Alston & Bird Consumer Finance Blog

#consumerprotection

Illinois Enacts Comprehensive Buy-Now-Pay-Later Law: Implications for Licensing, Bank Partnerships, and Program Structure

By

What Happened?

On June 25, 2026, Illinois enacted Senate Bill 3561, which establishes the Buy-Now-Pay-Later Loan Consumer Protection Act. The measure creates a new state-level licensing and regulatory framework governing certain buy-now-pay-later (“BNPL”) products offered to Illinois consumers.

The Act applies to closed-end consumer credit products offered in connection with a specific purchase of goods or services where the credit is either (i) payable in four or fewer installments or (ii) has a term of 120 days or less. The definition expressly includes both interest-free “pay-in-four” products and BNPL products that carry interest or finance charges.

With this legislation, Illinois joins a growing number of states seeking to impose a tailored regulatory framework on BNPL products. The law is effective immediately, although it includes a transitional compliance period for existing market participants.

Overview of the Act

At a high level, the Act:

  • Requires licensure for persons engaged in the business of offering BNPL loans in the state
  • Establishes a regulatory regime administered by the Illinois Department of Financial and Professional Regulation
  • Imposes consumer protection, underwriting, reporting, and examination requirements
  • Applies broadly to a wide range of market participants involved in BNPL programs
  • Provides that violations constitute an unlawful practice under the Illinois Consumer Fraud and Deceptive Business Practices Act

The Act also provides that BNPL loans made in compliance with its requirements are not subject to certain existing Illinois lending statutes, including the Consumer Installment Loan Act and the Payday Loan Reform Act.

Scope of Coverage: Broad and Functional

A defining feature of the Illinois law is its expansive approach to coverage. The Act applies not only to entities that directly originate BNPL loans, but also to persons that:

  • Arrange or broker loans
  • Acquire or hold whole or partial interests in loans
  • Act as agents or service providers in connection with BNPL programs

In addition, the Act includes anti-evasion language intended to capture transactions that are “in substance” loans or structured to avoid application of the statute.

This framing reflects a broader trend in state legislation focusing on functional activity and economic substance, rather than formal labels or contractual roles.

Merchant and Passive Investor Carve-Outs

The Act includes several notable exceptions:

  • Merchant platform exception: A merchant or platform is not covered solely by offering BNPL options to consumers, provided it does not originate, underwrite, service, or hold an ownership interest in the underlying loans.
  • Passive investor exception: Persons holding a partial interest in a BNPL loan as a passive investor are excluded, so long as they do not control origination or servicing functions.

These carve-outs are consistent with approaches seen in other recent legislation, but their practical scope will depend on how regulators interpret concepts such as “control” and “participation” in the lending program.

Bank Partnership and “True Lender” Considerations

Although the Act exempts banks, credit unions, and certain other depository institutions, it does not automatically exempt nonbank participants in bank-partner BNPL programs.

Instead, the statute’s broad applicability provisions—combined with its anti-evasion framework—suggest that Illinois regulators may evaluate BNPL programs based on economic interest and operational control, rather than the nominal identity of the originating lender.

As a result, fintech companies and other nonbank program participants should consider how their roles—particularly in marketing, underwriting, funding arrangements, and servicing—may be viewed under the Act.

Underwriting and Consumer Protections

The Act introduces a set of consumer protection requirements that align BNPL products more closely with traditional consumer lending obligations.

Among other things, the law:

  • Requires disclosure of loan terms, costs, and repayment structure
  • Mandates processes for handling consumer disputes and refunds
  • Imposes an expectation that lenders assess a borrower’s ability to repay prior to extending credit

While the statute does not prescribe a specific underwriting formula, it signals a shift toward ability-to-repay–type standards in the BNPL context.

Transition Period and Implementation Timeline

The Act provides a transition pathway for existing BNPL providers.

Specifically, a person that was offering BNPL products in Illinois prior to January 1, 2028, and submits a license application by that date, may continue operating while the application is pending.

Key Takeaways

The Illinois BNPL Act raises several important considerations for market participants:

  1. Licensing analysis will be broader than traditional lender-focused regimes. Entities involved in program structure, marketing, servicing, or funding should assess whether they fall within scope.
  2. Form will not control over substance. The Act’s anti-evasion provisions suggest regulators will look beyond contractual labels to determine who is effectively acting as the lender.
  3. Bank partnership structures may be subject to scrutiny. Nonbank participants should evaluate their role in underwriting, economic exposure, and program governance.
  4. Merchant and investor carve-outs are helpful—but limited. These exclusions depend heavily on the absence of operational control or program-level influence.
  5. Compliance will extend beyond licensing. The Act introduces substantive obligations around disclosures, underwriting, dispute resolution, and regulatory oversight.

Looking Ahead

Illinois’s enactment of a comprehensive BNPL framework reflects an accelerating trend toward state-level regulation of point-of-sale financing products.

As additional states consider similar legislation, market participants should expect continued divergence in regulatory requirements—and a growing need to align program structures with evolving expectations around licensing, consumer protection, and risk management.

Misrepresentation and Deception: Government Enforcement Agencies Ready to Litigate

By ,

A&B ABstract:  The COVID-19 pandemic appears to be drafting the attention to consumer protection regulators to products that were active after the 2008 recession.

In the midst of the global pandemic, with unemployment rates surging to unprecedented levels, consumer protection regulators appear focused on areas where cash-strapped consumers may turn,  such as credit repair, payday loans, and mortgage and other debt relief.

Notably, these are the same areas that consumer protection regulators were active in during the post-2008 recession. For example, on May 22, 2020, the Consumer Financial Protection Bureau (CFPB) and Commonwealth of Massachusetts filed a lawsuit alleging that defendants misrepresented that they can offer solutions that will or likely will substantially increase consumers’ credit scores despite not achieving those results.

In addition, on May 19, 2020, the Federal Trade Commission (FTC) was granted a temporary restraining order and asset freeze against a payday lending operation alleging that it deceptively overcharged consumers millions of dollars and withdrew money repeatedly from consumers’ bank accounts without their permission.

These lawsuits are just two of many efforts that government enforcement agencies have undertaken recently to combat fraud and protect consumers. Businesses should be aware that agencies are actively pursuing litigation as a means to remedy potential consumer harm.

CFPB and Commonwealth of Massachusetts v. Commonwealth Equity Group d/b/a Key Credit Repair and Nikitas Tsoukales

The CFPB and Massachusetts allege that Commonwealth Equity Group d/b/a Key Credit Repair (KCR) and its president, Nikitas Tsoukales violated §§ 1031 and 1036 of the Consumer Financial Protection Act (CFPA), the Telemarketing Sales Rule’s (TSR) prohibition on deceptive and abusive telemarketing acts or practices, and the Massachusetts Credit Services Organization Law. 16 C.F.R. §§ 310.3 & 310.4; M.G.L. c. 93, §§ 68A-E (MA-CSO). KCR markets to consumers a service for supposedly removing harmful information from the consumer’s credit history, credit record, or credit scores or ratings.  Since 2011, KCR has collected at least $23 million in fees from tens of thousands of consumers through its telemarketing services.

The Complaint

According to the complaint, consumers pay KCR a “first work fee” upon enrolling with the company and then charges an additional monthly fee. KCR allegedly collects these fees from consumers before performing any service. KCR markets to consumers that “on average it can raise a person’s credit score by 90 points in 90 days” and that clients start “seeing removals of bad credit history in 45 days.”  However, “consumers did not see credit scores with an average 90-point increase in 90 days,” nor did they see “removals on their credit reports within 45 days” of enrolling with KCR in many instances.

The Complaint alleges that this scheme constitutes an abusive telemarking act because it is an improper advance fee to remove derogatory information from, or improve, a person’s credit history, credit record, or credit rating.

Further, the Complaint alleges that KCR’s conduct violates the CFPA because KCR allegedly misrepresented the material aspects of its services. Therefore, the CFPB and Massachusetts are seeking injunctive and monetary relief as well as civil monetary penalties.

FTC v. Lead Express, Inc., et al.

On May 11, 2020, the FTC filed an ex parte emergency motion for a temporary restraining order and sought other relief including an asset freeze against 11 payday lenders operating as a common enterprise through websites and telemarketing.  The FTC alleged that the entities were engaging in the deceptive, unfair, and unlawful marketing tactics in violation of the FTC Act, the TSR, the Truth in Lending Act (TILA) , and the Electronic Fund Transfer Act (EFTA).

The Complaint

According to the FTC’s complaint, despite claiming that consumers’ loans would be repaid after a fixed number of payments, the defendants typically initiated repeated finance-charge-only withdrawals without crediting the withdrawals to the consumers’ principal balances. Thus, consumers allegedly paid significantly more than what they were told they would pay. These misrepresentations violate Section 5(a) of the FTC Act (15 U.S.C. § 45(a)) as well as the TSR (16 C.F.R. § 310.3(a)(2)(iii)).  Additionally, the defendants allegedly made recurring withdrawals from consumers’ bank accounts without proper authorization which violates Section 907(a) of EFTA (15 U.S.C. § 1693e(a)) and illegally used remotely created checks, which under the TSR (16 C.F.R. § 310.4(a)(9)) are a prohibited form of payment in telemarketing.

The complaint also alleges that the defendants often failed to make required credit transaction disclosures in violation of Section 121 and 128 of TILA (15 U.S.C. §§ 1631 and 1638), and Sections 1026.17 and 1026.18 of Regulation Z (12 C.F.R. §§ 1026.17 and 1026.18).

The Court Order

On May 22, 2020, the District Court of Nevada granted an emergency motion for temporary restraining order against all eleven defendants. The order restrains the defendants from: (1) engaging in prohibited business activities in connection with advertising, marketing, promoting, or offering any loan or extension of credit, (2) releasing or using customer information, and (3) destroying, erasing falsifying documents relating to the business.  Furthermore, the defendants’ assets are frozen pending the show-cause hearing or further court order which will take place via videoconferencing on June 2, 2020.

Takeaway

With these two cases, government enforcement agencies support their statements that as the global pandemic continues, they are watching for deceptive or fraudulent practices in the financial services industry. Businesses should remain vigilant in their compliance with existing and new laws and regulations.