August 2026

Cornerstone's newsletter covers the state licensing, registration, and reporting developments that matter most to financial services companies. Each issue highlights what changed, where it applies, and what teams should review next.

NEW LICENSING & REPORTING REQUIREMENTS

FLORIDA

STABLECOIN LICENSING FRAMEWORK ADOPTED

Florida enacted two measures addressing payment stablecoins. HB 175 establishes a regulatory framework for state-qualified payment stablecoin issuers, including licensing and reserve requirements, effective October 1, 2026. Separately, SB 1568 created the Florida Stablecoin Pilot Program, allowing the Department of Financial Services to accept designated payment stablecoins for certain government fees. Stablecoin issuers and fintech companies should review how the new issuer framework affects their licensing, reserve, disclosure, and redemption obligations in Florida.

NORTH CAROLINA

MONEY TRANSMITTER LICENSING FOR VIRTUAL CURRENCY KIOSKS

North Carolina enacted House Bill 920, the Virtual Currency Kiosk Consumer Protection Act, creating a new framework for virtual currency kiosks effective January 1, 2027. The law requires kiosk operators to obtain a money transmitter license and adds transaction limits, disclosure rules, fraud-prevention measures, and other operating requirements. For companies offering crypto kiosks or similar cash-to-digital asset services, the law changes both the licensing analysis and the day-to-day rules for operating in the state.

ALASKA

VIRTUAL CURRENCY BROUGHT UNDER MONEY TRANSMISSION LAW

Alaska enacted Senate Bill 86, bringing virtual currency exchange, transfer, storage, and administration within the state's money transmission framework effective July 1, 2027. Crypto companies and payment providers with Alaska customers should review whether wallet custody, transfer services, exchange activity, or other virtual currency functions now trigger state licensing requirements. For companies operating across multiple jurisdictions, this is another example of states expanding money transmission laws to capture digital asset activity through existing licensing structures.

INDUSTRY NEWS

NMLS DEPLOYS PHASE THREE MODERNIZATION

CSBS deployed Phase Three of its NMLS modernization in August 2026, introducing state agency task management for the individual licensing process and replacing the existing Regulator Worklist for individuals. The update also improves two-way communication around review items. For companies managing individual licenses through NMLS, the changes affect how teams receive, track, and respond to state requests. With renewal season approaching, companies should review internal workflows now so new tasks, deficiencies, and follow-up items do not get missed.

RESOURCES & WEBINARS

WEBINAR

CROSS-BORDER MONEY TRANSMISSION LICENSING

Expanding money transmission across borders means navigating multiple regulatory frameworks at once. A company may need to account for U.S. state money transmitter licensing, FinCEN registration and federal requirements, and separate rules in the EU and UK that affect authorization, safeguarding, reporting, and ongoing operations. Expansion plans often slow down when teams underestimate how differently these frameworks apply to products, entity structure, counterparties, and customer flows. This session will compare the main regulatory frameworks and show where companies tend to run into trouble as they expand across borders. We will focus on the areas that create delays, added cost, and filing issues, so attendees can better scope the work before entering a new market.

Attendees will learn:

• How U.S. state money transmitter licensing differs from FinCEN requirements

• Where EU and UK frameworks diverge from the U.S. approach

• Which cross-border activities can trigger added licensing or registration obligations

• Where companies tend to underestimate timing, documentation, and operational requirements

• What to review before expanding into a new jurisdiction

REGISTER NOW

NEW WHITE PAPER

ACTIVE DEBT BUYING & COLLECTING

Debt buying and collection licensing requirements vary significantly by state and by activity. Our 2026 Licensing Guidebook provides essential insights for businesses involved in buying, collecting, litigating, or servicing debt.

What's Included:

• Common licensing triggers

• Major state variations

• Filing issues to consider

• Steps to develop an effective licensing strategy

DOWNLOAD

OPERATIONAL CHANGES

NEW YORK

NYC ISSUES SHIELD FAQs; EFFECTIVE DATE MOVES TO JANUARY 1, 2027

The New York City Department of Consumer and Worker Protection published FAQs for its amended SHIELD debt collection rule and pushed the compliance date to January 1, 2027. The FAQs give agencies, debt buyers, and collection law firms more direction on how the city expects the rule to be applied, while the delay provides additional time to adjust notices, scripts, workflows, and system logic. Companies collecting from New York City residents should use the added runway to complete implementation work before the new date. The direction of the rule has not changed, and the operational lift remains substantial. Read the Frequently Asked Questions.

FEDERAL

FINCEN ENDS BOI REPORTING FOR U.S. BUSINESSES

FinCEN issued a final rule permanently exempting U.S. companies from Corporate Transparency Act beneficial ownership information reporting requirements. Certain foreign companies registered to do business in the United States remain subject to reporting, although they are not required to report beneficial ownership information for U.S. persons. The final rule took effect August 14, 2026, making permanent changes first introduced through FinCEN's 2025 interim final rule. U.S. companies should update internal entity-management processes to reflect that BOI filings and updates are no longer required.

NEW YORK

DFS ISSUES CYBER ALERT TO REGULATED ENTITIES

The New York Department of Financial Services warned regulated entities to review whether they or their third-party service providers use vulnerable remote monitoring software tied to an active cyber campaign. DFS said covered entities should confirm mitigation steps, investigate unauthorized access, and assess whether any incident triggers reporting obligations under 23 NYCRR Part 500. For companies licensed or supervised by DFS, the alert shows the agency expects prompt review of vendor-related cyber exposure, not just internal systems.

MINNESOTA

NEW MORTGAGE SERVICING STANDARDS

Minnesota enacted HF 4188, adding a new section to chapter 58 that sets operating standards for residential mortgage servicers. The law covers servicing transfers, payment crediting, suspense accounts, fee timing, escrow notices, borrower information requests, complaint handling, third-party oversight, and borrower-facing disclosures in statements, welcome packets, and websites. It also requires servicers to maintain written policies for oversight of third-party providers and to make those policies available to the commissioner on request. Mortgage servicers with Minnesota loans should review current workflows, borrower communications, and vendor oversight procedures against the new statutory standards.

DELAWARE

CONSUMER FRAUD ACT EXPANDS TO POST-TRANSACTION CONDUCT

Delaware enacted Senate Bill 297 to clarify that the state Consumer Fraud Act applies before, during, and after a sale or other consumer transaction. The change came in response to a 2025 Delaware Supreme Court decision that had read the statute more narrowly, and the new language expressly supports enforcement against post-transaction conduct, including debt collection activity. For collection agencies and consumer finance companies, the amendment broadens the state's reach over conduct that occurs after the original transaction is complete.

NEW FEATURE!

ATLAS ASSISTANT

Atlas Assistant is an in-app chat assistant that helps Cornerstone clients efficiently navigate the licensing process. It has the full context of the licensing information in your Atlas portal, so it can help you find information, answer questions, and navigate the portal. If the assistant cannot confidently answer a question, it will bring your licensing specialist into the loop. This is one more way that Cornerstone ensures the licensing process is as transparent and efficient as possible.

LOGIN TO ATLAS

PROPOSALS & REGULATORY WATCH

FEDERAL

SEC PROPOSES CRYPTO ASSET FRAMEWORK WITH NEW EXEMPTIONS AND FEDERAL PREEMPTION

The Securities and Exchange Commission published a proposed rule titled "Regulation Crypto Assets," laying out a tailored federal framework for certain crypto investment contracts, with comments due by October 20, 2026. The proposal includes a startup exemption for offerings up to $5 million over four years, a fundraising exemption for offerings up to $75 million in a 12-month period, a safe harbor path for assets to move out of investment contract treatment once specified conditions are met, and a qualified purchaser provision that would preempt state securities registration and qualification requirements for covered offerings and certain secondary transactions. For digital asset businesses, the proposal could reshape how offerings are structured, how platforms assess registration exposure, and when federal treatment may displace state securities requirements.

COLORADO

RULES FOR AI LAWS AFFECTING FINANCIAL SERVICES

Colorado filed proposed rules to implement the Automated Decision-Making Technology Act and Chatbot Safety Act, both of which take effect January 1, 2027. The ADMT Act applies to systems used to materially influence consequential decisions, including those involving financial services, and creates requirements tied to disclosures, consumer rights, and human review. For lenders and other financial services companies using automated decision tools, the proposed rules provide an early look at how Colorado may apply these requirements. Written comments submitted by September 4 will be considered for proposed revisions presented at the rulemaking hearing, while the broader comment period remains open through October 26.

FEDERAL

FTC SIGNALS SCRUTINY OF PERSONALIZED PRICING AND DATA-BASED OFFERS

The Federal Trade Commission issued a proposed enforcement policy statement on personalized pricing and opened a public comment period, warning that businesses may face Section 5 exposure if they use consumer data to set individualized prices without clear disclosure. The statement says businesses should clearly explain when a price is personalized, the basis for that personalization, and the types of data used when consumers would not reasonably expect that treatment. For financial services companies, debt collectors, and servicers using algorithms or AI to shape settlement offers, discounts, or other consumer-facing terms, the proposal points to closer scrutiny of data-driven decisioning and disclosure practices. Comments on the proposed policy statement are due September 18, 2026.

BLOG POST

EARNED WAGE ACCESS HEADING TOWARD A STATE LICENSING PATCHWORK

Earned wage access is facing growing scrutiny as states take different approaches to licensing, fees, consumer protections, and enforcement. Recent litigation and a wave of state legislation are making it harder for EWA providers to rely on a single regulatory strategy across jurisdictions. See what this growing state-by-state patchwork means for providers and the licensing decisions that can shape expansion.

READ MORE

ENFORCEMENT

CALIFORNIA

DFPI PENALIZES UNLICENSED LENDING

The California Department of Financial Protection and Innovation ordered a Florida lender to pay $4 million for making loans in California without a California Financing Law license. The agency said it identified the issue when the company later applied for a license, then alleged the lender had made unlicensed loans, paid compensation to unlicensed or nonexempt brokers, and charged unlawful interest. The settlement also requires refunds of excessive interest charged on loans of $5,000 or less. The case shows how licensing gaps can surface during the application process and lead to penalties, refunds, and added scrutiny.

COLORADO

EWA PROVIDER SUED OVER ALLEGED UNLICENSED LENDING

Colorado sued EarnIn, alleging the company made more than 3.1 million unlicensed loans to state residents over roughly two and a half years, advancing about $300 million and collecting more than $16 million in tips and expedite fees. The case turns on whether the state treats earned wage advances as loans that require a lending license, rather than as a separate product category. For providers offering earned wage access, tip-based advances, or expedited funding features, the lawsuit is a reminder to review state-by-state licensing treatment before expanding or adjusting product structure.

CALIFORNIA

DFPI FINES MORTGAGE LENDER $825,000 OVER RANSOMWARE BREACH

The California Department of Financial Protection and Innovation ordered Academy Mortgage Corporation to pay $825,000 and provide one year of identity theft insurance after a 2023 ransomware attack exposed the personal information of 284,443 individuals, including 34,452 California residents. DFPI said the company's weaknesses predated the breach and cited inadequate risk assessments, deficient patch management and access controls, the lack of a full information security audit between 2017 and 2023, and gaps in board oversight. The agency also found recordkeeping deficiencies that prevented the Commissioner from determining whether lending and servicing functions complied with the California Residential Mortgage Lending Act. Although Academy stopped taking applications in 2024, DFPI still pursued the action, which shows regulators may continue examinations and penalties even as a licensed business winds down.

CALIFORNIA

DFPI RESOLVES COMMERCIAL FINANCING LICENSING AND PRICING ALLEGATIONS

The California DFPI entered into a consent order with a commercial finance provider over alleged violations of the California Financing Law, the state's commercial financing disclosure requirements, and alleged charges above California's constitutional interest-rate limit. The company neither admitted nor denied the findings. For commercial finance providers operating in California, the order is a reminder to review license coverage, disclosure practices, and pricing structure together, since product terms that fall outside the state's framework can trigger both licensing and enforcement risk.

NEW JERSEY

NJ SUPREME COURT FINDS NO PRIVATE RIGHT OF ACTION UNDER CFLA

The New Jersey Supreme Court held in Diana that the New Jersey Consumer Finance Licensing Act does not give borrowers a private right of action to void debt based on alleged unlicensed activity. The court said enforcement of that provision remains with regulators and prosecutors, while borrowers may still raise licensing-related issues as a defense in collection actions. Debt buyers should not treat the ruling as relief from New Jersey licensing requirements, since the New Jersey Commissioner of Banking and Insurance still retains authority to pursue violations. The decision narrows private litigation exposure, but the underlying New Jersey licensing obligation remains in place.

ALASKA

ACTION OVER UNLICENSED MORTGAGE ORIGINATION

Alaska's Division of Banking and Securities settled with a Missouri mortgage lender over alleged unlicensed activity by an individual mortgage loan originator. The Division said the MLO provided cost estimates and two preapproval letters to Alaska residents for Alaska residential real estate even though neither the MLO nor the lender was licensed in the state. Alaska assessed a $2,500 civil penalty, including $1,000 for unlicensed activity and $1,500 for failure to supervise. The action is a reminder that early-stage borrower communications can trigger state mortgage licensing exposure.

ILLINOIS

UNLICENSED COLLECTION ACTIVITY

The Illinois Department of Financial and Professional Regulation's April 2026 Enforcement Report noted a consent order with a collection agency for unlicensed collection activity in Illinois. The summary released in the state watch update does not include much detail, but the item still signals continued state attention on collection licensing and exam findings. For companies operating across multiple states, enforcement report summaries like this can flag where regulators are actively reviewing licensing status and branch activity.