State Lending Licenses and Bank-Partner Models for Online Credit Products

There is no federal lending license for consumer credit. Licensing is state law, applied to the state where the borrower is located, and it attaches to conduct — making a loan, brokering one, buying the receivable, or servicing it — rather than to what a company calls itself.

Bank-partner programs exist because a bank's rate authority can reach borrowers that a licensed lender's own rate cap cannot. That authority is real and federally grounded. What remains contested, as of mid-2026, is how far it travels when the economics of the loan sit somewhere other than with the bank.

The licensing question comes first

Before any preemption analysis, run the plain licensing analysis in each state where the product will be offered. States license different slices of the same activity, and a company can need two or three licenses for one product line — or none, if a genuine exemption applies.

1. Classify the credit

   Consumer or commercial; closed-end installment, open-end line, retail installment sale, or earned-wage access. The classification decides which licensing statute is even in play, and several states now license commercial financing and require commercial disclosures.

2. Map the conduct

   Identify every act performed for a resident of the state: soliciting, taking applications, underwriting, approving, funding, purchasing the receivable, collecting, and modifying. Each can be separately licensed.

3. Test the thresholds

   Many statutes turn on loan size, rate, term, or number of loans per year. A product priced below a state's rate trigger may be exempt in that state and licensable in the next one.

4. Check the exemptions honestly

   Bank, credit union, and bank-agent exemptions are narrow and fact-specific. An exemption read expansively is the most common origin of a multistate enforcement problem.

5. Plan the filings

   Most consumer lender, broker, and servicer licenses are filed through the Nationwide Multistate Licensing System, with control-person disclosures, surety bonds, net-worth requirements, and background review before approval.

Licensing applications also pull in adjacent obligations that founders routinely underestimate. Applications require identification of control persons and owners above defined percentages, which overlaps with the entity-transparency work described in beneficial ownership reporting and generally requires each beneficial owner to submit to background review. Examiners also expect a written information security program and a complaint log, which is the same infrastructure discussed in GLBA privacy notices and the Safeguards Rule. Licensing timelines are measured in months, and they run through the Conference of State Bank Supervisors system rather than a single federal window.

How rate authority actually works

A national bank may charge interest at the rate allowed by the law of the state where the bank is located, and may export that rate to borrowers in other states. That authority comes from 12 U.S.C. § 85, as interpreted by the Supreme Court in the late 1970s. A parallel provision of federal deposit-insurance law gives state-chartered insured banks comparable parity. This is the engine of every bank-partner credit program.

Two limits matter. First, the authority belongs to the bank. It is not a license the bank can hand to a marketing partner. Second, a small number of states have invoked a longstanding federal opt-out provision to disapply the parity rate authority for loans made in their state, and that opt-out has itself been litigated. Confirm the current status before assuming nationwide reach.

The related question — whether a loan that was lawful when made stays lawful after it is sold — was addressed by federal rules issued in 2020. The OCC and the FDIC each adopted "valid-when-made" rules providing that interest permissible when a loan is originated by the bank remains permissible after the loan is transferred. State attorneys general challenged both rules, and a federal district court upheld them in 2022. Those rules are therefore in force as of mid-2026.

Read the rules narrowly: a valid-when-made rule answers what happens to a loan validly made by a bank. It does not answer who made the loan. That second question is where nearly all current enforcement lives.

The true-lender question

The true lender doctrine asks which party has the predominant economic interest in a loan. If a court or regulator concludes the platform is the real lender and the bank is a conduit, the bank's rate authority does not travel with the loan, the platform needed a license it does not hold, and the loan may be void or subject to restitution under the state's usury law.

The OCC adopted a bright-line true-lender rule in late 2020 keyed to which entity was named as lender or funded the loan. Congress repealed that rule in 2021 under the Congressional Review Act, which also bars a substantially similar rule. There is accordingly no federal true-lender standard as of mid-2026; the analysis is state law and common law, applied by state regulators, state attorneys general, and private plaintiffs, and state enforcement on this theory has continued through the 2020s.

No single row decides the analysis, and courts differ on the weight given to each. The pattern that draws challenge is consistent: platform underwrites, platform funds economically, bank takes a fee, whole receivable sold immediately, platform holds all the loss. The pattern that survives is one where the bank's exposure is real, documented, and observable in its own books.

Consequences and collateral exposure

• Unlicensed lending. Consequences range from cease-and-desist orders and civil penalties to voiding of loans and refund of all interest and fees collected in the state.
• Usury recharacterization. If the platform is the lender, the applicable cap is the state's, and the overage is usually recoverable — sometimes with statutory multiples.
• Unfair or deceptive practices claims. A structure marketed as a bank loan while the platform functions as lender supports a separate deception theory independent of licensing.
• Bank-side supervisory consequence. Federal banking agencies supervise these arrangements as third-party relationships, and a partner bank under supervisory pressure can exit a program on short notice.
• Contract enforceability. Choice-of-law and arbitration clauses in the loan agreement are frequently challenged alongside the structure; a clause that depends on the bank being the lender fails when that premise fails.
• Payment-operations spillover. Repayment usually runs by ACH, so a licensing dispute quickly becomes an authorization and return-rate dispute as well.

That last point is more than incidental. Loan disbursement and repayment mechanics are governed by their own rules, and a program that loses its bank partner mid-stream has an immediate operational problem with existing ACH authorizations. The mechanics are set out in ACH authorization, returns, and account-freezing risk, and consumer error-resolution duties on the deposit side are covered in Regulation E error resolution. Where disputes are headed to a forum, the trade-offs are laid out in arbitration or court.

Questions the desk gets

If our bank partner is the named lender, are we done?

No. Naming is one factor and, since the repeal of the federal true-lender rule, not a controlling one. Regulators look at credit policy, approval authority, funding, retained risk, and program economics. A structure where the bank is named on the note but bears no meaningful loss and earns a flat fee is the exact pattern state enforcement targets. Document the bank's actual decision-making and actual exposure, not just its signature.

Does the valid-when-made rule solve the problem?

It solves a narrower problem. The 2020 OCC and FDIC rules confirm that interest permissible on a loan when a bank makes it stays permissible after transfer, and courts upheld them in 2022. They do not decide who made the loan. If a state concludes the platform was the lender all along, there was never a bank-originated loan for the rule to protect.

We only service and collect. Do we still need a license?

Often yes. A growing number of states license consumer-loan servicing and debt collection separately from lending, with their own bonding, examination, and conduct requirements. Purchasing receivables can also trigger a license even where origination does not. Run the conduct map state by state rather than assuming that avoiding origination avoids licensure.

How should we handle a state where the answer is genuinely unsettled?

Decide it as a business risk with a documented rationale, not as a legal certainty. Record the structure analysis, the rate applied, the volume exposed, and the remediation plan if the position fails. Regulators treat a documented, conservative, monitored position very differently from a structure adopted without analysis, and the file becomes the difference between a supervisory conversation and a penalty.

Sequencing the work

Start with a state-by-state conduct map, because it is the only step that produces a definite answer. It tells you where the product is licensable regardless of any bank relationship, and it usually reveals that a subset of states drives most of the exposure. Price the licensed path in those states before assuming a partner structure is necessary.

Next, if a bank-partner model is used, build the structure so the bank's role is substantive and provable: written credit policy owned by the bank, real approval authority, origination funding from the bank, and retained economic interest that appears in the bank's own reporting. Keep the program agreement consistent with what actually happens operationally, because the agreement will be the first document a regulator reads.

Then monitor. Verify the current status of state opt-outs from federal rate parity, watch state enforcement and legislation on true-lender questions, and re-run the analysis whenever the program economics change — a shift in the risk-retention percentage or the fee structure can move the answer without anyone editing the contract. Confirm the federal rules directly with the OCC and FDIC, and confirm licensing requirements with each state regulator rather than relying on secondary summaries.