What Multi-State Disclosure Laws Really Mean for MCA and Alternative Lenders
Multi-state disclosure laws introduce significant workflow challenges for MCA and alternative lenders. See how automation reduces risk and keeps...
Updated November 2026
A merchant cash advance now runs into real regulation: state disclosures, registration, a license in at least one state, broker rules, and penalties that cost real money. For a product that operated with almost none of this for years, that is a fast shift, and it is still moving.
What you owe on a given deal depends on where the merchant is, how the advance is structured, when you make the offer, how big it is, and whether you or your broker have to be registered before you do business at all. This guide walks through where MCA regulation stands in late 2026, in the order it matters to a funder: the federal picture, the state map, what the laws make you do and when, the details that decide whether you are even covered, and what it costs to get wrong.
This is a general overview for funders, not legal advice. These laws and their rules change, and whether any of them applies turns on how your product is structured and where your merchant is. Confirm current requirements with qualified counsel before you fund, extend an offer, or rely on anything here.
The quick answer
How many states regulate MCAs? Eleven have disclosure laws in effect (California, Connecticut, Florida, Georgia, Kansas, Louisiana, Missouri, New York, Texas, Utah, Virginia). Vermont makes twelve when its law takes effect on July 1, 2027.
Which states make you register or get licensed? Virginia, Connecticut, and Texas (providers and brokers), Utah (providers), and Missouri (brokers, with a bond). Vermont adds licensing in 2027.
What is the nearest hard deadline? Texas provider and broker registration is due December 31, 2026.
Does the CFPB regulate MCAs? No. The 2026 Section 1071 rule excludes merchant cash advances, so state law is the real compliance surface.
Do MCAs have a usury cap? Historically no, because they are not loans, but Texas HB 700 reopened that question for sales-based financing.
Where it starts
The starting point is what makes an MCA different: it is not a loan. You are buying a share of the merchant's future sales, not lending money. That structure is why MCAs have sat outside much of the lending rulebook, including many usury caps and the Truth in Lending Act disclosures a consumer loan carries.
Not a loan has never meant no rules, though, and the space between the two is where states have moved in. They now require a standardized disclosure before you fund, in several states a registration or license first, and they back both with penalties. For a funder, the question is no longer whether MCA funding is regulated. It is which state's rules apply to a given deal, and when.
It is tempting to assume usury caps simply never touch an MCA. That is too confident today. A court can recharacterize a deal as a disguised loan, and legislatures are testing the line directly. Texas HB 700 is the clearest case: it removed sales-based financing from the state's "account purchase transaction" exemption, so those deals lose the presumption that they are not loans, and it is unresolved whether the Texas usury limit now applies. Treat usury as a fact-specific question for counsel, not a settled exemption. With that caveat in mind, there is one federal question worth closing out before the state rules.
The federal layer
The federal item that hung over funders was Section 1071, the CFPB rule requiring lenders to collect and report data on small-business applicants. The fear was that it would reach MCA funders and bury them in reporting.
The 2026 rule answers that. The CFPB finalized a narrower version, and merchant cash advances are excluded from it. It also only reaches lenders doing more than 1,000 covered deals a year, which leaves most funders out, and for anyone still covered the compliance date is January 1, 2028.
Being outside Section 1071 is not the same as being outside federal risk. The FTC Act's ban on unfair or deceptive practices, advertising rules, and debt-collection standards still reach how you market, disclose, and collect, and so do state unfair-practices laws. The reporting question is settled; conduct is not. For the day-to-day work, though, the weight sits with the states, so that is where the rest of this guide lives.
The state map
Merchant cash advance regulation by state comes down to this: eleven states have disclosure laws in effect that can reach MCA-style deals, namely California, Connecticut, Florida, Georgia, Kansas, Louisiana, Missouri, New York, Texas, Utah, and Virginia. They do not all treat an MCA the same way, and that difference decides how much attention each one needs.
Four states wrote their laws specifically for sales-based or revenue-based financing, the legal name for how an MCA works: Virginia, Connecticut, Louisiana, and Texas. Fund a merchant in one of those and there is no debate, you are covered. California and New York do not use that label, but their commercial financing laws are broad enough that MCAs get caught anyway. The rest wrote general commercial financing laws, so whether a pure MCA is covered turns on how your deals are structured, which is a question for counsel.
Two more are on the horizon. Vermont has enacted its law, effective July 1, 2027, and it goes further than disclosure by requiring a license. New Jersey has a disclosure bill in committee that has not become law. The table shows the eleven in effect plus Vermont, in the order each takes effect. Thresholds are the upper limit for coverage, so deals above the amount are generally exempt.
| State | What it covers | Effective | Registration / license | Covers up to | Regulator |
|---|---|---|---|---|---|
| Virginia | Sales-based financing (MCA) | July 2022 | Providers + brokers | $500K | State Corporation Commission |
| California | Commercial financing | Dec 2022 | No | $500K | DFPI |
| Utah | Commercial financing | Jan 2023 | Providers | $1M | Dept. of Financial Institutions |
| Connecticut | Sales-based financing (MCA) | July 2023 | Providers + brokers | $250K | Dept. of Banking |
| Florida | Commercial financing | July 2023 | No | $500K | Attorney General |
| New York | Commercial financing | Aug 2023 | No | $2.5M | Dept. of Financial Services |
| Georgia | Commercial financing | Jan 2024 | No | $500K | Attorney General |
| Kansas | Commercial financing | July 2024 | No | $500K | Attorney General |
| Missouri | Commercial financing | Feb 2025 | Brokers (bond) | $500K | Division of Finance |
| Louisiana | Revenue-based financing (MCA) | Aug 2025 | No | No cap | Not designated |
| Texas | Sales-based financing (MCA) | Sept 2025 | Providers + brokers | $1M | OCCC |
| Vermont | Sales-based financing + factoring | July 2027 | License required | Verify | Dept. of Financial Regulation |
Effective dates, thresholds, and regulators reflect the best available public information as of November 2026, drawn from the American Bar Association survey and the law-firm analyses in the sources below. In the standard commercial financing states (Florida, Georgia, Kansas, Missouri), the state attorney general generally holds enforcement authority. Louisiana has no dollar cap, no entity exemptions, and names no enforcing agency in the statute. Florida took effect July 1, 2023, with compliance required for financings made on or after January 1, 2024. Vermont's threshold and mechanics should be confirmed against the Act.
Knowing which states reach your deals is the first step. The harder part is what each law actually makes you do, and for a covered deal those obligations arrive in a specific order.
The obligations
For a covered deal, three obligations stack up in sequence: be registered before you do business, give the disclosure at the right moment, and put the right information in it.
Nearest deadline: Texas provider and broker registration with the OCCC is due December 31, 2026.
Several states gate the business itself, not just the paperwork. Virginia, Connecticut, and Utah require registration (providers and brokers in Virginia and Connecticut, providers in Utah), and Missouri requires broker registration plus a surety bond. Texas sets a hard deadline, December 31, 2026, to register with the Office of Consumer Credit Commissioner. Vermont raises the bar from July 1, 2027: a provider needs a lender license, a broker needs a loan-solicitation license, and the funder behind a broker's deal must be licensed or exempt. The reason this matters more than it sounds: a missed disclosure is a paperwork fine, but funding or soliciting without a required registration or license is an unauthorized-business problem, which is a different order of risk. Registration is also ongoing, so plan for renewals, reporting changes in ownership or control, amendments, and recordkeeping.
The timing is where funders get caught. Several laws require the disclosure when you extend a specific offer, which is earlier than funding. Texas requires it before the merchant signs, Vermont requires a signed disclosure at the time of the specific offer, and New York ties disclosure to the offer as well. Build the disclosure into your offer step. Disclosing only at funding can still miss the obligation even though the merchant eventually gets the form.
The exact fields vary by state, but the core is consistent across them:
APR is the field that causes the most trouble. An MCA runs on a factor rate and a holdback, not a stated interest rate, so turning that into an APR or estimated APR takes a defensible calculation with documented assumptions. There is no single national formula either: some states prescribe their own method, others lean on a Regulation Z-derived approach, so use the method the state requires and keep your assumptions on file. Handling registration, timing, and fields still leaves one thing open, because whether a law applies at all comes down to a few structural details.
What decides coverage
True factoring, the purchase of specific accounts receivable, is a different product from an MCA, and some laws treat the two differently. Vermont expressly pulls factoring into its licensing and disclosure regime from 2027. If you run both, classify each deal correctly, because the rules can diverge.
The dollar caps are not the only carve-outs. Most of these laws exempt banks and licensed lenders, and some exempt transactions secured by real property or above the threshold. Whether your program is covered often comes down to an exemption rather than the headline rule, so check each state's exemptions, not just its number.
You cannot pick your way out with a favorable governing-law clause. Coverage usually turns on where the merchant is located, where you solicited them, and where the offer was made, not the state your contract names. If you fund a merchant in a disclosure state, assume that state's rules apply.
Brokers are not a side issue. In Virginia, Connecticut, Texas, and (from 2027) Vermont they carry their own registration or licensing, and in Missouri a surety bond, and several laws require broker compensation to be disclosed. A broker's claims about pricing or approval odds can create exposure, and your funding agreement can allocate responsibility but will not erase your own. Confirm your brokers are registered or licensed where required and using compliant disclosures. Each of these details is also where enforcement starts, and enforcement now carries real numbers.
The stakes
Texas is the clearest number: a civil penalty of up to $10,000 per violation, with no private right of action, and the state can enforce both disclosure failures and funding or brokering without registration. New York authorizes civil penalties plus restitution and injunctive relief under its Financial Services Law. Georgia and Florida hand enforcement to the state attorney general and run $500 to $20,000 per violation, rising to $1,000 to $50,000 for repeat violations.
Across the standard commercial financing states (Florida, Georgia, Kansas, Missouri), the attorney general generally holds that enforcement power. For every state you operate in, pin down the enforcing agency, the penalty amounts, whether willful or repeat violations are treated more harshly, and whether restitution or injunctions are on the table. Numbers like these are why compliance has moved from an annual policy review to something you handle on every deal.
Putting it to work
Pulled together, compliance is now a deal-level control. For every advance you fund, the checklist looks like this:
A folder of PDF templates does not hold up to that, deal after deal, across a dozen states.
Running this inside your MCA software takes the manual steps off the table, though it supports your compliance program rather than replacing legal review. Subject to your own counsel's determination of which laws apply, Onyx IQ can:
Onyx IQ supports disclosure generation, APR calculation, acknowledgment capture, and audit-ready retention. It does not decide which law applies to a given deal or replace your counsel's review.
See it on your deals
Bring a real deal and see how Onyx IQ generates a state disclosure and the APR from the deal data, captured and logged for audit.
FAQ
Yes, mostly at the state level. As of late 2026, at least eleven states have disclosure laws that can reach MCA-style deals: California, Connecticut, Florida, Georgia, Kansas, Louisiana, Missouri, New York, Texas, Utah, and Virginia. Vermont adds a licensing-and-disclosure regime on July 1, 2027. At the federal level, the CFPB's revised Section 1071 rule excludes MCAs, but conduct rules like the FTC Act still apply.
Usually it is structured as a purchase of future receivables or sales, not a loan, which has historically kept it outside usury caps and the Truth in Lending Act. That is not absolute. A court can recharacterize a deal as a disguised loan, and Texas HB 700 removed sales-based financing from the state's account-purchase exemption, leaving it unresolved whether the Texas usury limit applies.
California, Connecticut, Florida, Georgia, Kansas, Louisiana, Missouri, New York, Texas, Utah, and Virginia have disclosure laws in effect. Virginia, Connecticut, Louisiana, and Texas target the sales-based or revenue-based model directly. Vermont's law is enacted but takes effect July 1, 2027.
In some states, yes. Virginia, Connecticut, and Texas require provider and broker registration, and Utah requires provider registration. Missouri requires broker registration and a surety bond. Texas sets a registration deadline of December 31, 2026. Vermont requires licensing for providers and brokers from July 1, 2027.
The CFPB's revised Section 1071 rule, finalized in 2026, excludes merchant cash advances from covered transactions, with a January 1, 2028 compliance date for institutions still covered. Exclusion from 1071 does not remove federal conduct risk, including the FTC Act's ban on unfair or deceptive practices, advertising rules, and debt-collection standards.
They vary and they are real. Texas authorizes a civil penalty of up to $10,000 per violation. Georgia and Florida run $500 to $20,000 per violation, and up to $50,000 for repeat violations, enforced by the state attorney general. New York authorizes civil penalties plus restitution and injunctive relief under its Financial Services Law. Confirm current amounts with counsel for each state you operate in.
Watch the trigger. Several states require the disclosure when you extend a specific offer, not just before funding. Texas requires it before the merchant signs, and Vermont requires a signed disclosure at the time of the specific offer. Build your process around the offer stage so you do not miss the obligation.
Most state laws require a common set of fields: the total financing amount and amount disbursed, the finance charge and total repayment amount, an APR or estimated APR, the estimated term and the amount and frequency of payments, other fees, prepayment charges, collateral or security interests, and broker compensation where required. The exact fields and format vary by state.
Generally no. Coverage usually turns on where the merchant is located, where you solicited them, and where the offer was made, not the state your contract names. If you fund a merchant in a disclosure state, assume that state's rules apply.
Treat compliance as a deal-level control: identify the merchant's state, classify the product, check the threshold and exemptions, catch the disclosure at the offer stage, generate the right state form, calculate APR consistently, capture a timestamped acknowledgment, and keep registration current. For the broader operational playbook, see how lenders stay compliant while scaling. MCA software built for funders supports this inside the funding workflow; on Onyx IQ the disclosure and APR generate from the deal itself, subject to your own legal review.
Sources
State laws change every session, so treat this as a snapshot. For the current detail on each state, see our state-by-state commercial financing disclosure guide, and confirm anything you plan to act on with counsel.
Multi-state disclosure laws introduce significant workflow challenges for MCA and alternative lenders. See how automation reduces risk and keeps...
Funding across states means different disclosures, APR methods, and audit rules. See what to require from your loan management system, and how Onyx...
Read this article and discover the high stakes of non-compliance with MCA state disclosure laws (plus best practices for safeguarding your business).
