The expanding use of mobile technologies, cloud computing, and the Internet of Things has greatly increased the amount of available consumer data. The ability to efficiently process this information has the potential to provide countless consumer benefits. Nevertheless, companies must navigate an ever-expanding patchwork of domestic and foreign laws and uncertainty regarding the application of existing laws to new technologies. In addition, although regulators have commended the advancement and development of new consumer lending technologies, they also have warned that these new tools “carry the risk of disparate impact in credit outcomes and the potential for fair lending violations[.]” For companies under the authority of the Consumer Financial Protection Bureau (CFPB), the CFPB’s no-action letter (NAL) program offers a potential tool to help navigate these challenges. As described in the following article, however, the tool is not without risk for companies seeking regulatory guidance.

Finalized in February 2016, the CFPB’s NAL program establishes a process for companies to proactively seek input from the bureau regarding the regulatory risks presented by new products and services. When issued, no-action letters indicate that the CFPB “has no present intention to recommend initiation of an enforcement or supervisory action” against the applicant with respect to the applicants’ product or service. In September 2017, the CFPB issued its first NAL to Upstart Network, an online lending platform. Upstart’s application and the resulting no-action letter provide helpful insight into the NAL program and its potential to serve similarly situated companies, as well as the CFPB’s opinion on the use of alternative data sources in credit decisions.

The Applicant

Based in San Carlos, California, Upstart provides an online lending platform that the company markets as enabling people with limited credit history to obtain credit at competitive rates. According to Upstart, its lending platform, unlike those of traditional lenders, has the ability to identify differences in risk between “thin file” applicants. The company’s underwriting model purportedly includes both an examination of the borrower’s available financial indicators, as well as the borrower’s education and experience, including schools attended, degrees obtained, and jobs held. Upstart uses these inputs to develop a statistical model of the borrower’s financial capacity and personal propensity to repay. By complementing traditional underwriting data with these other factual elements, the platform is designed to quantify risk for borrowers that lack more traditional, established credit histories.

Requested Guidance

Through its application, Upstart requested that the CFPB address regulatory uncertainty surrounding the sufficiency of its efforts to ensure compliance with the Equal Credit Opportunity Act as implemented by Regulation B (collectively, the ECOA). The ECOA prohibits creditors from discriminating against an applicant “with respect to any aspect of a credit transaction.” The ECOA has two principal theories of liability: disparate treatment and disparate impact. Disparate treatment occurs when a creditor treats an applicant differently based on a prohibited basis, such as race or national origin. Disparate impact occurs when a creditor employs facially neutral policies or practices that have an adverse effect or impact on a member of a protected class unless it meets a legitimate business need that cannot reasonably be achieved by means that are less disparate in their impact.

In its application, Upstart sought to address any potential concerns of the CFPB regarding the disparate impact of its offering. Importantly, Upstart did not argue that its product met an important business need that could not be achieved by less disparate means. Rather, Upstart provided the CFPB with consumer statistics to establish the lack of any disparate impact.

The CFPB’s Decision

On September 14, 2017, the CFPB announced its decision to issue an NAL in response to Upstart’s application. Under the terms of the NAL, which is valid for three years, Upstart is required to regularly report lending and compliance information to the CFPB regarding the loan applications it receives, how it decides which loans to approve, and how it will mitigate risk to consumers, as well as information on how its model expands access to credit for traditionally underserved populations. The CFPB, unfortunately, provided no insight in how it came to its decision. It did, however, take the opportunity to stress its continued interest in the use of alternative data sources to evaluate credit worthiness.


The issuance of the no-action letter signifies that the CFPB remains committed to its NAL program and is interested in the effects of alternative sources of data on consumers. As a relatively new enforcement bureau, it comes as no surprise that the CFPB issued its first no-action letter to Upstart’s application. Upstart’s ability to provide statistical evidence to establish that its product was not causing a disparate impact on protected classes gave the CFPB a fairly straightforward application for issuance of its first no-action letter. The NAL program’s utility, however, remains uncertain.

Although the NAL may provide Upstart with some immediate assurance, it remains to be seen whether Upstart will benefit in the long run from having sought the NAL. Under the terms of the NAL, Upstart must provide the CFPB with regular reports that contain non-public information the bureau would not normally be able to access. Thus, Upstart appears to be under the CFPB’s microscope for at least three years. Further, the NAL is subject to modification or revocation at the CFPB’s discretion. Although the CFPB has indicated its intention to communicate with the relevant entity before issuing a modification or revocation, it is not required to do so. Given the regular reporting obligation and the CFPB’s ability to modify or revoke the NAL at will, it is not clear that applicants are better off seeking an NAL versus taking reasonable steps to ensure legal compliance without highlighting their activities for the CFPB. It will be interesting to see how the NAL program plays out in the long run.