A used car dealer can offer financing in one of two ways: lend to the buyer directly (Buy Here Pay Here) or broker the loan through an outside bank or credit union. Both models are legal, both are heavily regulated, and the choice between them drives almost every other decision you will make, from how much capital you tie up to which federal disclosures land on your desk. What follows is the federal baseline that applies in every state. Your own state’s retail installment sales act, dealer licensing statute, and interest rate ceiling sit on top of it, and you need to read them before you write a single contract.
Choose Your Financing Model
In a Buy Here Pay Here operation, the dealership is the lender. You fund the loan from your own capital, collect monthly payments, and carry the full risk of default. The title stays in the dealership’s name as lienholder until the balance is paid. This gives you complete control over approval criteria, interest rates, and collections, which is why BHPH dominates the subprime end of the used car market where traditional lenders will not extend credit.
The tradeoff is capital. Every car you finance ties up cash that cannot be reinvested in inventory until the buyer pays it back over months or years. Default rates on BHPH portfolios run significantly higher than conventional auto loans, so pricing that risk into your interest rate is the entire business model. No federal usury cap applies to motor vehicle retail installment contracts, but most states impose their own ceilings, and the range is wide. Setting rates without checking your state’s limit is one of the fastest ways to lose a license.
Indirect financing puts the dealership in an intermediary role. You collect the buyer’s credit application, submit it to banks or credit unions through an electronic platform, and wait for approval. Once a lender agrees to fund the deal, the lender pays you for the vehicle and takes on the credit risk. The buyer pays the lender, not you.
Dealers earn money on indirect deals through what the industry calls dealer reserve. The lender quotes a wholesale interest rate (the “buy rate”) based on the buyer’s credit profile. You mark that rate up when presenting terms to the buyer, and the difference is your compensation for originating the loan. The markup is discretionary, and that discretion has drawn federal scrutiny. The Consumer Financial Protection Bureau has flagged the practice as a potential source of discriminatory pricing when similarly qualified buyers end up paying different rates, and it has pushed lenders toward flat-fee compensation. Keeping your markup consistent and documented is your defense against a fair-lending complaint.
Licenses and Bonds You Need Before You Lend
Every state requires a dealer license before you can sell vehicles, and most require a surety bond to get one. Bond amounts commonly fall between $25,000 and $50,000 for retail dealers. If you plan to operate as a BHPH lender or charge interest on installment contracts, many states require a separate consumer credit or sales finance license on top of the dealer license. Initial fees for that license range from a few hundred dollars to several thousand depending on the state, and renewal is usually annual.
These are not optional add-ons. Extending credit without the right license can void your contracts, expose you to state enforcement actions, and make it impossible to collect on outstanding balances. Before you finance your first deal, confirm with your state’s motor vehicle division and financial regulator exactly which permits you need.
Federal Rules That Govern Every Financed Sale
The FTC Buyers Guide
Federal law requires every used vehicle you offer for sale to display a Buyers Guide on the window. The form is mandated by the FTC’s Used Motor Vehicle Trade Regulation Rule, and removing it before a consumer purchase is a federal violation.1eCFR. 16 CFR Part 455 – Used Motor Vehicle Trade Regulation Rule
The Guide must show the make, model, year, and VIN, along with a clear statement of warranty status. If you sell “as is,” the Guide must say so. If you offer a warranty, it must specify whether it is full or limited, which systems are covered, the duration, and the percentage of repair costs the dealer will pay. The Guide must also tell the buyer to ask about an independent inspection and a vehicle history report. If the sale is conducted in Spanish, the Guide must be provided in Spanish.2Federal Trade Commission. FTC Used Car Rule – Buyers Guide The information on the Guide becomes part of the sales contract, so treat it as a binding disclosure rather than a window decoration.
Truth in Lending Disclosures
Any dealership that extends credit directly to a consumer falls under the Truth in Lending Act. Before the buyer signs, you must provide a written disclosure showing the annual percentage rate, the finance charge in dollars, the total of payments, and the payment schedule.3Federal Trade Commission. Truth in Lending Act The buyer should be able to read it without a finance degree.
TILA has teeth. A creditor who fails to disclose correctly faces civil liability of twice the finance charge, with class exposure up to the lesser of $1,000,000 or one percent of the creditor’s net worth, plus the consumer’s attorney’s fees and court costs.4Office of the Law Revision Counsel. 15 USC 1640 – Civil Liability Getting the math wrong on a retail installment contract is an invitation for litigation.
If you only arrange financing through outside lenders and never extend credit yourself, TILA’s disclosure obligations fall on the lender. Dealers who participate in setting the credit terms, including by marking up the interest rate, should know that federal enforcement does not always draw a bright line between “arranging” and “extending” credit.
Equal Credit Opportunity and Adverse Action
The Equal Credit Opportunity Act makes it illegal to deny credit or set different terms based on race, color, religion, national origin, sex, marital status, or age. It also prohibits discrimination because an applicant’s income comes from public assistance or because the applicant exercised rights under consumer credit laws.5Office of the Law Revision Counsel. 15 USC 1691 – Scope of Prohibition
When you deny an application or offer terms substantially worse than the buyer applied for, you must send a written adverse action notice stating the specific reasons for the decision. A generic rejection is not enough. Under Regulation B, the notice must go out within 30 days of a completed application.6eCFR. 12 CFR 1002.9 – Notifications This applies whether the decision is yours (BHPH) or came back from a third-party lender you then communicated to the buyer.
Pulling Credit and Risk-Based Pricing
The Fair Credit Reporting Act governs how you access and use a buyer’s credit history. To pull a consumer report you need a “permissible purpose,” which is satisfied when the buyer applies for credit. Written authorization is best practice and most dealers collect it on the application, but the legal baseline is permissible purpose rather than signed consent. The FCRA explicitly requires written authorization only for employment-related credit checks.7Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
Federal risk-based pricing rules require a separate notice when you use a consumer report and then offer credit terms materially less favorable than those offered to your best-qualified buyers. The notice has to tell the consumer that credit history influenced the terms.8eCFR. 12 CFR 1022.72 – General Requirements for Risk-Based Pricing Notices Many dealers satisfy the obligation by giving a credit score disclosure to every applicant rather than identifying case by case which buyers received worse terms. Either method works; what matters is having a written policy before the first deal.
The FTC Holder Rule
One of the most overlooked requirements is the FTC’s Preservation of Consumers’ Claims and Defenses Rule. Every consumer credit contract you use, whether you hold the paper yourself or sell it to a lender, must contain a specific notice in at least ten-point bold type. The notice tells the buyer that any holder of the contract is subject to the claims and defenses the buyer could raise against the dealership, with recovery capped at the amounts the buyer has already paid.9eCFR. 16 CFR Part 433 – Preservation of Consumers Claims and Defenses
In a BHPH deal, the notice applies directly to you. In an indirect deal where you accept the proceeds of a purchase-money loan, the lender’s contract with the buyer must still include it. Omitting it is an unfair or deceptive act under Section 5 of the FTC Act. Standardized contract forms from dealer associations almost always include the notice, but verify before relying on that.
Where the Military Lending Act Does Not Reach
The Military Lending Act caps interest at a 36% Military Annual Percentage Rate for consumer loans to active-duty service members and their dependents. The statute explicitly excludes loans made for the express purpose of financing a vehicle purchase and secured by that vehicle.10Office of the Law Revision Counsel. 10 USC 987 – Terms of Consumer Credit Extended to Members and Dependents A standard auto purchase loan at a BHPH lot generally falls outside the cap. The exclusion does not cover other credit products you might offer alongside the sale, such as separately financed add-on service contracts, so the distinction matters.
Privacy and Data Security Obligations
Auto dealers that arrange or extend credit are “financial institutions” under the Gramm-Leach-Bliley Act. That status triggers three overlapping federal obligations.
Privacy Notices
Before sharing a buyer’s nonpublic personal information with nonaffiliated third parties, you must provide a privacy notice explaining what you collect, who you share it with, and how the consumer can opt out.11Office of the Law Revision Counsel. 15 USC 6802 – Obligations With Respect to Disclosures of Personal Information For customers who sign a retail installment contract or lease, the notice must be delivered no later than the time of signing. This applies even if you immediately assign the contract to a third-party lender.12Federal Trade Commission. The FTCs Privacy Rule and Auto Dealers Frequently Asked Questions For a shopper who gives you information but does not buy, you only need the notice if you plan to share their data with nonaffiliated companies.
The Safeguards Rule
The amended FTC Safeguards Rule requires a written information security program. You must designate a Qualified Individual to oversee it. That person does not need a particular title or degree, but needs real security knowledge appropriate to your size and complexity.13Federal Trade Commission. FTC Safeguards Rule What Your Business Needs to Know You can hire an outside provider, but a senior employee at the dealership must supervise them.
The program must include a written risk assessment, access controls, encryption of customer information at rest and in transit, multifactor authentication, regular vulnerability testing, employee training, service provider oversight, and a written incident response plan. The Qualified Individual must report to leadership in writing at least once a year.14Federal Trade Commission. Automobile Dealers and the FTCs Safeguards Rule Frequently Asked Questions A breach exposing the records of 500 or more consumers must be reported to the FTC within 30 days.15eCFR. 16 CFR Part 314 – Standards for Safeguarding Customer Information
The Red Flags Rule
Because dealers that extend credit maintain “covered accounts,” the FTC’s Red Flags Rule requires a written Identity Theft Prevention Program. It must identify warning signs of identity theft relevant to your business, detect them in daily operations, respond when they appear, and be updated as new threats emerge.16Federal Trade Commission. Red Flags Rule Common red flags at a dealership include mismatched names on identification, addresses that do not match credit reports, and credit files inconsistent with the person in front of you.
Cash Payments Over $10,000
If a buyer pays more than $10,000 in cash for a vehicle (or in multiple related payments that cross the threshold), you must file IRS Form 8300 within 15 days of receiving the cash. Related transactions include multiple payments from the same buyer within 24 hours, or payments spread over time when you know or have reason to know they are connected. Splitting a transaction into smaller amounts to duck the threshold is itself a federal violation.17Internal Revenue Service. Instructions for Form 8300
Penalties for failing to file are severe, and intentional disregard carries no annual cap.18Internal Revenue Service. IRS Form 8300 Reference Guide Cash-heavy BHPH operations are particularly exposed because large currency down payments are common.
Infrastructure to Put in Place
A Dealer Management System with integrated finance and insurance modules is the operational backbone. It calculates payment schedules, generates compliant contracts, tracks inventory, and produces the records regulators will ask for. Improvised solutions tend to break down exactly when compliance matters most.
Pulling credit reports requires a relationship with at least one major credit bureau. Expect a site inspection of your dealership and ongoing monthly access fees. The bureau wants to confirm a legitimate location and adequate data security before granting access.
For indirect financing, you will need accounts on electronic platforms like DealerTrack or RouteOne, which connect you to lender networks and let you submit applications to multiple institutions at once. Building lender relationships takes time; lenders evaluate your financial health, reputation, and volume before granting access. Start by sending your business financial statements to each lender’s dealer relations department. A mix of prime and subprime relationships lets you place buyers across the credit spectrum.
A floor plan financing agreement is worth considering if you do not want every dollar of working capital locked up in inventory. Floor plan lenders advance the cost of acquiring vehicles, and you repay them when the car sells. For BHPH dealers who also need capital on hand to fund buyer loans, preserving liquidity this way matters.
Running a Deal From Application to Funding
A complete credit application collects the buyer’s full legal name, Social Security number, date of birth, current and previous addresses, employer information, and income. You will need a copy of a valid government-issued photo ID to verify identity. Pay stubs, tax returns, or bank statements confirm income. A recent utility bill confirms residency. BHPH dealers commonly collect personal references and verify employment by phone before approving. The depth of verification is a business decision, but skimping on it shows up later in your default rate.
The Retail Installment Sales Contract formalizes everything: the vehicle description and VIN, the sale price, any trade-in credit, the down payment, the finance charge, the APR, the payment schedule, and the total cost. Standardized forms from state dealer associations are built to include all required disclosures, including the Holder Rule notice. Transfer every data point accurately. An incorrect VIN or a mismatched name creates problems when you try to perfect the lien and can give the buyer grounds to challenge the contract.
For indirect deals, you transmit the application through your lending platform. Lenders respond with an approval, a counteroffer, or a denial. An approval specifies the buy rate, the maximum term, and any required down payment. You present terms to the buyer, including your rate markup, and finalize the contract. Both the buyer and a dealership representative sign, and the buyer receives a complete copy of everything signed. For BHPH deals, the approval decision is yours. You set the rate, structure the payments, and execute the contract directly.
After signing, perfect the lien by filing with your state’s motor vehicle agency. This typically means a title application showing the lienholder’s name, EIN, and mailing address, plus a filing fee that varies by state. Until the lien is recorded, the security interest in the vehicle is not fully protected. In a BHPH deal, you are the lienholder. In an indirect deal, the funding lender is. File within the time your state requires.
Repossession and Record Retention
BHPH dealers who hold their own paper need to understand repossession law. Under the Uniform Commercial Code, a secured party can repossess collateral after default without going to court, provided the repossession occurs without a breach of the peace.19Cornell Law School. UCC 9-609 – Secured Partys Right to Take Possession After Default “Breach of the peace” is not precisely defined, but it generally rules out force, threats, or confrontation. If the buyer objects in person, the agent has to walk away and pursue judicial remedies instead.
After repossession, the UCC requires written notice to the buyer before you sell or otherwise dispose of the vehicle. The notice must explain what will happen to the vehicle, how the buyer can redeem it by paying the outstanding balance, and the buyer’s right to an accounting of the debt. Skipping the notice or sending it late can create liability and, in some states, wipe out your right to collect a deficiency. State rules often add timing requirements and redemption rights on top of the UCC framework, so this is another area where state law controls the details.
Federal regulations set minimum retention periods for credit-related documents. Under Regulation B, records tied to adverse action decisions must be kept at least 25 months. TILA disclosures, signed contracts, credit applications, and Form 8300 filings all have retention requirements that may run longer depending on the regulation or your state’s rules. Many dealers default to keeping everything for at least four to five years, which covers overlapping federal and state timelines without sorting records by statute. Whatever period you choose, your Safeguards Rule obligations apply to stored records too. Old files holding Social Security numbers and income data are a data breach waiting to happen if they sit in an unlocked cabinet or an unencrypted folder.