Alston & Bird Consumer Finance Blog

Mergers & Acquisitions

Illinois Enacts Comprehensive Buy-Now-Pay-Later Law: Implications for Licensing, Bank Partnerships, and Program Structure

By

What Happened?

On June 25, 2026, Illinois enacted Senate Bill 3561, which establishes the Buy-Now-Pay-Later Loan Consumer Protection Act. The measure creates a new state-level licensing and regulatory framework governing certain buy-now-pay-later (“BNPL”) products offered to Illinois consumers.

The Act applies to closed-end consumer credit products offered in connection with a specific purchase of goods or services where the credit is either (i) payable in four or fewer installments or (ii) has a term of 120 days or less. The definition expressly includes both interest-free “pay-in-four” products and BNPL products that carry interest or finance charges.

With this legislation, Illinois joins a growing number of states seeking to impose a tailored regulatory framework on BNPL products. The law is effective immediately, although it includes a transitional compliance period for existing market participants.

Overview of the Act

At a high level, the Act:

  • Requires licensure for persons engaged in the business of offering BNPL loans in the state
  • Establishes a regulatory regime administered by the Illinois Department of Financial and Professional Regulation
  • Imposes consumer protection, underwriting, reporting, and examination requirements
  • Applies broadly to a wide range of market participants involved in BNPL programs
  • Provides that violations constitute an unlawful practice under the Illinois Consumer Fraud and Deceptive Business Practices Act

The Act also provides that BNPL loans made in compliance with its requirements are not subject to certain existing Illinois lending statutes, including the Consumer Installment Loan Act and the Payday Loan Reform Act.

Scope of Coverage: Broad and Functional

A defining feature of the Illinois law is its expansive approach to coverage. The Act applies not only to entities that directly originate BNPL loans, but also to persons that:

  • Arrange or broker loans
  • Acquire or hold whole or partial interests in loans
  • Act as agents or service providers in connection with BNPL programs

In addition, the Act includes anti-evasion language intended to capture transactions that are “in substance” loans or structured to avoid application of the statute.

This framing reflects a broader trend in state legislation focusing on functional activity and economic substance, rather than formal labels or contractual roles.

Merchant and Passive Investor Carve-Outs

The Act includes several notable exceptions:

  • Merchant platform exception: A merchant or platform is not covered solely by offering BNPL options to consumers, provided it does not originate, underwrite, service, or hold an ownership interest in the underlying loans.
  • Passive investor exception: Persons holding a partial interest in a BNPL loan as a passive investor are excluded, so long as they do not control origination or servicing functions.

These carve-outs are consistent with approaches seen in other recent legislation, but their practical scope will depend on how regulators interpret concepts such as “control” and “participation” in the lending program.

Bank Partnership and “True Lender” Considerations

Although the Act exempts banks, credit unions, and certain other depository institutions, it does not automatically exempt nonbank participants in bank-partner BNPL programs.

Instead, the statute’s broad applicability provisions—combined with its anti-evasion framework—suggest that Illinois regulators may evaluate BNPL programs based on economic interest and operational control, rather than the nominal identity of the originating lender.

As a result, fintech companies and other nonbank program participants should consider how their roles—particularly in marketing, underwriting, funding arrangements, and servicing—may be viewed under the Act.

Underwriting and Consumer Protections

The Act introduces a set of consumer protection requirements that align BNPL products more closely with traditional consumer lending obligations.

Among other things, the law:

  • Requires disclosure of loan terms, costs, and repayment structure
  • Mandates processes for handling consumer disputes and refunds
  • Imposes an expectation that lenders assess a borrower’s ability to repay prior to extending credit

While the statute does not prescribe a specific underwriting formula, it signals a shift toward ability-to-repay–type standards in the BNPL context.

Transition Period and Implementation Timeline

The Act provides a transition pathway for existing BNPL providers.

Specifically, a person that was offering BNPL products in Illinois prior to January 1, 2028, and submits a license application by that date, may continue operating while the application is pending.

Key Takeaways

The Illinois BNPL Act raises several important considerations for market participants:

  1. Licensing analysis will be broader than traditional lender-focused regimes. Entities involved in program structure, marketing, servicing, or funding should assess whether they fall within scope.
  2. Form will not control over substance. The Act’s anti-evasion provisions suggest regulators will look beyond contractual labels to determine who is effectively acting as the lender.
  3. Bank partnership structures may be subject to scrutiny. Nonbank participants should evaluate their role in underwriting, economic exposure, and program governance.
  4. Merchant and investor carve-outs are helpful—but limited. These exclusions depend heavily on the absence of operational control or program-level influence.
  5. Compliance will extend beyond licensing. The Act introduces substantive obligations around disclosures, underwriting, dispute resolution, and regulatory oversight.

Looking Ahead

Illinois’s enactment of a comprehensive BNPL framework reflects an accelerating trend toward state-level regulation of point-of-sale financing products.

As additional states consider similar legislation, market participants should expect continued divergence in regulatory requirements—and a growing need to align program structures with evolving expectations around licensing, consumer protection, and risk management.

New York’s FAIR Act Update: Governor Hochul Signs Chapter Amendment SB 8811 Refining the New UDAP/UDAAP Framework

By

What Happened?

On March 27, 2026, New York Governor Kathy Hochul signed into law SB 8811 (Chapter 94 of the Laws of 2026), a chapter amendment relating to the Attorney General’s ability to protect New Yorkers from unfair, deceptive, and abusive business practices. As we highlighted in March following its introduction, New York’s Fostering Affordability and Integrity through Reasonable Business Practices (“FAIR”) Act represents a fundamental transformation of the state’s consumer protection framework, expanding enforcement authority beyond “deceptive” practices to include “unfair” and “abusive” acts. And, as we further noted, Governor Hochul, in initially signing the FAIR Act into law, noted an agreement with legislators to ensure the act “does not override” existing case law on the consumer-oriented standard. These amendments confirm that intent and make other changes to narrow and focus the scope of the law.

SB 8811 primarily revises the 2025 FAIR Act legislation (Chapter 708 of the Laws of 2025) by (1) removing the FAIR Act’s standalone “purpose and intent” provision, (2) refining the treatment of “substantial injury” under the unfairness standard, and (3) extending the Attorney General’s pre-suit notice response timeline.

Repeal of the Legislative Intent Section (GBL Section 348)

SB 8811 repeals Section 348 of the General Business Law, which the 2025 FAIR Act added as a “purpose and intent” statement for Article 22-A.

The repealed Section 348 was an unusually detailed statement of legislative purpose. Among other things, it declared that New York has a responsibility to protect New Yorkers from unfair, deceptive, and abusive business acts and practices, and that prior law, which focused on deception, was insufficient to protect New Yorkers and the New York economy. It emphasized that certain groups were left vulnerable to unscrupulous business practices. It also stated an intent for New York to adopt a comprehensive statute and “level the playing field” for honest businesses and non-profits that treat customers fairly.

The original intent provision also anticipated future unfair, deceptive, and abusive acts arising from new and emerging technology. It expressly framed the FAIR Act as eliminating court-imposed limitations that had constrained enforcement to conduct which is “consumer-oriented” or with a public-facing impact, while extending protections to businesses and non-profits as well as individuals.

What its removal may signal. SB 8811 is expressly described as a chapter amendment intended to “repeal the legislative intent,” “redefine the scope of substantial injury,” and make technical amendments. Against that backdrop, removing Section 348 may reflect a desire to reduce the extent to which broad purpose language could be used to push interpretive outcomes beyond the operative text of Section 349. Put differently, the Legislature may have concluded that the statute should stand or fall on the substantive prohibitions and definitions in Section 349, rather than a sweeping preamble that invites expansive arguments about scope.

From a practical perspective, this change may be read as tightening the language in response to stakeholder concerns about uncertainty and litigation risk. In particular, Section 348 explicitly spoke to eliminating “consumer-oriented” constraints and to protecting businesses and non-profits, and it also framed the law as a tool for both government and private parties. Its repeal may help the State defend the law as a more traditional, text-driven consumer protection update, while leaving the Attorney General to advance enforcement theories based primarily on the revised statutory elements rather than a broad statement of legislative purpose.

Refinement of the Unfairness Standard and “Substantial Injury”

SB 8811 amends the “unfair” prong in GBL Section 349(a)(1). The statute continues to define “unfair” acts or practices using the familiar three-part framework (substantial injury, not reasonably avoidable, not outweighed by countervailing benefits). However, SB 8811 ties “substantial injury” to the meaning of that term under the Federal Trade Commission Act and removes language that had expressly treated “substantial injury” to persons other than consumers as “substantial injury” for purposes of that section.

Notice and Response Timeline Extended

SB 8811 amends GBL Section 349(c) to revise the Attorney General’s pre-suit notice and response timeline. The Attorney General must still provide notice by certified mail and an opportunity to respond in writing before commencing an action or proceeding, but the response period is extended from five business days to ten calendar days after receipt of the notice.

Other Technical Repeals/Edits

The bill also repeals paragraph (3) of subdivision (b) of GBL Section 349 and makes additional technical amendments to the 2025 chapter. Notably, paragraph (3) of subdivision (b) of GBL Section 349 stated, “An act or practice made unlawful by this section is actionable by the attorney general regardless of whether or not that act or practice is consumer-oriented.” This language was notable because “consumer-oriented” has long been a recurring limitation in Section 349 case law. The paragraph functioned as a direct textual instruction that the Attorney General could bring Section 349 actions even where the challenged conduct was not consumer-oriented. By deleting the explicit “regardless of whether or not consumer-oriented” sentence, the Legislature removes a clear statutory hook that would have supported the broadest reading of the Attorney General’s authority in situations that look more like private commercial disputes or one-off transactions.

Why Does it Matter?

The FAIR Act’s headline expansion remains: New York’s consumer protection regime now addresses “unfair” and “abusive” conduct in addition to deception, with the Attorney General as the primary enforcer for unfairness and abusiveness. SB 8811 does not reverse that direction. Instead, it changes how the statute is likely to be argued and applied by removing an expansive legislative purpose statement that, by design, sought to broaden the interpretive lens.

With Section 348 repealed, parties should expect disputes about reach, especially around business-to-business implications and the continued relevance of prior “consumer-oriented” case law, to focus more heavily on the operative text of Section 349 (and any accompanying interpretive materials outside the now-repealed purpose clause).

By explicitly tying “substantial injury” to the FTC Act standard and deleting language that expressly deemed non-consumer injury to be “substantial injury” for purposes of the unfairness prong, SB 8811 may narrow certain theories that would otherwise emphasize harms to non-consumers under the “unfair” definition itself.

What Do I Need to Do?

Given the removal of the legislative intent provision, compliance programs should map controls to the operative statutory elements: what constitutes unfairness (including the “substantial injury” standard as tied to FTC Act concepts), what constitutes abusiveness, and what constitutes deception.

Even as federal enforcement priorities shift, New York’s framework continues to position the Attorney General as a central enforcement actor for unfair and abusive conduct. Companies operating in or touching New York should assume continued scrutiny, especially where practices can be characterized as causing unavoidable harm or taking unreasonable advantage of consumer vulnerabilities.

Alston & Bird’s Consumer Financial Services Team is actively monitoring these developments and can assist with impact assessments, updates to compliance management systems, and enforcement readiness planning in light of New York’s evolving consumer protection landscape.

Executive Order Targets Smaller Bank Participation in Mortgage Markets

By

What Happened?

On March 13, President Trump issued an Executive Order titled “Promoting Access to Mortgage Credit,” addressing factors that may have negatively impacted the ability of community banks and other smaller financial institutions to participate in mortgage lending and servicing.

In order to expand access to mortgage credit, the Executive Order directs the Consumer Financial Protection Bureau (“CFPB”) and other financial regulators (the Board of Governors of the Federal Reserve System, the National Credit Union Administration, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency (collectively, the “Regulators”)) to take action to reduce regulatory burdens, modernize reporting requirements, and utilize digital mortgage processes, among other actions.

Why Does it Matter?

The Executive Order includes broad directives to the Regulators to update regulations and processes that impact the mortgage markets, including:

  • Changes to Origination Regulations: The Executive Order directs the CFPB to consider regulatory changes including tailoring Regulation Z requirements as applicable to smaller banks (including ATR and QM, TILA, RESPA, and TILA-RESPA Integrated Disclosure (TRID) rules), updating TRID timing rules, modifying or exempting small mortgage loans from caps on QM points and fees, and amending rescission rights.
  • HMDA Modernization: The Executive Order requires the CFPB to consider proposing amendments to Regulation C to increase the asset threshold for exemption from HMDA data collection and reporting requirements for smaller banks, exclude inquiries from the scope of HMDA, and reduce burdens related to disclosures.
  • Alignment of Capital and Liquidity Standards: The Executive Order directs the Regulators to consider: (a) updating capital regulations and collateral valuation and transfer systems between the Federal Reserve and Federal Home Loan Banks; (b) expanding access to longer‑dated FHLB advances tied to residential mortgage assets; (c) creating targeted FHLB liquidity programs for entry‑level housing, owner‑occupied purchase loans, and small residential builders; and (d) modernizing collateral boarding and valuation processes.
  • Construction and Housing Supply: The Executive Order directs the Regulators to consider revising supervisory guidance to: (a) exclude one-to four-family residential development and construction lending from commercial real estate concentration guidance; and (b) ensure that supervisory expectations support responsible construction lending by community banks.
  • Appraisal Modernization: The Executive Order directs the Regulators to consider certain changes to appraisal processes, including with respect to valuations performed in connection with FHA-insured and VA-guaranteed loans and with respect to the use of alternative valuations (AVMs, desktop and hybrid appraisals, and artificial intelligence valuation tools).
  • Digital Mortgage Modernization: The Executive Order requires the Regulators to consider certain changes to facilitate digital mortgages, namely eliminating unnecessary wet signature requirements, standardizing acceptance of electronic signatures, e-notes, and remote online notarization, and promoting digital mortgage standards.
  • Servicing and Supervisory Certainty: The Executive Order directs the Regulators to consider supervisory changes relating to mortgage loan servicing, including: (a) aligning supervisory expectations to support portfolio mortgage servicing as a core community banking function; (b) extending cure‑first standards to good‑faith servicing errors; (c) simplifying loss mitigation requirements; (d) issuing a proposed rule providing exemptions from complex mortgage services for smaller banks; and (e) ensuring that supervisory evaluations of performing, prudently underwritten portfolio loans do not focus on technical defects or rely on evolving supervisory interpretations.
  • Duplicative or Unnecessary Licensing Requirements: The Executive Order requires the Regulators to consider eliminating duplicative or unnecessary requirements regarding licensing or registration (i.e., MLO licensing) for mortgage loan officers of any smaller bank.

What Do You Need to Do?

While the Executive Order does not directly impose obligations on mortgage lenders and servicers, it has the potential to significantly impact the mortgage market by changing the rules of the game, particularly for community banks and smaller banks. Industry participants appear open to the possibility of reform – for example, Mortgage Bankers Association President and CEO Bob Broeksmit issued a statement applauding the focus on “addressing costly mortgage regulations that have increased costs and limited access to credit,” and supporting efforts to address other structural factors (including valuations and construction regulations) impacting access to housing.

We will continue to monitor the Regulators’ activities to implement the directives of the Executive Order, particularly as the 21st Century ROAD to Housing Act (which includes provisions on some of the same topics) advances in Congress; we encourage mortgage market participants to do the same.

Enhanced Financial Monitoring of Nonbank Mortgage Servicers is Coming Soon

By

What Happened?

On February 10th, the U.S. Government Accountability Office (the GAO) published a report on nonbank mortgage servicers’ financial risk due to their growing role in the U.S. housing finance system, titled “Nonbank Mortgage Companies: Ginnie Mae and FHFA Could Enhance Financial Monitoring” (the GAO Report). The GAO Report draws from the GAO’s prior work and from the Financial Stability Oversight Council’s 2024 Report on Nonbank Mortgage Servicing, which we discussed in a prior blog.

The GAO Report addresses (i) the growing role of nonbanks in the mortgage market since 2024, and (ii) Ginnie Mae’s and FHFA’s processes for assessing the financial condition of nonbank mortgage companies. The report includes several recommendations. Both Ginnie Mae and the FHFA agreed with these recommendations and signaled that changes may be coming later this fall.

Why Does it Matter?

For over a decade, the Conference of State Bank Supervisors and federal regulators have sought to impose financial condition requirements on nonbank servicers. Over time, regulators have issued multiple recommendations and have imposed enhanced capital and liquidity requirements on these entities. The GAO Report builds on that prior work and provides concrete recommendations to Ginnie Mae and the FHFA—the regulator for Fannie Mae and Freddie Mac (the GSEs).

Once implemented, the revised requirements will flow down to the nonbanks that service GSE and agency (e.g., HUD/FHA, VA, USDA) loans.

According to the GAO Report, “[f]inancial monitoring of nonbanks has become increasingly important because of nonbanks’ expanding market role and financial vulnerabilities.” Nonbanks now service the majority of federally backed mortgages, which secure more than $9 trillion in securities backed by Ginnie Mae, Fannie Mae and Freddie Mac—a market share that has increased from 27% in 2014 to 66% in 2024. The share of nonbank originations has also grown extensively in the past decade—from 51% in 2014 to 76% in 2024.

The GAO Report recognizes the benefits nonbanks provide to markets and consumers, including increased liquidity, adoption of new technology, and playing a large role in serving the needs of underserved borrowers. However, consistent with other reports, the GAO Report concludes that the federal monitoring framework does not fully capture the liquidity and funding risk due in part to (i) the lack of a federal prudential regulator, (ii) fragmented oversight that increases the likelihood that weaknesses go undetected, (iii) nonbanks’ reliance on short-term warehouse credit that may become unavailable during economic downturns, and (iv) the potential for substantial government exposure.

Key Recommendations

Given these vulnerabilities, the GAO Report identifies specific opportunities for FHFA and Ginnie Mae to improve how they assess nonbanks’ financial condition. The recommendations focus primarily on data reliability, warehouse lending risk, which is viewed as a key liquidity risk, and consideration of nonbank stress scenarios. Specifically:

Improve Reliability of MBFRF Data

FHFA and Ginnie Mae rely on the data reported by mortgage servicers on the Mortgage Bankers Financial Reporting Form (MBFRF) to monitor the financial condition of nonbanks. Both agencies have identified reliability issues in the data reported on the MBFRF. While Ginnie Mae has already implemented certain controls, the GAO Report recommends that FHFA develop procedures to improve the quality and reliability of MBFRF data.

Improve Qualitative Assessment of Nonbanks to Fully Address Warehouse Lending Risks and Stress Test Scenarios

The GAO Report identifies five key components of warehouse lending risk:

  • Diversification: Number of warehouse lines available to a nonbank;
  • Utilization: Portion of available credit in use;
  • Maturity: Credit line maturity dates;
  • Covenant violations: Financial or collateral breaches that could lead to termination of the credit line; and
  • Committed amount: Extent of committed versus uncommitted capacity (i.e., a lender may be able to reprice an uncommitted amount at any time whereas a committed line can be altered in limited circumstances).

Neither FHFA’s nor Ginnie Mae’s monitoring currently captures all five components. The GAO Report recommends that FHFA assess the “feasibility and utility” of including all five components in its risk scoring process. For Ginnie Mae, the GAO Report recommends developing guidance that requires analysts to consistently review warehouse lending risks—particularly committed funding amounts—as part of its manual credit review process.

Expand Stress Testing Framework to Consider Alternative Economic Framework

In monitoring counterparty risk, Ginnie Mae currently conducts stress tests, but those tests only simulate a protracted recession. The GAO Report recommends that Ginnie Mae expand its stress testing framework to address other economic stress scenarios, such as stagflation—a type of recession where delinquencies rise and interest rates remain high (which means lower originations).

What Do You Need to Do?

Regulators continue to focus on the potential vulnerabilities of nonbank mortgage lenders and servicers—a priority that has persisted across both Democratic and Republican administrations, signaling that these issues will remain an area of focus. Both FHFA and Ginnie Mae have accepted the GAO’s recommendations, and changes are expected later this year. As a result, now is a good time to conduct additional stress testing using a broader range of economic stress scenarios. Additionally, FHFA indicated that, by September 30, 2026, its Division of Enterprise Regulation (DER) will develop procedures for assessing the reliability of MBRFR data and handling potentially unreliable data. Accordingly, nonbanks should ensure they have appropriate controls in place to support accurate MBFRF reporting.

UDAAP Update: New York’s FAIR Act Signed Into Law

By

What Happened?

On December 19, 2025, New York Governor Kathy Hochul signed into law Senate Bill 8416, the Fostering Affordability and Integrity through Reasonable (FAIR) Business Practices Act, (the “FAIR Act”), which updates Section 349 of New York’s General Business Law (GBL). In our prior post we explained that following the law’s passage by the legislature, the FAIR Act expands the state’s consumer protection statute beyond just deceptive practices to also prohibit “unfair” and “abusive” business acts or practices, marking a major broadening of the New York Attorney General’s enforcement powers. Notably, the final law clarifies that only the Attorney General (“NYAG”) can bring claims for unfair or abusive practices, while private lawsuits remain limited to deceptive acts. The FAIR Act will take effect 60 days after signing, on February 17, 2026.

Why Does It Matter?

The FAIR Act represents a sweeping update to New York’s consumer protection law. Previously, New York law only prohibited deceptive acts and practices. The FAIR Act amends Section 349 of the GBL to also prohibit “unfair” and “abusive” acts or practices in the conduct of any business, trade, or commerce. In practical terms, this aligns New York with the consumer protection laws of almost every other state (47 of which already outlaw unfair practices) and with federal UDAAP standards. Key elements of the new law include:

Expanded Definitions

The statute now defines an “unfair” act as one that “causes or is likely to cause substantial injury” to consumers which is not reasonably avoidable and not outweighed by countervailing benefits. This definition is modeled on the Federal Trade Commission’s standard (15 U.S.C. § 45(n)). An “abusive” act is defined in line with the federal Consumer Financial Protection Act standard (12 U.S.C. § 5531(d)), i.e., something that materially interferes with a person’s understanding of a product or takes unreasonable advantage of someone’s lack of understanding or inability to protect their interests. These broad definitions mean practices that might not be outright deceptive could still be illegal if they unjustifiably harm consumers or exploit imbalances in knowledge or power.

Attorney General Enforcement & Private Rights

Importantly, the law limits enforcement of the new “unfair” and “abusive” provisions to the NYAG. Private plaintiffs can continue to sue under Section 349 only for “deceptive” acts, just as before – there is no new private right of action for unfair or abusive practices. This was a critical concession to avoid opening floodgates of litigation. However, the AG can now bring enforcement actions against businesses for unfair or abusive conduct, seeking injunctions, restitution, and civil penalties. We can expect the NYAG (which has been actively advocating for this law) to launch investigations and actions under the expanded provisions once the law is effective.

“Consumer-Oriented” Standard Preserved (for Now)

A contentious aspect of the FAIR Act was whether it would eliminate the judicially-created requirement that Section 349 cases be “consumer-oriented” (i.e. directed at the public at large, not private contract disputes). The version initially passed by the legislature removed the consumer-oriented limitation entirely, which would have meant the AG (and possibly private plaintiffs) could pursue claims even for one-off transactions or business-to-business dealings. However, in approving the law, Governor Hochul noted an agreement with legislators to ensure the act “does not override” existing case law on the consumer-oriented standard. In effect, this signals that commercial transactions and purely private disputes will not suddenly all become actionable under Section 349. The statute text still says an act can be unlawful “regardless of whether or not it is consumer-oriented” in an AG enforcement, but this may be revisited by a chapter amendment. For now, compliance should assume that private lawsuits still require a consumer-facing element (as before), while the NYAG might test the boundaries of targeting misconduct affecting small businesses or other non-consumer victims in the public interest.

What Do You Need to Do?

For banks, lenders, and other financial services companies operating in New York, the FAIR Act demands a thorough compliance review beyond the traditional focus on deception/fraud. Even though private litigation risk remains mostly unchanged (as it remains limited to deception claims), the NYAG can now act as a mini-CFPB, bringing the full range of UDAAP claims at the state level. Financial services companies must proactively ensure their products and practices meet these standards and should stay aware of any further regulatory guidance issued by the NYAG.