32 CFR § 232.4
General conditions. A creditor who extends consumer credit to a covered borrower may not require the covered borrower to pay an MAPR for the credit with respect to such extension of credit, except as:
(1) Agreed to under the terms of the credit agreement or promissory note;
(2) Authorized by applicable State or Federal law; and
(3) Not specifically prohibited by this part.