CFPB issues new fintech sandbox and no-action letter policy

The Consumer Financial Protection Bureau issued a slew of actions on several fronts this week, including restarting a fintech sandbox program and recognizing the standard-setting body for open banking.

The CFPB issued separate policy statements on “sandbox approvals” and no-action letters for fintechs. Both policies are expected to be rescinded by an acting CFPB director appointed by President-elect Donald Trump.

The policy statements were included at the bottom of an order issued Wednesday recognizing Financial Data Exchange, or FDX, as a standard-setting body under the CFPB’s 1033 personal financial data rights rule. The recognition of FDX is the first issued under the rule and is subject to a ban on conflicts of interest. FDX is required to report on market use of standards to the CFPB and to ensure access to the public of information about its standards.

The CFPB released its open banking rule in October, which requires banks and other financial institutions to provide a customer’s personal financial data to another provider for free at the consumer’s request. The CFPB created a formal application process outlining the qualifications to become a recognized industry standard-setting body.

Separately, the CFPB also issued updated procedures for companies seeking special regulatory treatment. The sandbox policy allows the CFPB to provide a safe harbor for compliance with the Truth in Lending Act, the Equal Credit Opportunity Act and the Electronic Fund Transfer Act. The no-action letter policy states that the CFPB will not take supervisory or enforcement action against a product or service that complies with its requirements. 

In 2022, CFPB Director Rohit Chopra scrapped a fintech sandbox program and no-action letter policy created by his predecessor, former Director Kathy Kraninger. She had agreed to give fintechs a legal safe harbor and relief from supervisory and enforcement actions if the companies applied to the bureau to test their products.

The two policy statements differ substantially from prior versions, most notably by including a ban on applications submitted by former CFPB attorneys representing companies as outside legal counsel. The bureau said it created the ban to avoid the appearance of conflicts of interest.

Richard Horn, co-managing partner of Garris Horn and a former senior counsel and special advisor at the CFPB, said a ban on former CFPB attorneys “is most likely illegal.”

“There’s a plausible argument that this is a violation of the Constitution, and it doesn’t appear that they really did any analysis,” Horn said. “I can’t imagine that they don’t know the next administration is going to overhaul these programs and make them less restrictive. It’s very easy to rescind a policy statement.”

The CFPB said it wants to avoid the appearance of endorsing any product or service because past policies had the effect of conferring special status on companies that received approvals.

For the sandbox policy, the bureau said it is seeking to enable innovations that solve real problems or unmet needs in financial markets.

“Minor adjustments to existing products, or products that are designed to take advantage of gaps in laws rather than bringing new offerings to market, do not confer significant enough benefit on consumers to warrant the expenditure of government resources necessary to issue and monitor approvals,” the bureau said. 

To avoid giving any firm a first-mover advantage, and to avoid picking winners and losers, the CFPB said it will proactively reach out to any program applicants’ competitors and invite them to apply for the same approval. It also will not grant an approval on a specific topic to a single firm, which it said “can create the false appearance of endorsement or favored regulatory status and can distort competition.”

The CFPB said it will post approvals to an open docket on the regulations.gov website and will accept comments for 60 days. 

Chopra terminated a no-action letter given to online lender Upstart Network because the company had asked for changes to both the terms of its agreement and its artificial intelligence-based underwriting model.

The bureau said in the policy statement that it experienced “a number of potential abuses and challenges with the [no-action letter] policy that led to the decision to allow the prior policy to expire.”

Under the 2017 agreement with Upstart, the CFPB agreed not to enforce the Equal Credit Opportunity Act for its use of “artificial intelligence” in credit underwriting on behalf of bank partners, which led to Upstart becoming a leader in this market. The bureau said the market interpreted the no-action letter “as an endorsement that Upstart’s model did not violate the ECOA.”

A few years later, several nonprofits found that Upstart had incorporated the educational history of borrowers, including what university an applicant attended, in its lending model and a monitor found that the lender’s model caused “‘statistically and practically significant’ adverse approval/denial disparities for Black applicants,” the bureau said.