BNPL Rules in 2026: What Changes for a Merchant

The reliable way to read any BNPL rule is to find the defined term for the regulated party, then test whether your role fits it. The duties almost always attach to a named entity — a lender, a servicer, a licensee — and a merchant that simply surfaces a provider's offer often does not match that term.

Three threads matter heading into 2026. First, several states have moved toward their own BNPL frameworks. Second, the federal stance shifted after a 2025 action at the CFPB. Third, the merchant-versus-provider line stays the key to reading any single rule.

A practical filter

When you read a rule, do this in order:

• Find the defined regulated party — for example a "lender," "licensee," or "credit services organization."
• Check whether a merchant that only displays a provider's offer fits that term.
• Confirm your reading against the actual text, not a headline.

Because rules name specific parties, a broad "BNPL is now regulated" claim tells you little. You need the exact authority and the exact defined term — which is why the sections below point to each authority's own page.

A proposed rule can change before it is final, or never finalize at all. So a merchant who builds to a draft may be building to text that later shifts. That is why status comes first, in the agency's own words.

The primary source for NY DFS material is the state's own host (ny.gov) or the Federal Register (federalregister.gov). If that page shows a proposal still open for comment, the right move is to track it — not to treat it as binding. A comment deadline is not an effective date; never read one as the other.

What to capture from the NY DFS page, in order

• Status first — proposed, final, or withdrawn, in the agency's own words.
• Regulated party — the defined entity the rule binds.
• Effective date — the actual date, not a comment deadline.
• Merchant reach — whether a checkout that displays a provider's offer is in scope.

This is a statement about New York DFS material, cited to its issuing authority's own page below. Read that page yourself before you rely on any status or date.

We will not paraphrase a statute we cannot cite to an approved primary page. Doing so would risk stating a rule or date the real text does not support. So here is what you confirm when you read the act yourself.

First, identify the regulated party the act defines. Next, find its effective date and any phase-in schedule. Then check whether it imposes licensing, disclosure, or servicing duties — and on whom. Because state acts often target the lender or a credit-services role, a merchant surfacing a provider's offer may fall outside the core duties. Verify that against the text, with counsel; do not assume.

If you need this quickly, ask your counsel for three facts: the current bill number, its status in the legislature, and its effective date. Those settle most of the practical questions, and they come from the primary source rather than any secondhand recap — including this one.

An interpretive rule explains how an agency reads an existing law; it is not new law itself. So when the CFPB withdrew its interpretation, the consumer-protection laws it referenced did not vanish. The withdrawal narrows what the agency has formally said, not what the underlying law requires.

For a merchant, the takeaway is practical. Do not treat the withdrawal as a green light, and do not treat the earlier interpretive rule as current. Read the CFPB's live page (consumerfinance.gov), or the Federal Register (federalregister.gov), to see the agency's present stance.

Other federal bodies, including the Federal Reserve, can also speak to consumer credit. So check whether any newer federal guidance has issued since the withdrawal. Because a federal stance can shift again, this is exactly the kind of claim to re-verify on a schedule — the cadence section below covers when.

The whole question turns on separating the roles clearly, because a single rule can attach a duty to one party and leave the other untouched.

Where a rule can still reach a merchant

Sometimes a state attaches a duty to how an offer is advertised or how disclosures appear at the point of sale. A rule may ask that financing terms be shown a certain way, and that kind of duty can touch what appears in your checkout. For that reason, read the text, not a summary.

On state licensing, the question usually resolves the same way: the requirement falls on the provider or licensee, not on a merchant that simply surfaces the offer. Still, a few frameworks define broker or credit-services roles broadly, so confirm your role against the exact definition.

When you offer financing through PayFull, you do so under your own merchant accounts and provider agreements, so the provider's duties stay with the provider. PayFull does not provide regulatory, compliance, or licensing services, and it has no authority over any provider's decisions.

A date you carry forward without re-reading is a date you cannot trust. Set a simple cadence so nothing drifts.

A workable rhythm

• Quarterly: re-open each cited authority page and confirm status, party, and effective date.
• On trigger: re-verify the moment a rule finalizes, a new state act passes, or a federal position shifts.
• At launch and at change: re-read before you add a provider, enter a new state, or change how offers appear at checkout.
• Document each check: note what you read and when, so your records show a live review rather than a stale assumption.

Because providers set and change their own terms and availability, those details also warrant a periodic look — but that is a provider decision, so confirm it with the provider directly. For the regulatory side, the authority's own page always beats any secondhand recap, including this one.