Illinois enacts a broad licensing framework for buy now, pay later providers

Illinois has become the second state, after New York, to place buy now, pay later (BNPL) providers under a dedicated licensing and supervisory regime, and it has done so with a statute that reaches well beyond the companies that originate these loans. On June 25, 2026, Governor J.B. Pritzker signed the Buy-Now-Pay-Later Loan Consumer Protection Act (the Act), enacted as Public Act 104-475, which passed the Illinois legislature unanimously. For the lenders, program managers, banks, and merchants that make up the BNPL ecosystem, the law is notable less for its consumer-protection checklist (much of which tracks what other states have done) than for how widely it draws the circle of who must be licensed and how aggressively it looks through arrangements designed to sit outside that circle.

Key takeaways

The Act requires a license from the Illinois Department of Financial and Professional Regulation (the Department), administered through its Division of Financial Institutions, for anyone engaged in providing covered loans. It defines a BNPL loan broadly as closed-end credit tied to a particular purchase of goods or services that is either repayable in four or fewer installments or carries a term of 120 days or less. The definition expressly captures both no-interest products and those that charge interest or finance charges.

The licensing net extends past originators to reach entities that purchase all or part of a BNPL loan, arrange loans for third parties, act as an agent in making them, or service them. Layered on top is an expansive anti-evasion regime that lets regulators treat a party as the true lender despite a formal claim to be merely an agent or service provider for an exempt institution. This feature is most likely to matter for bank-fintech partnerships.

The Act took effect on signing, but covered providers generally have until January 1, 2028, to come into compliance, and the secretary may set a later implementation date by rule. Existing providers that apply for a license on time may continue operating while their applications are reviewed.

Background

BNPL financing lets a consumer split the cost of a purchase into a short series of payments (often four) and has spread rapidly from discretionary retail into everyday spending. Consumer advocates supporting the law pointed to its growing use for essentials, like groceries and even rent, and framed the Illinois law as filling gaps left by an uncertain federal posture toward the sector. Illinois is not writing on a blank slate. New York enacted the first comprehensive BNPL-specific framework in 2025, with implementing rules proposed earlier this year, and California, while it has no dedicated BNPL statute, already requires these providers to be licensed by treating them as lenders. Illinois now joins that small group of states regulating BNPL rather than leaving it to existing lending statutes.

A deliberately wide definition and licensing net

The statute's reach is its defining characteristic. It covers any closed-end purchase credit repayable in four or fewer installments or within 120 days, and because it includes interest-free products, the definition captures the classic pay-in-four offering along with longer or interest-bearing variants. Several categories fall outside this scope: seller-financed credit where the creditor is the merchant selling the goods, motor vehicle loans, residential mortgages, and inventory financing for merchants. The secretary may designate additional products as BNPL loans by rule, so the perimeter can expand over time.

Licensing turns on the activity rather than the label, which means firms that may not think of themselves as lenders can be pulled in. A company that arranges loans, services them, or buys them on the back end may need a license even if another party advances the funds. Applicants must submit detailed information through the Nationwide Multistate Licensing System (NMLS) covering ownership, management, financial condition, operations, and regulatory history, including audited financial statements.

The Act expressly exempts several kinds of institutions, including banks, savings banks, savings and loan associations, credit unions, and insurance companies. Merchants and merchant platforms that simply make a licensed or exempt lender's product available are also generally exempt, provided they do not originate, underwrite, service, or hold an ownership interest in the loans. Passive investors that stay out of origination, underwriting, and servicing qualify for similar treatment. The Act also sorts out how these products relate to existing Illinois lending statutes. A BNPL loan made in compliance with the Act is not subject to the Consumer Installment Loan Act or the Payday Loan Reform Act, and a company already licensed under certain Illinois lending statutes need not obtain a separate BNPL license, though it must still satisfy the Act’s substantive requirements and must provide notification that it is engaging in covered BNPL loans.

The anti-evasion and true-lender provisions

The most consequential part of the law is its anti-evasion language, which deserves close reading by anyone relying on an exempt-entity structure. The Act reaches beyond direct lenders to any person the Department determines is engaged in what is, in substance, a disguised loan or a subterfuge meant to evade the statute. A party can be treated as the lender even if it claims to be only an agent or service provider for an exempt institution.

The Act enumerates factors for making that determination. An entity may be deemed the lender if it holds the predominant economic interest in the loan or if it markets, brokers, arranges, or facilitates the loan while also holding a right or first right of refusal to purchase the loan or its receivables. The totality of the circumstances can also support a finding that the transaction was structured to evade the Act. Additional factors resulting in designation as a covered lender include indemnifying an exempt entity against loan-related risk, predominantly designing or controlling the loan program, or acting as an agent for an exempt entity while lending directly in other states. These provisions echo the true-lender debates that have emerged in other state lending laws and are likely to draw close attention from both industry and regulators.

The Act’s reach also has a ceiling built into its own definition. Because a covered loan must be repayable in four or fewer installments or within 120 days, longer-dated or differently structured installment products fall outside it altogether, a gap distinct from the disguised-lender arrangements the anti-evasion provisions are meant to catch. Consumer advocates have criticized that boundary, warning that providers can structure around it, for instance by writing terms just beyond 120 days, and that removing these loans from the Consumer Installment Loan Act also takes them out of the state loan database used to detect predatory lending patterns. Providers, for their part, will want to watch exactly where that line falls as they classify products.

Consumer-protection and servicing requirements

Alongside licensing, the Act imposes conduct standards that will feel familiar from other consumer-credit regimes. Before extending credit, a provider must perform reasonable risk-based underwriting, evaluate the consumer's ability to repay, maintain written underwriting policies, and disclose the factors it weighs. The Act bars the use of social-network or group creditworthiness data in that assessment. Providers must also disclose key loan terms, including cost and repayment schedule, consistent with the federal Truth in Lending Act and Regulation Z; maintain procedures for billing disputes and merchant refunds; and offer consumers protections resembling the dispute rights available under credit card rules. The Act prohibits mandatory automatic payments, limits repeated Automated Clearing House (ACH) debit attempts after an insufficient-funds notice, and forbids tips and expedited-payment fees.

On the enforcement side, covered loans remain subject to the 36% rate cap under the Illinois Predatory Loan Prevention Act. Loans made by an unlicensed provider are void and unenforceable, and any violation of the Act constitutes an unlawful practice under the Illinois Consumer Fraud and Deceptive Business Practices Act. The secretary holds broad supervisory authority, including the power to examine licensees and certain affiliates, issue subpoenas, and halt unlawful practices. The secretary may impose civil penalties of up to $1,000 per day on a licensee that fails to respond to regulatory or reporting requests, may levy larger per-offense penalties reported at up to $25,000, and may seek injunctive relief through the attorney general.

Why this matters

For BNPL providers, the immediate question is scope. Coverage follows the activity, and the definition is broad, so the first task is to determine which entities in a given program—whether they originate, arrange, service, or purchase—will need an Illinois license. From there, providers should build the compliance runway toward the January 1, 2028, deadline.

For bank-fintech partnerships and program managers, the anti-evasion and true-lender provisions are the headline risk. A structure that treats a partner bank as the lender while the fintech designs the program, carries the economic interest, or holds the right to purchase the receivables is exactly the arrangement these factors are written to reach. Parties relying on an exempt-entity model should pressure-test it against the statute's factors rather than assume the label controls.

For merchants and platforms, the exemption is real but conditional. It applies only when the merchant simply makes a licensed or exempt lender's product available and stays clear of origination, underwriting, servicing, and ownership. Programs that blur those lines risk losing the exemption.

For companies operating across multiple states, Illinois deepens an emerging patchwork. Its approach overlaps with California and New York in substance but differs in mechanics. The anti-evasion provisions in particular may not align neatly with those in other states, making a single national compliance template unlikely to suffice.

What to do now

Companies in the BNPL ecosystem, or those otherwise making short-term consumer purchase loans, may want to take several steps well ahead of the compliance date:

• Map each entity in your Illinois programs against the licensing triggers, including arrangers, servicers, and loan purchasers (not just originators).
• Confirm whether each product falls within the Act’s definition, since the installment count and the loan term at or beyond 120 days determine coverage.
• Stress-test any exempt-entity or bank-partner structure against the true-lender factors, focusing on economic interest, program control, indemnification, and rights to purchase receivables.
• Review underwriting, ability-to-repay, and disclosure practices, and confirm you are not using prohibited social-network or group creditworthiness data.
• Update servicing, dispute-resolution, refund, and payment practices to meet the Act's limits on automatic payments, repeat ACH attempts, tips, and expedited fees.
• Track the implementing rulemaking, since the secretary can expand covered products, add exemptions, and adjust timing.

This is unlikely to be the last word. The compliance date is more than a year out, the Department has broad rulemaking authority that will shape how the statute operates in practice, and other states continue to move as federal oversight of the sector remains uncertain. We will continue to monitor Illinois rulemaking and related state developments.