Disclosure laws quietly turned a sales workflow into a records workflow. California’s SB 1235 and New York’s Commercial Finance Disclosure Law require providers and brokers to deliver standardized, APR-style disclosures to merchants before they accept financing, and to keep proof of that delivery for years afterward, which means an MCA CRM now has to generate state-specific disclosure documents, timestamp their delivery, and archive them as retrievable records on every deal. The platform stopped being just a pipeline the day these laws took effect; it became the evidence file.
The map keeps expanding. A growing list of states, including Utah, Georgia, Virginia, and Florida, have added commercial financing disclosure regimes of their own, each with its own thresholds, formats, and timing rules. This guide explains what the two flagship laws require, how the APR disclosure requirements translate into system features, and what audit trail documentation a funder needs when a regulator calls. It is general information rather than legal advice, so confirm current specifics with counsel for every state you sell into.
The short answer is disclosure before acceptance, records after it. California’s law, enacted in 2018 and operative once regulations were finalized in 2022, covers commercial financing transactions under its dollar threshold and obligates both funders and the brokers who arrange their deals. New York’s version took effect in 2023 and reaches transactions up to two and a half million dollars, with providers defined broadly enough to include direct funders, intermediaries, and brokers.
The disclosures themselves follow a standardized template: the total amount of funds provided, the total dollar cost of the financing, the term or estimated term, prepayment policies, collateral or guaranty requirements, and the annualized cost figure computed by the state’s prescribed formula. Both states treat sales-based financing, including merchant cash advances, as in scope.
Enforcement and registration ride alongside the paper. California’s Department of Financial Protection and Innovation administers its regime with reporting obligations for brokers, and New York’s Department of Financial Services requires broker registration. Penalties and private remedies make sloppy records expensive, which is why the recordkeeping question matters as much as the disclosure itself.
| Law | Who It Covers | Core Obligation | Recordkeeping Angle |
|---|---|---|---|
| California SB 1235 | Providers and brokers under the threshold | Standardized disclosure before acceptance | Retain disclosures and delivery proof |
| New York CFDL | Providers, brokers, intermediaries up to $2.5M | Disclosure with each specific offer | Multi-year retention, commonly cited at four years |
| Other states | Varies by state and threshold | Similar disclosure frameworks | Rulesets continue to diverge |
The awkward part is the fit. A merchant cash advance is a purchase of future receivables, not a loan, so it has no interest rate in the ordinary sense. The laws respond by requiring an annualized cost figure, California calls it the implied annualized rate and New York prescribes its own methodology, so that merchants can compare a ninety day advance against a three year term loan on one scale.
The math is not something a rep should do by hand. It depends on product type, fee treatment, payment structure, and state-specific assumptions, and it changes whenever terms change, which means the platform has to compute it from the deal record under the right state ruleset. Get the calculation from the system, not from a spreadsheet someone built in a hurry.
Changes trigger it again. When the amount, term, or fees move between the first offer and the signature, the disclosure has to move with them, and a re-disclosure needs to happen before the merchant accepts the new terms. A CRM that versions disclosures against deal revisions makes that automatic instead of a scramble.
The laws convert the deal file into a compliance file. A purpose-built MCA CRM treats the disclosure as a first-class document: generated from the deal terms, tied to the correct state ruleset, delivered through a logged channel, and retained on a schedule the platform enforces. Four capabilities carry the weight.
The system should produce the correct disclosure template from three inputs: the product type, the transaction amount against the state threshold, and the merchant’s state. Rulesets for California and New York, plus each additional state you sell into, live as configuration rather than as a folder of PDFs someone maintains by memory. The annualized rate computes from the same deal data that drives the offer, so the disclosure and the contract never disagree.
Regulators do not ask whether you meant to disclose; they ask when and how. The platform should log the delivery channel, the timestamp, and any acknowledgment, for every disclosure, on every deal. Timing windows and re-disclosure triggers should be enforced as workflow guards, so a file physically cannot move to be funded with a missing or stale disclosure attached.
Retention windows run for years, commonly four depending on the state, and the platform should hold the disclosure, the delivery log, the deal terms at that moment, and the executed contract together for the full period. Legal holds should freeze records against routine cleanup. When an examination letter arrives, the answer is a filtered export, not a discovery project.
California provides a rescission window for certain transactions, which means the record has to show not just the disclosure but the timeline around acceptance. Amendments and re-disclosures need the same versioned treatment as originals. The merchant who changes their mind inside the window is a records test as much as a service moment.
Audit trail documentation is the difference between compliance and claims of compliance. When a regulator or a plaintiff’s counsel reviews a deal, the questions are consistent, and the system should answer each one from stored facts:
| The Question | What the System Must Show |
|---|---|
| Was a disclosure delivered? | Delivery event with channel and timestamp |
| Which version was delivered? | Document version linked to deal terms at that moment |
| When was it delivered relative to acceptance? | Timeline of offer, disclosure, and signature |
| Who prepared and sent it? | User attribution on every action |
| Did terms change afterward? | Version history with re-disclosure events |
| Can you produce it today? | Retention policy met, export on demand |
Immutability is the quiet requirement underneath all six. Audit entries should be append-only, with edits visible as new events rather than overwrites, because an audit trail someone can quietly revise is not an audit trail at all. Exports should render cleanly as PDFs with metadata, ready to attach to a response letter.
Hardcoding one state’s disclosure is the most common and most expensive mistake. Thresholds, definitions, and formats differ, and they keep changing as more states legislate, so the platform needs a ruleset architecture where adding a state is configuration, not development. A deal should pick up its obligations automatically from the merchant’s state and the product structure.
Workflow enforcement closes the loop. The deal stage model should refuse to advance without the required disclosure logged, and renewals, as new transactions, should trigger the same treatment as first fundings. Compliance becomes a property of the pipeline rather than a habit of the team.
Start with an inventory: which states you sell into, which products you offer, and which transactions cross each threshold. Map those against disclosure templates, configure the retention policy, and run a test deal through the full path, offer, disclosure, delivery, signature, and archive, before the first live file. The exercise usually surfaces gaps in a day that would otherwise surface in an examination.
If mapping obligations across states sounds like a project you would rather hand off, Contact us and we will configure the rulesets, templates, delivery logging, and retention policies around the states you actually serve. The goal is a system where the compliant path is the only path.
Platforms such as ConvergeHub keep disclosures, timestamps, and the deal record in one place, with document storage and an audit trail that behaves like a compliance file rather than an afterthought. When the regulator’s letter arrives, the answer is a report, not a reconstruction.
Yes. Both California and New York expressly cover sales-based financing, which is the category an advance falls into, and both extend obligations to brokers as well as funders. The specific thresholds and formats vary by state and continue to evolve, so map each state you sell into.
It is the APR-style cost figure states require so merchants can compare products on one scale, calculated by a prescribed formula rather than a normal interest rate, since an advance is a purchase of receivables. The platform should compute it from deal terms under each state’s methodology. Hand math is how discrepancies happen.
Retention windows run for years, with four years commonly cited under New York’s regime and similar periods in other states, and the safest posture is retention for the longest period that applies to you. The system should enforce the schedule automatically. Confirm the current requirement for each state with counsel.
In several states, yes. New York requires broker registration with its financial regulator, and California imposes reporting obligations on brokers under its regime. Registration status should live on the broker record so unregistered partners cannot be assigned covered deals. Verify current rules for each state.
Yes. Documents, version history, timestamps, and user-level audit trails attach to the deal record, and retention policies can be configured to match your obligations. The disclosure travels with the deal instead of living in a folder beside it.
State disclosure laws changed what an MCA CRM has to hold: not just the pipeline, but the generated disclosure, the delivery timestamp, the terms at that moment, and the audit trail that ties them together, retained for years and exportable on demand. Building that into the workflow, rather than reconstructing it after a request, is the difference between a routine examination and an expensive one. Multi-state rulesets, enforced retention, and append-only logs are the features that carry the load.
To bring your recordkeeping up to the map, schedule an appointment with ConvergeHub. We will review the states you serve, configure the disclosure rulesets and retention policies, and test the full path on live deals before you rely on it. The laws keep expanding; your records should be ahead of them.
