Colorado won the court fight. Oregon followed. Your bank partnership state map just changed.

The U.S. Court of Appeals for the 10th Circuit ruled 2-1 in National Association of Industrial Bankers v. Weiser that Colorado's DIDMCA opt-out is lawful, creating the first federal appellate precedent backing state rate caps on out-of-state bank partnerships.⁵ The decision reversed a lower court injunction that the industry had won, and it applies directly to the six states within the 10th Circuit: Colorado, Kansas, New Mexico, Oklahoma, Utah, and Wyoming.

Oregon's House committee has now passed a bill exercising the same DIDMCA opt-out, requiring all lenders operating in the state to comply with Oregon's 36% APR cap regardless of where they or their partner bank are chartered. The primary target: OppFi, which charges Oregonians up to 195% APR on $500 to $5,000 personal loans through partnerships with three Utah-chartered banks.^{1 2 3}

Oregon is not an outlier. It is the latest state in an accelerating national movement. Six states have enacted 36% APR caps since 2010. Rate cap ballot initiatives have passed in every state where they appeared on a general election ballot: Montana (2010), South Dakota (2016, 76% yes), Colorado (2018), and Nebraska (2020). The political math is clear.^{5 8}

Key facts:

The rent-a-bank model works like this: an online lender partners with a bank chartered in a state with no usury cap (usually Utah or New Jersey). The bank formally "originates" the loan. The online lender actually underwrites, markets, services, and purchases the loan within days. Because the loan is technically "made" by the bank, it inherits the bank's home-state rate authority, bypassing the borrower's state consumer protections.^{6 8}

OppFi is the most prominent example. Through partnerships with FinWise Bank, Capital Community Bank, and First Electronic Bank (all Utah-chartered), OppFi charges up to 195% APR on personal installment loans of $500 to $5,000. After the bank funds the loan, OppFi purchases upward of 95% of the receivables within days. The Center for Responsible Lending describes this as a business model "built around high levels of delinquency and default."^{7 8}

MCA funders should care because the legal reasoning extends beyond consumer lending. Common MCA structures produce effective APRs well into triple digits when calculated using TILA methodology. A 1.3x factor rate over six months, repaid via daily ACH, translates to an effective APR well above 100%. Factor rates of 1.2x to 1.5x on 3 to 12 month terms routinely produce effective APRs ranging from 40% to over 350%, depending on actual repayment speed and payment structure.¹⁵ APR calculations for MCA vary based on daily versus weekly payment schedules, holdback percentages, and how quickly the merchant repays. The ranges are wide, but they are consistently above any proposed 36% threshold. If a state successfully applies APR calculations to commercial credit products, the same 36% cap becomes relevant to your portfolio.

Section 521 of the Depository Institutions Deregulation and Monetary Control Act of 1980 (DIDMCA) allows federally insured state-chartered banks to lend at their home state's highest allowed rate, even to borrowers in other states. This is the legal foundation of rate exportation.⁶

However, DIDMCA also includes a provision allowing states to opt out of this preemption for loans made to their own residents. Oregon's bill exercises this opt-out, which would require all lenders operating in Oregon, regardless of where they or their bank partner are chartered, to comply with Oregon's 36% APR cap.^{6 11}

The critical legal question is the "true lender" doctrine: who is actually making the loan? If the bank is the true lender, federal preemption applies and state rate caps do not. If the online lender is the true lender (because it underwrites, markets, services, and buys back the loan), federal preemption fails and state law applies. Oregon's bill effectively codifies this at the state level.⁶

The OCC under the first Trump administration adopted a rule in 2020 that would have favored rent-a-bank structures. The Biden administration repealed it in 2021 using the Congressional Review Act with bipartisan support. No replacement has been proposed.

Two weeks before the committee vote, Oregon DFR announced a $1.56 million consent order against LoanMart (Wheels Financial Group LLC) for charging 126% to 178% APR on at least 806 consumer loans through a bank partnership model, collecting approximately $1.4 million in interest above the 36% statutory cap.^{4 13}

The order requires $900,000 in restitution to Oregon borrowers plus $660,000 in civil penalties (suspended for three years if LoanMart remains compliant). DFR Administrator TK Keen stated: "Consumer finance companies cannot hide behind out-of-state banks to bypass Oregon's consumer protection laws."⁴

The timing is not accidental. Oregon regulators are building a record of enforcement actions to demonstrate that the rent-a-bank model is already operating illegally under existing law, while simultaneously pushing legislation to close the loophole formally. For lenders operating in Oregon, the message is clear: the state is enforcing now, not waiting for the bill to pass.

Oregon is part of a growing movement. Six states have enacted 36% APR caps since 2010: Montana (2010 ballot initiative), South Dakota (2016 ballot initiative), Colorado (2018 ballot initiative plus 2023 DIDMCA opt-out), Nebraska (2020 ballot initiative), California (2019 legislative), and Illinois (2021 Predatory Loan Prevention Act).^{5 8}

The DIDMCA opt-out specifically has been enacted in Colorado, Puerto Rico, and Iowa. Oregon is attempting to join that list. Bills were introduced but did not pass in Minnesota, Nevada, Rhode Island, and Washington, D.C.^{5 6}

The 36% APR threshold has become the de facto standard, backed by the Center for Responsible Lending and state consumer advocacy groups. If Oregon passes its opt-out this session, advocates plan to use it as a template for 10 to 15 additional states.

On November 10, 2025, the U.S. Court of Appeals for the 10th Circuit ruled 2-1 in National Association of Industrial Bankers v. Weiser that Colorado's DIDMCA opt-out is lawful. The court reversed a lower court that had granted the industry a preliminary injunction blocking the law.⁵

This is the first federal appellate decision interpreting the DIDMCA opt-out clause, and it sided with the state. The court held that DIDMCA's opt-out provision allows states to apply their interest rate caps to loans made to borrowers within their borders, regardless of where the lending bank is located.⁵

Industry plaintiffs filed for rehearing en banc on December 19, 2025, and may petition the Supreme Court. But until a higher court reverses the 10th Circuit, states in Colorado, Kansas, New Mexico, Oklahoma, Utah, and Wyoming now have clear federal appellate authority supporting DIDMCA opt-outs. Oregon's bill cites the Colorado outcome directly.

Oregon's bill targets consumer lending ($500 to $5,000 personal loans), not commercial products. MCA, factoring, and equipment finance may have exemptions depending on how the final legislation defines covered products. This is the critical detail that has not been resolved.¹

Here is what makes this an untested gray zone: no state has yet enforced a rate cap against a commercial MCA or revenue-based financing product. The enforcement actions that exist target different violations. New York's $1.175 billion judgment against Yellowstone Capital recharacterized MCAs as loans based on their structure, but the case centered on fraud and deception, not a rate cap.¹⁶ California's commercial financing disclosure law (SB 362) requires APR disclosure but does not cap rates. North Dakota expanded its definition of "loan" to potentially include MCAs starting August 2025, but enforcement data is not yet available. No commercial lender has been tested against a 36% cap. We are operating in legal territory with no precedent, and that should concern you more than the bill text itself.

The regulatory trend is unmistakable. California's SB 362 (effective January 2026) banned factor rate language and requires APR disclosures on commercial financing. New Jersey's APR disclosure mandate applies to MCA and factoring deals. Texas introduced HB 700 and SB 2677 in 2025, which would bring MCAs under state usury guidelines. Multiple states are actively collapsing the legal distinction between consumer and commercial high-cost credit.⁸

If your MCA factor rates translate to effective APRs above 36%, you have regulatory exposure in every state with pending or proposed rate cap legislation. The American Fintech Council is lobbying Congress for "clear federal standards for bank-fintech partnerships" specifically to preempt what they call a "patchwork of state laws." Until that preemption happens (if it happens), state-level regulation is the operating reality.^{9 14}

The American Fintech Council (AFC) is leading the organized opposition. CEO Phil Goldfeder traveled to Salem to testify against Oregon's bill, arguing it would "severely limit credit availability" and "disproportionately harm rural and minority communities" by eliminating lending options. The Financial Technology Association (FTA) submitted formal opposition to the Oregon Senate Committee.⁹

The "rural and minority harm" argument deserves scrutiny because it has a track record. Rate cap ballot initiatives appeared before voters in four states: Montana, South Dakota, Colorado, and Nebraska. Voters passed the cap in all four, including South Dakota at 76%. The argument has not stopped a single rate cap at the ballot box, and Colorado's 10th Circuit win proved it does not stop them in court either.

The industry's legal strategy centers on challenging DIDMCA opt-outs in court. In Colorado, they secured a preliminary injunction (later reversed by the 10th Circuit) and are pursuing further appeals. The AFC's 2026 federal priorities explicitly call for federal preemption of state rate caps through Congressional action on bank-fintech partnership rules.^{9 14}

Simultaneously, the industry is betting on a friendlier federal posture. The CFPB has been effectively gutted under the Trump administration, with approximately 1,400 workers receiving layoff notices and the agency securing only $145 million in emergency funding through March 2026. Twenty-two state attorneys general have sued to force CFPB funding.¹⁰ The AFC celebrated when the FDIC withdrew its amicus brief in the Colorado case, signaling a shift in federal agency support.

Three concrete actions for your Monday morning:

NGS usually means a missed annual report, not a dead business.

Let’s break down when to conditionally approve, when to decline, and the 6-month rule that separates a filing oversight from a real red flag.

Schedule a FREE demo call

Edmonton-based Trust Science acquired Toronto's Lenders API to create a consortium-based fraud detection system targeting loan stacking, bust-out fraud, and synthetic identity schemes. The platform anonymizes lender data at source, letting competing lenders share fraud signals without exposing proprietary portfolio information. If the model scales to the US market, it addresses the single largest fraud vector in MCA: borrowers taking simultaneous advances from multiple funders against the same revenue stream.

Private credit and non-bank lending have grown rapidly, but cracks are showing. Foreclosures surged 82% between 2023 and 2025, default rates hit 7.4% in certain markets, and private lenders pushed loan-to-value ratios to 90% chasing volume. For alternative lenders, the question is whether tighter capital conditions will restrict warehouse lines and increase borrowing costs for originators who depend on institutional funding from the same BDCs and private credit funds now absorbing CRE losses.

The DOJ's Civil Rights Division secured a $68 million settlement against Colony Ridge developers in Texas for predatory land sales targeting immigrant communities, including loans issued without income verification or ability-to-repay assessment. The settlement signals continued federal enforcement appetite for predatory lending cases even as the CFPB scales back. The enforcement vector matters: DOJ's Civil Rights Division can pursue any credit extender under ECOA, not just regulated financial institutions.

Morgan Stanley flagged growing risk in the $235 billion software lending market, where 50% of loans carry B- or lower ratings and 30% mature by 2028. AI disruption is the core concern: if AI reduces the value of legacy software products, the recurring revenue streams backing these loans deteriorate. For equipment finance and working capital lenders, the warning reinforces that the same BDCs and private credit funds backing your warehouse lines also hold concentrated software exposure. Their losses become your funding squeeze.