The agency is allowed by statute to request additional information from companies that “self-certify” their financial products, including demonstrating that they aren’t readily susceptible to manipulation and meet other regulatory requirements. It can evaluate the responses and decide whether to take any enforcement actions or begin drafting a new rule.