On October 27, 2025, amendments to Delaware’s Medical Debt Protection Act took effect, establishing a total ban on the inclusion of medical debt in consumer credit reports. The amendments, enacted through Senate Substitute 1 for Senate Bill 156, revise Delaware’s consumer protection laws to prohibit both the furnishing and use of medical-debt information by consumer reporting agencies.Continue Reading Delaware Bans Medical Debt from Consumer Credit Reports
On October 15, the Oklahoma State Banking Department issued a memo detailing new licensing and compliance obligations for digital kiosk operators. The memo details the requirements under Senate Bill 1083, enacted in May under the Oklahoma Financial Reporting Act, which became effecting on November 1, 2025.Continue Reading Oklahoma Issues Memo Detailing New Digital Asset Kiosk Licensing Requirements
On October 24, 2025, the Massachusetts Division of Banks (DOB) finalized a suite of regulatory amendments implementing the Massachusetts Money Transmission Act. The final regulations, 209 Mass. Code Regs. §§ 44.00, 45.00, 48.00, and 801 Mass. Code Regs. § 4.02, take effect November 7. The changes establish a uniform licensing and compliance regime for all entities engaged in money transmission, replacing prior requirements that applied only to check cashers, check sellers, and foreign transmittal agencies.Continue Reading Massachusetts Finalizes Comprehensive Money Transmission Regulations
On October 30, the California DFPI announced a consent order against a Nevada-based crypto kiosk operator for alleged violations of the Digital Financial Assets Law and the California Consumer Financial Protection Law. The action follows a DFPI investigation into widespread noncompliance among crypto ATM operators, which the agency has identified as a growing consumer-protection concern.Continue Reading DFPI Fines Kiosk Operator $675,000 for Alleged Violations of the Digital Financial Assets Law
On October 28, the CFPB issued an interpretive rule under the Fair Credit Reporting Act (FCRA) declaring that federal law generally preempts state laws governing the content of consumer credit reports. The Bureau’s action, led by Acting Director Russell Vought, replaces and withdraws a July 2022 interpretive rule issued under the prior administration, which had concluded that the FCRA’s preemption provisions were limited in scope.Continue Reading CFPB Issues Interpretive Rule Asserting Federal Preemption Over State Medical Debt Credit Reporting Laws
On October 21, the NYDFS issued new cybersecurity guidance addressing the growing risks associated with regulated entities’ reliance on third-party service providers (TPSPs). The guidance clarifies compliance obligations under the New York Cybersecurity Regulation and outlines best practices for managing cybersecurity risk across the third-party relationship lifecycle.Continue Reading NYDFS Issues Cybersecurity Guidance on Third-Party Service Provider Risk
On October 1, 2025, Nevada’s Senate Bill 437 took effect, modernizing Nevada’s Installment Loan and Finance Act to reflect the growth of online consumer lending and “buy now, pay later” (BNPL) products. The new law authorizes “Internet consumer lenders,” defined as companies that make, solicit, or facilitate consumer loans exclusively through the internet, to apply for and maintain a Nevada lending license without operating a physical office within the state.Continue Reading Nevada Removes In-State Office Requirements for Online and Buy Now, Pay Later Lenders
On September 26, 2025, financial regulators in Hawaii, Idaho, Oregon, and Texas entered into a multistate Settlement Agreement and Consent Order with a mortgage company to resolve allegations of unlicensed activity, inadequate supervision, and examination noncompliance under each state’s mortgage licensing laws. The agreement followed a coordinated multistate examination conducted in October 2023.Continue Reading Four States Settle with Mortgage Company for Alleged Unlicensed Activity
On September 24, the Connecticut Department of Banking entered a consent order with a lender that offered advances based on anticipated personal-injury recoveries. The Department alleged that the company’s products constituted “small loans” under the Connecticut Small Loan and Related Activities Act and that the company had extended and collected such loans without first obtaining a state license.Continue Reading Connecticut Department of Banking Issues Consent Order for Alleged Unlicensed Small-Loan Activity
On October 14, the Maryland Office of Financial Regulation (OFR) issued regulatory guidance explaining three new state laws governing the collection and reporting of medical debt. The guidance clarifies how House Bills 428, 1020, and 268, all effective October 1, 2025, alter the obligations of hospitals, debt collectors, and consumer reporting agencies.Continue Reading Maryland OFR Issues Guidance on New Medical Debt Collection Laws
On September 26, Arizona Attorney General Kris Mayes announced that the new Cryptocurrency Kiosk License Fraud Prevention Law took effect, establishing new safeguards for consumers using cryptocurrency ATMs. The law, enacted through House Bill 2387, amends the state’s money transmission statutes to require enhanced disclosures, transaction limits, and refund rights for fraud victims.Continue Reading Arizona Cryptocurrency Kiosk Law Takes Effect