The U.S. Consumer Financial Protection Bureau (CFPB) recently issued its first no-action letter, pursuant to a policy designed to encourage innovation in the fintech marketplace by creating a testing ground for new technologies. If received, a no-action letter simply indicates that the CFPB “has no present intention to recommend initiation of an enforcement or supervisory action” against the applicant with respect to the specific product and regulatory concerns at issue.

The CFPB issued its first no-action letter to Upstart Network, a marketplace lender that, in addition to traditional sources, uses alternative data, such as a borrower’s education and employment background, to underwrite consumer loans. While federal regulators have encouraged the development of consumer lending technologies, they have also warned that new technologies “carry the risk of disparate impact in credit outcomes and the potential for fair lending violations,” particularly where they have not been tested in unfavorable credit conditions.  Upstart requested and received a no-action letter with respect to its alternative underwriting criteria in the context of compliance with the Equal Credit Opportunity Act (ECOA), which prohibits credit discrimination.

While issuance of the first no-action letter may justify some cautious optimism that the CFPB will meaningfully foster innovation, no-action letters have their limits. As is now clear from the Upstart letter, the CFPB is not providing any hall passes for fintech companies. Coupled with being narrowly limited to ECOA compliance for Upstart’s underwriting model, Upstart’s no-action letter reserves the CFPB’s right to seek penalties and fines on those matters in the future (even if it has no “present intention” to do so), and is expressly conditioned on Upstart sharing its lending data with the CFPB.

Finally, and perhaps most importantly, the no-action letter can be revoked or modified for any reason at the sole discretion of CFPB staff.