# Policy Statement on Compliance Assistance Sandbox Approvals
**AGENCY:**
Consumer Financial Protection Bureau.
**ACTION:**
Policy statement.
**SUMMARY:**
The Consumer Financial Protection Bureau (CFPB) is issuing this policy statement on Compliance Assistance Sandbox (Policy), which is intended to further objectives under Section 1021 of the Consumer Financial Protection Act.
**DATES:**
This policy statement is applicable on January 10, 2025.
**FOR FURTHER INFORMATION CONTACT:**
George Karithanom, Regulatory Implementation & Guidance Program Analyst, Office of Regulations, at 202-435-7700 or at: *https://reginquiries.consumerfinance.gov/.* If you require this document in an alternative electronic format, please contact *[email protected].*
**SUPPLEMENTARY INFORMATION:**
**I. Overview**
The CFPB is accepting applications for Compliance Assistance Sandbox Approvals (“Approvals”), as set forth in the policy statement below and subject to Conditions to Promote Innovation, Competition, Ethics and Transparency (“the Conditions”). The Conditions would be incorporated into individual Approvals and serve several purposes.
To summarize the Conditions, they are first designed to ensure that Approvals promote innovations that solve unmet needs in markets for consumer financial products and services. Minor adjustments to existing products, or products that are designed to take advantage of gaps in laws rather than bringing new offerings to market, do not confer significant enough benefit on consumers to warrant the expenditure of government resources necessary to issue and monitor Approvals. Granting Approvals in such circumstances misallocates government resources towards advantaging slight variations of what is essentially the same product that is currently available in the market. The Conditions therefore aim to enable innovations that solve real problems that consumers face in financial markets.
Second, the Conditions ensure that Approvals do not compromise the competitive process. Innovation is maximized by competitive, open markets and robust rivalry among firms. In seeking to promote innovation, the Approvals program must not tilt the competitive playing field by picking winners and losers in markets, or appearing to do so. For this reason, the CFPB will affirmatively reach out to program applicants' competitors and invite them to apply for the same Approval topic. The CFPB will not grant an Approval on a topic for a single firm, to avoid granting a first-mover advantage in the market. The Conditions also prevent firms from advertising the receipt of an Approval, which can create the false appearance of endorsement or favored regulatory status and can distort competition.
Third, the Conditions promote transparency and rigorous ethical standards. The CFPB will post applications for Approvals to an open docket on the regulations.gov website and will accept comment for 60 days. To avoid ethical conflicts, the CFPB will not consider applications from former CFPB attorneys representing firms as outside counsel. The CFPB is concerned that former CFPB employees will use their relationships to obtain special treatment for specific firms in procuring Approvals, or that there is a risk of the appearance of special treatment by the public or specific firms seeking outside counsel. Because applicants' integrity is also critical for the programs' success, Approvals will not be granted to firms that have been the subject of an enforcement action involving prior violations of federal consumer financial law in the last five years. And to prevent bait-and-switch negotiation tactics experience under the prior Sandbox policy, where firms negotiated terms of Approvals with the CFPB and thereafter materially change the underlying products or services, Approvals will automatically be rescinded when recipients change their product or service so that it no longer fits the description provided in the application and described in the Approval, unless the Approval recipient applies for and receives an amended Approval. These safeguards ensure that the programs are facilitating stakeholder participation, government accountability, and integrity on the part of Approval applicants. [^1]
[^1]*See, e.g.,* Letter to Dave Girouard, CEO, Upstart Network, Inc. (Feb. 13, 2023) (expressing “concern about a recent report that found lenders' use of educational data to make credit determinations could have a disparate impact on borrowers of color”), *https://www.brown.senate.gov/imo/media/doc/2020-02-13%20Senate%20letter%20to%20Upstart.pdf;* Fair Lending Monitorship of Upstart Network's Lending Model (Mar. 27, 2023) (identifying “approval disparities for Black applicants”), available at *https://www.relmanlaw.com/assets/htmldocuments/Upstart%20Final%20Report.pdf.*
**II. Background**
On September 10, 2019, the CFPB issued the “Policy on the Compliance Assistance Sandbox.” [^2] The Policy on the Compliance Assistance Sandbox sets forth how the CFPB would grant a company immunity from liability under one or more of three safe harbor provisions and provide an Approval concluding that the offering or providing of certain aspects of an individual company's product or service complies with the relevant Federal consumer financial law.
[^2] 84 FR 48229 (Sept. 13, 2019).
After conducting a review in 2022, the CFPB determined that the Policies failed to advance their stated objective of facilitating consumer-beneficial innovation. [^3] The CFPB also determined that the existing Policies failed to meet appropriate standards for transparency and stakeholder participation. The CFPB rescinded the policies, and the CFPB continued to develop new protocols to ensure that such tools were consistent with the objectives of the Consumer Financial Protection Act and did not raise ethical concerns.
[^3] Statement on Competition and Innovation, 87 FR 58439 (Sept. 27, 2022).
As noted above, the CFPB experienced a number of potential abuses and challenges with the CAS policy, and with the NAL policy that is being reissued simultaneously with this policy, that led to the decision to allow the prior policies to expire. For example, the CFPB granted Upstart Network a NAL in 2017, [^4] committing to not enforce the Equal Credit Opportunity Act (ECOA) against the company for their use of “artificial intelligence” in credit underwriting on behalf of bank partners. Despite the fact that other companies had similar models, Upstart became a leader in this market after receiving the NAL, and outside observers appear to have interpreted the NAL as an endorsement that Upstart's model did not violate the ECOA. [^5] The CFPB extended that NAL in November 2020. [^6] Immediately after the extension, Upstart closed its initial public offering and began trading its stock on the Nasdaq Global Select Market on December 16, 2020, [^7] with an initial market capitalization of $1.88 billion. [^8] In 2021, Upstart originated 1.3 million loans, totaling $11.8 billion, on behalf of bank partners.
[^4]*Id.*
[^5] MARCO DI MAGGIO, DIMUTHU RATNADIWAKARA, & DON CARMICHAEL, INVISIBLE PRIMES: FINTECH LENDING WITH ALTERNATIVE DATA, 3 (HARVARD BUSINESS SCHOOL, 2021), *https://www.hbs.edu/ris/Publication%20Files/22-024_80dc9115-69cc-4564-99c6-3a937f275d31.pdf.*
[^6]*https://www.consumerfinance.gov/rules-policy/competition-innovation/granted-applications/.*
[^7]*https://ir.upstart.com/news-releases/news-release-details/upstart-announces-closing-initial-public-offering-and-full.*
[^8]*https://www.reuters.com/technology/lending-platform-upstarts-shares-jump-nasdaq-debut-2020-12-16/.*
Around the same time as the IPO, several nonprofit organizations raised concerns about Upstart's use of educational criteria ( *e.g.,* educational history, which university the applicant attended) in its lending model. Upstart agreed to appoint an independent monitor to determine whether Upstart's model complied with the ECOA. [^9] Ultimately, the independent monitor ended the relationship after coming to an impasse with Upstart about how to assess compliance with ECOA. [^10] Notably, the monitor detected that the model caused “`statistically and practically significant' adverse approval/denial disparities for Black applicants.” [^11]
[^9] Relman Colfax PLLC, Fair Lending Monitorship of Upstart Network's Lending Model: Initial Report of the Independent Monitor, April 14, 2021, *https://www.relmanlaw.com/media/cases/1088_Upstart%20Initial%20Report%20-%20Final.pdf.*
[^10] Relman Colfax PLLC, Fair Lending Monitorship of Upstart Network's Lending Model: Fourth and Final Report of the Independent Monitor, March 27, 2024, *https://www.relmanlaw.com/assets/htmldocuments/Upstart%20Final%20Report.pdf.*
[^11]*Id.*
When Upstart wanted to substantially change its model, under the terms of the NAL, Upstart was supposed to apply for a modification of the NAL. Upstart applied for a modification, but the CFPB did not have enough time to review the implications of the significant changes. Upstart thus requested a termination of the NAL in order to be able to make the changes more quickly. The request was granted. [^12]
[^12] In re November 30, 2020 No-Action Letter, Order to Terminate No-Action Letter (June 8, 2022), *available at https://files.consumerfinance.gov/f/documents/cfpb_upstart-no-action-letter-termination_order_2022-06.pdf.*
The CFPB experienced similar challenges with its Sandbox Approval policy. For example, the CFPB issued a Sandbox Approval Order for Payactiv, Inc., a paycheck advance lender. It did not grant an Approval to any other paycheck advance lender. The CFPB discovered evidence suggesting that Payactiv was using the approval in marketing materials to misrepresent that the CFPB endorsed Payactiv's product. On June 3, 2022, the CFPB informed Payactiv that, for this reason, it was considering terminating the approval order. [^13] Payactiv requested termination of the order, and the CFPB approved that termination request. [^14]
[^13] In re December 30, 2020 Sandbox Approval Order, Order to Terminate Sandbox Approval Order (June 30, 2022), *available at https://www.consumerfinance.gov/about-us/newsroom/cfpb-rescinds-special-regulatory-treatment-for-payactiv/.*
[^14]*Id.*
To correct these shortcomings, the CFPB developed the Conditions to Promote Innovation, Competition, Ethics, and Transparency that must be met for a Letter or Approval to be issued. They are incorporated in Part B of the Policy on Sandbox Compliance Assistance Sandbox that follows.
**III. Regulatory Requirements**
This Policy on the Compliance Assistance Sandbox constitutes an agency general statement of policy and/or a rule of agency organization, procedure, or practice exempt from the notice and comment rulemaking requirements under the Administrative Procedure Act, pursuant to 5 U.S.C. 553(b). Because no notice of proposed rulemaking is required, the Regulatory Flexibility Act does not require an initial or final regulatory flexibility analysis. [^15] The CFPB has also determined that the issuance of the Bulletin does not impose any new or revise any existing recordkeeping, reporting, or disclosure requirements on covered entities or members of the public that would be collections of information requiring approval by the Office of Management and Budget under the Paperwork Reduction Act.
[^15] 5 U.S.C. 603(a), 604(a).
**IV. Policy Statement**
The text of the Policy is as follows:
**Policy on the Compliance Assistance Sandbox**
In section 1021(a) of the Consumer Financial Protection Act (CFPA), Congress established the Consumer Financial Protection Bureau's (CFPB's) statutory purpose as ensuring that all consumers have access to markets for consumer financial products and services and that markets for consumer financial products and services are fair, transparent, and competitive. [^16] Relatedly, the CFPB's objectives include exercising its authorities under Federal consumer financial law for the purposes of ensuring that markets for consumer financial products and services operate transparently and facilitate innovation. [^17]
[^16] 12 U.S.C. 5511(a).
[^17] 12 U.S.C. 5511(b)(3), (5).
Congress has given the CFPB a variety of authorities under the CFPA and the enumerated consumer laws [^18] that it can exercise to promote this purpose and these objectives. These authorities include supervision and enforcement authority, and the authority to issue orders and guidance. These authorities provide the basis for the Policy on the Compliance Assistance Sandbox (CAS Policy or Policy) and the Approvals issued pursuant to the Policy.
[^18]*See* 12 U.S.C. 5481(12) (listing the enumerated consumer laws).
The primary purposes of the Policy are to provide a mechanism through which the CFPB may more effectively carry out its statutory purpose and objectives and to facilitate compliance with applicable Federal consumer financial laws.
The Policy is not intended to, nor should it be construed to:
a. restrict or limit in any way the CFPB's discretion in exercising its authorities, including the provision of compliance assistance other than pursuant to the Policy;
b. constitute an interpretation of law,
c. create or confer upon any covered person, consumer, or other external party any substantive or procedural rights, obligations, or defenses that are enforceable in any manner.
In contrast, a particular Approval involves the CFPB's exercise of its supervision and enforcement discretion in a particular manner. It cannot bind, and never could bind, state plaintiffs or plaintiffs in private actions, including but not limited to states enforcing violations of federal consumer financial law under Section 1042 of the CFPA.
The Policy consists of seven sections:
• Section A describes the compliance assistance available under the Policy;
• Section B describes the Conditions to Promote Innovation, Competition, Ethics, and Transparency;
• Section C describes factors the CFPB intends to consider in deciding whether to grant an application for compliance assistance;
• Section D describes the standard procedures the CFPB intends to use in providing compliance assistance;
• Section E describes procedures the CFPB intends to use for granting extensions of, modifying, and terminating compliance assistance;
• Section F describes how the CFPB intends to coordinate with other regulators with respect to compliance assistance; and
• Section G describes the CFPB's intentions regarding disclosure of information relating to approvals.
**A. Compliance Assistance Approvals**
An Approval is provided by the CFPB to a particular entity under one or more of three statutory safe harbor provisions, based on the application of existing law to particular facts and circumstances. [^19] An Approval issued to a particular entity will state that, subject to good faith compliance with specified terms and conditions, the CFPB concludes for the reasons stated therein that offering or providing the described aspects of the product or service complies with the Federal consumer financial law identified therein. [^20] By operation of the applicable statutory provision, the recipient has a safe harbor from liability under the relevant statute, to the fullest extent permitted by these provisions, as to any act done or omitted in good faith in conformity with the Approval. [^21]
[^19] 15 U.S.C. 1640(f) (TILA); 15 U.S.C. 1691e(e) (ECOA); 15 U.S.C. 1693m(d) (EFTA).
[^20] For convenience, the Policy uses the term “described aspects of the product or service” to refer to the subject matter scope of a particular form of compliance assistance, including both the particular aspects of the product or service in question and the particular manner in which it is offered or provided. If a Sandbox applicant seeks more than one form of assistance under the Policy (for example, an approval under one statute and an approval under another statute), it is possible that these different forms may relate to *different* described aspects of the same product or service. If so, in order to enable the CFPB to respond expeditiously to the application, the applicant should make its best efforts to specify the described aspects that relate to each form sought. The CFPB recognizes that in some cases it may be difficult to determine precisely which aspects of a product or service implicate different legal provisions, particularly for applicants that lack the legal resources for a fully precise determination. In such circumstances, the applicant should provide the maximum specification practicable under the circumstances and explain the limits on further specification.
[^21]*See* 15 U.S.C. 1640(f); 15 U.S.C. 1691e(e); 15 U.S.C. 1693m(d).
**B. Conditions To Promote Innovation, Competition, Ethics, and Transparency**
The following conditions apply to the Compliance Assistance Sandbox program:
1. Applicants for CAS Approvals must establish a market problem, in the form of an unmet consumer need, that the new financial product or service solves.
(a) Applicants must articulate the benefit to consumers that flows from the CFPB permitting the product or service to be sold at market with a safe harbor from liability under the law at issue.
(b) A claim that a CAS Approval would increase access to the applicant's product or service is insufficient to establish a market problem. To satisfy this requirement, the applicant must prove that their product or service is meeting an untapped consumer need.
2. The CFPB will not grant a CAS Approval on a topic for a single firm.
3. The CFPB will reach out to the applicant's competitors and invite them to apply for a CAS Approval on the same topic, to ensure that the CFPB does not select a single firm that gains a first-mover advantage in the market as a result.
4. CAS Approvals will state that recipients may not market or promote the fact that their product or service received an Approval. Such marketing is inherently deceptive to consumers, creating the false impression that the CFPB endorses the product.
5. The CFPB will post applications for a CAS Approval to an open docket on the regulations.gov website and will accept comment for 60 days. In so doing, the CFPB will adhere to the confidentiality protections set forth in section G, below.
6. The CFPB will generally not consider applications from companies that are represented by former CFPB attorneys as outside counsel, to avoid ethical conflict and to maintain the highest integrity in the CAS Approval program.
7. The CFPB will not consider applications from companies that have been the subject of an enforcement action involving violations of federal consumer financial law in the last 5 years, or who are subject to a pending enforcement investigation by federal or state authorities.
8. CAS Approvals will automatically be rescinded when recipients materially change their product or service so that it no longer fits the description provided in the application and described in the Approval, unless a modification is approved under Subpart E.
9. Submitting CAS Approval applications under false pretenses, or with misleading or incomplete information, may be a violation of law and may be referred for potential prosecution. [^22]
[^22] 18 U.S.C. 1001.
**C. Assessment of Applications for Compliance Assistance**
The CFPB may grant or deny a compliance assistance application in its sole discretion. If it chooses to grant an application, the CFPB also has discretion to grant the application in whole or only in part. In deciding whether to grant an application for compliance assistance, the CFPB intends to balance a variety of factors in considering the quality and persuasiveness of the application, as well as information about the applicant and the product or service in question derived through CFPB due diligence processes.
**D. Procedures for Providing Compliance Assistance
23**
[^23] These procedures may be modified based on coordination efforts with other regulators, as specified in section F.
When the CFPB decides to grant an application for compliance assistance, it intends to provide the recipient with a Compliance Assistance Statement of Terms (CAST) setting forth the terms under which compliance assistance is provided, including the types and scope of assistance provided to the recipient. The CAST will be signed by the Director, and by an officer of the recipient. [^24] The CFPB expects that the CAST will:
[^24] If the CFPB decides to deny an application, it will inform the applicant of its decision. The CFPB intends to respond to reasonable requests to reconsider its denial of an application within 60 days of such requests. Applicants may withdraw, modify, and re-submit applications at any time.
1. Identify the recipient;
2. Specify the subject matter scope of the CAST, *i.e.,* the described aspects of the product or service; [^25]
[^25] If these vary by the form of assistance sought, the document will specify the relevant aspects separately.
3. State that the CAST and the compliance assistance provided:
(a) Is limited to the recipient's offering or providing the described aspects of the product or service, and does not apply to the recipient's offering or providing different aspects of the product or service;
(b) Is based on the factual representations made by the recipient, which may be incorporated by reference;
(c) Does not constitute the CFPB's endorsement of the product or service that is the subject of the CAST, or any other product or service offered or provided by the recipient; and
(d) Expires in 2 years.
4. Require the recipient to consent to the CFPB's supervisory examination authority, if the recipient is not already subject to this authority;
5. Require the recipient to inform the CFPB of: (a) material changes to information included in the application; and (b) material information indicating that the described aspects of the product or service are not performing as anticipated in the application; [^26] Pursuant to B.7, unless an applicant applies for an amendment pursuant to section E, CAS Approvals will automatically be rescinded when recipients change their product or service so that it no longer fits the description provided in the application and described in the Approval;
[^26] “Not performing as anticipated” includes the materialization of consumer risks identified in the application, and the materialization of other consumer risks not identified in the application.
6. Require the recipient to report information about the effects of offering or providing the described aspects of the product or service, including with respect to complaint patterns, default rates, or similar metrics that will enable the CFPB to identify material increase in any risk of injury to consumers;
7. Where appropriate, include a commitment by the recipient to compensate consumers for CFPA actionable substantial injury caused by the recipient's offering or providing the described aspects of the product or service; [^27]
[^27] CFPA actionable substantial injury, as used in this Policy, means substantial injury that is not reasonably avoidable by the consumer, where such substantial injury is not outweighed by countervailing benefits to consumers or competition. *See* 12 U.S.C. 5531(c); *see also* 12 U.S.C. 5536(a)(1)(B).
8. Specify any other limitations or conditions, such as the duration of the compliance assistance, [^28] the nature and extent of the recipient's data-sharing, and the extent to which the CFPB intends to publicly disclose information about the recipient's participation; [^29]
[^28] The CFPB expects two years to be an appropriate duration for approvals in most cases, but recipients may apply for extensions. *See* section E.1.
[^29] If an applicant objects to the disclosure of certain information and the CFPB insists that the information must be publicly disclosed for compliance assistance to be provided, the applicant may withdraw the application and the CFPB intends to treat all information related to the application as confidential to the full extent permitted by law.
9. With respect to any approval the CFPB is providing the recipient: (a) state that, subject to good faith compliance with the CAST, the CFPB approves the recipient's offering or providing the described aspects of the product or service under the relevant law identified therein; [^30] and (b) explain the CFPB's basis for issuing the Approval;
[^30] As noted in section A.1, the safe harbor associated with an approval only applies to acts done or omitted in good faith in conformity with the approval, and the approval will so state.
10. State that: (a) the recipient may reasonably rely on any CFPB commitments made in the CAST unless or until the Approval expires or is terminated by the CFPB; and (b) the CFPB may terminate [^31] any approval described in the CAST if: (i) the recipient fails to substantially comply in good faith with the specified terms and conditions of the CAST; (ii) the described aspects of the product or service do not perform as anticipated in the application; [^32] or (iii) a statutory change or Federal judicial holding causes the CFPB to conclude that the recipient can no longer rely in good faith on the CFPB's approval as the safe harbor provisions require; and
[^31] No retroactive action premised on the described aspects of the product or service will lie under provisions covered by an approval. Actions that are not premised on the described aspects of the product or service associated with a particular approval are, by definition, not subject to any such restriction.
[^32] Such ground includes the materialization of consumer risks identified in the application, or the materialization of other consumer risks not identified in the application.
11. If the applicant also applied for a No-Action Letter using their application under the CAS Policy for compliance assistance, incorporate any No-Action Letter that the CFPB is issuing pursuant to the terms of the NAL Policy. [^33]
[^33] If the CFPB is providing a No-Action Letter to the recipient, any termination of the No-Action Letter will be in accordance with the NAL Policy.
**E. Procedures for Extension, Modification, and Termination**
**1. Extension Procedures**
Recipients of compliance assistance may apply for an extension of a specified period of time. In considering applications for extensions, the CFPB expects to place particular weight on the extent to which the data provided to the CFPB under the terms of the CAST shows that the described aspects of the product or service are benefitting consumers, not causing unanticipated harms, and not materially increasing the risk of substantial injury. Such applications for an extension should include the proposed duration of the extension and should be submitted no later than 90 days prior to the expiration of the compliance assistance under the terms of the CAST. [^34] The recipient should explain the reasons for the requested extension, such as whether it is intended to last until a possible amendment to CFPB regulations or the Commentary, or is instead intended for more particularized compliance assistance purposes.
[^34] Assuming the two-year period the CFPB expects to be appropriate in most cases, the CFPB believes recipients would have sufficient time to gather evidence supportive of an extension request. For periods of one year or less, the CFPB may consider an extension deadline appropriate for the period in question.
Upon the presentation of persuasive data, the CFPB anticipates granting such extension applications for a period at least as long as the period of the applicant's original receipt of assistance. The CFPB anticipates permitting longer extensions where the CFPB is considering amending applicable regulatory requirements or the relevant Commentary. [^35] During the time period pending a rule or Commentary amendment, the CFPB intends to consider means of providing similar assistance to other covered entities that engage in the same or similar conduct in offering or providing comparable products.
[^35] The CFPB's plans regarding rulemaking activity are set forth in its Semiannual Regulatory Agenda, published in full on *www.reginfo.gov* . If the period of an extension were tied to the CFPB's consideration of amending relevant regulatory provisions and the CFPB announced it was discontinuing its plans to amend the provisions in question, the extension period would be adjusted accordingly, *e.g.,* to end on a specific date.
**2. Modification Procedures**
A recipient of compliance assistance may apply for a modification of the CAST. The recipient may seek modification to address an anticipated or unanticipated change in circumstances, such as iterations of the underlying product or service or changes to the information included in the application for assistance. Applications for a modification should include the following:
a. Any material changes to the information included in the original application;
b. The specific requested modification to the CAST;
c. The grounds for modifying the CAST; and
d. Any other information the recipient wishes to provide in support of the modification application.
In deciding whether to grant an application for modification, the CFPB intends to balance a variety of factors, including the quality and persuasiveness of the application. The CFPB expects to grant or deny such applications within 30 days of notifying the applicant that the CFPB has deemed the application to be complete. When the CFPB grants an application for modification, it intends to provide the recipient with a modified CAST in accordance with the procedures specified in Section D.
**3. Termination Procedures**
The CFPB intends that the recipient of compliance assistance should be able to reasonably rely on any CFPB commitments made in the associated CAST.
The CFPB expects that a CAST will state that: (a) the recipient may reasonably rely on any CFPB commitments made in the CAST; and (b) the CFPB may terminate any approval described in the CAST if: (i) the recipient fails to substantially comply in good faith with the specified terms and conditions of the CAST; (ii) the described aspects of the product or service do not perform as anticipated in the application; <sup>36</sup> or (iii) a statutory amendment or federal judicial holding causes the CFPB to conclude that the recipient can no longer rely in good faith on the CFPB's approval as the safe harbor provisions require. By operation of law, no retroactive action premised on the described aspects of the product or service will lie under provisions within the scope of an approval, except where a failure to substantially comply in good faith with the terms of the Approval caused consumer harm or where the CFPB's initial granting of the Approval failed to comply with the Administrative Procedure Act or other law. If the CFPB is also providing a No-Action Letter to the recipient, termination will be in accordance with the NAL Policy.
Before terminating any approval provided under the Policy, the CFPB may, in the appropriate cases, notify the recipient of the possible grounds for termination and permit an opportunity to respond within a reasonable period of time. In its discretion, the CFPB may offer the recipient an opportunity to modify its conduct to avoid termination. The CFPB may allow the recipient to wind-down the offering or providing of the described aspects of the product or service during a period of six months before termination is effective, unless the described aspects of the product or service are causing injury to consumers, and a wind-down period would permit such injury to continue. If the CFPB terminates any approval provided under this Policy, it will do so in writing and specify the reasons for its decision. The CFPB will publish termination decisions on its website.
**F. Regulatory Coordination**
Section 1015 of the CFPA instructs the CFPB to coordinate with Federal agencies and State regulators, as appropriate, to promote consistent regulatory treatment of consumer financial and investment products and services. [^37] Similarly, section 1042(c) of the CFPA instructs the CFPB to provide guidance in order to further coordinate actions with the State attorneys general and other regulators. [^38] Such coordination includes coordinating in circumstances where other regulators have chosen to offer assistance to entities offering innovative products and services. One method of providing such assistance is through a State sandbox, or group of State sandboxes, or other limited scope State authorization program (State sandbox). [^39] The CFPB is interested in entering into agreements with State authorities that operate or plan to operate a State sandbox, which may include a process to receive compliance assistance under this Policy in a coordinated manner with assistance from the State sandbox.
[^37] 12 U.S.C. 5495.
[^38] 12 U.S.C. 5552(c).
[^39] The concept of a regulatory sandbox is relatively new and does not have a precise, generally accepted definition. The term is used in this Policy to refer to a regulatory structure where a participant obtains limited or temporary access to a market in exchange for reduced regulatory uncertainty or other regulatory barriers to entry.
Furthermore, the CFPB is interested in coordinating with other regulators more generally regarding this Policy. To this end, the CFPB intends to enter into agreements whenever practicable to coordinate compliance assistance under the Policy with assistance offered by State, Federal, or international regulators.
**G. Disclosure of Information Relating to Approvals**
Public disclosure of information regarding approvals under this Policy is governed by applicable law, including the CFPA, [^40] the Freedom of Information Act (FOIA), [^41] and the CFPB's Rule on Disclosure of Records and Information (Disclosure Rule). [^42] The Disclosure Rule generally prohibits the CFPB from disclosing confidential information, [^43] and defines confidential information to include information that may be exempt from disclosure under the FOIA [^44] —including Exemption 4 regarding trade secrets and confidential commercial or financial information that is privileged or confidential. [^45] The Disclosure Rule also defines business information as commercial or financial information obtained by the CFPB from a submitter that may be protected from disclosure under Exemption 4 of FOIA, and generally provides that such business information shall not be disclosed pursuant to a FOIA request except in accordance with section 1070.20 of the rule. [^46]
[^40] See, *e.g.,* 12 U.S.C. 5512(c)(8).
[^41] 5 U.S.C. 552.
[^42] 12 CFR part 1070.
[^43] 12 CFR 1070.41.
[^44] 12 CFR 1070.2(f).
[^45] 5 U.S.C. 552(b)(4).
[^46] 12 CFR 1070.20(a), (b).
Consistent with applicable law, the CFPB will publish on its website its final disposition of applications for approvals, as well as the application previously published on regulations.gov. If the CFPB decides to grant an application, it intends to publish an order regarding the decision on its website as soon as practicable. The CFPB expects that the order will overlap with the CAST provided to the recipient, but will contain other information and will not include information protected from public disclosure under applicable law. The CFPB expects the order to include: (i) the identity of the recipient; (ii) the described aspects of the product or service to which the approval applies; (iii) the approval's specified duration, basis, and legal authority; and (iv) in appropriate cases, a version of the summary of the application. [^47] The CFPB also intends to publish denials of applications on its website, including an explanation of why the application was denied in whole or in part. [^48]
[^47] When a regulated entity receives an approval in a coordinated manner with assistance under a State sandbox, the CFPB may be restricted in its discretion to further disclose information obtained from the relevant State authority. Nonetheless, the CFPB anticipates that all the disclosures identified above would be made with respect to any approval provided by the CFPB under this Policy.
[^48] The CFPB intends to publish denials only after the applicant is given an opportunity to request reconsideration of the denial. Upon request, and if disclosure is not required by 5 U.S.C. 552(a)(2) or other applicable law, the CFPB intends to redact identifying information from denials published on its website.
Where information submitted to the CFPB is both customarily and actually treated as private by the submitter, the CFPB intends to treat it as confidential in accordance with the Disclosure Rule. [^49] The CFPB anticipates that much of the information submitted by applicants in their applications, and by recipients while operating pursuant to a CAST, will qualify as confidential information under the Disclosure Rule. [^50]
[^49] See Food Marketing Institute v. Argus Leader Media, 139 S.Ct. 2356 (June 24, 2019).
[^50] To the extent associated communications include the same information, that information would have the same status. But other information in associated communications may be subject to disclosure.
Disclosure to other Federal and State agencies of information or data provided to the CFPB under the Policy is governed by applicable law, including the CFPA [^51] and the Disclosure Rule.
[^51] See, *e.g.,* 12 U.S.C. 5512(c)(8).
To the extent the CFPB wishes to publicly disclose non-confidential information regarding approvals, the CFPB intends to include the terms of such disclosure in the CAST. The CFPB intends to draft the CAST in a manner such that confidential information is not disclosed. Consistent with applicable law and its own rules, the CFPB does not intend to publicly disclose any information that would conflict with consumers' privacy interests.
Rohit Chopra,
Director, Consumer Financial Protection Bureau.