```

[Federal Register Volume 90, Number 6 (Friday, January 10, 2025)]
[Notices]
[Pages 1974-1979]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2025-00377]

-----------------------------------------------------------------------

CONSUMER FINANCIAL PROTECTION BUREAU

Policy Statement on Compliance Assistance Sandbox Approvals

AGENCY: Consumer Financial Protection Bureau.

ACTION: Policy statement.

-----------------------------------------------------------------------

SUMMARY: The Consumer Financial Protection Bureau (CFPB) is issuing 
this policy statement on Compliance Assistance Sandbox (Policy), which 
is intended to further objectives under Section 1021 of the Consumer 
Financial Protection Act.

DATES: This policy statement is applicable on January 10, 2025.

FOR FURTHER INFORMATION CONTACT: George Karithanom, Regulatory 
Implementation & Guidance Program Analyst, Office of Regulations, at 
202-435-7700 or at: https://reginquiries.consumerfinance.gov/. If you 
require this document in an alternative electronic format, please 
contact [email protected].

SUPPLEMENTARY INFORMATION:

I. Overview

    The CFPB is accepting applications for Compliance Assistance 
Sandbox Approvals (``Approvals''), as set forth in the policy statement 
below and subject to Conditions to Promote Innovation, Competition, 
Ethics and Transparency (``the Conditions''). The Conditions would be 
incorporated into individual Approvals and serve several purposes.
    To summarize the Conditions, they are first designed to ensure that 
Approvals promote innovations that solve unmet needs in markets for 
consumer financial products and services. Minor adjustments to existing 
products, or products that are designed to take advantage of gaps in 
laws rather than bringing new offerings to market, do not confer 
significant enough benefit on consumers to warrant the expenditure of 
government resources necessary to issue and monitor Approvals. Granting 
Approvals in such circumstances misallocates government resources 
towards advantaging slight variations of what is essentially the same 
product that is currently available in the market. The Conditions 
therefore

[[Page 1975]]

aim to enable innovations that solve real problems that consumers face 
in financial markets.
    Second, the Conditions ensure that Approvals do not compromise the 
competitive process. Innovation is maximized by competitive, open 
markets and robust rivalry among firms. In seeking to promote 
innovation, the Approvals program must not tilt the competitive playing 
field by picking winners and losers in markets, or appearing to do so. 
For this reason, the CFPB will affirmatively reach out to program 
applicants' competitors and invite them to apply for the same Approval 
topic. The CFPB will not grant an Approval on a topic for a single 
firm, to avoid granting a first-mover advantage in the market. The 
Conditions also prevent firms from advertising the receipt of an 
Approval, which can create the false appearance of endorsement or 
favored regulatory status and can distort competition.
    Third, the Conditions promote transparency and rigorous ethical 
standards. The CFPB will post applications for Approvals to an open 
docket on the regulations.gov website and will accept comment for 60 
days. To avoid ethical conflicts, the CFPB will not consider 
applications from former CFPB attorneys representing firms as outside 
counsel. The CFPB is concerned that former CFPB employees will use 
their relationships to obtain special treatment for specific firms in 
procuring Approvals, or that there is a risk of the appearance of 
special treatment by the public or specific firms seeking outside 
counsel. Because applicants' integrity is also critical for the 
programs' success, Approvals will not be granted to firms that have 
been the subject of an enforcement action involving prior violations of 
federal consumer financial law in the last five years. And to prevent 
bait-and-switch negotiation tactics experience under the prior Sandbox 
policy, where firms negotiated terms of Approvals with the CFPB and 
thereafter materially change the underlying products or services, 
Approvals will automatically be rescinded when recipients change their 
product or service so that it no longer fits the description provided 
in the application and described in the Approval, unless the Approval 
recipient applies for and receives an amended Approval. These 
safeguards ensure that the programs are facilitating stakeholder 
participation, government accountability, and integrity on the part of 
Approval applicants.\1\
---------------------------------------------------------------------------

    \1\ See, e.g., Letter to Dave Girouard, CEO, Upstart Network, 
Inc. (Feb. 13, 2023) (expressing ``concern about a recent report 
that found lenders' use of educational data to make credit 
determinations could have a disparate impact on borrowers of 
color''), https://www.brown.senate.gov/imo/media/doc/2020-02-13%20Senate%20letter%20to%20Upstart.pdf; Fair Lending Monitorship of 
Upstart Network's Lending Model (Mar. 27, 2023) (identifying 
``approval disparities for Black applicants''), available at https://www.relmanlaw.com/assets/htmldocuments/Upstart%20Final%20Report.pdf.
---------------------------------------------------------------------------

II. Background

    On September 10, 2019, the CFPB issued the ``Policy on the 
Compliance Assistance Sandbox.'' \2\ The Policy on the Compliance 
Assistance Sandbox sets forth how the CFPB would grant a company 
immunity from liability under one or more of three safe harbor 
provisions and provide an Approval concluding that the offering or 
providing of certain aspects of an individual company's product or 
service complies with the relevant Federal consumer financial law.
---------------------------------------------------------------------------

    \2\ 84 FR 48229 (Sept. 13, 2019).
---------------------------------------------------------------------------

    After conducting a review in 2022, the CFPB determined that the 
Policies failed to advance their stated objective of facilitating 
consumer-beneficial innovation.\3\ The CFPB also determined that the 
existing Policies failed to meet appropriate standards for transparency 
and stakeholder participation. The CFPB rescinded the policies, and the 
CFPB continued to develop new protocols to ensure that such tools were 
consistent with the objectives of the Consumer Financial Protection Act 
and did not raise ethical concerns.
---------------------------------------------------------------------------

    \3\ Statement on Competition and Innovation, 87 FR 58439 (Sept. 
27, 2022).
---------------------------------------------------------------------------

    As noted above, the CFPB experienced a number of potential abuses 
and challenges with the CAS policy, and with the NAL policy that is 
being reissued simultaneously with this policy, that led to the 
decision to allow the prior policies to expire. For example, the CFPB 
granted Upstart Network a NAL in 2017,\4\ committing to not enforce the 
Equal Credit Opportunity Act (ECOA) against the company for their use 
of ``artificial intelligence'' in credit underwriting on behalf of bank 
partners. Despite the fact that other companies had similar models, 
Upstart became a leader in this market after receiving the NAL, and 
outside observers appear to have interpreted the NAL as an endorsement 
that Upstart's model did not violate the ECOA.\5\ The CFPB extended 
that NAL in November 2020.\6\ Immediately after the extension, Upstart 
closed its initial public offering and began trading its stock on the 
Nasdaq Global Select Market on December 16, 2020,\7\ with an initial 
market capitalization of $1.88 billion.\8\ In 2021, Upstart originated 
1.3 million loans, totaling $11.8 billion, on behalf of bank partners.
---------------------------------------------------------------------------

    \4\ Id.
    \5\ MARCO DI MAGGIO, DIMUTHU RATNADIWAKARA, & DON CARMICHAEL, 
INVISIBLE PRIMES: FINTECH LENDING WITH ALTERNATIVE DATA, 3 (HARVARD 
BUSINESS SCHOOL, 2021), https://www.hbs.edu/ris/Publication%20Files/22-024_80dc9115-69cc-4564-99c6-3a937f275d31.pdf.
    \6\ https://www.consumerfinance.gov/rules-policy/competition-innovation/granted-applications/.
    \7\ https://ir.upstart.com/news-releases/news-release-details/upstart-announces-closing-initial-public-offering-and-full.
    \8\ https://www.reuters.com/technology/lending-platform-upstarts-shares-jump-nasdaq-debut-2020-12-16/.
---------------------------------------------------------------------------

    Around the same time as the IPO, several nonprofit organizations 
raised concerns about Upstart's use of educational criteria (e.g., 
educational history, which university the applicant attended) in its 
lending model. Upstart agreed to appoint an independent monitor to 
determine whether Upstart's model complied with the ECOA.\9\ 
Ultimately, the independent monitor ended the relationship after coming 
to an impasse with Upstart about how to assess compliance with 
ECOA.\10\ Notably, the monitor detected that the model caused 
```statistically and practically significant' adverse approval/denial 
disparities for Black applicants.'' \11\
---------------------------------------------------------------------------

    \9\ Relman Colfax PLLC, Fair Lending Monitorship of Upstart 
Network's Lending Model: Initial Report of the Independent Monitor, 
April 14, 2021, https://www.relmanlaw.com/media/cases/1088_Upstart%20Initial%20Report%20-%20Final.pdf.
    \10\ Relman Colfax PLLC, Fair Lending Monitorship of Upstart 
Network's Lending Model: Fourth and Final Report of the Independent 
Monitor, March 27, 2024, https://www.relmanlaw.com/assets/htmldocuments/Upstart%20Final%20Report.pdf.
    \11\ Id.
---------------------------------------------------------------------------

    When Upstart wanted to substantially change its model, under the 
terms of the NAL, Upstart was supposed to apply for a modification of 
the NAL. Upstart applied for a modification, but the CFPB did not have 
enough time to review the implications of the significant changes. 
Upstart thus requested a termination of the NAL in order to be able to 
make the changes more quickly. The request was granted.\12\
---------------------------------------------------------------------------

    \12\ In re November 30, 2020 No-Action Letter, Order to 
Terminate No-Action Letter (June 8, 2022), available at https://files.consumerfinance.gov/f/documents/cfpb_upstart-no-action-letter-termination_order_2022-06.pdf.
---------------------------------------------------------------------------

    The CFPB experienced similar challenges with its Sandbox Approval 
policy. For example, the CFPB issued a Sandbox Approval Order for 
Payactiv, Inc., a paycheck advance lender. It did not grant an Approval 
to any other paycheck advance lender. The CFPB discovered evidence 
suggesting that Payactiv was using the approval in marketing materials 
to misrepresent that

[[Page 1976]]

the CFPB endorsed Payactiv's product. On June 3, 2022, the CFPB 
informed Payactiv that, for this reason, it was considering terminating 
the approval order.\13\ Payactiv requested termination of the order, 
and the CFPB approved that termination request.\14\
---------------------------------------------------------------------------

    \13\ In re December 30, 2020 Sandbox Approval Order, Order to 
Terminate Sandbox Approval Order (June 30, 2022), available at 
https://www.consumerfinance.gov/about-us/newsroom/cfpb-rescinds-special-regulatory-treatment-for-payactiv/.
    \14\ Id.
---------------------------------------------------------------------------

    To correct these shortcomings, the CFPB developed the Conditions to 
Promote Innovation, Competition, Ethics, and Transparency that must be 
met for a Letter or Approval to be issued. They are incorporated in 
Part B of the Policy on Sandbox Compliance Assistance Sandbox that 
follows.

III. Regulatory Requirements

    This Policy on the Compliance Assistance Sandbox constitutes an 
agency general statement of policy and/or a rule of agency 
organization, procedure, or practice exempt from the notice and comment 
rulemaking requirements under the Administrative Procedure Act, 
pursuant to 5 U.S.C. 553(b). Because no notice of proposed rulemaking 
is required, the Regulatory Flexibility Act does not require an initial 
or final regulatory flexibility analysis.\15\ The CFPB has also 
determined that the issuance of the Bulletin does not impose any new or 
revise any existing recordkeeping, reporting, or disclosure 
requirements on covered entities or members of the public that would be 
collections of information requiring approval by the Office of 
Management and Budget under the Paperwork Reduction Act.
---------------------------------------------------------------------------

    \15\ 5 U.S.C. 603(a), 604(a).
---------------------------------------------------------------------------

IV. Policy Statement

    The text of the Policy is as follows:

Policy on the Compliance Assistance Sandbox

    In section 1021(a) of the Consumer Financial Protection Act (CFPA), 
Congress established the Consumer Financial Protection Bureau's 
(CFPB's) statutory purpose as ensuring that all consumers have access 
to markets for consumer financial products and services and that 
markets for consumer financial products and services are fair, 
transparent, and competitive.\16\ Relatedly, the CFPB's objectives 
include exercising its authorities under Federal consumer financial law 
for the purposes of ensuring that markets for consumer financial 
products and services operate transparently and facilitate 
innovation.\17\
---------------------------------------------------------------------------

    \16\ 12 U.S.C. 5511(a).
    \17\ 12 U.S.C. 5511(b)(3), (5).
---------------------------------------------------------------------------

    Congress has given the CFPB a variety of authorities under the CFPA 
and the enumerated consumer laws \18\ that it can exercise to promote 
this purpose and these objectives. These authorities include 
supervision and enforcement authority, and the authority to issue 
orders and guidance. These authorities provide the basis for the Policy 
on the Compliance Assistance Sandbox (CAS Policy or Policy) and the 
Approvals issued pursuant to the Policy.
---------------------------------------------------------------------------

    \18\ See 12 U.S.C. 5481(12) (listing the enumerated consumer 
laws).
---------------------------------------------------------------------------

    The primary purposes of the Policy are to provide a mechanism 
through which the CFPB may more effectively carry out its statutory 
purpose and objectives and to facilitate compliance with applicable 
Federal consumer financial laws.
    The Policy is not intended to, nor should it be construed to:
    a. restrict or limit in any way the CFPB's discretion in exercising 
its authorities, including the provision of compliance assistance other 
than pursuant to the Policy;
    b. constitute an interpretation of law,
    c. create or confer upon any covered person, consumer, or other 
external party any substantive or procedural rights, obligations, or 
defenses that are enforceable in any manner.
    In contrast, a particular Approval involves the CFPB's exercise of 
its supervision and enforcement discretion in a particular manner. It 
cannot bind, and never could bind, state plaintiffs or plaintiffs in 
private actions, including but not limited to states enforcing 
violations of federal consumer financial law under Section 1042 of the 
CFPA.
    The Policy consists of seven sections:
     Section A describes the compliance assistance available 
under the Policy;
     Section B describes the Conditions to Promote Innovation, 
Competition, Ethics, and Transparency;
     Section C describes factors the CFPB intends to consider 
in deciding whether to grant an application for compliance assistance;
     Section D describes the standard procedures the CFPB 
intends to use in providing compliance assistance;
     Section E describes procedures the CFPB intends to use for 
granting extensions of, modifying, and terminating compliance 
assistance;
     Section F describes how the CFPB intends to coordinate 
with other regulators with respect to compliance assistance; and
     Section G describes the CFPB's intentions regarding 
disclosure of information relating to approvals.

A. Compliance Assistance Approvals

    An Approval is provided by the CFPB to a particular entity under 
one or more of three statutory safe harbor provisions, based on the 
application of existing law to particular facts and circumstances.\19\ 
An Approval issued to a particular entity will state that, subject to 
good faith compliance with specified terms and conditions, the CFPB 
concludes for the reasons stated therein that offering or providing the 
described aspects of the product or service complies with the Federal 
consumer financial law identified therein.\20\ By operation of the 
applicable statutory provision, the recipient has a safe harbor from 
liability under the relevant statute, to the fullest extent permitted 
by these provisions, as to any act done or omitted in good faith in 
conformity with the Approval.\21\
---------------------------------------------------------------------------

    \19\ 15 U.S.C. 1640(f) (TILA); 15 U.S.C. 1691e(e) (ECOA); 15 
U.S.C. 1693m(d) (EFTA).
    \20\ For convenience, the Policy uses the term ``described 
aspects of the product or service'' to refer to the subject matter 
scope of a particular form of compliance assistance, including both 
the particular aspects of the product or service in question and the 
particular manner in which it is offered or provided. If a Sandbox 
applicant seeks more than one form of assistance under the Policy 
(for example, an approval under one statute and an approval under 
another statute), it is possible that these different forms may 
relate to different described aspects of the same product or 
service. If so, in order to enable the CFPB to respond expeditiously 
to the application, the applicant should make its best efforts to 
specify the described aspects that relate to each form sought. The 
CFPB recognizes that in some cases it may be difficult to determine 
precisely which aspects of a product or service implicate different 
legal provisions, particularly for applicants that lack the legal 
resources for a fully precise determination. In such circumstances, 
the applicant should provide the maximum specification practicable 
under the circumstances and explain the limits on further 
specification.
    \21\ See 15 U.S.C. 1640(f); 15 U.S.C. 1691e(e); 15 U.S.C. 
1693m(d).
---------------------------------------------------------------------------

B. Conditions To Promote Innovation, Competition, Ethics, and 
Transparency

    The following conditions apply to the Compliance Assistance Sandbox 
program:
    1. Applicants for CAS Approvals must establish a market problem, in 
the form of an unmet consumer need, that the new financial product or 
service solves.
    (a) Applicants must articulate the benefit to consumers that flows 
from the CFPB permitting the product or service to be sold at market 
with a safe harbor from liability under the law at issue.
    (b) A claim that a CAS Approval would increase access to the 
applicant's product or service is insufficient to establish a market 
problem. To satisfy

[[Page 1977]]

this requirement, the applicant must prove that their product or 
service is meeting an untapped consumer need.
    2. The CFPB will not grant a CAS Approval on a topic for a single 
firm.
    3. The CFPB will reach out to the applicant's competitors and 
invite them to apply for a CAS Approval on the same topic, to ensure 
that the CFPB does not select a single firm that gains a first-mover 
advantage in the market as a result.
    4. CAS Approvals will state that recipients may not market or 
promote the fact that their product or service received an Approval. 
Such marketing is inherently deceptive to consumers, creating the false 
impression that the CFPB endorses the product.
    5. The CFPB will post applications for a CAS Approval to an open 
docket on the regulations.gov website and will accept comment for 60 
days. In so doing, the CFPB will adhere to the confidentiality 
protections set forth in section G, below.
    6. The CFPB will generally not consider applications from companies 
that are represented by former CFPB attorneys as outside counsel, to 
avoid ethical conflict and to maintain the highest integrity in the CAS 
Approval program.
    7. The CFPB will not consider applications from companies that have 
been the subject of an enforcement action involving violations of 
federal consumer financial law in the last 5 years, or who are subject 
to a pending enforcement investigation by federal or state authorities.
    8. CAS Approvals will automatically be rescinded when recipients 
materially change their product or service so that it no longer fits 
the description provided in the application and described in the 
Approval, unless a modification is approved under Subpart E.
    9. Submitting CAS Approval applications under false pretenses, or 
with misleading or incomplete information, may be a violation of law 
and may be referred for potential prosecution.\22\
---------------------------------------------------------------------------

    \22\ 18 U.S.C. 1001.
---------------------------------------------------------------------------

C. Assessment of Applications for Compliance Assistance

    The CFPB may grant or deny a compliance assistance application in 
its sole discretion. If it chooses to grant an application, the CFPB 
also has discretion to grant the application in whole or only in part. 
In deciding whether to grant an application for compliance assistance, 
the CFPB intends to balance a variety of factors in considering the 
quality and persuasiveness of the application, as well as information 
about the applicant and the product or service in question derived 
through CFPB due diligence processes.

D. Procedures for Providing Compliance Assistance 23
---------------------------------------------------------------------------

    \23\ These procedures may be modified based on coordination 
efforts with other regulators, as specified in section F.
---------------------------------------------------------------------------

    When the CFPB decides to grant an application for compliance 
assistance, it intends to provide the recipient with a Compliance 
Assistance Statement of Terms (CAST) setting forth the terms under 
which compliance assistance is provided, including the types and scope 
of assistance provided to the recipient. The CAST will be signed by the 
Director, and by an officer of the recipient.\24\ The CFPB expects that 
the CAST will:
---------------------------------------------------------------------------

    \24\ If the CFPB decides to deny an application, it will inform 
the applicant of its decision. The CFPB intends to respond to 
reasonable requests to reconsider its denial of an application 
within 60 days of such requests. Applicants may withdraw, modify, 
and re-submit applications at any time.
---------------------------------------------------------------------------

    1. Identify the recipient;
    2. Specify the subject matter scope of the CAST, i.e., the 
described aspects of the product or service; \25\
---------------------------------------------------------------------------

    \25\ If these vary by the form of assistance sought, the 
document will specify the relevant aspects separately.
---------------------------------------------------------------------------

    3. State that the CAST and the compliance assistance provided:
    (a) Is limited to the recipient's offering or providing the 
described aspects of the product or service, and does not apply to the 
recipient's offering or providing different aspects of the product or 
service;
    (b) Is based on the factual representations made by the recipient, 
which may be incorporated by reference;
    (c) Does not constitute the CFPB's endorsement of the product or 
service that is the subject of the CAST, or any other product or 
service offered or provided by the recipient; and
    (d) Expires in 2 years.
    4. Require the recipient to consent to the CFPB's supervisory 
examination authority, if the recipient is not already subject to this 
authority;
    5. Require the recipient to inform the CFPB of: (a) material 
changes to information included in the application; and (b) material 
information indicating that the described aspects of the product or 
service are not performing as anticipated in the application; \26\ 
Pursuant to B.7, unless an applicant applies for an amendment pursuant 
to section E, CAS Approvals will automatically be rescinded when 
recipients change their product or service so that it no longer fits 
the description provided in the application and described in the 
Approval;
---------------------------------------------------------------------------

    \26\ ``Not performing as anticipated'' includes the 
materialization of consumer risks identified in the application, and 
the materialization of other consumer risks not identified in the 
application.
---------------------------------------------------------------------------

    6. Require the recipient to report information about the effects of 
offering or providing the described aspects of the product or service, 
including with respect to complaint patterns, default rates, or similar 
metrics that will enable the CFPB to identify material increase in any 
risk of injury to consumers;
    7. Where appropriate, include a commitment by the recipient to 
compensate consumers for CFPA actionable substantial injury caused by 
the recipient's offering or providing the described aspects of the 
product or service; \27\
---------------------------------------------------------------------------

    \27\ CFPA actionable substantial injury, as used in this Policy, 
means substantial injury that is not reasonably avoidable by the 
consumer, where such substantial injury is not outweighed by 
countervailing benefits to consumers or competition. See 12 U.S.C. 
5531(c); see also 12 U.S.C. 5536(a)(1)(B).
---------------------------------------------------------------------------

    8. Specify any other limitations or conditions, such as the 
duration of the compliance assistance,\28\ the nature and extent of the 
recipient's data-sharing, and the extent to which the CFPB intends to 
publicly disclose information about the recipient's participation; \29\
---------------------------------------------------------------------------

    \28\ The CFPB expects two years to be an appropriate duration 
for approvals in most cases, but recipients may apply for 
extensions. See section E.1.
    \29\ If an applicant objects to the disclosure of certain 
information and the CFPB insists that the information must be 
publicly disclosed for compliance assistance to be provided, the 
applicant may withdraw the application and the CFPB intends to treat 
all information related to the application as confidential to the 
full extent permitted by law.
---------------------------------------------------------------------------

    9. With respect to any approval the CFPB is providing the 
recipient: (a) state that, subject to good faith compliance with the 
CAST, the CFPB approves the recipient's offering or providing the 
described aspects of the product or service under the relevant law 
identified therein; \30\ and (b) explain the CFPB's basis for issuing 
the Approval;
---------------------------------------------------------------------------

    \30\ As noted in section A.1, the safe harbor associated with an 
approval only applies to acts done or omitted in good faith in 
conformity with the approval, and the approval will so state.
---------------------------------------------------------------------------

    10. State that: (a) the recipient may reasonably rely on any CFPB 
commitments made in the CAST unless or until the Approval expires or is 
terminated by the CFPB; and (b) the CFPB may terminate \31\ any 
approval

[[Page 1978]]

described in the CAST if: (i) the recipient fails to substantially 
comply in good faith with the specified terms and conditions of the 
CAST; (ii) the described aspects of the product or service do not 
perform as anticipated in the application; \32\ or (iii) a statutory 
change or Federal judicial holding causes the CFPB to conclude that the 
recipient can no longer rely in good faith on the CFPB's approval as 
the safe harbor provisions require; and
---------------------------------------------------------------------------

    \31\ No retroactive action premised on the described aspects of 
the product or service will lie under provisions covered by an 
approval. Actions that are not premised on the described aspects of 
the product or service associated with a particular approval are, by 
definition, not subject to any such restriction.
    \32\ Such ground includes the materialization of consumer risks 
identified in the application, or the materialization of other 
consumer risks not identified in the application.
---------------------------------------------------------------------------

    11. If the applicant also applied for a No-Action Letter using 
their application under the CAS Policy for compliance assistance, 
incorporate any No-Action Letter that the CFPB is issuing pursuant to 
the terms of the NAL Policy.\33\
---------------------------------------------------------------------------

    \33\ If the CFPB is providing a No-Action Letter to the 
recipient, any termination of the No-Action Letter will be in 
accordance with the NAL Policy.
---------------------------------------------------------------------------

E. Procedures for Extension, Modification, and Termination

1. Extension Procedures
    Recipients of compliance assistance may apply for an extension of a 
specified period of time. In considering applications for extensions, 
the CFPB expects to place particular weight on the extent to which the 
data provided to the CFPB under the terms of the CAST shows that the 
described aspects of the product or service are benefitting consumers, 
not causing unanticipated harms, and not materially increasing the risk 
of substantial injury. Such applications for an extension should 
include the proposed duration of the extension and should be submitted 
no later than 90 days prior to the expiration of the compliance 
assistance under the terms of the CAST.\34\ The recipient should 
explain the reasons for the requested extension, such as whether it is 
intended to last until a possible amendment to CFPB regulations or the 
Commentary, or is instead intended for more particularized compliance 
assistance purposes.
---------------------------------------------------------------------------

    \34\ Assuming the two-year period the CFPB expects to be 
appropriate in most cases, the CFPB believes recipients would have 
sufficient time to gather evidence supportive of an extension 
request. For periods of one year or less, the CFPB may consider an 
extension deadline appropriate for the period in question.
---------------------------------------------------------------------------

    Upon the presentation of persuasive data, the CFPB anticipates 
granting such extension applications for a period at least as long as 
the period of the applicant's original receipt of assistance. The CFPB 
anticipates permitting longer extensions where the CFPB is considering 
amending applicable regulatory requirements or the relevant 
Commentary.\35\ During the time period pending a rule or Commentary 
amendment, the CFPB intends to consider means of providing similar 
assistance to other covered entities that engage in the same or similar 
conduct in offering or providing comparable products.
---------------------------------------------------------------------------

    \35\ The CFPB's plans regarding rulemaking activity are set 
forth in its Semiannual Regulatory Agenda, published in full on 
www.reginfo.gov. If the period of an extension were tied to the 
CFPB's consideration of amending relevant regulatory provisions and 
the CFPB announced it was discontinuing its plans to amend the 
provisions in question, the extension period would be adjusted 
accordingly, e.g., to end on a specific date.
---------------------------------------------------------------------------

2. Modification Procedures
    A recipient of compliance assistance may apply for a modification 
of the CAST. The recipient may seek modification to address an 
anticipated or unanticipated change in circumstances, such as 
iterations of the underlying product or service or changes to the 
information included in the application for assistance. Applications 
for a modification should include the following:
    a. Any material changes to the information included in the original 
application;
    b. The specific requested modification to the CAST;
    c. The grounds for modifying the CAST; and
    d. Any other information the recipient wishes to provide in support 
of the modification application.
    In deciding whether to grant an application for modification, the 
CFPB intends to balance a variety of factors, including the quality and 
persuasiveness of the application. The CFPB expects to grant or deny 
such applications within 30 days of notifying the applicant that the 
CFPB has deemed the application to be complete. When the CFPB grants an 
application for modification, it intends to provide the recipient with 
a modified CAST in accordance with the procedures specified in Section 
D.
3. Termination Procedures
    The CFPB intends that the recipient of compliance assistance should 
be able to reasonably rely on any CFPB commitments made in the 
associated CAST.
    The CFPB expects that a CAST will state that: (a) the recipient may 
reasonably rely on any CFPB commitments made in the CAST; and (b) the 
CFPB may terminate any approval described in the CAST if: (i) the 
recipient fails to substantially comply in good faith with the 
specified terms and conditions of the CAST; (ii) the described aspects 
of the product or service do not perform as anticipated in the 
application; \36\ or (iii) a statutory amendment or federal judicial 
holding causes the CFPB to conclude that the recipient can no longer 
rely in good faith on the CFPB's approval as the safe harbor provisions 
require. By operation of law, no retroactive action premised on the 
described aspects of the product or service will lie under provisions 
within the scope of an approval, except where a failure to 
substantially comply in good faith with the terms of the Approval 
caused consumer harm or where the CFPB's initial granting of the 
Approval failed to comply with the Administrative Procedure Act or 
other law. If the CFPB is also providing a No-Action Letter to the 
recipient, termination will be in accordance with the NAL Policy.
    Before terminating any approval provided under the Policy, the CFPB 
may, in the appropriate cases, notify the recipient of the possible 
grounds for termination and permit an opportunity to respond within a 
reasonable period of time. In its discretion, the CFPB may offer the 
recipient an opportunity to modify its conduct to avoid termination. 
The CFPB may allow the recipient to wind-down the offering or providing 
of the described aspects of the product or service during a period of 
six months before termination is effective, unless the described 
aspects of the product or service are causing injury to consumers, and 
a wind-down period would permit such injury to continue. If the CFPB 
terminates any approval provided under this Policy, it will do so in 
writing and specify the reasons for its decision. The CFPB will publish 
termination decisions on its website.

F. Regulatory Coordination

    Section 1015 of the CFPA instructs the CFPB to coordinate with 
Federal agencies and State regulators, as appropriate, to promote 
consistent regulatory treatment of consumer financial and investment 
products and services.\37\ Similarly, section 1042(c) of the CFPA 
instructs the CFPB to provide guidance in order to further coordinate 
actions with the State attorneys general and other regulators.\38\ Such 
coordination includes coordinating in circumstances where other 
regulators have chosen to offer assistance to entities offering 
innovative products and services. One method of providing such 
assistance is through a State sandbox, or group of State sandboxes, or 
other limited scope State authorization

[[Page 1979]]

program (State sandbox).\39\ The CFPB is interested in entering into 
agreements with State authorities that operate or plan to operate a 
State sandbox, which may include a process to receive compliance 
assistance under this Policy in a coordinated manner with assistance 
from the State sandbox.
---------------------------------------------------------------------------

    \37\ 12 U.S.C. 5495.
    \38\ 12 U.S.C. 5552(c).
    \39\ The concept of a regulatory sandbox is relatively new and 
does not have a precise, generally accepted definition. The term is 
used in this Policy to refer to a regulatory structure where a 
participant obtains limited or temporary access to a market in 
exchange for reduced regulatory uncertainty or other regulatory 
barriers to entry.
---------------------------------------------------------------------------

    Furthermore, the CFPB is interested in coordinating with other 
regulators more generally regarding this Policy. To this end, the CFPB 
intends to enter into agreements whenever practicable to coordinate 
compliance assistance under the Policy with assistance offered by 
State, Federal, or international regulators.

G. Disclosure of Information Relating to Approvals

    Public disclosure of information regarding approvals under this 
Policy is governed by applicable law, including the CFPA,\40\ the 
Freedom of Information Act (FOIA),\41\ and the CFPB's Rule on 
Disclosure of Records and Information (Disclosure Rule).\42\ The 
Disclosure Rule generally prohibits the CFPB from disclosing 
confidential information,\43\ and defines confidential information to 
include information that may be exempt from disclosure under the FOIA 
\44\--including Exemption 4 regarding trade secrets and confidential 
commercial or financial information that is privileged or 
confidential.\45\ The Disclosure Rule also defines business information 
as commercial or financial information obtained by the CFPB from a 
submitter that may be protected from disclosure under Exemption 4 of 
FOIA, and generally provides that such business information shall not 
be disclosed pursuant to a FOIA request except in accordance with 
section 1070.20 of the rule.\46\
---------------------------------------------------------------------------

    \40\ See, e.g., 12 U.S.C. 5512(c)(8).
    \41\ 5 U.S.C. 552.
    \42\ 12 CFR part 1070.
    \43\ 12 CFR 1070.41.
    \44\ 12 CFR 1070.2(f).
    \45\ 5 U.S.C. 552(b)(4).
    \46\ 12 CFR 1070.20(a), (b).
---------------------------------------------------------------------------

    Consistent with applicable law, the CFPB will publish on its 
website its final disposition of applications for approvals, as well as 
the application previously published on regulations.gov. If the CFPB 
decides to grant an application, it intends to publish an order 
regarding the decision on its website as soon as practicable. The CFPB 
expects that the order will overlap with the CAST provided to the 
recipient, but will contain other information and will not include 
information protected from public disclosure under applicable law. The 
CFPB expects the order to include: (i) the identity of the recipient; 
(ii) the described aspects of the product or service to which the 
approval applies; (iii) the approval's specified duration, basis, and 
legal authority; and (iv) in appropriate cases, a version of the 
summary of the application.\47\ The CFPB also intends to publish 
denials of applications on its website, including an explanation of why 
the application was denied in whole or in part.\48\
---------------------------------------------------------------------------

    \47\ When a regulated entity receives an approval in a 
coordinated manner with assistance under a State sandbox, the CFPB 
may be restricted in its discretion to further disclose information 
obtained from the relevant State authority. Nonetheless, the CFPB 
anticipates that all the disclosures identified above would be made 
with respect to any approval provided by the CFPB under this Policy.
    \48\ The CFPB intends to publish denials only after the 
applicant is given an opportunity to request reconsideration of the 
denial. Upon request, and if disclosure is not required by 5 U.S.C. 
552(a)(2) or other applicable law, the CFPB intends to redact 
identifying information from denials published on its website.
---------------------------------------------------------------------------

    Where information submitted to the CFPB is both customarily and 
actually treated as private by the submitter, the CFPB intends to treat 
it as confidential in accordance with the Disclosure Rule.\49\ The CFPB 
anticipates that much of the information submitted by applicants in 
their applications, and by recipients while operating pursuant to a 
CAST, will qualify as confidential information under the Disclosure 
Rule.\50\
---------------------------------------------------------------------------

    \49\ See Food Marketing Institute v. Argus Leader Media, 139 
S.Ct. 2356 (June 24, 2019).
    \50\ To the extent associated communications include the same 
information, that information would have the same status. But other 
information in associated communications may be subject to 
disclosure.
---------------------------------------------------------------------------

    Disclosure to other Federal and State agencies of information or 
data provided to the CFPB under the Policy is governed by applicable 
law, including the CFPA \51\ and the Disclosure Rule.
---------------------------------------------------------------------------

    \51\ See, e.g., 12 U.S.C. 5512(c)(8).
---------------------------------------------------------------------------

    To the extent the CFPB wishes to publicly disclose non-confidential 
information regarding approvals, the CFPB intends to include the terms 
of such disclosure in the CAST. The CFPB intends to draft the CAST in a 
manner such that confidential information is not disclosed. Consistent 
with applicable law and its own rules, the CFPB does not intend to 
publicly disclose any information that would conflict with consumers' 
privacy interests.

Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2025-00377 Filed 1-8-25; 8:45 am]
BILLING CODE 4810-AM-P
```