The mechanism: The federal BNPL crackdown died quietly — the CFPB withdrew its interpretive rule treating BNPL "digital accounts" as credit cards on May 12, 2025, after the Financial Technology Association sued and the Bureau folded. But Washington's retreat just handed the job to the states, and they're finishing it with more teeth than the CFPB ever proposed. Illinois signed SB 3561 into law on June 25, 2026, creating a full licensing and supervisory regime for BNPL lenders. New York DFS followed with nation-leading proposed rules in February requiring state licensure, ability-to-repay underwriting, capped late fees, and credit-bureau-reporting disclosures — the exact plumbing credit card issuers already run. More states are drafting similar bills. The pattern: BNPL grew by avoiding the licensing, underwriting, and disclosure costs card issuers absorbed decades ago. States are now closing that gap loan-by-loan, statehouse-by-statehouse — and compliance costs scale worse for standalone apps than for issuers who already have the legal and underwriting infrastructure built.