New York regulators continued to assert themselves as some of the most active and influential financial services regulators in the country in the third quarter of 2026.

While federal regulators have spent much of the year recalibrating their priorities in the areas of consumer finance, digital assets and bank supervision, New York has continued to pursue an aggressive regulatory agenda affecting mortgage lenders, fintech companies, virtual currency businesses and traditional banking institutions.

Several developments from the third quarter reflect a common theme: Regulators are increasingly seeking to apply established supervisory expectations to newer market participants and emerging financial products.

Community Reinvestment Rule

Perhaps the most significant development for the mortgage industry was the implementation of New York's Community Reinvestment Act-style requirements for nondepository mortgage bankers — Part 12D of Title 3, Banking Law Section 28-bb(1).

Historically, community reinvestment obligations have been associated primarily with depository institutions. New York's decision to extend similar concepts to certain nonbank mortgage lenders reflects the growing market share and importance of nondepository institutions within the residential mortgage industry.

Regulators have increasingly expressed concern that entities responsible for a substantial percentage of residential mortgage originations should be subject to obligations comparable to those imposed on traditional banks.

The new framework places greater emphasis on documenting how mortgage lenders serve communities throughout the state, particularly underserved and low-to-moderate income areas.

For many mortgage companies, compliance will require more than merely tracking origination volumes. Institutions may need to further evaluate geographic lending patterns, marketing initiatives, community outreach efforts, complaint management programs and fair lending monitoring systems. The public nature of performance ratings creates an additional layer of reputational risk that may affect future regulatory interactions.

Buy Now, Pay Later

Another important development from the third quarter involved New York's continuing efforts to regulate buy now, pay later products. Although these products originally emerged as technology-driven alternatives to traditional credit offerings, regulators have increasingly concluded that they raise many of the same consumer protection concerns historically associated with lending products.

The state's proposed framework would create licensing requirements, supervisory oversight, underwriting expectations, disclosure standards and data governance obligations for companies offering buy now, pay later products to New York consumers.

What makes the proposal particularly significant is that it signals a broader shift in regulatory thinking. Rather than viewing buy now, pay later products as distinct technological innovations, regulators appear increasingly inclined to treat them as extensions of traditional consumer credit.

This approach could ultimately require providers to enhance compliance programs, formalize underwriting standards, implement more robust consumer complaint procedures and strengthen controls governing the collection and use of consumer data.

Digital Assets

Digital asset supervision likewise continued to evolve during the third quarter. New York has long distinguished itself as one of the most active regulators of virtual currency businesses, and recent developments indicate that the state remains committed to integrating digital asset activities within more traditional supervisory frameworks.

Regulatory actions during the quarter reinforced the message that digital asset firms operating in New York will be expected to maintain governance, compliance, cybersecurity and risk management programs comparable to those expected of more traditional financial institutions.

This trend is important because it reflects a maturation of the regulatory landscape rather than a relaxation of oversight. As digital asset products become increasingly integrated into mainstream financial markets, regulators appear less willing to permit separate compliance standards for firms operating in the sector.

Instead, New York continues to emphasize institutional-grade controls, operational resilience, safeguarding of customer assets and comprehensive compliance management systems.

Enforcement and Supervisory Priorities

Enforcement activity during the third quarter further underscored regulators' broader compliance priorities. Recent actions by the New York Department of Financial Services highlighted ongoing concerns regarding governance, anti-money laundering controls, compliance oversight and regulatory reporting.

These matters serve as a reminder that even as regulators devote attention to new technologies and emerging business models, traditional supervisory expectations remain firmly in place.

Indeed, many recent enforcement actions, discussed further below, illustrate that regulatory concern often extends beyond the underlying issue giving rise to an investigation. Regulators frequently focus on how an institution identified, escalated, investigated and remediated potential compliance concerns.

In this respect, governance structures, reporting processes, internal audit functions and compliance monitoring programs remain critical components of a successful risk management framework.

DCWP Delays SHIELD Rule Effective Date and Issues Compliance FAQ

On Aug. 4, the New York City Department of Consumer and Worker Protection further delayed the effective date of the Stopping Harassment and Intimidation and Ensuring Lawful Debt Collection, or SHIELD, rule — codified in Title 6 of the Rules of the City of New York — from Sept. 1, 2026, to Jan. 1, 2027, and published a FAQ for the SHIELD rule to clarify compliance requirements thereunder.[1]

The SHIELD rule provides protections beyond the federal Fair Debt Collection Practices Act and imposes new obligations for debt collectors and other financial institutions engaged in debt collection with consumers in New York City.

The FAQ includes 15 topics, including the following for illustrative purposes.

Scope and Definitions

The SHIELD rule applies to debt collectors, including licensed debt collection agencies, third-party debt collectors, debt buyers, and qualifying debt collection attorneys or law firms, as well as original creditors engaged in debt collection procedures involving New York City consumers.

The FAQ clarifies, however, that purchasers of debt that do not add to the debt before initiating collection are not considered original creditors. They also confirm that the rule does not apply to day-to-day business transactions, billing or customer service, and that notices containing language required by federal or state law do not, on their own, constitute the start of debt collection procedures.

Disputed Debt and Verification Process

New York City consumers can trigger the dispute and verification process under the SHIELD rule at any time, unlike the Fair Debt Collection Practices Act, which provides that such a dispute must be submitted within 30 days of a debt collector's notice of the debt.

Debt collectors must cease collection activity upon receiving a dispute and, within 60 days, provide either written debt verification or a notice of unverified debt. Failure to verify the debt is a violation of the SHIELD rule, and failure to send a notice of unverified debt when required is a separate violation of the rule.

In addition, the FAQ clarifies that merely closing an account after receiving a dispute or verification request from a consumer fails to comply with the SHIELD rule. The DCWP provides a template for the notice of unverified debt, but debt collectors are not required to use the same.   

Collection of Time-Barred Debt

Regulated entities must maintain reasonable procedures for determining the applicable statute of limitations and whether the limitations period has expired. Further, for time-barred debts, regulated entities must send a notice of time-barred debt to New York City consumers and wait at least 14 days after such mailing before contacting the NYC consumer. Regulated entities are also required to provide a time-barred debt disclosure in any oral communication and all other communications on time-barred debts.

Although the FAQ provides some key clarifications, it does not resolve all ambiguities or operational issues associated with compliance with the SHIELD rule. For example, the guidance on federal- or state-mandated notice language may create additional uncertainty because it does not identify when debt collection procedures are deemed to begin.

If debt collectors and other financial institutions that are subject to the SHIELD rule have not already done so, they should prepare for the Jan. 1, 2027, effective date by updating communication policies to comply with weekly contact limits, revising verification and dispute processes to meet the timeline and documentation standards, and training internal teams and third-party vendors on the SHIELD rule. Regulated entities should also review debt collection activity involving New York City consumers for compliance.

Enforcement Actions and Highlights

On Aug. 5, Order Express Inc. was penalized $250,000 for: (1) failing to conduct sufficient cyber risk assessments; (2) lacking adequate written cybersecurity policies for system updates; and (3) not properly designing program controls under Title 23 of the New York Codes, Rules and Regulations, Part 500, despite qualifying for a limited exemption.

The NYDFS emphasized risk assessment compliance, issuing updated guidance in September detailing expectations for cybersecurity risk reviews across all supervised financial entities.

On Aug. 12, the NYDFS announced that it, along with regulators for 46 other states, entered into a settlement agreement and consent order with Newrez LLC to resolve allegations that it had erroneously assessed charges for lender-placed insurance, or LPI, or force-placed insurance against borrowers, despite evidence of a valid homeowners insurance policy on the loans.[2]

The consent order is the result of a multistate examination of Newrez initiated by the Multi-State Mortgage Committee in January 2022 to determine Newrez's compliance with applicable state and federal laws and regulations, financial condition, the adequacy of policies and procedures, and the control and supervision of the licensed mortgage loan servicing operations for the period from Nov. 1, 2020, to Oct. 31, 2021.

The Multi-State Mortgage Committee issued a report of examination to Newrez on Sept. 12, 2022, which identified noncompliance with the Real Estate Settlement Procedures Act and Regulation X, specifically Title 12 of the Code of Federal Regulations, Section 1024.37, governing LPI.

Newrez agreed to credit $4,511,242.16 to borrowers and pay $10,988,757.84 to state regulators for administrative penalties and costs. Of the approximately $11 million in administrative penalties and costs, New York regulators will receive $602,226.09 in administrative penalties. Further, the NYDFS indicated that Newrez has returned $409,026 to affected borrowers in New York state.

In addition to these payments, Newrez agreed to, among other things, conduct a self-audit of all LPI fees collected or refunded for newly boarded loans within states participating in the consent order for the period from Jan. 1, 2023, through the effective date of the consent order.

This latest consent order is an example of how the NYDFS and other state regulators have taken up the enforcement mantle to protect consumers due to the gap in federal enforcement.

Given the consent order and the NYDFS' focus on consumer protection, mortgage servicers and lenders should consider:

  • Reviewing their loan boarding procedures to ensure the implementation of insurance verification checks to confirm whether a valid homeowners insurance policy is in place or an LPI is required;
  • Inspecting service transfer procedures to ensure accurate insurance information is provided in compliance with Title 12 of the Code of Federal Regulations, Section 1024.38(b)(4);
  • Implementing independent LPI compliance testing with an error threshold — the consent order provides for 5% — to trigger escalation and corrective action; and
  • Including LPI compliance audit rights, reporting obligations and service-level standards with error thresholds and indemnification provisions for regulatory penalties resulting from vendor errors in any servicer-vendor agreements, including subservicing agreements.

On Sept. 17, the New York Attorney General's Officeannounced a more than $700 million settlement with Credit Acceptance Corp., a subprime auto lender, to resolve a lawsuit in Mercer County Superior Court alleging that CAC deceptively made unaffordable loans packaged with expensive add-on products and caused consumers to lose their vehicles when they could not make their payments.

Thirty-nine other states and Washington, D.C., joined the New York Attorney General's Office to settle Davenport v. CAC. Under the consent judgment and order, CAC will (1) pay the states $15.5 million in penalties and $60 million to a trust account for restitution to consumers; and (2) eliminate $634 million in debt for certain consumers with defaulted loans.

In addition, CAC must adopt practices to protect consumers, including, but not limited to, maintaining policies and procedures reasonably designed to detect a dealer's imposition of add-ons without a consumer's consent and directly contacting consumers in writing to inform them of any purchased add-ons, the purchase price of such add-ons and the process to cancel the same.

Conclusion

Taken together, these third-quarter developments demonstrate New York's continued commitment to expanding regulatory oversight across the financial services sector.

Whether addressing mortgage lending; buy now, pay later products; digital asset activities; or traditional compliance obligations, regulators are increasingly focused on ensuring that institutions maintain robust governance frameworks, effective compliance management systems and strong consumer protection controls.

"NY Banking Brief: All The Notable Legal Updates In Q3," by Scott Samlin and Diana Eng was published in Law360 on October 6, 2026.