MULTISTATE PRIVACY ENFORCEMENT SWEEP TARGETS NONCOMPLIANT BUSINESSES
Attorneys general from California, Colorado, and Connecticut, along with the California Privacy Protection Agency, have launched a coordinated investigation into companies failing to honor the Global Privacy Control (GPC) browser signal. Regulators are demanding immediate compliance from businesses that ignore consumer opt-out requests related to the sale or sharing of personal data. This multistate action underscores increased coordination among state privacy enforcers following perceived gaps in federal oversight.
MA SMALL LOAN AND MORTGAGE LICENSING RULES UPDATED
Massachusetts has revised its regulations governing small loans and mortgage licensing. The updates expand financial responsibility reviews for license applicants and add new annual reporting requirements. Mortgage lenders and brokers must now disclose their NMLS ID at key transaction points, increasing transparency throughout the lending process.
CA NEW PRIVACY AND CONSUMER PROTECTION LAWS
California Governor signed a slate of new bills expanding consumer protections and data privacy. The Opt Me Out Act (AB 566) makes California the first state to require web browsers to include an in-browser control that allows users to block websites from selling or sharing their personal data, effective January 2027. The Combating Auto Retail Scams (CARS) Act introduces strict disclosure requirements for vehicle dealers and grants consumers a three-day right to cancel certain used-car sales. In addition, the DFPI took enforcement action against an unlicensed crypto ATM operator under the Digital Financial Assets Law, reinforcing California’s commitment to stronger digital finance oversight.
CA DATA BREACH NOTIFICATION LAW
California has approved Senate Bill 446, updating the state’s data breach notification requirements effective January 1, 2026. The law now mandates that breach disclosures be made within 30 calendar days of discovery, with limited exceptions for law enforcement or system restoration needs. It also requires businesses to submit a sample copy of the consumer notification to the Attorney General within 15 days of alerting affected individuals. These changes set clearer timelines and expand reporting obligations for organizations handling California residents’ personal data.
CT UNLICENSED SMALL-LOAN ACTIVITY TARGETED
The Connecticut Department of Banking entered a consent order with a company accused of offering small loans tied to personal-injury settlements without holding the required state license. Regulators determined that the company’s advances qualified as “small loans” under the state’s lending laws, triggering licensure requirements. The action reinforces Connecticut’s strict stance on licensing and highlights the importance of ensuring that all lending activities—especially newer or nontraditional loan products—fall within proper regulatory frameworks.
MA PASSIVE DEBT BUYERS EXCLUDED FROM LICENSING REQUIREMENTS
The Massachusetts Division of Banks finalized amendments clarifying that “passive debt buyers” are not considered debt collectors under state regulations and therefore are not required to hold a state license. A passive debt buyer is defined as an entity that purchases delinquent consumer debts solely for investment and uses licensed collectors or attorneys for all collection activity, without directly contacting consumers. While exempt from licensing, these entities remain subject to the Attorney General’s conduct rules under 940 CMR § 7.03. The amendments, effective September 26, 2025, also align certain state debt collection provisions with federal Regulation F, ensuring consistency in areas such as time-barred debt collection, misleading representations, and validation requirements.
CA SECOND MORTGAGE SERVICING LAW CREATES INDUSTRY UNCERTAINTY
California’s new law, AB 130, effective July 1, 2025, adds Section 2924.13 to the state’s Civil Code, aiming to restrict non-judicial foreclosures on so-called “zombie mortgages.” The legislation is intended to curb aggressive foreclosure practices on older or inactive second mortgages but has created uncertainty for lenders and servicers due to its broad and unclear language. Industry stakeholders have raised concerns about how the law applies to existing loans and the potential for inconsistent enforcement. The lack of clarity may increase compliance risks and legal disputes as servicers navigate how to apply the new foreclosure limits within California’s complex mortgage framework.
STATE SCRUTINY GROWS FOR EARNED WAGE ACCESS AND PAYDAY LENDERS
Consumer advocacy groups are urging regulators to tighten oversight of earned wage access and payday lending apps, which they say function as high-cost loans that trap workers in cycles of debt. A new report from the Center for Responsible Lending found frequent repeat borrowing, increased overdrafts, and hidden fees disguised as tips or expedite charges. Fifteen states introduced legislation in 2025, with six enacting new laws, some expanding access to app-based lending despite long-standing rate caps. Attorneys general in several states, including New York and the District of Columbia, have filed lawsuits alleging deceptive practices, while courts are increasingly classifying these products as loans subject to lending laws. The report calls for stronger APR caps, stricter data reporting, and limits on multiple loans against the same paycheck.
OH LICENSING REQUIREMENT INTRODUCED FOR DEBT SERVICES PROVIDERS
A new bill in Ohio would require anyone offering debt resolution services to be licensed by the state. Licenses would be valid for two years, nontransferable, and subject to renewal through a potential multistate licensing system. The measure outlines strict standards for application approval, consumer disclosures, and fee structures, allowing charges only when a debt is successfully renegotiated or reduced. Licensees must provide written agreements detailing services, fees, and estimated timelines and must file annual reports with the state. Exemptions include attorneys, banks, nonprofit organizations, and government agencies. The proposal is currently under consideration in the Ohio House.
WHITE PAPER: LICENSING SURVIVAL GUIDE FOR THIRD-PARTY DEBT COLLECTORS
What’s Included:
What’s Included:- Application & renewal pitfalls (and fixes)
- Surety bond requirements & cost strategies
- How to track regulatory changes
- State spotlights & city overlays
- How Cornerstone can help
OR LAWMAKERS CONSIDER EXPANDING STATE CONSUMER PROTECTION POWERS
Oregon’s legislature is reviewing options to strengthen its consumer protection framework amid what officials described as a “federal enforcement retreat.” Discussions included expanding state authority over financial lending, auto sales, and credit practices while improving penalties for violations affecting vulnerable populations. Regulators also noted the use of new software tools to manage enforcement and the potential hiring of former federal agency staff to support growing state oversight.
CA COMMERCIAL FINANCING DISCLOSURE LAW PASSED
California’s new Senate Bill 362 introduces stronger disclosure standards for commercial financing providers. The law requires the use of standardized annual percentage rate (APR) disclosures and prohibits misleading terms such as “interest” or “rate.” It also aligns state oversight with the California Financing Law and the California Consumer Financial Protection Law, creating greater clarity and consistency in commercial lending.
FOUR STATES SETTLE WITH MORTGAGE COMPANY OVER UNLICENSED OPERATIONS
Regulators in Hawaii, Idaho, Oregon, and Texas reached a multistate settlement with a mortgage company for alleged unlicensed activity, inadequate oversight, and examination noncompliance. The action followed a coordinated multistate examination launched in 2023 and resulted in a consent order requiring operational and supervisory improvements. This case underscores the growing collaboration among state regulators to identify and address gaps in mortgage licensing and compliance management across jurisdictions.
SURVEY: COLLECTIONS TECH READINESS
The future of collections tech is being written now – and your input drives it.
Take the survey to benchmark your organization’s modernization progress against peers across 4 metrics:
- Agent Enablement
- Compliance and QA
- Conversion Economics
- Data and Integration
When you complete the survey, you’ll instantly receive your personalized Modern Collections Technology Index (MCTI) scores by email, showing where your technology stands today and where there’s room to grow.
Your results also feed into the 2026 Tratta Annual Collections Tech Readiness Report, publishing in January, which will reveal industry wide trends in automation, data, and digital engagement.
TAKE THE SURVEY
NV LENDING RULES FOR ONLINE AND BNPL PROVIDERS MODERNIZED
Nevada’s new Senate Bill 437 updates state lending laws to better accommodate online consumer lenders and “buy now, pay later” (BNPL) providers. The measure, effective October 1, 2025, allows internet-based lenders to apply for and maintain a Nevada license without operating a physical office in the state. It also establishes specific criteria for “Internet consumer lenders,” streamlining licensing for digital-first financial providers while maintaining oversight through the Nevada Financial Institutions Division.
CORNERSTONE CAN HELP: BUSINESS FORMATION
Choosing the right business structure is a critical decision as it affects the legal, financial, and operational aspects of the business, as well as its growth and success. There are many differing business structures and factors such as the number of owners, liability protection, taxation, and management structure play a role in determining the best structure.Â
We are here to guide you through this exciting journey. Our team of experts is well-versed in business formation and can help you navigate the complexities. We’ll assist you in choosing the most suitable business structure that aligns with your goals and needs, filing all the necessary paperwork swiftly and accurately. Let us handle the technicalities while you focus on what truly matters – growing your business.
LLC TRANSPARENCY ACT TAKES EFFECT IN 2026Â
Starting January 1, 2026, the New York LLC Transparency Act (NY LLCTA) will require most LLCs formed in or registered to do business in New York to disclose detailed beneficial ownership information (BOI) annually to the New York Department of State. The law is modeled after the federal Corporate Transparency Act but establishes its own state-specific definitions and exemptions. LLCs must report information such as owners’ names, addresses, birthdates, and identification numbers, with exemptions still requiring an attestation filing. Noncompliance can result in steep penalties, including fines up to $500 per day, suspension of business authority in New York, or dissolution. Businesses with LLC structures should begin preparing now by identifying beneficial owners, gathering required information, and planning for ongoing reporting obligations.
Cornerstone will be monitoring NYDOS publications for any updates or notices regarding requirements.
D.C. MAJOR MEDICAL DEBT REFORM PROPOSED
The D.C. Council has introduced the Medical Debt Mitigation Amendment Act of 2025, which would significantly change how medical debt is incurred, reported, and collected in the District. The bill would require hospitals to provide cost estimates before treatment, standardize financial assistance policies, and offer payment plans for low-income patients. It would also ban medical debt from being reported to credit bureaus and restrict aggressive collection practices such as wage garnishments and property liens. Additionally, the bill would prohibit hospitals from promoting medical credit cards and authorize fines of up to $10,000 per week for violations. If enacted, D.C. would establish one of the strongest local frameworks for consumer protection from medical debt.
NMLS EXPANDS TO NEW LICENSE TYPES FOR STUDENT LOANS AND EWA PROVIDERS
The Nationwide Multistate Licensing System (NMLS) is now accepting applications for two new license types: a Student Loan Servicer License in the District of Columbia and an Earned Wage Access (EWA) License in Indiana. The new categories formalize regulatory oversight for businesses that manage student loans or provide early access to earned wages. Entities offering these services must apply by December 31, 2025, to avoid being considered delinquent after April 30, 2026. This expansion highlights regulators’ growing attention to emerging financial models that operate outside traditional lending but directly impact consumer financial stability.
RECORDED WEBINAR: LIFE AFTER LICENSE APPROVAL
In case you missed it, our recent webinar explored what happens after you earn your license, and how to keep it active year after year without costly lapses.
Key Takeaways
- Approval isn’t the finish line. Most licenses require annual renewals and regular filings.
- Stay organized. Use reliable tracking tools for renewals, reports, and due dates.
- Know the NMLS. More states are adopting it for filings—convenient but full of nuances.
- Expect deficiencies. Treat them as guidance that clarifies what regulators need.
- Report changes quickly. Ownership, management, or address updates must be filed promptly.
- Be proactive. Submit early, communicate respectfully with regulators, and expect follow-up.
We’ve recorded the entire session –Â it’s available for you to watch at your convenience.
WATCH NOW
MA JUNK FEE RULE TAKES EFFECT
Massachusetts’ new junk fee regulation is now in force, requiring upfront disclosure of all mandatory fees in pricing to prevent misleading cost practices. Attorney General Andrea Campbell stated that the regulation enhances transparency for consumers and promotes fair competition among businesses. The AG’s office has made compliance resources available and indicated that enforcement has already begun.
CSBS SEEKS COMMENTS ON NMLS EXPANSION FOR DIGITAL ACTIVITIES
The Conference of State Bank Supervisors (CSBS) opened a public comment period on proposed additions to the Nationwide Multistate Licensing System (NMLS) for new business activities, including stablecoin issuance and virtual currency kiosk operations. The proposal would establish formal licensing categories to bring these emerging financial technologies under consistent state supervision. Comments are due by November 13, 2025, and will help shape the NMLS Policy Committee’s approach to regulating digital assets through the state system.
VIRTUAL SUGGESTION BOX
We’ve continued to hear great feedback from you, our clients, on how our newsletter provides value for your organization. To ensure we continue to research and provide the best data, we have created a virtual “suggestion box” for your ideas. Whatever topic you’d like to learn about, large and small, we will go research with our team and knowledgeable folks from our industry.
NY BILL TO ALLOW CONSUMERS TO SUE DEBT COLLECTORS DIRECTLY
A new bill introduced in the New York State Assembly would create a private right of action for consumers to sue debt collectors for violations of state debt collection laws. The proposal, Assembly Bill 9166, would allow courts to award actual and punitive damages as well as attorney’s fees. If enacted, the measure would expand liability for agencies, creditors, and debt buyers, adding to the state’s already aggressive enforcement environment. This shift would align New York with states like California and Washington that have broadened consumer enforcement powers, increasing litigation risk and compliance costs for the collection industry.
AZ CRYPTO ATM FRAUD PREVENTION LAW ENACTED
Arizona’s new Cryptocurrency Kiosk License Fraud Prevention Law took effect on September 26, 2025, creating one of the nation’s most comprehensive consumer protection frameworks for crypto ATM operators. The law, enacted through House Bill 2387, amends Arizona’s money transmission statutes to require enhanced disclosures, transaction limits, anti-fraud monitoring, and refund rights for scam victims. Operators must use blockchain analytics to detect fraudulent wallets, provide 24/7 customer support, and issue refunds to new users who report verified fraud within 30 days. Daily transaction caps are set at $2,000 for new customers and $10,500 for existing ones. Violations may be prosecuted as unfair or deceptive acts under the Arizona Consumer Fraud Act, signaling the state’s growing focus on digital-asset and consumer fraud prevention.
MD NEW MEDICAL DEBT COLLECTION LAWS CLARIFIED
The Maryland Office of Financial Regulation (OFR) released guidance detailing three new laws that significantly reshape medical debt collection and reporting practices. Effective October 1, 2025, these laws restrict how medical debts can be collected, prohibit reporting them to credit bureaus, and expand consumer protections. Hospitals must now provide a 240-day financial assistance window before initiating collection, and collectors are barred from placing liens on primary residences. The OFR is urging agencies, lenders, and hospitals to review existing policies immediately to ensure compliance with the new requirements. This update will be of particular importance to debt buyers, collection agencies, and servicers that manage or report medical debt in Maryland.
BEYOND THE NEWSLETTER
Head to LinkedIn and give us a follow to tap into a stream of real-time updates, legislative changes, and great content tailored for ARM and Fintech professionals. Engage with thought leaders and peers in our community to enhance your expertise.
Follow Cornerstone on LinkedIn and transform the way you stay informed in our ever-evolving industry.
CA DFPI ISSUES FIRST ANNUAL ASSESSMENT FOR DEBT COLLECTOR LICENSEES
The California Department of Financial Protection and Innovation (DFPI) has issued its first annual assessment fee notices to licensed debt collectors under Section 100020 of the California Financial Code. While the DFPI’s notice lists October 31, 2025 as the due date, payments may be submitted without penalty until December 31, 2025. After that date, a 1% monthly penalty applies for late payments, and licenses may be suspended or revoked if fees remain unpaid by January 1, 2026. Many licensees have reported higher-than-expected assessment amounts, prompting budgetary review and planning considerations. Debt collectors are advised to submit payments well before the deadline to avoid transmission issues or penalties.
BLOG: LICENSING CHALLENGES FOR MORTGAGE SERVICERS
Mortgage servicers operate in one of the most complex regulatory environments in financial services, facing a web of state-specific licensing rules, audits, and ongoing reporting requirements. Since the 2008 financial crisis, oversight has intensified, with both state and federal regulators raising expectations around financial stability and consumer protection. This article breaks down why mortgage servicers need state licenses, the most common challenges they face, and what trends are shaping the future of servicing oversight.
Read the full article to learn how to stay ahead of evolving licensing requirements and manage multi-state mortgage servicer operations more efficiently.
CFPB EXTENDS SMALL BUSINESS LENDING DATA RULE DEADLINES
The Consumer Financial Protection Bureau (CFPB) has finalized a one-year extension for compliance with its Section 1071 Small Business Lending Data Collection Rule under the Equal Credit Opportunity Act and Regulation B. The extension aligns timelines for institutions affected by ongoing litigation and federal court stays, giving lenders more time to build reporting systems and prepare for data submission. The rule requires lenders to collect and report demographic and application data for small business loans, with the goal of improving transparency and monitoring fair lending practices. However, many in the financial services industry continue to raise concerns about the cost and complexity of implementation.
NY DIGITAL ASSET CUSTODY GUIDANCE UPDATED
The New York Department of Financial Services (NYDFS) released updated virtual currency custody guidance to strengthen consumer protections during insolvency events. The revisions clarify that customer assets held by custodians must remain in the customers’ beneficial interest and set clearer expectations for sub-custodial arrangements. The update reflects the growing complexity of digital asset markets and replaces prior guidance from 2023. Licensed virtual currency firms are expected to review and adjust their agreements and disclosures to ensure full alignment with the new standards.
STATE-STABLECOIN REGULATION GAINING MOMENTUM
North Dakota has launched the Roughrider Coin, the first state-issued stablecoin operating under the new GENIUS Act framework. The initiative positions the state as an early leader in exploring how digital currencies can function within a regulated banking environment. By using state-chartered institutions to issue asset-backed tokens, North Dakota aims to demonstrate how stablecoins can accelerate payments, lower settlement costs, and promote inclusion in underserved areas. Other states, including Wyoming, are expected to follow suit as regulators test different models for digital asset oversight. These developments could influence future standards for licensing, custody, and money transmission as digital payments become more integrated into mainstream financial systems.
STATES LAUNCH LARGE-SCALE MEDICAL DEBT RELIEF INITIATIVES
North Carolina and Cincinnati have taken major steps to ease the burden of medical debt for residents. North Carolina announced the elimination of $6.5 billion in medical debt for more than 2.5 million people through a statewide initiative led by Governor Josh Stein, the Department of Health and Human Services, and nonprofit Undue Medical Debt, in partnership with all 99 state hospitals. Similarly, the city of Cincinnati worked with Undue Medical Debt and University of Cincinnati Health to erase $219 million in debt for over 110,000 residents, funded through a $1.45 million city allocation. Both programs target lower-income individuals and reflect a growing trend of state and local governments addressing medical debt as a financial and public health issue, setting potential models for future relief efforts nationwide.
CA DFPI MODIFIES DIGITAL FINANCIAL ASSET REGULATIONS
California’s Department of Financial Protection and Innovation (DFPI) announced updates to its proposed Digital Financial Assets Law (DFAL) and Money Transmission Act (MTA) regulations. The revisions clarify that activities covered under the DFAL, such as the transmission and custody of digital assets, are exempt from MTA requirements to avoid duplicative oversight. Additionally, covered exchanges must now certify compliance with disclosure and risk management standards before listing digital assets. These modifications aim to modernize California’s regulatory framework for digital finance and provide greater clarity for fintech and crypto operators.
CFPB RESCINDS NONBANK REGISTRY RULE
The Consumer Financial Protection Bureau has withdrawn its Nonbank Registry Rule, which required nonbank lenders, servicers, and fintechs to report enforcement actions into a public database. The Bureau determined that the rule’s compliance costs and administrative burden outweighed its limited consumer protection benefits. Originally implemented in 2024, the registry was meant to track repeat offenders and support supervision efforts, but the CFPB found that similar data is already collected by state regulators and the NMLS.
RANSOMWARE ATTACKS CONTINUE TO RISE NATIONWIDE
Ransomware incidents increased 36% year-over-year in the third quarter of 2025, according to cybersecurity firm BlackFog. The report documented 270 publicly disclosed attacks between July and September, though experts estimate over 1,500 incidents went unreported. Healthcare was the most targeted sector, followed by government and technology, while law firms experienced record attack levels. Data theft occurred in 96% of cases, with cybercriminals increasingly abandoning encryption in favor of extortion through stolen information. Experts urge organizations to strengthen data protection and limit exposure to minimize the leverage of attackers.
This information is not intended to be, nor is it, legal advice. It is intended for information purposes only. We make no warranty, express or implied, as to the accuracy or reliability of this information. We are not attorneys. You must retain your own attorney to receive legal advice. While Cornerstone strives to provide the most current and accurate state licensing information, the responsibility for any decision related to state licensing or agency compliance is solely yours.
