Does federal law regulate merchant cash advances, and does the CFPB have authority over MCA providers?

The CFPB's jurisdiction over commercial financing has historically been limited. However, the CFPB's Section 1071 Small Business Lending Rule — finalized under Dodd-Frank — does require data collection and reporting for certain small business credit applications, including some commercial financing products. MCA providers whose transactions meet the Section 1071 covered credit threshold should review whether their product falls within the rule's scope. Additionally, the FTC Act's prohibition on unfair or deceptive practices applies to commercial lenders, including MCA providers, regardless of state law status.

If an MCA provider is headquartered outside California, does California's SB 1235 still apply?

Yes. California's disclosure obligation attaches based on where the borrower's business is directed or managed, not where the lender is located. An MCA provider headquartered in Texas that funds a business operating from California is subject to SB 1235 for that transaction. The geographic test is borrower-side, not lender-side.

Are MCA brokers subject to the same state disclosure and registration requirements as MCA funders?

It depends on the state. Virginia's legislation specifically extends requirements to sales-based financing brokers in addition to funders, creating distinct obligations for intermediaries who facilitate MCA transactions. California and New York's disclosure laws focus primarily on the provider — but depending on how a broker structures its engagement, it may bear responsibility for disclosure delivery. MCA brokers operating in Virginia should treat registration and disclosure compliance as applicable to their activity, not solely to the funder they represent.

How do these state disclosure laws interact with the Uniform Commercial Code (UCC)?

The UCC, which governs commercial transactions including MCA contracts in all U.S. states, addresses contract enforceability — not disclosure adequacy. State MCA disclosure laws layer on top of UCC compliance, not in place of it. A transaction that is UCC-compliant can still violate state disclosure requirements if the required pre-transaction disclosures were not provided in the correct format. Both frameworks apply simultaneously.

What is the enforcement exposure for non-compliant MCA disclosures?

Enforcement mechanisms vary by state. California's SB 1235 empowers the DFPI (Department of Financial Protection and Innovation) to investigate violations and impose civil penalties. New York's Department of Financial Services has similar authority. Utah and Virginia violations can trigger regulatory action by their respective financial institution regulators. Beyond direct regulatory penalties, non-compliant disclosures create litigation exposure — borrowers who did not receive required disclosures have grounds for claims that can include contract rescission in addition to damages.

MCA Lending Regulation: What Lenders Must Know

The Regulatory Quiet Is Over for MCA Lenders

Merchant cash advance has operated in a regulatory grey zone for most of its history. Because MCAs are structured as commercial transactions rather than loans, they fell outside the federal lending framework that governs traditional bank credit — no TILA requirements, no federal usury caps, no standardized disclosure mandates. For years, that classification gave MCA providers significant operational flexibility.

That flexibility is now being constrained, state by state. California, New York, Utah, and Virginia have all enacted commercial financing disclosure or registration laws that directly apply to MCA providers. Several other states — including Missouri, New Jersey, and North Carolina — have legislation in active development. The direction of travel is clear: regulators at the state level are no longer willing to leave commercial financing outside consumer-facing transparency standards.

For loan management software salesforce users who work with MCA or broader commercial lending portfolios, the compliance implications are immediate. Disclosure obligations, APR calculation requirements, and in some states mandatory registration create workflow requirements that manual processes — or software not built for multi-state compliance — cannot reliably meet. Lenders using Salesforce-native compliance tools can build the disclosure and decisioning infrastructure these laws require into their existing workflow.

This post maps the key state-level MCA regulations now in effect, explains what each requires operationally, and outlines what commercial lenders need to have in place.

MCA lending regulation illustration showing state disclosure and registration requirements for commercial lenders

Why MCA Regulation Is Accelerating Now

Merchant cash advance is not a new product. But it has grown substantially. Industry projections cited prior to 2026 placed the MCA segment on a trajectory of approximately 15.5% CAGR through 2028, driven by SMB demand for fast capital access that traditional bank credit cannot deliver at the required speed.

That growth has attracted regulatory attention for the same reason growth always does: when a financial product reaches meaningful scale and serves a population that may lack sophisticated legal counsel, regulators step in. State attorneys general and financial services regulators began examining MCA practices in earnest around 2020, with particular focus on disclosure adequacy, fee transparency, and the conduct of sales-based financing brokers.

The regulatory argument is straightforward. MCAs are used predominantly by small and mid-sized businesses that need capital quickly. Cash arrives fast, but MCA payment terms — structured as a fixed percentage of daily or weekly revenue — can carry effective rates substantially higher than traditional lending products. Without standardized disclosure, borrowers cannot make informed comparisons. Without registration requirements, states have no oversight mechanism when disputes arise.

Understanding compliance obligations that now extend to commercial lenders is essential context for MCA providers who may have historically treated their product as regulation-exempt. The product's commercial classification limits federal reach — it does not eliminate state authority.

Diagram illustrating MCA market growth and corresponding expansion of state commercial lending disclosure laws

So what does this mean for your institution? MCA lenders who structured their operations around federal non-applicability are now managing state-level compliance obligations that vary by jurisdiction, change as new legislation passes, and carry real enforcement consequences for non-compliance. The question is no longer whether regulation applies — it is how well your operations are built to meet it.

State-by-State MCA Regulation: What Each Law Requires

Four states have enacted commercial financing disclosure or registration laws with direct applicability to MCA providers. Each has distinct requirements. Lenders operating across multiple states must meet each state's standard independently.

State	Law	Effective	Applies To	Key Requirements
California	SB 1235	Dec 2022	Commercial financing ≤ $500,000 directed or managed from CA	APR disclosure, finance charge, total repayment amount, payment schedule; e-signature rules
New York	S 5470-B	Jan 2022	Non-bank commercial financing ≤ $500,000 to small businesses	Disclosure of APR, total financing amount, disbursement amount, finance charge, fees, prepayment terms, collateral
Utah	Commercial Financing Registration and Disclosure Act	Jan 2023	Any person completing 5+ commercial financing transactions in UT per year	State registration with Utah Dept. of Financial Institutions; pre-transaction disclosures
Virginia	HB 1027 / SB 1313	July 2022	MCA providers and sales-based financing brokers explicitly	Registration; disclosures specific to MCA structure; additional broker conduct requirements

California: SB 1235

California's commercial financing disclosure regulation, enacted through Senate Bill 1235 and finalized in late 2022, was among the first state laws to directly target MCA and other non-traditional commercial financing products. The regulation applies to any provider offering commercial financing of $500,000 or less to businesses directed or managed from California — a deliberately broad geographic test that captures out-of-state lenders serving California-based borrowers.

Required disclosures under SB 1235 include the total amount of financing, the disbursement amount, all finance charges, the APR (or an estimate where the total repayment depends on future revenue), total repayment amount, payment schedule, and any fees, prepayment penalties, or collateral requirements. The regulation also prescribes specific formatting and e-signature standards — the disclosure document cannot simply be buried in contract language.

The APR calculation requirement is operationally significant for MCA providers. Because MCA repayment is tied to revenue percentage rather than fixed installments, APR estimation requires a methodology that the regulation specifies. Lenders without automated calculation tools embedded in their origination workflow face a meaningful operational challenge in producing compliant disclosures at volume.

New York: S 5470-B

New York's disclosure law, which took effect in January 2022, closely parallels California's framework — both in scope and intent. The law applies to non-bank providers of commercial financing up to $500,000 and requires disclosure of all material terms before the transaction is completed.

New York's required disclosures are substantively similar to California's: total financing amount, disbursement amount, finance charge, APR, total repayment amount, payment schedule, and disclosure of all fees, prepayment charges, and collateral requirements. The New York law explicitly mirrors the transparency objectives of the federal Truth in Lending Act (TILA), even though TILA itself does not apply to commercial transactions.

Utah: Commercial Financing Registration and Disclosure Act

Utah's law goes beyond disclosure — it requires registration. Under the Utah Commercial Financing Registration and Disclosure Act, any person or entity completing more than five commercial financing transactions in Utah in a calendar year must register with the Utah Department of Financial Institutions. Operating without registration is unlawful, regardless of whether the individual transactions are otherwise compliant.

In addition to registration, the Utah law requires pre-transaction disclosures across all covered financing types, not solely MCAs. Utah's scope is notably broad: it applies to multiple categories of non-mortgage small business financing, making it relevant to any commercial lender with Utah-based borrowers, not only those who specifically offer MCAs.

Virginia: HB 1027 / SB 1313

Virginia's legislation is the most MCA-specific of the four enacted state laws. While California and New York created general commercial financing disclosure frameworks that captured MCAs within a broader category, Virginia's statute explicitly names MCA providers and sales-based financing brokers as regulated parties.

Virginia requires both registration and transaction-level disclosures. The broker-specific requirements — which impose conduct standards and disclosure obligations on parties who facilitate MCA transactions rather than fund them directly — extend compliance obligations further into the MCA distribution chain than any other state law to date.

Compliance requirements comparison for MCA lending regulation across California New York Utah and Virginia

So what does this mean for your institution? If your MCA or commercial lending portfolio includes borrowers in California, New York, Utah, or Virginia, disclosure and in some cases registration compliance are not optional. And if Missouri, New Jersey, or North Carolina legislation advances in 2026 or beyond, the applicable jurisdiction count will expand.

The Operational Challenge: Multi-State Compliance at Volume

Understanding what each state law requires is step one. Meeting those requirements consistently, at origination volume, across a portfolio that may include borrowers in multiple states simultaneously, is the operational challenge that separates compliant lenders from exposed ones.

The core workflow problems MCA lenders face under these disclosure regimes:

APR calculation methodology: California and New York require APR disclosure for products where the effective rate depends on future revenue performance. There is no universally standardized MCA APR calculation method, and the regulations prescribe specific estimation approaches. Manual APR calculations at volume create accuracy risk.
State-specific disclosure formatting: Each state has its own formatting requirements — field order, required language, e-signature standards. A single disclosure template does not satisfy all four states' requirements. Lenders with multi-state portfolios must either maintain separate state-specific templates or use software that generates compliant disclosures dynamically based on borrower jurisdiction.
Registration maintenance: Utah requires ongoing registration, not a one-time filing. Virginia's registration requirements apply to both funders and brokers. Compliance requires tracking registration status and renewal timelines as an operational function.
Audit trail: When a state regulator or AG inquires about a specific transaction, the lender must be able to produce evidence that the required disclosure was delivered before the transaction closed. Without a documented, timestamped record of disclosure delivery, the burden of proof in an enforcement inquiry shifts heavily against the lender.

Credit compliance intelligence for lenders navigating multi-state requirements has become a necessary operational capability — not a project for the compliance team to handle manually in parallel with origination.

Regulatory compliance audit trail visualization for multi-state MCA lending disclosure requirements

So what does this mean for your institution? A disclosure process built on spreadsheets, manual checklists, or origination software that was not designed with these state laws in mind is a compliance liability. Each transaction in a covered state that lacks a timestamped, state-compliant disclosure record is a potential enforcement finding.

Why LASER for MCA and Commercial Lending Compliance

LASER Credit Access is built natively inside Salesforce — the same platform where most commercial lenders already manage their pipeline, underwriting, and servicing. That native architecture is directly relevant to the multi-state MCA disclosure challenge.

Salesforce-native credit access, built-in compliance, and decisioning — unified in a single app, ready from day one.

When disclosure requirements, credit data access, and decisioning all run inside a single Salesforce-native application, the audit trail that state regulators require is a byproduct of the origination workflow — not a separate documentation project. Every credit pull, every disclosure event, and every decisioning action is logged within the same system of record that your team uses to manage the deal.

For MCA and commercial lending portfolios, the LASER platform's ACCESS pillar connects lenders to credit bureau data inside Salesforce for underwriting. The DECIDE pillar supports the credit decisioning workflow. And the COMPLY pillar provides the built-in compliance infrastructure — including the documentation and process controls — that multi-state disclosure obligations now require.

Consumer protection obligations that SMB lenders unknowingly trigger extend beyond the MCA disclosure framework — personal guarantor requirements, adverse action notice obligations, and credit data accuracy standards all intersect with commercial lending activity in ways that a disconnected technology stack cannot reliably manage.

What Lenders Should Do Right Now

The states that have already enacted MCA disclosure and registration requirements are not waiting for federal action. And the states actively developing legislation are watching California and New York for implementation guidance. The compliance window for lenders to build the right infrastructure is open — but it is narrowing.

Immediate actions for MCA and commercial lenders:

Map your borrower geography. Identify what percentage of your MCA or commercial financing portfolio is sourced from California, New York, Utah, and Virginia borrowers. If those percentages are material, compliance is not future-state — it is now.

Audit your current disclosure workflow. Does your origination system produce state-specific disclosure documents before transaction close? Are those documents formatted to each state's specification? Are delivery events timestamped and stored?

Verify Utah and Virginia registration status. If you complete more than five commercial financing transactions annually in Utah — or any MCA transactions in Virginia — confirm that registration is current and renewal timelines are tracked.

Review your APR calculation methodology. For California and New York transactions, confirm your APR estimation approach is consistent with each state's prescribed methodology. Document the methodology so it can be produced during a regulatory inquiry.

Monitor Missouri, New Jersey, and North Carolina legislation. These three states have active MCA-related bills. If they pass in their current or revised form, disclosure and potentially registration requirements will apply to lenders currently operating there without any state-level MCA compliance program.

So what does this mean for your institution? The lenders who will manage this regulatory environment most effectively are those who treat multi-state MCA compliance as an operational systems problem — not a legal research project. The right software infrastructure makes compliant disclosure the default output of your origination process, not an additional manual step.

Abstract illustration guiding MCA lenders toward compliance discovery and Salesforce loan management solutions

Ready to Build Multi-State MCA Compliance Into Your Salesforce Workflow?

State-level MCA regulation is no longer a future consideration for commercial lenders. California, New York, Utah, and Virginia have active disclosure and registration requirements in effect now, and multiple other states are advancing similar legislation. The lenders positioned to manage this environment are those whose compliance infrastructure is embedded in their origination system — not running separately alongside it.

LASER Credit Access delivers loan management software built natively for Salesforce, connecting credit bureau access, decisioning, and compliance workflow in a single application. If your institution offers MCA or commercial financing products and needs to close multi-state compliance gaps, a discovery call is the right starting point.

→ Schedule a Discovery Call