstone offers background screening services that are accurate and prompt so you can spend less time worrying about compliance and more time on your business. Most criminal searches are completed in less than a day. We provide screenings for new hires as well as for statutory requirements. We can perform domestic screenings as well as international screenings.
CALIFORNIA PROTECTIONS EXPANDED IN SUBORDINATE MORTGAGE FORECLOSURES
California has enacted Assembly Bill 130, strengthening consumer protections in the nonjudicial foreclosure process for subordinate mortgages. Mortgage servicers must now certify compliance with state law before initiating foreclosure and inform borrowers of their right to court intervention. Courts are empowered to halt sales or grant remedies for violations, though protections for bona fide purchasers remain. This law raises operational and legal risks for mortgage lenders and servicers working in California, especially those handling second liens.
ILLINOIS REGLATIONS SET FOR DIGITAL ASSET BUSINESSES
Illinois has passed the Digital Assets and Consumer Protection Act, establishing a formal licensing and registration framework for companies engaging in digital asset activities. The new law grants enforcement and supervisory authority to the state’s Department of Financial and Professional Regulation and imposes requirements for disclosures, examinations, and consumer asset protections. Fintechs offering services like crypto transfers, digital wallets, or tokenized payments may now be required to register and comply with specific licensing obligations in Illinois. The law also creates a Consumer Protection Fund to support ongoing oversight.
MASSACHUSETTS MAJOR CONSUMER DEBT COLLECTION REFORMS ADVANCE
The Massachusetts Senate unanimously passed the “Debt Collection Fairness Act,” which would significantly reshape how consumer debt judgments are pursued and enforced. Key provisions include new wage garnishment limits, a shortened statute of limitations, and a ban on jail time for unpaid debts. The bill also caps post-judgment interest and attorney fees, and limits debt collection lawsuits to five years after a debt arises. Violations would be treated as consumer protection violations under Chapter 93A, and contracts that breach the act would be unenforceable. If enacted, most provisions will take effect January 1, 2026.
VIRTUAL SUGGESTION BOX
We’ve continued to hear great feedback from you, our clients, on how our newsletter provides value for your organization. To ensure we continue to research and provide the best data, we have created a virtual “suggestion box” for your ideas. Whatever topic you’d like to learn about, large and small, we will go research with our team and knowledgeable folks from our industry.
LOUISIANA & CONNECTICUT: MOMENTUM BUILDS AROUND EWA REGULATION
Connecticut and Louisiana have both enacted new laws regulating Earned Wage Access (EWA) services, reflecting growing state-level momentum around wage-based advance products.
Connecticut’s law (effective October 1) treats EWA as a form of small lending and imposes licensing, fee caps, and strict repayment rules—along with prohibitions on credit checks, debt collection, and litigation.
Louisiana’s newly enacted measure focuses on operational conduct, requiring voluntary tipping disclosures, consumer protections, and mandatory reporting to regulators, while explicitly exempting providers from lending, transmission, or debt collection classifications.
BEYOND THE NEWSLETTER
Head to LinkedIn and give us a follow to tap into a stream of real-time updates, legislative changes, and great content tailored for ARM and Fintech professionals. Engage with thought leaders and peers in our community to enhance your expertise.
Follow Cornerstone on LinkedIn and transform the way you stay informed in our ever-evolving industry.
CALIFORNIA: FIRST ENFORCEMENT UNDER DIGITAL FINANCIAL ASSETS LAW
The California Department of Financial Protection and Innovation (DFPI) issued its first enforcement action under the new Digital Financial Assets Law (DFAL), targeting Coinme Inc., a digital asset kiosk operator. The consent order cites violations of the DFAL and the California Consumer Financial Protection Law, signaling active state enforcement in the crypto space. This action puts fintechs and financial service providers on notice that offering digital financial products in California now requires careful licensing and regulatory review.
PENNSYLVANIA LICENSING REQUIREMENT FOR VIRTUAL CURRENCY TRANSMITTERS
Pennsylvania has enacted Senate Bill 202, expanding its Money Transmitter Act to cover virtual currency transmission. The new law—effective 60 days from enactment—requires a license for any entity transmitting digital assets on behalf of others for a fee. The legislation includes standard compliance obligations such as annual reporting, agent registration, and adherence to federal AML requirements. While self-custody is exempt, transmitting from a self-hosted wallet on someone else’s behalf triggers licensure. Pennsylvania now joins over half of U.S. states in regulating virtual currency transmission—underscoring growing scrutiny of crypto-related activity.
CSBS ISSUES FIRST MTMA GUIDANCE ON VIRTUAL CURRENCY AND NET WORTH REQUIREMENTS
On June 26, the Conference of State Bank Supervisors (CSBS) issued its first non-binding advisory guidance under the Model Money Transmission Modernization Act (MTMA), addressing how virtual currency should be treated in tangible net worth (TNW) calculations. The guidance clarifies that money transmitters may include virtual currency assets in their total assets for TNW purposes, provided those assets correspond to customer obligations denominated in the same virtual currency. This treatment applies only if virtual currency is integral to the licensee’s operations. With 27 states having adopted the MTMA in whole or part, the update signals a push toward consistency in how digital assets are accounted for in licensing and financial solvency requirements.
CONNECTICUT OVERHAUL ON CRYPTO AND MONEY TRANSMISSION RULES
Connecticut has enacted Public Act 25-66, a sweeping update to its money transmission laws that significantly impacts digital asset businesses. Effective October 1, 2025, the law broadens the definition of regulated activity to include digital wallets and virtual currency, while imposing a 1:1 reserve requirement for customer-held assets and new consumer disclosure mandates. It also places strict limitations on crypto ATMs and bans the state and its subdivisions from accepting, holding, or investing in virtual currencies. Together, these provisions position Connecticut among the most aggressive states in regulating digital assets and modernizing its licensing framework. Fintechs and crypto firms operating in the state should carefully assess whether they now fall within licensure scope.
ARIZONA VETOES BITCOIN RESERVE BILL AGAIN
Arizona Governor has vetoed House Bill 2324, marking the third digital asset reserve proposal she has rejected this session. The bill aimed to fund a Bitcoin and Digital Assets Reserve using criminal asset forfeitures, but Hobbs cited concerns that it would disincentivize local law enforcement by diverting seized assets away from their jurisdictions. Despite this veto and others—including proposals to allow crypto payments and direct state investments in digital assets—Arizona has passed HB 2749, a narrower law creating a reserve funded by unclaimed virtual property. This cautious legislative posture reflects a growing divide among states regarding government participation in crypto markets, with potential implications for fintechs navigating shifting digital asset regulations.
This information is not intended to be, nor is it, legal advice. It is intended for information purposes only. We make no warranty, express or implied, as to the accuracy or reliability of this information. We are not attorneys. You must retain your own attorney to receive legal advice. While Cornerstone strives to provide the most current and accurate state licensing information, the responsibility for any decision related to state licensing or agency compliance is solely yours.
