The Consumer Financial Protection Bureau (CFPB) has finally taken action on the long-dormant Project Catalyst initiative to issue no-action letters (NALs) to companies taking new and creative approaches to providing consumer financial services and products. This CFPB initiative is aimed at offering startups the opportunity to request more clarity on how the CFPB will be reviewing new business models. On September 14, 2017, nearly three years after first proposing to do so, the CFPB announced its first NAL issued to a company that uses alternative data to make credit and pricing decisions. The long delay before the first NAL suggests it is a controversial process within the CFPB that took time to navigate.
While limited, there are a few lessons to glean from this first NAL:
- NALs will likely include very little detail.
- The CFPB will retain as much latitude to supervise and enforce covered entities as possible, even while issuing NALs.
- Recipients of NALs may be required to provide detailed information about their compliance mechanisms on a continuing basis.
The company, Upstart Network Inc., operates an online lending platform for personal loans, such as credit card refinancing, student loans, and debt consolidation – all policy areas where the CFPB has been very active in recent years. Inherent in lending based on nontraditional consumer data is the risk of violating the Equal Credit Opportunity Act (ECOA) and its implementing regulation, Regulation B, as well as committing unfair, deceptive, and abusive acts and practices (UDAAPs). We discussed these risks last year in a previous advisory. Upstart’s NAL explains that the CFPB “has no present intention to recommend initiation of an enforcement or supervisory action” under ECOA or Regulation B against Upstart for the company’s “automated model for underwriting applicants for unsecured non-revolving credit.” The NAL explains that it is limited to the business model Upstart described in its application, and that the NAL should not be viewed as an “interpretation, waiver, safe harbor, or the like.” The NAL fails to mention its intentions under UDAAP.
The NAL also contains conditions requiring Upstart to regularly report lending and compliance information to the CFPB. As it says in its press release, the CFPB is requiring this information to “mitigate risk to consumers and aid … [its] understanding of the real-world impact of alternative data on lending decision-making.” The NAL expires after three years and may be renewed.
The CFPB has received years of criticism for what many have called “regulation by enforcement.” Last year, CFPB Director Richard Cordray noted in a speech that this criticism is misplaced, and what his agency is doing is really “working toward a pattern of actions that conveys an intelligible direction to the marketplace, so as to create deterrence that can be readily understood and implemented.” Still, financial services companies, and particularly startups, face continued uncertainty about how new products and services will be received once the CFPB turns its gaze on these new practices.
The No-Action Letter Process
In 2012, the CFPB announced an initiative aimed at providing startups more clarity on how the CFPB will be reviewing new business models, known as Project Catalyst. This initiative, in turn, produced the NAL final policy statement. Project Catalyst operates like a sort of regulatory sandbox, providing a point of contact for the CFPB to engage with startups and “encourage consumer-friendly innovation in markets for consumer financial products and services.” The CFPB created Project Catalyst in November 2012, with the goal of encouraging marketplace innovation by working with companies developing new and emerging financial products that are safe and beneficial for consumers. Project Catalyst resides in the CFPB’s Front Office, which reports directly to the director. Project Catalyst staff worked to establish communication channels with industry stakeholders to collaborate on research and the development of CFPB policies that would encourage innovation.
The NAL process, in turn, which is conducted by the head of Project Catalyst, was initially proposed in October 2014, but the final NAL policy was not issued until February 2016. The NAL policy provided a mechanism by which companies, and particularly startups, could submit details of a proposed financial product or service and receive a statement from CFPB staff that would reduce regulatory uncertainty for a new product or service that offers the potential for significant consumer-friendly innovation. This process has been a move much-anticipated by those in the industry, as many other agencies already offer NALs or similar statements that provide regulatory certainty to regulated entities, including the SEC, IRS, Financial Crimes Enforcement Network (FinCEN), and Financial Industry Regulatory Authority (FINRA).
Under the NAL policy, the CFPB, in its sole discretion, may issue NALs to specific applicants in instances involving innovative financial products or services that promise substantial consumer benefits but also include substantial regulatory uncertainty. An NAL advises the recipient that, subject to its stated limitations (including time, volume, transactions, or otherwise), the CFPB staff has no present intention to recommend initiation of an enforcement or supervisory action against the requester about the specified matter.
Additionally, NALs are subject to modification or revocation at any time at the discretion of CFPB staff and may be conditioned on particular undertakings by the applicant on product or service usage and data-sharing with the CFPB. NALs generally will be disclosed publicly. Importantly, NALs are nonbinding on the CFPB and do not bind courts or other actors who might challenge an NAL recipient’s product or service, such as other regulators or parties in litigation.
It announcing its NAL policy, the CFPB highlighted the following criteria to determine whether to issue an NAL:
- The extent to which the requester’s product structure, terms and conditions, and disclosures allow the consumer to assess and protect themselves from unnecessary cost and risk, and how the requester controls for and mitigates risks to consumers.
- The extent to which evidence indicates that the product provides substantial benefits to consumers, and whether asserted benefits are already available to consumers through other products in the marketplace.
- The extent to which the substantial regulatory uncertainty identified by the requester may be better addressed through other regulatory means, such as the CFPB rulemaking process, other CFPB guidance, or provision of a waiver under the CFPB’s Policy to Encourage Trial Disclosure Programs.
- Whether the requesting entity is demonstrably in compliance with other relevant federal and state regulatory requirements.
- The extent to which any data regarding the operation of the product will be expected to further consumer protection, and further, the extent to which the requester would permit public disclosure of relevant data.
Upstart Network’s Application
In addition to issuing Upstart an NAL, the CFPB also published Upstart’s responses to the NAL application questions. Upstart’s responses more fully detail the company’s offered products and services, and relevant to the ECOA analysis, describe the eligibility requirements for credit applicants and the marketing tactics the company uses. Upstart is an online lending platform that utilizes both traditional credit scores and modeling techniques, as well as additional financial indicators such as the borrowers’ employment and education. Upstart states that it uses these additional factors “to develop a statistical model of the borrower’s financial capacity and personal propensity to repay” for “thin file” applicants.
Upstart describes its advertising as both intent-based and demographic-based. Intent-based advertising targets those individuals who are actively looking for a loan. Upstart claims to not target individuals based on specific demographic criteria, but rather “focuses on audiences that share characteristics with individuals who have received rates, applied for loans, or obtained loans through Upstart.” Additionally, Upstart states that it does not advertise based on any prohibited bases pursuant to ECOA or Regulation B.
Finally, Upstart makes numerous assurances to the CFPB in its application. For example, Upstart promises to monitor compliance with all laws and regulations through “real-time systematic checks, daily health checks of loan data, frequent review of loan data and disclosures, ongoing analyses of customer complaints, and a variety of external reporting to third parties.” Furthermore, Upstart notes that it is going to conduct research in the future on “the predictiveness of certain behaviors related to cash flow and affordability, voluntary consumer actions, or other potential variables.” Upstart commits to sharing the results of its fair lending and access-to-credit tests with the CFPB.
What This Means Going Forward
- It is still early: The CFPB’s issuance of its first NAL is a significant moment for the financial services industry, but there is still reason to be wary of putting too much weight on the NAL process just yet. In particular, Upstart’s NAL states clearly that it is “limited to Upstart’s automated model for underwriting applicants for unsecured non-revolving credit” as described in Upstart’s application, and “should not be viewed as an interpretation, waiver, safe harbor, or the like, nor should it be viewed as binding” on the CFPB.
- NALs provide limited insight: Much like CFPB enforcement actions, the industry will be looking at the details of Upstart’s program to determine what kind of new products and services the CFPB considers permissible. Caution is still warranted, however, because the NAL is based on Upstart’s application details, some of which are confidential, and therefore not public. For any company considering alternative data for credit decisions, experienced counsel is highly recommended.
- There is a price: As seen in Upstart’s NAL, receiving a CFPB NAL likely will be tied to continued sharing and disclosure of company data and complex compliance requirements. To take advantage of this opportunity, companies have to be willing and prepared to welcome the CFPB to investigate their compliance management systems. This is not an insignificant price to pay for most institutions, given that it exposes the company to further scrutiny and potential issues in other areas not covered by the NAL. It also gives companies little protection when it comes to courts or other actors, such as other regulators and litigants, who might challenge an NAL recipient’s practices.
- Highly selective process to-date: For those companies considering submitting applications for an NAL, they should be mindful that the CFPB went nearly three years without issuing an NAL, and stated in the NAL policy that NALs will be issued “rarely,” and the CFPB will likely receive only “one to three actionable applications per year.” Going on recent history, it seems the chances of receiving an NAL are still quite low.
- Topics ripe for consideration: Anyone following the CFPB’s work over the course of the last five years will find it no surprise that the first-ever issued NAL relates to improving the landscape for consumers in credit scoring. The agency has been vocal about this issue through its many outlets of policy communication. In speculating what other areas of the financial services industry the agency might entertain the NAL process, companies should look to the policy issues the agency has focused on in recent years, such as student lending, payday/installment lending, and personal finance management, to name a few.
- Future opportunities: Although the NAL process has been slow to materialize with the first issuance of an NAL, we expect other companies may want to engage the CFPB in the NAL process moving forward. Like anything else, it takes federal agencies a long time to build capabilities such as this, especially in a regulatory landscape where cutting a deal with an institution isn’t necessarily at the top of the priority list. Even so, many have speculated about Director Cordray’s departure from the agency, and it is quite possible that new leadership would view this process differently. There is potentially a regulatory future where we see these letters issued more frequently and without as many constraints to their applicability.
Conclusion
This is the first, but may not be the last, NAL issued by the CFPB. While we anticipate their issuance to be rare, companies pursuing innovative strategies may still be able to achieve some regulatory clarity through this process. The consumer financial services and products landscape is changing rapidly and keeping pace with the expansion of mobile technology and data aggregation and analysis. If a company is committed to compliance, and seeks the potential competitive edge an NAL could provide, then this process may be for you. Now that Project Catalyst appears to be opening its doors, those who have eyed the NAL process with suspicion in the past may want to consider taking a second look.
Alston & Bird is uniquely situated to aid companies in considering and pursuing CFPB NALs, with established teams focused on corporate law, federal and state consumer finance regulation, bank regulation, payment systems, and privacy and data security.