April 2026

NY BNPL LICENSING FRAMEWORK ADVANCES WITH DETAILED REQUIREMENTS

Following earlier movement to regulate Buy Now, Pay Later products, New York regulators are now advancing a proposed rule that outlines how the framework would operate in practice. The rule would require most BNPL providers to obtain a state license and comply with detailed requirements covering disclosures, billing practices, underwriting, fee limitations, and data usage. It also expands the scope of covered products beyond traditional "pay-in-four" models. Notably, loans made without proper authorization could be deemed void and uncollectible. Companies offering point-of-sale financing should assess whether their products fall within scope and prepare for licensing and operational changes.

ECOA RULE SHIFT CHANGES FEDERAL FAIR LENDING EXPECTATIONS

The CFPB finalized revisions to Regulation B under ECOA, eliminating disparate impact as a basis for federal enforcement and narrowing standards related to applicant discouragement. The rule also imposes new restrictions on how Special Purpose Credit Programs can be structured by for-profit lenders. While this marks a shift at the federal level, state-level standards may continue to differ. Lenders operating across jurisdictions should review policies to account for potential divergence.

UPCOMING WEBINAR: DEBT BUYER LICENSING

Debt buyers face a state-by-state licensing framework that is difficult to map and maintain as requirements change. Some states require a license before accounts are purchased, while others focus on collection activity, servicing arrangements, disclosures, or reporting. Join Aryeh Derman, Joann Needleman and Christy Barger for a discussion on how these rules vary by jurisdiction, what debt buyers should review before entering a new state, and where companies commonly run into trouble.

What we'll cover:

When debt buyer licensing requirements are triggered
How state expectations differ for purchasing, servicing, and collecting debt
Common issues tied to third-party collection agencies and servicers
Where applications get delayed or denied
What regulators are paying attention to in the current environment

Steps to prepare for expansion into new states

MD LICENSING EXPANDEDTO LOAN ACQUIRERS AND ASSIGNEES

Maryland enacted a law removing an exemption for entities that acquire or are assigned loans without originating or servicing them. These entities will now fall within the state's licensing framework beginning in mid-2026. This directly impacts secondary market participants, including debt buyers and passive investors. Companies should review portfolio structures and determine whether licensing obligations now apply.

MS DATA SECURITY REQUIREMENTS FOR MONEY TRANSMITTERS

Mississippi enacted a law establishing new data security expectations for licensed money transmitters, including requirements around safeguarding consumer information and maintaining formal security controls. These requirements are likely to intersect with examination expectations and internal risk management programs. The law reflects a broader trend of states layering operational standards onto licensing regimes. Companies should review cybersecurity frameworks and supporting documentation.

RECORDED WEBINAR: HOW TO PREPARE FOR THE LICENSE APPLICATION PROCESS

Our recent webinar covered what it takes to get licensed in regulated industries, from business formation and registration to state-specific filing requirements, common deficiencies, and post-approval reporting. Drawing on 64 years of combined licensing experience from our experts, the session covered the documents, disclosures, timing issues, and jurisdiction differences that often delay applications, even when companies think they are fully prepared.

Topics included ownership and management disclosures, business plans and financials, trust accounts and surety bonds, stale documents, incomplete filings, and the ongoing reporting obligations that continue after submission and after approval. And more.

We've recorded the full webinar, and it's now available to watch on your schedule.

WATCH NOW

CT UNLICENSED LEAD GENERATION ACTIVITY

A Connecticut action reinforces that mortgage lead generation and referral activity can trigger licensing requirements depending on how it is structured. The case involved a company operating without the required license, underscoring that marketing and customer acquisition models may fall within regulated activity. Companies using third-party lead generators should review arrangements carefully to avoid unintended licensing exposure.

ME MEDICAL DEBT COLLECTION PRACTICES RESTRICTED

Maine enacted a law limiting key collection tools for medical debt, including prohibiting liens on a consumer's primary residence and wage garnishment tied to medical debt judgments. The law also restricts certain interest tied to property-based enforcement, further impacting recovery economics. These changes require clearer segmentation of medical debt and adjustments to legal strategy. Companies should review collection practices and internal controls ahead of the effective date.

BLOG: CALIFORNIA DELETE ACT

California's Delete Act moves data broker obligations into daily operations. Starting August 1, 2026, covered businesses must connect to the state's DROP platform and process consumer deletion requests on an ongoing basis. For financial services firms, the key challenge is scope and execution. Companies may qualify based on how they share or move data, and must be ready to locate and delete information across systems and vendors at scale. Read our blog post for more information.

LENDER LICENSING GUIDE

If you're launching or expanding a lending program, this guide lays out what it takes to be license-ready across states, before timelines and product plans get boxed in

What's Included:

Consumer vs. commercial licensing footprint
Federal expectations
State licensing nuance
Bonds, net worth, & insurance expectations
Common pitfalls that create delays

DOWNLOAD

NY COERCED DEBT LAW AMENDED

New York updated its coerced debt law, introducing new timelines for pausing collection activity and expanding the types of documentation consumers can provide. The law also establishes clearer dispute resolution processes and increases potential exposure for non-compliance. Debt buyers and collectors should review procedures and training to ensure alignment.

LENDING RISK EBOOK COMING SOON!

Deep dive into the regulatory pressures shaping nonbank lending today, from licensing and supervision to partnerships, servicing, product design, and data governance. Developed in collaboration with Chuck Dodge of Hudson Cook.

Join the list to get the ebook The State of Regulatory Risk in Lending as soon as it's released!

CA DEBT COLLECTION LICENSING FEES CHALLENGED

Industry groups filed a lawsuit challenging California's debt collection licensing fee structure, arguing that assessments exceed the cost of regulation and are applied disproportionately. The case focuses on how fees are calculated and allocated, including reliance on gross receipts and discretionary audit costs. This highlights broader questions around how states structure and fund licensing programs. Companies should monitor developments, as outcomes could impact licensing costs.

NEW HIRE BACKGROUND CHECKS

Cornerstone offers background screening services that are accurate and prompt so you can spend less time worrying about compliance and more time on your business. Most criminal searches are completed in less than a day. We provide screenings for new hires as well as for statutory requirements. We can perform domestic screenings as well as international screenings.

GET STARTED

BLOG: 15 LICENSING APPLICATION FACTS

Most licensing delays come from small, avoidable issues. This article pulls together 15 common trouble spots, drawn directly from Cornerstone's recent webinar, where real-world filing challenges were discussed in detail. From incomplete applications and expired documents to payment issues and background check gaps, these are the details that slow approvals and create rework. Many of them surface after submission, when timelines are tighter and fixes are more disruptive.

Teams that plan ahead, double-check requirements, and assign clear ownership across the process are better positioned to keep filings moving and avoid unnecessary delays. Read our blog post for all 15 license application facts.

STATE APPROACHES TO VIRTUAL CURRENCY KIOSKS CONTINUE TO DIVERGE

Building on earlier state activity around crypto kiosks, recent developments highlight a widening divide in regulatory approaches. Tennessee enacted a law prohibiting kiosk operations entirely, while Wisconsin established a formal licensing and oversight framework. This contrast reflects a broader trend of states either integrating these activities into existing licensing regimes or restricting them outright. Companies operating in crypto, payments, or money transmission should evaluate how state-specific rules affect expansion and licensing strategy.

NEW REMITTANCE TAX CREATES OPERATIONAL AND REPORTING BURDEN

Treasury and the IRS proposed rules implementing a 1% excise tax on certain cross-border remittance transfers funded with cash or similar instruments. Providers would be responsible for collecting the tax, making regular deposits, and handling reporting requirements. The rules clarify which funding methods trigger the tax and how the taxable amount is calculated, which may require updates to transaction workflows and systems. Companies offering money transmission or cross-border payments should assess operational impact ahead of implementation.

BEYOND THE NEWSLETTER

Head to LinkedIn and give us a follow to tap into a stream of real-time updates, legislative changes, and great content tailored for ARM and Fintech professionals. Engage with thought leaders and peers in our community to enhance your expertise.

Follow Cornerstone on LinkedIn and transform the way you stay informed in our ever-evolving industry.

STATE DATA PRIVACY LAWS CONTINUE TO EXPAND ACROSS THE U.S.

Building on recent momentum in this area, Oklahoma and Alabama enacted comprehensive consumer data privacy laws, continuing the expansion of state-level frameworks governing how businesses collect, use, and share personal data. These laws introduce consumer rights, require data protection assessments, and mandate formal vendor agreements. While some financial institutions may be exempt under federal frameworks, many fintechs and service providers remain within scope. Companies should ensure consistent data governance and vendor oversight across jurisdictions.

FINCEN UPDATES GTO GUIDANCE FOR MONEY TRANSMITTERS

FinCEN issued updated FAQs clarifying requirements under its Geographic Targeting Order affecting money transmitters and banks in certain Minnesota counties. The updates provide more detail on reporting expectations and transaction handling within scope. While geographically limited, this reflects continued use of targeted reporting obligations tied to specific risk areas. Companies should confirm how these requirements apply to their operations.

This information is not intended to be, nor is it, legal advice. It is intended for information purposes only. We make no warranty, express or implied, as to the accuracy or reliability of this information. We are not attorneys. You generally must retain your own attorney to receive legal advice. While Cornerstone strives to provide the most current and accurate state licensing information, the responsibility for any decision related to state licensing or agency compliance is solely yours.