September 2026

Cornerstone's newsletter covers the state licensing, registration, and reporting developments that matter most to financial services companies. Each issue highlights what changed, where it applies, and what teams should review next.

NEW LICENSING & REPORTING REQUIREMENTS

CALIFORNIA: BILL WOULD EXPAND LICENSING FOR COMMERCIAL FINANCE PROVIDERS AND BROKERS

California Assembly Bill 2116 passed the legislature on August 20, 2026 and now awaits action by Governor Gavin Newsom. If signed, the bill would require a California Financing Law license for commercial financing providers and commercial financing brokers, including factoring and revenue-based financing providers and brokers, with the licensing requirement taking effect July 1, 2028. The bill also creates new rules for commercial financing transactions involving small businesses, defined as for-profit entities with annual gross receipts of no more than $16 million, subject to inflation adjustments every two years. Among other changes, the bill would prohibit confessions of judgment, apply California's unconscionability standard, and require commercial financing brokers to post their average and maximum annual percentage rates on their websites. For companies active in commercial finance, the bill points to a much wider California licensing footprint and a longer list of operational requirements if it becomes law.

NEW JERSEY: STUDENT LOAN BILL WOULD REQUIRE REGISTRATION

A New Jersey Assembly committee advanced A5117, a bill that would require private student loan creditors to register with the Commissioner of Banking and Insurance and the Nationwide Multistate Licensing System. The bill covers non-Title IV postsecondary education debt and would bar collection unless the creditor or collector holds detailed account records, including transaction history, contract copies, fee itemization, and chain-of-title documents. Before acceleration or suit, creditors would also need to send a notice of intention 30 to 180 days in advance and provide a copy to the department. If enacted, the bill would take effect 180 days later and expose violators to civil penalties, borrower lawsuits, and possible criminal liability for knowing violations.

CSBS FORMALIZES MTMA GUIDANCE REQUEST PROCESS

The Conference of State Bank Supervisors announced a formal process for submitting guidance requests on Money Transmission Modernization Act implementation, giving industry participants a centralized way to raise interpretive questions as states continue to adopt and apply the model law. According to CSBS, more than half of the states have adopted the MTMA in full or in part, and differences in interpretation have emerged as jurisdictions operationalize the framework. The new intake process is intended to support more consistent treatment across adopting states and could shape how regulators approach issues such as permissible investments, net worth standards, supervisory expectations, and digital asset activities. For money transmitters operating across multiple states, this creates a clearer path to seek clarification before inconsistent state positions become harder to unwind.

CALIFORNIA: DATA BROKERS WARNED ON DELETE ACT REGISTRATION FILINGS

The California Privacy Protection Agency issued Enforcement Advisory 2026-01 warning that data brokers can face a $200 per day fine for incorrect annual registration filings under the state's Delete Act. The advisory says the agency has already brought enforcement actions tied to reporting errors and is focusing on the accuracy of disclosures such as data collection metrics, data types collected, and data recipients. Businesses that operated as data brokers in the prior year must register annually and provide the required disclosures. The advisory signals that filing errors can trigger daily penalties even when a business has submitted a registration.

RESOURCES & WEBINARS

UPCOMING WEBINAR: LICENSE RENEWAL SEASON WITHOUT THE SCRAMBLE

Getting approved is only the start. Most licenses still need to be renewed to stay active, and as perpetual licenses become less common, more companies are dealing with year-end renewals, license annual reports, NMLS updates, and state-specific filing requirements at the same time. Those annual reports are often separate from Secretary of State filings and may require financial data, bond calculations, or other supporting documents that take time to pull together.

This session will cover what licensed companies need to review before year-end, including renewal timelines, annual reporting obligations, and material changes such as updates to ownership, officers, and business addresses that often must be reported within 30 days. Dawn Graham and Jennifer Kim will also walk through how deficiencies should be handled, why proactive follow-up with regulators is often necessary, and how a reliable internal tracking system helps teams manage due dates across multiple jurisdictions. Because renewals are often processed first come, first serve, filing early can reduce the risk of backlogs, technical issues, and last-minute problems in December.

MULTI-STATE LICENSING GUIDE FOR STUDENT LOAN SERVICERS

Student loan servicing is facing increased scrutiny and regulatory requirements across multiple states. This guide provides essential insights into the licensing landscape, helping your organization stay compliant and avoid costly delays.

Inside, you will find:

An overview of state-specific licensing requirements
Common pitfalls and challenges during the licensing process
Steps to ensure compliance after receiving approval
Strategies for scaling operations across jurisdictions

DOWNLOAD NOW

WEBINAR ON-DEMAND: CROSS-BORDER MONEY TRANSMISSION LICENSING

Cross-border money transmission gets complicated when a product touches the U.S., UK, and EU. The same service can fall under different licensing or authorization frameworks depending on how funds move, who holds customer money, where conversion occurs, and which entity serves the customer.

During this webinar, we compared U.S. state money transmitter licensing and FinCEN registration with UK FCA authorization and EU payment institution and electronic money institution frameworks. We also explored how definitions of money transmission and payment services vary across jurisdictions, and why the actual flow of funds is critical to determining licensing scope.

The discussion also covered the operational factors that can affect licensing and authorization, including entity structure, local leadership, banking relationships, bonding, and application timelines. We looked at why policies, business plans, website language, and application materials need to reflect the product actually being offered.

Finally, we discussed what regulators may look for in funds flow, safeguarding, reconciliation, vendor oversight, and customer handling, as well as how foreign exchange, cross-border payout partners, and digital assets can add another layer of complexity.

No problem if you missed it. Watch it on-demand at your convenience.

WATCH ON-DEMAND

OPERATIONAL CHANGES

CALIFORNIA AUTHENTICATION RULES ADDED FOR MONEY TRANSMITTERS

California enacted SB 505, adding new authentication requirements for companies regulated under the state's Money Transmission Act. Beginning January 1, 2028, covered companies may not allow a user to log in or access the platform unless the company uses two-factor authentication, multifactor authentication, or an equivalent secure access control approved in writing by the company's information security officer. The bill also requires a risk-based process to reverify user identity when suspicious activity occurs and an easily accessible method for users to report errors or suspected fraud through the platform. For California money transmitters, this points to product, security, and customer support changes that may need planning well before the effective date.

CALIFORNIA DFPI URGES LICENSEES TO REPORT CYBER INCIDENTS WITHIN 48 HOURS

The California DFPI updated its guidance to encourage licensees to report cybersecurity incidents within 48 hours, or as soon as possible, when there is reason to believe a reportable incident has affected California operations. The guidance covers a wide range of events, including ransomware, unauthorized network intrusions, data breaches, phishing incidents that cause significant downtime, fraudulent fund transfers tied to social engineering, and certain vendor breaches. For DFPI licensees, that means incident response and internal escalation procedures need to move fast enough to support prompt reporting through the agency's Cybersecurity Incident Report Form.

CSBS AI EXAM FRAMEWORK SIGNALS WHAT STATE EXAMINERS MAY ASK FOR

The Conference of State Bank Supervisors released an AI supervisory framework for state-chartered banks and state-licensed nonbank financial institutions that examiners can use during reviews. The package includes scoping questions, risk tiering, and document request guidance covering AI policies, board reporting, AI inventories, vendor contracts, and samples of consumer-facing outputs such as notices and chatbot transcripts. It does not create new legal obligations, and each state agency will decide whether to adopt it, but it gives licensed companies a clear view of the records and controls examiners may start requesting. Higher-risk uses include direct consumer outcomes, sensitive personal data, and limited human review.

DELAWARE GLBA EXEMPTION NARROWS UNDER PERSONAL DATA PRIVACY ACT

Delaware amended its Personal Data Privacy Act through House Bill 380, with changes taking effect January 1, 2027. The law lowers applicability thresholds, extends coverage to certain third parties that acquire personal data from a controller, and removes the broader entity-level GLBA exemption, replacing it with a narrower exemption for banks, credit unions, and savings associations, while leaving the data-level GLBA exemption in place. The amendments also expand consumer access rights, add contract requirements for third-party data sharing, and require impact assessments for certain automated decisions that produce legal or similarly significant effects. Financial services companies that previously assumed they were fully exempt under GLBA may need to revisit that position before the 2027 effective date.

LABCORP SETTLEMENT IMPOSES NEW VENDOR RULES ON DEBT COLLECTORS

Labcorp agreed to pay $2.3 million to 44 state attorneys general and adopt new oversight standards for the debt collectors it uses, resolving a multistate investigation tied to the 2019 AMCA data breach. Under the settlement, effective October 1, Labcorp must require its collection vendors to segment Labcorp data from other client data, complete annual risk assessments and penetration tests, and undergo annual SOC 2 Type 2 audits or HITRUST assessments. Vendors must also dispose of data under NIST standards and provide annual written confirmation that consumer data has been deleted once a debt is satisfied or a referral is rescinded. Labcorp has 12 months to amend existing collector contracts and must retain the right to terminate vendors that do not meet the new standards. For agencies servicing healthcare accounts, the settlement gives states a clear benchmark for vendor controls, data handling, and contract terms.

CONNECTICUT ORDER SHOWS SERVICING ACTIVITY CAN TRIGGER SMALL LOAN LICENSING

Connecticut's banking commissioner issued a consent order against Nelnet Servicing, LLC, alleging the company received payments on at least 1,114 small loans to Connecticut borrowers before obtaining the required small loan company license on March 25, 2026. The order covers activity from January 1, 2022 through March 25, 2026 and requires the company to stop unlicensed activity, verify whether creditors it services in Connecticut are licensed or exempt, and retain that documentation. Nelnet also agreed to pay a $25,000 civil penalty and $800 in back licensing fees. For companies servicing consumer loans, the order is a reminder that licensing exposure can attach to payment handling, not only origination.

PROPOSALS & REGULATORY WATCH

MICHIGAN BILL WOULD ADD NEW PRE-CONTACT NOTICE RULES

Michigan House Bill 6418 would require a licensed debt collector or collection agency to send written notice at least five days before first contacting a debtor on a purchased, assigned, or transferred claim. The notice would need to list the amount owed, the current collector, the seller or transferor, the original creditor, and the date and amount of the last payment. The bill would also require collection activity to stop if the debtor provides written notice and documentation showing the debt resulted from economic abuse, with a five-day follow-up notice required if the documentation is incomplete. For agencies handling purchased debt, the proposal would add a new notice step and a new review process before outreach begins. The bill is tie-barred to HB 6419 and would take effect only if that companion measure is also enacted.

WASHINGTON SEEKS LICENSE BAN AND $1.03 MILLION PENALTY AGAINST CRYPTO KIOSK OPERATOR

The Washington Department of Financial Institutions issued a Statement of Charges against GPD Holdings LLC, which operates as CoinFlip, and its chief executive, seeking cancellation of the company's money transmitter license, an industry ban, customer refunds, and a $1,029,600 civil penalty. According to the agency, a 2025 examination found a long list of deficiencies, including alleged failures tied to anti-money laundering controls, customer identification, suspicious activity alert review, transaction limits, disclosures, refund handling, surety bond coverage, and reporting of banking relationships, lawsuits, and a data breach. Washington also alleged that more than half of the company's in-state transactions involved customers age 60 or older, increasing the risk of harm in crypto kiosk scams. For money transmitters and digital asset operators, the case shows how state regulators are using licensing authority to police operating controls, disclosures, and supervisory reporting, especially where cash-to-crypto activity creates consumer fraud exposure.

COLORADO AND TEXAS MULTISTATE EXAM PUTS MONEY TRANSMITTER AML AND CYBER CONTROLS IN FOCUS

Colorado and Texas issued a June 2026 multistate consent order against RamadPay, a Minnesota-based money transmitter, after a coordinated examination identified several operating deficiencies. According to Troutman Pepper Locke's summary of the order, regulators cited untimely filing of CTRs and CMIRs, weaknesses in the company's AML/CFT program, including agent monitoring and independent reviews, and Safeguards Rule deficiencies tied to device and software inventory management. The order reportedly imposed a $200,000 penalty, required the company to retain a third-party consultant, enhance monitoring, and provide quarterly progress reports to both states. For money transmitters, the case shows how state examinations are reaching beyond license status into transaction reporting, internal controls, and data security.

ENFORCEMENT

MASSACHUSETTS ENFORCEMENT TARGETS UNLICENSED DEBT COLLECTION

A Massachusetts consent judgment requires several debt buyers and their owner to provide about $52 million in debt relief to more than 6,000 consumers and permanently stop debt buying, selling, and collection activity involving Massachusetts consumers. The case alleged unlicensed debt collection along with other conduct, including attempts to collect debts the defendants did not own, overstated prejudgment interest, collection on time-barred debt, and communication-limit violations. The order bars the defendants from collecting within or from Massachusetts, accepting payments from Massachusetts consumers, applying for a Massachusetts debt collector license, or purchasing, selling, assigning, or transferring debts owed by Massachusetts consumers. It also requires the surrender of a debt collector license and the wind-down of related business activity tied to the state. For debt buyers and collection agencies, the case shows how state enforcement can move beyond fines and end in a permanent loss of access to a state market.

WASHINGTON UNLICENSED MORTGAGE PROCESSING AND UNDERWRITING TARGETED

Washington's Department of Financial Institutions issued a consent order against 3N Performance Partners, LLC after finding the company performed third-party loan processing and underwriting on at least 1,803 Washington residential mortgage loans without the required state license. According to the order, the company engaged in the activity from December 21, 2023 through July 29, 2025 without a consumer loan company license or mortgage broker license. The company agreed to cease the activity, pay a $75,000 fine, and reimburse a $2,815.60 investigation fee. The order also states that a pending mortgage broker license application would not allow the company to resume underwriting without a separate consumer loan company license.

CONNECTICUT UNLICENSED EWA ACTIVITY TARGETED UNDER SMALL LOAN LAW

The Connecticut Banking Commissioner entered a consent order with Tapcheck Inc. over allegations that the company made, offered, and advertised small loans to Connecticut borrowers without the small loan company license required under Conn. Gen. Stat. § 36a-556(a). The order covers activity from January 1, 2024 through January 29, 2026 and says the company has stopped the activity in Connecticut and has a licensing application pending. Tapcheck agreed to pay a $200,000 civil penalty, $400 in back licensing fees, and reimburse fees collected from affected Connecticut borrowers. The order also says the state will not pursue further action for the covered conduct and does not prevent the company from obtaining a license later if it meets Connecticut's requirements.

ILLINOIS ENFORCEMENT OF UNLICENSED STUDENT LOAN DEBT RELIEF

Illinois regulators are continuing to enforce licensing requirements for student loan debt relief providers. On September 17, the Illinois Department of Financial and Professional Regulation announced actions against two companies for allegedly providing student loan debt relief services without the required license under the Debt Settlement Consumer Protection Act. One matter resulted in a consent order barring further activity in Illinois and requiring $47,929.44 in restitution plus a $50,000 penalty, while a second action could require $79,585.59 in restitution and a $318,000 fine if finalized. The agency also pointed to the protections tied to licensure, including bonding, examinations, suitability determinations, and fee limits. For companies in this space, the message is straightforward. If the activity triggers licensure and the license is missing, Illinois can impose restitution, penalties, and orders to stop operating.

FLORIDA UNLICENSED CONSUMER FINANCE CASE SETTLED

The Florida Office of Financial Regulation entered a final order with BYDcash, Incorporated after finding the company made consumer finance loans without the license required under section 516.02(1), Florida Statutes. Under the settlement, BYDcash agreed to cease and desist from future violations, pay a $107,250 administrative fine, and waive its right to contest the findings. In return, the agency agreed to approve the company's consumer finance license application and issue the license within one business day of the final order. For companies operating in lending, the case shows that Florida is still pursuing unlicensed activity even where the matter ends in a negotiated path to licensure.

COLORADO AG BRINGS FIRST ENFORCEMENT UNDER MEDICAL DEBT JUDGMENT LAW

Colorado Attorney General Phil Weiser announced a settlement with Wakefield & Associates that marks the first enforcement of Senate Bill 23-093, the state's 2023 medical debt law. The law requires collection agencies seeking default judgments on medical debt incurred on or after May 4, 2023 to file an affidavit from an authorized employee of the medical provider that treated the consumer. Regulators said the company relied at times on assignment documents that did not satisfy that evidentiary standard. The order requires the agency to pay a $30,000 fine, move to vacate unsatisfied default judgments tied to 44 Colorado medical debt accounts, and refrain from seeking judgment again until consumers receive new notice and compliant affidavits are filed.

CONNECTICUT FIRM ORDERED TO STOP UNLICENSED COLLECTION ACTIVITY

Connecticut Banking Commissioner Jorge L. Perez ordered Parking Revenue Recovery Service to stop collecting parking violation fees in the state without a license, refund amounts collected from Connecticut consumers with interest, and pay a $30,000 civil penalty. The order rejected the company's argument that it was acting as an original creditor rather than a collection agency, finding that the violation fees arose from a consumer transaction and that substance and economic reality control over labels. The Commissioner also found the company failed to show a third-party collector was involved when the notices were sent, pointing to a master collection agreement dated after the collection activity at issue. For companies operating in debt collection or adjacent receivables models, the case is a reminder that Connecticut regulators may look through contract structure and branding when deciding whether a collection license is required.

ILLINOIS COURT APPLIES COLLECTION LICENSING TO DEBT BUYER

An Illinois appellate court held that a company that purchased defaulted mortgage loans and pursued judicial foreclosure on those loans was subject to the state's Collection Agency Act. In People ex rel. Laskowski v. Axiom Financial Services, LLC, the court reversed a trial court ruling and found that the licensing requirement applied even though the company was enforcing debt it owned. The court focused on the Illinois statute's plain language, which expressly reaches debt buyers, and rejected the argument that the federal FDCPA result in Henson v. Santander controlled the state licensing analysis. For companies buying, servicing, or enforcing distressed consumer debt, the decision is a reminder that state collection licensing rules can apply even when the activity falls outside the federal debt collector definition.