Passing a law is the easy part. Enforcing it against a fragmented industry of hundreds of non-bank commercial lenders, many of which operate across state lines from out-of-state addresses, is harder. For the first several years after New York and California enacted their commercial financing disclosure requirements, the industry watched, updated some forms, and kept a close eye on whether regulators would actually act.
They're acting now.
The New York Department of Financial Services and California's Department of Financial Protection and Innovation have each shifted from rulemaking mode into enforcement mode. What's changed is not the law — the statutes have been in place since 2020 and 2018, respectively, and implementing regulations have been final since late 2022. What's changed is the pace of examinations, the threshold for formal enforcement action, and the willingness of both agencies to pursue penalties against lenders who've had ample time to comply and haven't.
For borrowers, this represents a real shift in their practical rights. For lenders — particularly MCA providers — it represents a reckoning that was deferred but is no longer avoidable.
The Laws: What They Require
Before understanding the enforcement, it helps to understand what compliance actually demands. Both states require providers of commercial financing to deliver a written disclosure to borrowers before any agreement is signed. The disclosure must include an annualized rate — the annual cost percentage (ACP) in New York, an APR equivalent in California — along with total repayment amount, payment frequency and amount, and prepayment terms.
New York's law, the Small Business Financing Act (effective August 1, 2023), covers transactions up to $2.5 million and requires disclosure of broker compensation as a separate line item. The ACP methodology is spelled out in 23 NYCRR Part 600, with specific rules for variable-payment products like merchant cash advances that require providers to model the annualized cost under both a standard and an accelerated repayment assumption.
California's law, built on SB 1235 and substantially expanded by AB 424 (effective July 1, 2024), now covers all commercial financing transactions regardless of dollar amount. California removed its original $500,000 cap specifically because regulators and advocates argued that mid-market borrowers — deals in the $500K–$2M range — were being left unprotected.
Both laws apply to out-of-state lenders serving in-state borrowers. A Texas-based MCA company funding a restaurant owner in Brooklyn must comply with New York's rules. An Ohio equipment lessor financing a California business must comply with California's.
Why Enforcement Lagged — and Why It No Longer Does
The first phase of enforcement after a major regulatory change is almost always light. Agencies prioritize education over penalties during the initial compliance window. Regulated entities benefit from the uncertainty: if you can argue the disclosure methodology is ambiguous, the penalty risk stays low.
That window closed. Both the DFS and DFPI finalized their implementing regulations in December 2022. By mid-2023, the statutes were live in both states. By 2024, industry guidance documents had been published, compliance workshops had run, and FAQs had answered most of the methodology questions that lenders had raised in comment periods.
At that point, the question shifted from "does the lender know what's required" to "is the lender doing it."
For many MCA providers, the answer to the second question was: no, or not meaningfully. A common pattern documented in examination findings: disclosure forms that technically existed but were delivered after — not before — the borrower signed. Or forms that listed a factor rate alongside an ACP figure that was calculated using a repayment assumption so conservative that the disclosed rate bore no meaningful relationship to the actual borrower experience. Or forms delivered only to borrowers who asked for them, not as a matter of routine.
These aren't gray-area compliance failures. They're the structure of an industry that built its business model on opacity and is being told, for the first time with teeth behind it, that the business model is now illegal.
New York DFS: Examinations and Formal Inquiries
The DFS has authority to examine providers of commercial financing that are registered with the department or operating in New York. Under the Small Business Financing Act, commercial financing providers with ten or more transactions per year must register — which gives DFS a roster of who's operating and who's due for a look.
DFS examination findings are typically not public unless they result in formal enforcement orders, but the pattern of agency behavior is readable from the consent orders, guidance letters, and formal advisories that have been published. Several themes have emerged:
Timing of disclosure. The law requires disclosure before the borrower "authorizes" the commercial financing agreement. Some providers interpreted "authorization" to mean execution — delivering the disclosure at or after signing. DFS has consistently taken the position that "before authorization" means materially before, with enough time for a reasonable borrower to review the document prior to committing.
ACP calculation for MCA products. The 23 NYCRR Part 600 rules for variable-payment products require providers to calculate ACP under two scenarios: a "standard" scenario and an "alternative" scenario using a faster assumed repayment. Providers whose factor-rate-to-ACP conversion consistently produced low numbers were flagged for review of their calculation methodology. In some cases, DFS found that providers were treating assumed repayment periods as far longer than commercially realistic, which mechanically produces a lower annualized rate.
Broker compensation disclosure. New York is one of the few states that requires the disclosure form to separately itemize compensation paid to any broker who helped arrange the financing. Providers that funneled deals through ISO (independent sales organization) networks but didn't disclose the ISO compensation on the disclosure form were found non-compliant regardless of whether the underlying rate disclosures were accurate.
Out-of-state registration gaps. Some lenders serving New York borrowers had not registered with DFS at all, concluding that their out-of-state charter put them outside the reach of the registration requirement. DFS has rejected that interpretation: if you're offering commercial financing to New York businesses, you need to be registered.
California DFPI: The AB 424 Enforcement Shift
California's enforcement trajectory is closely linked to the scope expansion that took effect July 1, 2024. When AB 424 removed the $500,000 cap from SB 1235's disclosure requirements, it pulled a large segment of the commercial lending market — mid-market term loans, commercial real estate bridge loans, larger equipment facilities — into scope for the first time.
For those lenders, the compliance clock started ticking in July 2024. Many of them had never built a California-compliant disclosure workflow because they'd concluded their average deal size put them outside the original law. Suddenly they weren't outside anything.
DFPI's enforcement actions have followed two tracks:
The repeat-offender track targets MCA providers that were in scope under the original SB 1235 law, have been subject to DFPI examination or guidance, and are still not in compliance. For this group, the agency has moved toward formal enforcement orders with civil penalties rather than further warnings.
The newly-in-scope track targets the lenders caught by the AB 424 expansion. DFPI's posture here has been more education-forward — examination letters, guidance, a compliance grace period for lenders that can document good-faith efforts. But that grace period is finite. Lenders who had 12 months post–July 2024 to come into compliance and haven't are increasingly the subjects of formal examination proceedings.
Civil penalties under California law are $500 per violation for standard violations and $2,500 per willful violation. In commercial financing, each transaction is a separate violation. A provider making 500 transactions per month in California and failing to deliver compliant disclosures on any of them is looking at exposure that compounds quickly. DFPI has explicitly framed per-transaction penalties as the applicable unit of count in several enforcement proceedings.
What "Compliant" Actually Looks Like
The disclosure documents required by both states are standardized enough that what compliance looks like isn't ambiguous. Both states have published model forms. A compliant workflow, stripped to its essentials, looks like this:
- Before the borrower signs anything, deliver a completed disclosure form on the prescribed template.
- The form must show: amount disbursed, total repayment amount, ACP or APR equivalent (calculated per state methodology), payment frequency and amount, prepayment terms, and any broker compensation.
- The borrower must acknowledge receipt of the disclosure before executing the agreement.
- The provider retains documentation of delivery and acknowledgment.
The methodology for calculating ACP/APR on MCA and other variable-payment products is the most technically demanding part. It requires an assumption about average repayment period, and both states have published guidance on what assumptions are defensible. Using assumptions that consistently produce artificially low rates is not a methodology question — it's an accuracy problem that triggers the willful-violation standard.
For lenders that offer both fixed-payment and variable-payment products, the disclosure template differs by product type, and the calculation must be product-specific. Applying a fixed-loan APR calculation to an MCA product — a common shortcut — will produce a non-compliant disclosure even if the math is internally consistent.
What This Means for Borrowers
If you're financing your business in New York or California, you now have a legal right to a disclosure document that includes an annualized rate before you sign anything. That right is backed by active enforcement, not just statute.
In practice, this means:
You can ask, and if they won't provide it, that tells you something. Any commercial financing provider operating in New York or California must give you a disclosure form before you sign. If a lender won't produce one, or produces one after the fact, they're non-compliant. That's worth knowing before you commit.
The annualized rate is required, not optional. Some lenders will volunteer a monthly cost percentage or quote you a factor rate and leave it at that. In New York and California, that's not enough — an annualized rate equivalent must appear on the disclosure form. If it isn't there, the form is deficient.
You can file a complaint if you don't receive a disclosure. California DFPI: dfpi.ca.gov/file-a-complaint. New York DFS: dfs.ny.gov/complaint. Both agencies track complaint patterns, and pattern complaints against a specific provider accelerate examination priority.
The disclosure is the baseline. A disclosure form tells you the cost. It doesn't tell you whether the product is right for your business, whether the lender is reputable, or whether better terms exist elsewhere. Disclosure is a floor, not a ceiling.
What This Means for Lenders on the FundScout Platform
FundScout requires all lenders on the platform to provide clear, standardized cost disclosure to matched borrowers — including the annualized cost of financing — as a condition of participation. This is not a response to the DFS and DFPI enforcement wave; it's been our baseline requirement since launch.
But the enforcement context is worth naming plainly. Lenders that have been operating without compliant California or New York disclosure workflows are increasingly being identified and penalized. The per-transaction penalty structure means that the exposure scales with volume. The DFS and DFPI are not going to wind down enforcement — they're going to accelerate it as the industry's compliance grace period runs out.
For lenders on our platform who serve California or New York borrowers: if your disclosure workflow is not current, the time to fix it is not after a DFS examination letter arrives. The laws, the model forms, and the calculation guidance are all published and available.
For borrowers: a lender who can't or won't provide a compliant disclosure on request is telling you something about how they operate. That's a meaningful signal before you sign.
The Broader Pattern
New York and California are the two enforcement leaders, but they're not operating in isolation. Virginia, Utah, Connecticut, Florida, and Missouri have all passed commercial financing disclosure laws with their own enforcement mechanisms. The patchwork of state laws that has characterized this regulatory space is converging toward a de facto national standard — any lender that wants to operate in the major commercial lending markets has to have a disclosure-compliant workflow.
The logical endpoint of this trajectory is either federal preemption, where Congress or the CFPB adopts a uniform national commercial disclosure rule that supersedes the state patchwork, or continued state-by-state expansion until every significant commercial lending market has its own law. The federal path would benefit lenders by eliminating multi-state methodology inconsistencies. The state-by-state path benefits enforcement, because state agencies with local jurisdiction can examine and penalize faster than a federal agency can.
Either way, the direction of travel is the same: commercial lenders will disclose the annualized cost of their products to borrowers, or they will be found and penalized. The DFS–DFPI enforcement shift represents the moment when that became a present tense.
Sources
- New York Small Business Financing Act (signed November 2020, effective August 1, 2023) — N.Y. Financial Services Law § 801 et seq.
- 23 NYCRR Part 600 — NY DFS implementing regulation for the Small Business Financing Act, including ACP calculation methodology; DFS official text
- California SB 1235 (signed October 2018) — original commercial financing disclosure law; Cal. Financial Code § 22800 et seq.
- California AB 424 (signed September 2023, effective July 1, 2024) — removed dollar cap from SB 1235 scope; AB 424 bill text
- California DFPI implementing regulations — 10 CCR §§ 900–953
- NY DFS complaint portal — dfs.ny.gov/complaint
- California DFPI complaint portal — dfpi.ca.gov/file-a-complaint
- Virginia SB 1345 (effective July 1, 2022) — Va. Code § 6.2-2228 et seq.
- Connecticut SB 1032 (effective July 1, 2024) — commercial financing disclosure
- Florida HB 1543 (effective July 1, 2024) — commercial financing disclosure, includes broker compensation and loan/purchase-agreement characterization requirement