Colorado's AI law binds credit decisions on June 30, the Justice Department is suing to overturn state rules it has nothing ready to replace them with, and a lender running one national underwriting model now has to satisfy explainability and human-review demands that change at every state line.

_{Sources
1 Forbes | AI Lending In The US Needs One Rule, Not Fifty
2 Digital Applied | Federal vs. State AI Regulation: Congress and Preemption in 2026
3 Asurity | Colorado Revises Landmark AI Law: What Mortgage Lenders Need to Know
4 Alston & Bird | New Executive Order Aims to Curb State AI Regulation
5 National Mortgage Professional | Trump AI Framework Signals Future Relief, But No Compliance Break Yet
6 The Financial Brand | How a 160-Year-Old Law Will Regulate AI for National Banks
7 Ropes & Gray | The Landscape and Limitations of the Federal Push to Override State AI Regulation
8 Lawfare | White House AI Framework Proposes Industry-Friendly Legislation
9 Connect Money | P10 to Acquire Stellus Capital in $250M Direct Lending Deal
10 Dallas Innovates | Dallas' P10 to Acquire Houston-Based Direct Lender Stellus for $250M
11 New York Law Journal | True Lender Doctrine and 'Opportunity Financial, LLC v. Clothilde Hewlett'
12 ABA Banking Journal | California Court Rejects 'Rent-a-Bank' Theory in OppFi Lawsuit
13 Bloomberg | 'Take Risk': Canada Regulator Cuts Bank Capital Level to Boost Lending
14 OSFI | OSFI Lowers Domestic Stability Buffer to 3.0% So Canada's Largest Banks Can Deploy More Capital
15 America's Car-Mart | Agreement with Lenders to Support Ongoing Strategic Review Process
16 Talk Business & Politics | Car-Mart Lenders Extend Deadline; Shares Hit 52-Week Low}

Because the laws in question regulate the decision, not the institution. A state AI law that governs "consequential decisions" or "automated decision-making" applies to the act of approving, pricing, or declining a loan, regardless of whether the lender holds a bank charter. The merchant cash advance shop scoring a thin-file restaurant in seconds, the online lender pricing a revenue-based advance off bank-transaction data, the equipment financier running a condition-scoring model: each is making exactly the kind of automated consequential decision these statutes were written to reach. The bank-versus-fintech framing in most of the coverage obscures who is actually most exposed.

And the exposure is uneven by design. A national bank can point to the National Bank Act and a 160-year line of preemption doctrine, and the OCC has committed to defending that shield.⁶ A state-licensed nonbank has no equivalent. It complies with the law of every state it lends into, one rulebook at a time, which is the opposite of the single national underwriting model most automated lenders were built to run.

Lighter than the original draft, but real. After the May 2026 revision in Senate Bill 26-189, a lender deploying AI in a credit decision in Colorado must give the consumer notice when automated technology materially influences a consequential decision, let the consumer request information about the decision and the system's role in it, provide an opportunity to correct inaccurate information and seek human review under certain circumstances, and keep documentation supporting those transparency obligations.³

What the revision removed is as telling as what it kept. Gone are the mandatory risk-management program, the annual impact assessment, and the broad duty to guard against algorithmic discrimination that defined the 2024 version.³ The state that wrote the template decided the template was too heavy. That is useful intelligence for any operator budgeting compliance spend against the worst-case version of these laws: the worst case is being negotiated down even in the state most committed to it.

Because the federal effort is litigation and rulemaking, not a switch that has been flipped. The December executive order tasks the DOJ task force with challenging state laws, directs Commerce to identify "onerous" statutes, and leans on levers like broadband funding and FCC and FTC policy statements to pressure states.⁴ It names specific targets, including the Colorado AI Act, Illinois' HB 3773, California's Transparency in Frontier AI Act, and New York's RAISE Act.⁴ But naming a law as a target is not striking it down.

The limits are real and well documented. Analysts tracking the push note that an executive order cannot by itself preempt a state statute, that the funding-conditioning levers face their own legal challenges, and that the cleaner route, federal legislation, is the route the Senate just rejected 99-1.⁷ A lender that pauses its compliance build on the theory that federal preemption is imminent is betting on a timeline that the people running the preemption effort will not promise.⁵

At the three points where state rules and machine-learning models disagree about how a decision gets made. The first is human review: a state that requires a person to be able to review or override an automated credit decision forces a workflow change into a process built for speed. The second is permissible inputs: a state that restricts which variables a model may consider, or treats certain proxies as off-limits, can invalidate a feature your model already relies on. The third is explainability: a state that demands a clear, individualized reason for a decision collides with models that, by the analysts' own description, cannot produce that explanation by design.⁶

The operational problem is that these three requirements do not line up across states. A model that satisfies Colorado's notice-and-review posture may still trip an input restriction in another state and an explainability standard in a third. The industry's own framing of the fix, "one rule, not fifty," is a confession that the current architecture, a single model serving every state, is the thing under strain.¹

Three moves, in order of urgency. First, if you lend in Colorado, treat June 30 as a live deadline and confirm you can do four things on a covered decision: notify the borrower that a model materially influenced it, answer a request to explain the model's role, route a correction-and-human-review request, and produce the documentation behind all three.³ Those are workflow questions, not modeling questions, and they are answerable before month-end.

Second, build a state-by-state map of where your model touches a consequential decision and which of the three pressure points, human review, input limits, or explainability, each state activates. You cannot comply with a patchwork you have not drawn. Third, decide deliberately whether you are building one model that meets the strictest state's bar everywhere, or a model that flexes by jurisdiction, because drifting into the second by accident is how a lender ends up out of compliance in a state it forgot it lent into. Do not wait for the federal preemption fight to resolve the question for you; the people running that fight are not promising it will.⁷

Treasury has fined fintech lenders, payment processors, and trade finance shops in recent years.

The defense of "not a bank" does not work. Cobalt's OFAC API plugs into intake and screens business + guarantor with confidence scores in milliseconds. One API call to avoid the math.

Schedule a FREE demo call

Ridgepost Capital, the firm formerly known as P10 and now trading on the NYSE as RPC, completed its acquisition of Stellus Capital Management on June 22, folding in a roughly $4 billion direct lender focused on the lower middle market.⁹ The deal, first announced in February at $250 million, paid $125 million in cash and $125 million in exchangeable units, with up to $60 million more tied to 2027 and 2029 revenue targets, and left Stellus' partners running day-to-day investing.¹⁰ The operator signal is that the lower middle market, companies roughly in the $5 million to $50 million EBITDA band, is now a consolidation target in its own right, and an alt-lender competing there is increasingly bidding against platforms with permanent capital and the scale to hold paper that a warehouse-funded shop has to sell.

A New York Law Journal analysis published June 18 revisits Opportunity Financial v. Clothilde Hewlett, the case in which a California Superior Court granted OppFi summary judgment in May 2026, rejecting the DFPI's "true lender" theory that OppFi, not its partner FinWise Bank, was the real lender on loans priced above California's 36% cap.¹¹ The court held that at origination the entity that funds, controls underwriting, and bears the risk is the true lender, a standard the bank-partnership model is built to satisfy.¹² The operator signal is a caution, not a victory lap: a single state trial-court win does not bind other states, and any lender treating the California outcome as a national safe harbor for rate exportation is reading more durability into one ruling than it carries.

Canada's banking regulator, OSFI, lowered its Domestic Stability Buffer by 50 basis points to 3.0% effective June 19, its first cut in three years, freeing roughly C$74 billion of capital and headroom for as much as $673 billion in additional risk-weighted assets across the country's six largest banks.¹⁴ Superintendent Peter Routledge framed it bluntly, saying the regulator is telling banks "there's enough health and strength in the banking system to take risk and we don't want to stand in the way of it."¹³ The operator signal is a divergence worth watching: as US capital rules stay contested, a loosened Canadian banking sector with fresh lending capacity is a more aggressive competitor in any cross-border segment where private credit and bank balance sheets overlap.

America's Car-Mart, the largest publicly traded buy-here-pay-here auto dealer, amended its credit agreement with Silver Point Finance and its lender group, which agreed to waive specified defaults and grant covenant relief through early September 2026, extendable to November if the company hits certain milestones, while it runs a strategic-alternatives review.¹⁵ The relief came as the shares touched a 52-week low, a signal the market reads the "strategic alternatives" language as distress rather than opportunity.¹⁶ The operator signal is a read on subprime-auto collateral health: when the biggest buy-here-pay-here operator needs covenant waivers to keep going, anyone underwriting against subprime consumer auto paper should be re-checking advance rates and recovery assumptions, not waiting for the restructuring to confirm the stress.