State usury caps and the "rent-a-bank" problem, explained

Most states cap how much interest a lender can legally charge on a consumer loan. A real and growing share of high-rate online lending doesn't come from a state-licensed lender bound by that cap at all — it comes from a federally regulated bank partnered with a non-bank company, structured specifically so a state usury cap never applies to begin with. Whether that structure is a legitimate use of a real federal law or an evasion dressed up as one is a live, unsettled legal fight, not a settled question with one clean answer.

The federal rule the whole structure runs on

Federal law lets a chartered bank "export" its home state's interest rate nationwide, regardless of the borrower's own state's cap — a rule with two separate statutory sources depending on the bank's charter type: the National Bank Act, 12 U.S.C. § 85, for a nationally chartered bank, and the Depository Institutions Deregulation and Monetary Control Act of 1980 (DIDMCA), § 521, codified at 12 U.S.C. § 1831d, for a state-chartered, FDIC-insured bank. Practically, this means a bank chartered in a state with no usury cap at all, or a high one, can lend to a borrower anywhere in the country at that rate — a mortgage, a credit card, or a personal loan from an out-of-state bank has run on this exact mechanism for decades, largely without controversy.

The controversy starts with what happens next: a bank makes the loan, then quickly sells it — sometimes within days — to a non-bank company that actually services it, manages the risk, and keeps most of the economics. If the interest rate the loan carries could travel with it after that sale, a non-bank lender that could never itself get a state license to charge that rate gets the same outcome by having a bank originate the loan first and sell it immediately after. Critics call this "rent-a-bank" lending: the bank's charter is functionally rented out for the one thing it provides — rate-exportation privilege — while a non-bank company does everything else and keeps most of the profit.

Madden v. Midland Funding, and the "valid-when-made" doctrine that answered it

In 2015, the Second Circuit Court of Appeals' decision in Madden v. Midland Funding, LLC, 786 F.3d 246 (2d Cir. 2015), threw this structure into real doubt: the court held that a non-bank debt buyer that purchased charged-off credit card debt from a national bank could not continue charging the bank's original interest rate once the debt changed hands, reasoning that federal preemption under the National Bank Act protected the originating bank, not whoever bought the debt afterward. The ruling applied only within the Second Circuit (New York, Connecticut, Vermont), but it rattled a much broader swath of bank-partnership and debt-sale lending nationally, since it implied a purchased loan's legal interest rate could effectively change the moment it changed hands.

Both federal bank regulators moved to reverse that outcome for future lending. In 2020, the Office of the Comptroller of the Currency and the FDIC each finalized a "valid-when-made" rule, codifying the opposite of Madden's holding: if a loan's interest rate was legal when a bank originated it, that rate stays legal after the loan is sold or transferred, regardless of who now holds it. Multiple states and consumer-advocacy groups sued to block both rules; a federal district court upheld them in 2022, reasoning that the interest rate genuinely attaches to the loan itself at origination, not to whichever entity happens to hold it later. As of this writing, the valid-when-made rules remain in effect, and Madden's narrower holding is now largely confined to its original circuit.

The separate "true lender" fight — who actually made the loan?

A related but distinct question is who the "true lender" on a bank-partnership loan actually is in the first place — because a bank exporting its own home-state rate is one thing, but a non-bank company using a bank as a brief pass-through for a loan it designed, funds indirectly, and immediately buys back is a different fact pattern, one several courts and state regulators have found crosses the line into the non-bank partner being the real lender in substance, regardless of whose name is on the paperwork. In October 2020, the OCC finalized its own "true lender" rule, providing that a bank would be treated as the actual lender — and its rate-exportation right would apply — if, as of the date of origination, it either was named as the lender in the loan agreement or funded the loan, largely regardless of who designed the product or who bought it moments later. Congress disagreed: in June 2021, it repealed the OCC's true-lender rule under the Congressional Review Act, which — beyond undoing the specific rule — bars the OCC from ever issuing a "substantially similar" rule again without new statutory authorization from Congress. The valid-when-made rules described above were unaffected by that repeal, since they address a legally separate question (what happens to a legitimate loan's rate after a genuine sale), not who counts as the true originating lender in the first place.

States pushing back directly on rate exportation itself

Illinois took the most direct legislative swing at the underlying economics: its Predatory Loan Prevention Act (815 ILCS 123), effective March 2021, caps the all-in cost of most consumer loans made to Illinois residents at a 36% "Illinois APR," calculated using the same all-in methodology as the federal Military Lending Act (including most fees and ancillary charges, not just the stated interest rate), and declares any loan made above that cap void — with no entity permitted to collect, attempt to collect, or retain any principal, fee, or interest on it. The Act exempts banks and credit unions directly, but its drafters wrote specific anti-evasion language aimed at the bank-partnership structure itself, reflecting an explicit intent to reach loans routed through a bank specifically to avoid the cap.

Colorado tried a more direct legal challenge to DIDMCA rate-exportation itself: a 2023 state law exercised DIDMCA § 521(b)(2)'s own built-in opt-out provision, which lets a state refuse to be bound by out-of-state rate exportation for loans made in that state, effective July 2024. Lending-industry trade groups — the National Association of Industrial Bankers, the American Financial Services Association, and the American Fintech Council — immediately sued, and a federal district court granted a preliminary injunction blocking the opt-out in mid-2024. In a 2-1 decision on November 10, 2025, a Tenth Circuit panel reversed that injunction, holding that DIDMCA's opt-out provision reaches a loan "made in" Colorado, and that a loan counts as made there if either the lender or the borrower is located in the state — a reading that, if it had stood, would have let Colorado's rate cap reach loans an out-of-state bank makes to a Colorado resident, not just loans an in-state bank originates. It didn't stand for long: on April 2, 2026, the full Tenth Circuit vacated that panel decision and granted rehearing en banc, which automatically restored the original district-court injunction — meaning Colorado's opt-out is, as of this writing, blocked again pending the en banc court's own ruling, with briefing from federal banking regulators and a 21-state amicus coalition still ongoing into mid-2026 and no en banc decision issued yet. The practical, current answer for a Colorado borrower is that the pre-2023 rate-exportation rules still apply for now — but this is genuinely unsettled, first-impression litigation, not a settled outcome in either direction, and it's worth checking the case's current status directly before assuming either result.

None of this makes a specific high-rate loan automatically illegal, or automatically fine. Whether a particular bank-partnership loan is a legitimate use of a genuine federal rate-exportation right, or an evasion a court would treat as the non-bank partner's loan in substance, depends on the specific structure — who designed the loan, who funds it in practice, how quickly and completely the bank sells its interest, and which state's law and which court's reasoning applies. This is exactly the kind of company-specific, currently-unsettled legal terrain our standard's debt-consolidation checklist flags for direct disclosure rather than a blanket answer — see the checklist entry on usury-cap and bank-partnership disclosure in our debt consolidation loans explainer.

What to actually check before signing

Ask directly which entity is actually named as the lender on your loan agreement, and whether that entity is a bank at all — a state-licensed non-bank lender is bound by that state's own usury cap with no exportation right to invoke; only a genuine bank can attempt to export a rate in the first place.
If a bank is named, ask which state chartered it — the exported rate is that bank's home-state cap (or, for a state-chartered bank, the higher of that cap or roughly one point above the Federal Reserve discount rate), not a number the lender can set unilaterally.
A rate that would be illegal for a state-licensed lender in your state isn't automatically illegal for a genuine bank — but a company relying on a bank-partnership structure specifically to reach a rate no state-licensed lender in your state could legally charge is worth extra scrutiny, not an assumption either way.
Check whether your state has taken direct action here — Illinois's 36% all-in cap and Colorado's DIDMCA opt-out (however its litigation ultimately resolves) show state legislatures are actively testing new ways to reach this structure, and more states may follow.

Related: see debt consolidation loans, explained for how this same bank-partnership structure shows up specifically in that industry's standard checklist, and payday loans, explained for the separate, narrower state-by-state rate-cap patchwork that governs short-term payday lending specifically.