The CFPB has issued its first No-Action Letter, pursuant to a policy issued last year. We previously outlined the No-Action Letter Policy here, but to briefly summarize, under the Policy the CFPB will, in exceptional cases, issue an informal, non-binding letter indicating that it does not currently intend to take action under a specific consumer financial protection law or regulation (except for the prohibition on unfair, deceptive, or abusive acts or practices (UDAAP). Industry participants may submit applications for a No-Action Letter. The CFPB reviews both the applicant and the proposed product or service.
According to its application, the Upstart Network, Inc., which provides an online lending platform, seeks No-Action protection for a non-traditional underwriting model focused on "thin file" applicants, meaning individuals with limited credit history. Upstart's underwriting model looks to the borrower's financial indicators "[a]s well as his or her education and/or experience."
The No-Action Letter issued to Upstart provides that the CFPB does not intend to take action regarding Upstart's automated underwriting of applicants for unsecured non-revolving credit, as described in Upstart's application, with regard to application of the Equal Credit Opportunity Act (ECOA) and its implementing regulation, Regulation B. The Letter will expire in three years, although Upstart can seek to renew the Letter. Under the Letter and the No-Action Policy, Upstart is required to report lending and compliance data to the CFPB on a regular basis.
Importantly, the No-Action Letter does not protect Upstart if the automated underwriting is applied in a different manner than described in the company's application. The Letter also does not protect Upstart from UDAAP liability for activities using the automated underwriting program.
Moreover, since the No-Action Letter is written at a high level, and based on the applicant, as well as the proposed product or service, third parties will not be able to rely on the Letter with regard to their own products and services. In particular, neither Upstart's application nor the CFPB's No-Action Letter addresses exactly how Upstart intends to handle the ECOA/Regulation B challenges implied by alternative data underwriting, including running afoul of prohibited bases and proxies, as well as practical compliance challenges such as the content of adverse action letters.
While receiving a No-Action Letter can provide a degree of protection for novel or newly developed financial products or services, there are certain risks (and no guarantees) in submitting an application to the CFPB. However, the CFPB's first No-Action Letter does indicate a willingness by the Bureau to explore alternative data for credit underwriting, as long as sufficient consumer protections are in place.