Online lenders may own more than half of the personal lending market, but they face serious headwinds. For one thing, rising interest rates will increase their cost of funds, and perhaps make their offerings less attractive, and for another, regulations may arrive that make operating their businesses more expensive.

In New York State, perhaps anticipating a vacuum of consumer protections at the federal level, that second condition has been met. The Empire State’s Department of Financial Services released a report recommending additional regulations for online lenders yesterday. The DFS report stems from a bill signed by Governor Andrew Cuomo on June 1. The report emphasizes that existing consumer protection laws and usury limits apply equally to online lenders as well as chartered institutions.

Financial Services Superintendent Maria T. Vullo noted that borrowers, whether consumers or small businesses, require protection, and banks deserve a “level playing field”:

“Access to credit is essential to the well-being of consumers, the lifeblood of small businesses and a driver of economic growth, job creation and prosperity of our communities in New York. Our review shows that while online lending has grown in recent years, our banking industry still supports the overwhelming majority of lending in New York while being subject to strong safeguards and oversight. DFS supports the promise that new technologies are able to reach more consumers, but innovation must also be responsible, and all associated risks must be appropriately managed, including by strong underwriting standards, compliance with usury laws, and capital requirements. All lenders must operate on a level playing field and address market risk. As the regulator of the financial services industry in New York, DFS has and will continue to be a leader in enforcing robust market safeguards and consumer protections through strong state regulation, licensing and supervision.”

Pamela Perdue, chief regulatory officer and executive vice president of the New Haven, Conn.-based compliance management firm Continuity, noted this was not out of character for New York, which, after all, launched the BitLicense. “It’s not surprising to see state supervisors beginning to step in where there are gaps in federal regulation or oversight,” Perdue told Bank Innovation. “New York, in particular, has a long tradition of vigorous consumer protection, and often enacts legislation and deploys supervisory tactics more stringent than federal requirements. A recent example is the cybersecurity rules imposed last year, where NY DFS provided guidelines and requirements that clarified and strengthened expectations for banks in their protection of consumer data.”

She also noted that requiring all lenders to follow consumer protection guidelines is hardly radical. “Online lenders have always been covered by federal regulations, same as their bank and credit union counterparts because they’re ‘creditors’ for truth-in-lending and other consumer protection purposes,” she said. The difference is the lack of a “diligent watchdog” for nonbank lenders.

“The Bureau of Consumer Financial Protection [the former CFPB] has been mostly hands-off, and is expected to be even more so in the months ahead,” Perdue said. “It’s clear from the position piece that NY DFS is concerned that the lack of close federal oversight may lead to abusive or deceptive practices that will harm New York residents.”

As for the effects of the new state position, Perdue expects that online lenders can look forward to closer scrutiny now that the background data has been gathered. “We might see a crackdown on licensing standards as a first step, or perhaps further investigation of the rate structures of certain participants in the marketplace,” she said. “Servicing arrangements is another area where the overlap of banking and securities rules might come into play.”

In other words, online lenders better watch this space closely. In the absence of strict federal oversight, more states may step in with recommednations of their own. The full report can be found here.