Axiant Partners logo Commercial Finance Referrals powered by axiant

Last updated: May 2026

ISO Broker Education

Commercial Finance Compliance Basics for ISOs and Brokers

The commercial finance industry is experiencing its most significant regulatory evolution in decades. State legislatures, banking regulators, and federal agencies are progressively extending oversight to the alternative lending and ISO channel that operated with minimal regulation for years. ISOs and commercial finance brokers who treat compliance as someone else's problem — the funder's job, not theirs — are increasingly exposed as state-level requirements impose obligations on brokers directly. This guide covers the compliance basics every ISO and commercial finance broker needs to understand: state disclosure laws, licensing requirements, record-keeping obligations, CFPB considerations, and AML awareness.

Become a Referral Partner Broker Starting Guide
  • California SB 1235 — what it requires and who must comply
  • New York Commercial Finance Disclosure Law
  • State-by-state disclosure requirement summary
  • CFPB oversight and what Section 1071 means for brokers
  • Record-keeping requirements and best practices
  • AML awareness basics for commercial finance ISOs

Table of Contents

The commercial finance regulatory landscape

For most of the alternative commercial finance industry's history, ISOs and brokers operated in a lightly regulated environment. Consumer lending was subject to extensive federal and state oversight — TILA disclosures, ECOA requirements, state usury laws, NMLS licensing — but commercial lending was treated differently. The traditional view was that businesses, unlike individual consumers, have the sophistication to evaluate financing terms without the same level of regulatory protection.

This framework is changing. Beginning with California's SB 1235 in 2018 (effective 2022) and New York's Commercial Finance Disclosure Law (effective 2023), states began extending disclosure requirements to commercial financing products — particularly MCA and short-term working capital products that critics argued were presented to small business owners without adequate information about true cost of capital.

The regulatory direction is clear: commercial finance brokers and funders can expect increasing disclosure requirements, potential registration or licensing requirements, and growing regulatory scrutiny of product pricing and practices. ISOs who build compliance practices now — before requirements are fully developed in their state — are in a much stronger position than those who scramble to retrofit compliance after violations have occurred.

This guide covers the current state of commercial finance compliance. For specific legal advice on your obligations in your state and for your specific products, consult a licensed attorney familiar with commercial finance regulation. Requirements are evolving, and state-specific nuances matter significantly.

California SB 1235 and DFPI requirements

California SB 1235 is the most comprehensive state-level commercial finance disclosure law enacted to date and has served as a model for other states' legislation. Signed into law in 2018 and implemented through California Department of Financial Protection and Innovation (DFPI) regulations effective December 9, 2022, SB 1235 requires providers of commercial financing to California-based small businesses to deliver standardized cost-of-capital disclosures at the time of offering financing.

For commercial finance ISOs and brokers, California creates compliance obligations that require immediate attention regardless of whether they are physically located in California. The law applies based on where the borrowing business is located — not where the ISO operates.

  • Who must comply. "Commercial financing providers" — entities that offer or enter into commercial financing transactions — must provide disclosures. The DFPI has issued guidance on whether brokers who facilitate transactions without being the funder have independent disclosure obligations. In many structures, the funder is responsible for providing the disclosure form, but brokers who prepare or present offers to California borrowers should confirm with legal counsel whether they have independent obligations under the current DFPI guidance.
  • What must be disclosed. The DFPI-required disclosure form includes: the total amount disbursed to the recipient, the total amount owed, the term or estimated term, the method, frequency, and amount of payments, the total cost of financing (dollar amount), the annual percentage rate (APR) or estimated APR, and any prepayment penalties or fees for late payment. The APR calculation for MCA products was a significant implementation challenge because MCA does not have a fixed term, requiring estimation methodologies for APR disclosure.
  • Registration requirements. California requires commercial financing providers and some brokers to register with the DFPI. "Commercial financing broker" registration is required for entities that, for compensation, solicit or arrange for commercial financing from third-party sources for small businesses. The registration process requires application to the DFPI, background checks, and ongoing reporting. ISOs who broker deals to California businesses should evaluate whether they need to register as commercial financing brokers under current DFPI requirements.
  • Enforcement. The DFPI has authority to investigate violations, issue cease-and-desist orders, impose civil money penalties, and require restitution. Early enforcement actions have targeted funders and brokers who provided materially inaccurate disclosures or who failed to provide required disclosures entirely. The DFPI has been active in examining the commercial finance market and is likely to increase enforcement activity over time.

New York Commercial Finance Disclosure Law

New York enacted its Commercial Finance Disclosure Law (CFDL) in 2020, with implementing regulations finalized in 2023. New York's law requires providers of commercial financing to small businesses in New York to provide standardized disclosures at the time of offer. The New York law is broadly similar to California's SB 1235 in its disclosure requirements but has some structural differences in implementation.

Key provisions of the New York CFDL relevant to commercial finance brokers:

  • Scope of coverage. The law covers commercial financing offers of $2.5 million or less made to New York-based businesses. Covered products include sales-based financing (MCA), closed-end financing (term loans), factoring, and other commercial financing products. Like California, the coverage is based on where the borrower is located — ISOs anywhere in the country who originate deals for New York businesses need to understand these requirements.
  • Disclosure content. Required disclosures under the New York law include: disbursed amount, total repayment amount, financed amount, APR, total dollar cost, payment amounts and frequency, term, and prepayment information. New York requires a specific disclosure form format developed by the Department of Financial Services (DFS), and providers and brokers must use the DFS-approved form rather than creating their own.
  • Broker-specific provisions. New York's CFDL has specific provisions addressing brokers who facilitate commercial financing transactions. Brokers must provide disclosures or ensure that the financing provider provides disclosures before the transaction closes. The law also addresses compensation arrangements — brokers must disclose their compensation to the small business recipient in certain circumstances.
  • Enforcement and penalties. The DFS has authority to enforce the CFDL and impose civil penalties. The law also creates a private right of action for small businesses that do not receive required disclosures or that receive materially inaccurate disclosures — meaning borrowers can potentially sue brokers or funders for disclosure violations, not just wait for regulatory action.

State-by-state commercial finance disclosure requirement summary

The table below summarizes the current state of commercial finance disclosure requirements across major states. This is a general reference only — requirements change, and legal counsel familiar with current state rules is essential before originating in any jurisdiction.

State Disclosure Law Status Products Covered Broker Registration Required? Key Regulator
California Active (SB 1235, effective 2022) MCA, working capital, equipment finance, factoring, lines of credit under $500k Yes — DFPI commercial finance broker registration DFPI
New York Active (CFDL, effective 2023) MCA, closed-end loans, factoring under $2.5M Disclosure compliance required; registration under review NYDFS
Virginia Active (2022) Commercial financing products to VA businesses No specific broker registration yet SCC
Utah Active (2023) Commercial financing products to UT businesses No specific broker registration yet UDFI
Florida Pending / under consideration Proposed coverage for MCA and working capital Not yet required OFR (proposed)
Georgia Pending / under consideration Proposed coverage Not yet required DBF (proposed)
Texas No current law N/A No N/A
Illinois Proposed / in development Under legislative consideration Under consideration IDFPR (proposed)
North Carolina No current law N/A No N/A
Most other states No current specific law General business registration only No N/A

The regulatory map above changes regularly. States that have "no current law" today may have active requirements within 12–24 months. ISOs who originate nationally or who have significant volume in any single state should monitor legislative developments in their primary markets and engage legal counsel proactively rather than reactively.

CFPB oversight and Section 1071 data collection

The Consumer Financial Protection Bureau (CFPB) has historically focused its regulatory activity on consumer financial products — mortgages, credit cards, auto loans, payday loans — and has had limited direct authority over commercial lending to businesses. However, several CFPB developments are relevant to commercial finance brokers and their funder partners.

Section 1071 of Dodd-Frank: Section 1071 requires financial institutions that originate credit applications from small businesses to collect and report data on those applications — including demographic data about the ownership of the applicant business. Finalized CFPB rules implementing Section 1071 require larger covered lenders to begin reporting this data, with smaller institutions phasing in over subsequent years. This data collection requirement affects the lenders that ISOs work with, not typically the ISOs themselves, but it changes the submission process for covered lenders by adding required data fields to applications.

UDAAP guidance: The CFPB's authority over unfair, deceptive, or abusive acts or practices (UDAAP) has been asserted in various enforcement contexts. While the CFPB's direct jurisdiction over commercial finance brokers is limited, brokers who facilitate transactions for lenders that are subject to CFPB oversight should ensure their practices would withstand scrutiny under UDAAP standards — accurately representing financing terms, not using deceptive sales practices, and not pressuring borrowers into unsuitable products.

FTC jurisdiction. The Federal Trade Commission (FTC) has broader jurisdiction than the CFPB over commercial business practices, including commercial finance companies and brokers that engage in deceptive or unfair practices. FTC enforcement actions in the commercial finance space have focused on misrepresentation of financing terms, undisclosed fees, and fraudulent practices. ISOs should be aware that FTC UDAP authority applies to their business practices even where CFPB authority does not.

Record-keeping requirements for commercial finance brokers

Adequate record-keeping is not just a compliance best practice — it is essential protection in three practical contexts: ISO agreement commission disputes, regulatory examinations, and fraud allegations. ISOs who cannot produce documentation of how a deal was underwritten and what disclosures were provided are defenseless in all three contexts.

Deal application files

Maintain a complete copy of every deal application file: the signed application, all bank statements submitted, tax returns or financial statements, owner identification, and any product-specific documentation. Organize by deal date and merchant name. Retain for a minimum of 5 years from the funding date — 7 years is a safer standard that covers most state statute of limitations periods for contract disputes. Electronic storage with access controls is acceptable and preferable for searchability.

Disclosure records

If you have disclosure obligations under state commercial finance disclosure laws, retain evidence that compliant disclosures were provided — a copy of the disclosure form, a signed acknowledgment from the borrower, or a timestamped delivery record. For California and New York deals, the specific DFPI or DFS disclosure forms should be in your file with confirmation of delivery to the borrower before the transaction closed.

ISO agreement records

Keep signed copies of every ISO agreement you execute with funders, including any amendments or modifications. Also retain the commission payment records for each funder relationship — commission statements, ACH payment records, and any correspondence about commission disputes or clawbacks. These records are the foundation of any commission dispute resolution and demonstrate the terms under which you were operating.

Correspondence records

Retain all material correspondence with funders, merchants, and referral partners related to specific deals — emails about deal submission, approval conditions, documentation requests, and funding confirmation. Email retention is particularly important for documenting the sequence of events in any dispute. A routine email retention policy of 5–7 years for deal-related correspondence is appropriate for commercial finance operations.

Identity verification records

Document the identity verification you performed for each business owner whose application you submitted — a copy of the government-issued ID provided, the date it was reviewed, and any additional verification steps. This practice protects you against claims that you facilitated fraudulent applications and provides the basic KYC documentation that regulators expect from financial services intermediaries.

Marketing and advertising records

Retain copies of all marketing materials, website content, email campaigns, and advertising that describes your commercial finance services and the products you offer. Regulatory examinations of commercial finance companies often begin with review of marketing materials for potential misleading claims about product terms, costs, or accessibility. Materials that accurately describe what you offer and who qualifies protect you in examinations.

AML awareness for commercial finance ISOs

Commercial finance ISOs are not currently subject to the formal Bank Secrecy Act (BSA) / Anti-Money Laundering (AML) program requirements that apply to banks, credit unions, and certain other financial institutions. These institutions must maintain written AML compliance programs, designate compliance officers, conduct employee training, file Suspicious Activity Reports (SARs), and implement Customer Identification Programs (CIPs).

Despite not being subject to these formal requirements, commercial finance ISOs have practical reasons to maintain basic AML awareness and know-your-customer practices:

  • Fraud protection. The most common AML-adjacent risk in commercial finance is not sophisticated money laundering but fraud — fabricated business identities, altered bank statements, and misrepresented financial profiles. Basic KYC practices — verifying business owner identity with government-issued ID, confirming the business exists (website, Google Business listing, industry databases), and reviewing bank statements for obvious patterns of fictitious transactions — protect ISOs from inadvertently submitting fraudulent applications.
  • Funder BSA obligations flow upstream. Funders who are subject to BSA/AML requirements — most banks, some non-bank lenders — maintain their own AML programs and expect ISO submissions to be consistent with legitimate business activity. An ISO who submits applications from businesses with obviously suspicious characteristics creates problems for the funder's AML program, which creates relationship problems for the ISO. Demonstrating basic diligence about the businesses you submit protects the funder relationship as well as providing legal protection.
  • FinCEN oversight of the AML space. The Financial Crimes Enforcement Network (FinCEN) has periodically issued guidance on AML risks in non-bank financial services, and the regulatory trend is toward extending BSA/AML requirements to a broader range of financial intermediaries. Commercial finance brokers who are not currently required to maintain formal AML programs may face such requirements in the future. Building basic AML awareness practices now positions you to expand them if formal requirements emerge.
  • Identify and decline suspicious applications. Specific patterns that should prompt caution before submission: business with no verifiable online presence, physical location, or industry activity; bank statements showing circular or self-referential deposit patterns; multiple applications from the same address with different business names; applications where the business description does not match the bank statement activity; and applications where the requested loan amount has no plausible business purpose. Do not submit applications that you believe may involve fraud, regardless of the commission opportunity.

Building a basic compliance program for commercial finance ISOs

A "compliance program" does not need to be a complex, expensive undertaking for a solo or small ISO operation. What it needs to be is systematic, documented, and consistent. The following elements constitute a basic compliance program appropriate for most commercial finance ISOs — scaled appropriately to your volume and the states where you originate.

  • Know your state requirements before originating. Before originating your first deal in any state, verify current licensing, registration, and disclosure requirements for the products you plan to offer. A brief consultation with a commercial finance attorney familiar with the target states is the most cost-effective way to start. Requirements change frequently, so build an annual compliance review into your business calendar.
  • Implement a disclosure checklist for covered states. For California and New York deals, create a pre-closing checklist that confirms the required disclosure form was provided to the borrower and documented. For other states with active requirements, maintain equivalent checklists. The checklist should be completed for every funded deal in a covered state and retained in the deal file.
  • Establish a document retention policy. Write a simple document retention policy that specifies what records are kept, in what format (electronic), for how long (minimum 5 years from deal funding date), and who is responsible for maintaining them. Even a one-page policy that is actually followed is better than a comprehensive policy that exists only on paper.
  • Conduct an annual regulatory update review. Set a calendar reminder to review your compliance practices against current requirements at least once per year. Subscribe to DFPI, NYDFS, and FTC publications and alerts relevant to commercial finance. If you do not have legal counsel, a brief annual consultation ($300–$600) to review any new requirements that affect your business is a reasonable investment.
  • Train staff and referral partners on basic KYC. If you have staff or referral partners who collect applications on your behalf, provide basic guidance on identity verification requirements, red flags for fraudulent applications, and the documentation required from every borrower. Staff who understand why these steps matter are more likely to implement them consistently than those who see compliance as unnecessary overhead.

Compliance in commercial finance is not a static checklist — it requires ongoing attention as the regulatory environment evolves. ISOs who build compliance awareness into their business model from the beginning are positioned to adapt as requirements develop, rather than reacting to enforcement actions or regulatory penalties that could have been avoided. For more on the ISO business model, see our guides on ISO agreements, becoming a commercial finance broker, and our commercial lending ISO program.

FAQ

Questions about commercial finance compliance for ISOs and brokers

Do commercial finance brokers need to comply with state disclosure laws?

Yes, if they originate transactions with businesses in states that have enacted commercial finance disclosure laws. California (SB 1235) and New York (CFDL) have active requirements. Virginia, Utah, and other states are implementing similar laws. Requirements apply based on where the borrower is located — not where the broker operates. Brokers who originate deals for California or New York businesses need to understand whether their funder handles disclosure compliance or whether they have independent obligations.

What is California SB 1235 and how does it affect commercial finance brokers?

California SB 1235 (DFPI regulations effective December 2022) requires providers of commercial financing to deliver a standardized disclosure form to California small businesses showing APR, total repayment amount, payment schedule, and costs. Brokers who facilitate commercial financing in California may have independent disclosure obligations or must confirm the funder is handling disclosures. California also requires registration with the DFPI for commercial financing providers and certain brokers. Non-compliance can result in DFPI enforcement action and civil penalties.

Does the CFPB regulate commercial finance brokers?

The CFPB has limited direct authority over commercial finance brokers — its primary jurisdiction is consumer financial products. However, CFPB oversight of small business lenders is expanding through Section 1071 data collection requirements. The FTC has broader authority over deceptive and unfair practices that applies to commercial finance intermediaries. Brokers should ensure their practices would withstand scrutiny for misleading disclosures, deceptive sales practices, or pressure tactics regardless of which agency might examine them.

What records should commercial finance brokers keep?

Maintain: all deal application files (signed application, bank statements, financial documents, owner ID) for 5–7 years from funding date; copies of state disclosure forms delivered to borrowers; signed ISO agreements and commission payment records; material correspondence on all deals; and basic identity verification records. Electronic storage with organized naming conventions (by deal date and merchant name) and access controls is appropriate. Adequate records protect you in commission disputes, regulatory examinations, and fraud allegations.

Do commercial finance ISOs need to comply with AML requirements?

ISOs are not currently subject to formal BSA/AML program requirements. However, basic KYC practices — verifying business owner identity, confirming the business's existence, reviewing bank statements for signs of fraud, and declining suspicious applications — protect against fraud exposure and maintain the ISO's credibility with funders who do have formal AML obligations. The regulatory trend is toward extending AML oversight to more financial intermediaries, and building basic practices now prepares you for potential future requirements.

Which states require commercial finance broker registration?

California requires DFPI registration for commercial financing providers and certain commercial financing brokers under SB 1235 and its implementing regulations. New York's CFDL creates disclosure compliance requirements for brokers operating in New York, and broker registration may be required under current or forthcoming DFS rules. Virginia, Utah, and other states have enacted or proposed similar frameworks. Verify current requirements for each state where you originate with a commercial finance attorney — requirements are evolving and vary by state and product type.

Refer deals without compliance overhead

Work with Axiant Partners

If you want to earn commercial finance referral fees without the growing compliance complexity of operating as a full ISO, Axiant Partners referral agreements are structured to minimize your compliance obligations while maximizing your referral income. Submit a deal or review the referral agreement to get started.

Become a Referral Partner Review the Referral Agreement Broker Starting Guide