In this Expert Analysis series, attorneys provide quarterly recaps discussing the biggest developments in New York banking regulation and policymaking.
There were several banking and consumer finance developments in New York during the first quarter of 2026, headlined by initiatives to expand oversight of financial institutions and strengthen consumer protection laws.
Extended Community Reinvestment Act-Like Review
On Jan. 7, the New York State Department of Financial Services adopted Part 120 of Title 3, Compliance with Banking Law Section 28-bb.[1] The rule applies to DFS-licensed nondepository mortgage bankers that originate more than 200 New York mortgage loans annually. Complianceis required beginning on July 7, after a six-month transition period.
Part 120 establishes a first-of-its-kind state law regime styled on the Community Reinvestment Act, which Congress passed in 1977 to ensure that banks and savings associations meet the credit needs of their communities, particularly low- and moderate-income areas. Part 120 similarly requires New York nonbank mortgage lenders — both traditional and online branchless lenders — to demonstrate equitable access to credit through lending and service tests.
The NYDFS will periodically evaluate the degree to which covered lenders are meeting the credit needs of the community, and will issue public ratings of "Outstanding," "Satisfactory," "Needs to Improve," or "Substantial Noncompliance." As outlined below, the evaluations and ratings will also affect licensing and other regulatory approvals.
The rule aims to be practical. It recognizes that in high-cost areas, homeownership may be unattainable for low- and moderate-income communities, and that there may be a shortage of credit for certain borrowers.
To that end, the rule authorizes the department to be flexible in its consideration of a mortgage banker's activities in high-cost areas by crediting its efforts in providing loans to these middle-income communities in the department's overall evaluation of the lender.
The rule also provides that a mortgage banker need not make investments with the primary purpose of engaging in community development to achieve any specific rating on the service test.
Poor performance under the rule could come with serious consequences. Under Section 120.3, based on a mortgage banker's Part 120 record, the superintendent may denyapplications to open branches or to effect a change of control. The superintendent may also condition approved applications based on the lender's Part 120 performance record, i.e., its rating, underlying deficiencies or identified gaps.
By extending CRA-style oversight to nonbank mortgage lenders, the NYDFS has introduced a new layer of supervisory and reputational risk that is likely to affect how lenders structure their operations, approach community lending, and navigate licensing and transactional approvals in New York.
A Potential Framework for Buy Now, Pay Later Lenders
The NYDFS published a draft of a new Part 423 — a proposed addition to Title 3 of the New York Codes, Rules and Regulations— governing buy now, pay later, or BNPL, lenders.[2] If adopted, the regulation would be one of the first comprehensive state-level regulatory frameworks for BNPL products.
The draft was posted for preliminary public comment on Feb. 23 and comments were due on March 5. Once the proposed regulation is published in the New York State Register, a 60-day formal comment period will begin, and the law will take effect 180 days after adoption of a final rule.
For BNPL providers, Part 423 would establish a comprehensive licensing and supervisory regime, including ongoing reporting and supervisory obligations, effectively bringing BNPL products within New York's consumer credit framework.
Part 423's reach is intended to be broad. It would cover any person offering BNPL loans to New York consumers, including originators, purchasers or acquirers of BNPL loans, and platform operators facilitating BNPL credit, excluding motor vehicle loans. The regulations would thus widely apply to many fintech models — including those that have historically avoided lending regulations.
If adopted, the regulations would require nonbank BNPL providers to obtain a DFS license. Similarly, banks and other regulated entities that are already licensed would need to obtain an additional NYDFS authorization to specifically offer BNPL loans.
In addition to entity-level licensing or authorization, the proposal requires providers to obtain "category permissions" for specific BNPL products — such as interest-free or interest-bearing offerings — thus giving the NYDFS granular, product-level control over how BNPL is deployed in the market.
Part 423 would include significant consumer protections. The proposal would impose requirements related to underwriting and the ability to repay that mark a significant departure from traditional BNPL practices.
Additionally, covered providers would be required to conduct risk-based assessments of a consumer's capacity to repay, including consideration of incomeand existing obligations. This introduces a more formal credit underwriting framework into a segment that has historically relied on streamlined or minimal underwriting, particularly for short-term, interest-free products.
The rule would also establish robust data privacy and consumer data use restrictions, including several that go beyond existing federal requirements. BNPL providers would be required to obtain affirmative, purpose-specific consumer consent for certain data uses and would face limits on data retention, sharing and secondary use. These provisions could require meaningful changes to fintech business models that rely on transaction-level data for marketing, cross-selling or analytics.
Finally, the proposal would subject BNPL providers to ongoing supervision by the NYDFS, including examinations, reporting obligations and advertising requirements, such as prohibitions on using descriptive language like "as low as" or "from" without additional disclosures. In other words, the rule would treat BNPL providers less like lightly regulated fintech platforms, as they are accustomed to, and more like traditional financial institutions, embedding them within the broader supervisory and compliance framework of the NYDFS.
The proposal reflects the growth of BNPL — in particular, BNPL offered by nonbanks — and signals the department's perceived need for a robust regulatory regime in the space. To that end, the regulations would impose bank-like compliance, data and supervisory obligations on a product that has historically operated at the margins of lending regulation.
Second Circuit Ruling Limiting Prejudgment Asset Freezes
In Leadenhall Capital Partners LLP v. Advantage Capital Holdings LLC, a panel of the U.S. Court of Appeals for the Second Circuit unanimously vacated, in relevant part, a preliminaryinjunction that had frozen more than $609 million in guarantor-defendants' assets.
Applying the U.S. Supreme Court's 1999 decision in Grupo Mexicano de Desarrollo SA v. Alliance Bond Fund Inc., the court held that the U.S. District Court for the Southern District of New York lacked the authority to freeze assets over which the plaintiff had no lien, and over which the plaintiff brought no claim for final equitable relief.
The ruling marks the first time that the Second Circuit has applied Grupo Mexicano to reverse a district court decision and vacate an asset freeze.
The case arose from a structured lending arrangement in which the borrower entities granted a first-priority security interest in their assets, while their parent entities provided guarantees of payment and performance, but pledged no assets of their own as collateral. The plaintiff alleged that the borrowers and guarantors conspired to fraudulently overstate the value of the plaintiff's collateral and to dissipate assets.
On that basis, the district court froze both the borrowers' and guarantors' assets in an amount sufficient to repay the alleged $609 million — and growing — accelerated debt. That ruling was challenged on appeal by another creditor that claimed the first-priority security interest in the guarantors' assets.
The Second Circuit applied a core holding of Grupo Mexicano: Under Rule 65, district courts lack the authority to restrain assets in which movants have no lien or equitable interest. The court ruled that the plaintiff has no lien on any asset of the guarantor-defendants, none of which had been pledged as collateral.
The plaintiff argued that it had an equitable interest because it sued for specific performance of the guarantors' alleged obligation to pledge additional collateral of their own in an amount sufficient to cover the accelerated debt. But the court rejected this argument.
Applying precedent from the context of the Employee Retirement Income Security Act, the court differentiated between legal and equitable remedies. It held that, even accepting the plaintiff's disputed factual predicate, the plaintiff sought no remedy with respect to any particular asset of the guarantors' — it did not sue for the return of any particular asset that, in good conscience, was theirs — and thus had no equitable interest in any guarantor asset.
The court viewed the claim as no more than an effort to facilitate collection of a contractual debt — the classic remedy at law.
The Second Circuit's ruling is significant as a contrary result could have shaken the foundation of asset-based lending. The ruling precludes unsecured lenders from using contract claims or other legal claims to effectively leapfrog secured creditors and reshape leverage in distressed situations.
For unsecured lenders, the ruling underscores that district courts lack the power to freeze assets in aid of a money judgment — even when the lender alleges fraud and asset stripping. Absent a claim for equitable relief with respect to particular assets, lenders should instead consider other potential paths, such as attachment, claims for fraudulent conveyance and bankruptcy remedies.
Finalized Debt Collection Rule
On Feb. 26, the New York City Department of Consumer and Worker Protection finalized a sweeping new rule — branded the SHIELD Rule — establishing what the agency describes as the most stringent local consumer protection regime governing debt collection in the U.S. The amended rule will take effect on Sept. 1.[3]
The rule's scope is expansive, covering not only third-party debt collectors and debt buyers, but also original lenders — including banks — when engaging in specified collection activities, such as accelerating debt or pursuing legal action. This marks a notable shift, bringing first-party collections within the ambit of NYC's debt collection framework.
The rule further strengthens consumer dispute and verification rights by allowing consumers to challenge debts at any time, and requiring both first- and third-party collectors to substantiate those debts within prescribed time frames or cease collection activity. The resulting need to maintain accurate and readily accessible records is likely to impose additional operational burdens on creditors and collectors.
The rule also introduces targeted protections for consumers with medical debt, including enhanced disclosure requirements and obligations to inform consumers of available financial assistance programs.
Under the rule, first- and third-party collectors must also send a specific notice to a consumer before furnishing negative information about the consumer's debt to a consumer reporting agency.
Finally, the rule imposes heightened compliance and recordkeeping requirements, mandating detailed tracking of communications, disputes and payments, along with extended retention periods.
Taken together, the rule substantially recalibrates the debt collection landscape in New York City, extending regulatory obligations to a broader set of market participants while imposing stricter conduct and documentation requirements. In doing so, the rule is likely to require covered entities to reassess collection strategies, invest in compliance infrastructure and navigate a more exacting local regulatory regime that significantly exceeds federal standards.
Revised Corporate Self-Disclosure Program for Financial Crimes
On Feb. 24, the U.S. Attorney's Office for the Southern District of New York announced a revised corporate enforcement and voluntary self-disclosure program targeting fraud and financial misconduct affecting market integrity.[4]
The program is designed to incentivize financial institutions and other companies to promptly self-report misconduct by offering a clear, structured and fast path to a declination of prosecution — as well as consequences for companies that do not promptly self-report.
However, a corporate enforcement policy that was recently announced by the U.S. Department of Justice explained how SDNY's revised program is applied in practice, and practitioners should take care to assess how the two frameworks interact when evaluating self-disclosure decisions.
SDNY says that it has "refined and strengthened" its self-reporting program, and that it will decline to prosecute an eligible company when the reported conduct falls within covered categories, when the company timely and voluntarily self-discloses, when it fully cooperates with prosecutors, and when it remediates and makes restitution to injured parties.
Companies that satisfy the program's requirements may avoid criminal charges, monetary penalties and independent monitors. The program also offers certainty on a compressed timeline — qualifying companies could receive conditional prosecutorial declination within weeks, not years.
To satisfy the program's required timeliness requirement, a company must self-report before receiving a grand jury subpoena or document request from law enforcement or a regulator, and before learning of a government investigation.
The cooperation requirement is robust. Companies must volunteer the identity of witnesses and responsible individuals, as well as the results of any internal investigations and relevant communications and documents. The requirement also subjects companies to an ongoing compliance reporting obligation for three years.
The program also comes with consequences for companies that decline to self-report. Companies that fail to promptly self-report misconduct face a presumption against prosecutorial declination, and thus a greater likelihood of deferred prosecution agreements, which often come with monetary penalties, compliance obligations, guilty pleas and charges.
The program's carrot-and-stick approach could yield a surge in early reporting. Given the material benefits and consequences, banks, broker-dealers and other institutions that are active in the securities, commodities and digital assets markets would be wise to implement systems to facilitate prompt escalation and evaluation of misconduct allegations that could be covered by the program.
Conclusion
The first quarter of 2026 reflects a continued expansion of supervisoryand enforcement expectations across both traditional and emerging financial services activities in New York, in contrast to a broader pullback in federal oversight in certain areas. Regulators are increasingly applying bank-like standards to nonbank actors, while also layering more prescriptive conduct and documentation requirements onto established institutions.
For financial institutions operating in the state, the message is clear: Firms should expect earlier and more interventionist oversight, heightened scrutiny of compliance frameworks and disclosures, and reduced tolerance for ambiguity in how risks to consumers and market integrity are identified, documented and addressed.
[1] https://www.dfs.ny.gov/industry_guidance/regulatory_activity/banking, https://www.dfs.ny.gov/system/files/documents/2026/01/rf-bank-new-3-nycrr-120-text-c.pdf
[2] https://www.dfs.ny.gov/industry_guidance/regulatory_activity/banking, https://www.dfs.ny.gov/system/files/documents/2026/02/rd-pp-outreach-new-3-nycrr-423.pdf
[3] https://rules.cityofnewyork.us/wp-content/uploads/2026/02/DCWP-NOA-Rules-Relating-to-Debt-Collectors.pdf, https://www.nyc.gov/site/dca/news/022-26/dcwp-the-nation-s-strongest-consumer-protection-rules-against-predatory-debt-collection
[4] https://www.justice.gov/usao-sdny/pr/sdny-announces-corporate-enforcement-and-voluntary-self-disclosure-and-cooperation, https://www.justice.gov/usao-sdny/media/1428811/dl?inline
Reproduced with permission. Originally published April 7, 2026, "NY Banking Brief: All The Notable Legal Updates In Q1," Law360.
