Frank LLP, a New York law firm specializing in consumer class actions, seeks records from the Consumer Financial Protection Bureau ("CFPB" or "Bureau") related to the Bureau's enforcement action against a debt collector. The firm made two requests under the Freedom of Information Act ("FOIA"), which the Bureau denied based on several of FOIA's nine exemptions. Frank challenges those denials and, in addition, seeks to invalidate two of the Bureau's policies with respect to withholding documents under FOIA Exemptions 4 and 8. In its motion seeking dismissal or summary judgment, the Bureau defends its decision to withhold documents, it contends that Frank lacks standing to challenge its FOIA policies, and it claims that, in any event, the challenged policies are valid on the merits.
With respect to all except one of Frank's claims, the Court will grant summary judgment in the Bureau's favor and deny Frank's cross-motion. The Court agrees that the Bureau properly withheld the documents Frank sought in its first request under FOIA Exemptions 5 and 7(E). As for the second FOIA request, Frank has not properly exhausted its administrative remedies because the request was remanded to the Bureau's FOIA Office after an administrative appeal and Frank has yet to pay the Bureau's processing fees. The Court finds that Frank has standing to challenge the Bureau's FOIA policies with respect to Exemptions 4 and 8. And it finds that, while the challenged Exemption 8 policy is valid, Frank is entitled to summary judgment on its Exemption 4 policy claim.
I. Background
A. First FOIA Request
The CFPB filed a consent order in September 2015 concluding that Encore Capital *51Group-one of the nation's largest purchasers and collectors of consumer debt-filed misleading affidavits in hundreds of thousands of debt-collection lawsuits claiming ownership of certain debts, despite having not substantiated those claims. See Consent Order ¶¶ 78-79, In re Encore Capital Group, Inc., No. 2015-CFPB-0022 (Sept. 9, 2015), https://perma.cc/VB3F-58NQ. The order also cited "approximately 35,600 identified Consumers" who paid on debts after Encore filed such an affidavit. Id. ¶ 145.
Shortly after the Bureau publicized the consent order, Frank filed its first FOIA request, seeking documents "that the Bureau relied on in identifying these approximately 35,600 lawsuits." Decl. Raynell Lazier Supp. Def.'s Mot. Summ. J. ("Lazier Decl.") Ex. A, at 1 (ECF No. 19). In reply, the Bureau's FOIA Office informed Frank that it had located responsive documents but was withholding them under Exemption 4 of FOIA, which protects confidential commercial information. Id. Ex. B, at 1; see 5 U.S.C. § 552(b)(4). Frank appealed to the Bureau. Lazier Decl. Ex. C. The Bureau denied the appeal, but relied on a different FOIA exemption than the FOIA Office. It concluded that the documents were properly withheld under Exemption 7(E), which covers certain "records or information compiled for law enforcement purposes." 5 U.S.C. § 552(b)(7)(E) ; see Lazier Decl. Ex. D. Frank filed suit in April 2016 challenging the Bureau's denial.
B. Second FOIA Request
While the parties sought to resolve Frank's first suit through mediation, the firm filed a second FOIA request with the Bureau in July 2016. Suppl. Compl. ¶¶ 34-35 (ECF No. 13 Ex. 1). This second request sought (1) records supporting the Bureau's findings in its consent order regarding Encore's litigation practices and (2) records related to the compliance requirements imposed on Encore by the consent order. See Lazier Decl. Ex. E. The Bureau's FOIA Office denied Frank's second request, invoking Exemptions 4 and 7(E), as well as Exemption 8, which protects information "contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions." 5 U.S.C. § 552(b)(8) ; see Lazier Decl. Ex. F.
Frank then filed an administrative appeal, which the Bureau granted. Lazier Decl. Exs. G, H. In remanding Frank's request to the FOIA Office, the Bureau explained that it was unclear from the denial determination whether the FOIA Office had properly assessed the responsive records to determine if any "non-exempt" and "reasonably segregable portion" of those records could be produced, 5 U.S.C. § 552(b) ; see Lazier Decl. Ex. H, at 3. "To guide the FOIA Office's analysis on remand," the appellate decision also analyzed the applicability of Exemptions 4, 7(E), and 8 to the information Frank requested, and suggested that at least some of the information sought was properly withheld under those exemptions. Lazier Decl. Ex. H, at 3-5.
Frank then filed a supplemental complaint challenging both the Bureau's denial of his second FOIA request and its administrative policies with respect to Exemptions 4 and 8. Specifically, Frank alleged that the Bureau improperly treats records produced by third parties in response to the Bureau's civil investigative demands as "voluntarily submitted" for purposes of Exemption 4, a treatment that would allow the Bureau to withhold those records more liberally. And it claims that the Bureau unlawfully treats debt buyers with at least $10 million in annual receipts (such as *52Encore) as "financial institutions" whose examination reports and related documents are thereby shielded from disclosure under Exemption 8. According to Frank, both of these policies conflict with FOIA and violate the Administrative Procedures Act ("APA"). Suppl. Compl. ¶¶ 55-76.
C. Procedural Posture
The Bureau has moved for summary judgment on Frank's claims, raised in both its original and supplemental complaints, that the Bureau improperly withheld records sought in the FOIA requests. The Bureau also has moved to dismiss Frank's claims, raised in its supplemental complaint, that the Bureau's FOIA policies are unlawful, contending that the firm lacks Article III standing to challenge them and that, in any event, the policies are lawful on the merits. In the alternative, the Bureau seeks summary judgment on the policy-based claims. Frank has filed a cross-motion for summary judgment.
II. Standard of Review
FOIA requires federal executive agencies to produce their records upon request unless one of the Act's nine exemptions applies. See 5 U.S.C. § 552(b). The exemptions aim "to balance the public's interest in governmental transparency against the 'legitimate governmental and private interests [that] could be harmed by release of certain types of information.' " United Techs. Corp. v. DOD, 601 F.3d 557 (D.C. Cir. 2010) (quoting Critical Mass Energy Project v. Nuclear Regulatory Comm'n, 975 F.2d 871, 872 (D.C. Cir. 1992) ). "But these limited exemptions do not obscure the basic policy that disclosure, not secrecy, is the dominant objective of the Act." Dep't of Air Force v. Rose, 425 U.S. 352, 361, 96 S.Ct. 1592, 48 L.Ed.2d 11 (1976). Thus, where a plaintiff challenges an agency's withholding of records, the agency bears the burden of showing that one of FOIA's exemptions applies. Am. Civil Liberties Union v. DOD, 628 F.3d 612, 619 (D.C. Cir. 2011).
FOIA disputes are generally resolved on cross-motions for summary judgment. In evaluating each motion, the Court must view the record in the light most favorable to the non-movant. The agency may satisfy its burden of showing that a FOIA exemption applies through an affidavit that "describes the justifications for withholding the information with specific detail, demonstrates that the information withheld logically falls within the claimed exemption, and is not contradicted by contrary evidence in the record or by evidence of the agency's bad faith." Am. Civil Liberties Union, 628 F.3d at 619.
In addition to seeking summary judgment, the Bureau moves to dismiss the challenges to its FOIA policies raised in Frank's supplemental complaint. A plaintiff may challenge an agency policy or practice as violating FOIA. See Payne Enters., Inc. v. United States, 837 F.2d 486, 494-95 (D.C. Cir. 1988). Dismissal of such a challenge is proper if the plaintiff lacks standing, Fed. R. Civ. P. 12(b)(1), or if the allegations, accepted as true, do not show that the agency policy or practice violates FOIA, Fed. R. Civ. P. 12(b)(6). But where an agency's policy or practice conflicts with FOIA's dictates, the statute gives the Court equitable power to enjoin enforcement of that policy or practice. See Citizens for Responsibility & Ethics in Wash. ("CREW") v. DOJ, 846 F.3d 1235, 1242 (D.C. Cir. 2017) ("This circuit's case law reflects the wide latitude courts possess to fashion remedies under FOIA, including the power to issue prospective injunctive relief."); Payne Enters., 837 F.2d at 494-95.
*53III. Analysis
A. First FOIA Request
1. Documents
The Bureau contends that the documents responsive to Frank's first request-those used to identify the 35,600 lawsuits referenced in the Consent Order in which Encore filed improper affidavits-fall within FOIA Exemption 7(E). That exemption covers "records or information compiled for law enforcement purposes" that "would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law." 5 U.S.C. § 552(7).
After reviewing the Bureau's description of the responsive documents, the Court agrees that they were properly withheld under Exemption 7(E). First, the documents were "compiled for law enforcement purposes." To satisfy this aspect of Exemption 7(E), the agency need only show "a rational nexus between the investigation and one of the agency's law enforcement duties, and a connection between an individual or incident and a possible security risk or violation of federal law." Campbell v. DOJ, 164 F.3d 20, 32 (D.C. Cir. 1998) (quotation omitted)); see also Tax Analysts v. IRS, 294 F.3d 71, 77 (D.C. Cir. 2002) ("Exemption 7 includes both civil and criminal matters within its scope"). That standard is readily met here: the responsive documents were generated as part of the Bureau's enforcement action against Encore for potential violations of federal law.
The remaining question is whether the records sought "would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law." 5 U.S.C. § 552(7)(E). The Court finds that it would. The D.C. Circuit has explained that Exemption 7(E):
looks not just for circumvention of the law, but for a risk of circumvention; not just for an actual or certain risk of circumvention, but for an expected risk; not just for an undeniably or universally expected risk, but for a reasonably expected risk; and not just for certitude of a reasonably expected risk, but for the chance of a reasonably expected risk.
Mayer Brown LLP v. IRS, 562 F.3d 1190, 1193 (D.C. Cir. 2009). In other words, the agency seeking to withhold investigative techniques need only "demonstrate logically how the release of the requested information might create a risk of circumvention of the law." Id. at 1194 (quotation omitted). This is "a relatively low bar." Blackwell v. FBI, 646 F.3d 37, 42 (D.C. Cir. 2011).
Frank contends that the techniques the Bureau used in its investigation are too obvious to warrant protection under Exemption 7(E). See Malloy v. DOJ, 457 F.Supp. 543, 545 (D.D.C. 1978) ("The Conference Report discussion of Exemption 7(E) ... indicates that the exemption extends to investigative techniques and procedures generally unknown to the public."). It suggests that the techniques sought to be protected can be easily inferred from the Bureau's briefing in this case: In Frank's view, "the Bureau simply ask[ed] Encore to self-identify the number of occasions in which an [improper] affidavit was used against a consumer." Pl.'s Opp. to Mot. Summ. J. & Cross-Mot. Summ. J. ("Pl.'s Opp.") at 14. But after reviewing an ex parte declaration submitted by the Bureau, the Court is persuaded that the Bureau's technique is not so obvious.
*54If it were disclosed, targets of the Bureau's investigations might be able to complicate enforcement, if not outright evade it. The technique is admittedly not proprietary or especially complex. But, again, an agency is justified in withholding records based on a mere "chance of a reasonably expected risk" of circumvention. Mayer Brown, 562 F.3d at 1193 (emphasis added). The Court finds that disclosure would create such a chance, and thus that the Bureau's withholding under Exemption 7(E) was proper.
2. Attorney Notes
The Bureau also withheld hand-written notes made by its attorney during a settlement conversation with Encore. Decl. Gregory Nodler Supp. Def.'s Mot. Summ. J. ¶ 15. It contends that those notes were properly withheld under FOIA Exemption 5. That exemption shields "inter-agency or intra-agency memorandums or letters that would not be available by law to a party other than an agency in litigation with the agency." 5 U.S.C. § 552(b)(5). Exemption 5 has been interpreted to cover records that would be "normally privileged in the civil discovery context," NLRB v. Sears, Roebuck & Co., 421 U.S. 132, 149, 95 S.Ct. 1504, 44 L.Ed.2d 29 (1975), including attorney work product that is "prepared in anticipation of litigation," Nat'l Ass'n of Criminal Def. Lawyers v. DOJ Exec. Office for U.S. Attorneys, 844 F.3d 246, 251 (D.C. Cir. 2016). Attorney work product is protected even if the anticipated litigation never materialized. FTC v. Grolier Inc., 462 U.S. 19, 28, 103 S.Ct. 2209, 76 L.Ed.2d 387 (1983) ("[A]ttorney work-product is exempt from mandatory disclosure without regard to the status of the litigation for which it was prepared.").
The notes here fall within Exemption 5. Attorney interview notes are generally protected as work product because their content reveals the lawyer's mental processes and the threat of their disclosure could discourage open discussion. See Dir. of Office of Thrift Supervision v. Vinson & Elkins, LLP, 168 F.R.D. 445, 446-47 (D.D.C. 1996). Frank attempts to defeat the paradigmatic protection typically accorded to attorney interview notes on two grounds.
Frank first contends that the interview notes here cannot be protected because they do not relate the attorney's mental impressions "in a meaningful way." Pl.'s Opp. at 15 (quoting FTC v. Boehringer Ingelheim Pharma., Inc., 778 F.3d 142, 151 (D.C. Cir. 2015) ). Whether or not Frank's characterization of the attorney notes is correct, its argument must be rejected. To be sure, in the context of civil discovery there is a distinction between "opinion" and "fact" work product-the former is subject to more protection-and courts require that opinion work product meaningfully reflect the attorney's thought process. Boehringer, 778 F.3d at 151. But there is no such fact-opinion distinction for purposes of Exemption 5. Rather, because "[t]he test under Exemption 5 is whether the documents would be 'routinely ' or 'normally ' disclosed upon a showing of relevance," Grolier, 462 U.S. at 26, 103 S.Ct. 2209 (emphasis added), "factual materials prepared in anticipation of litigation" receive the same protection as "deliberative materials," Tax Analysts v. IRS, 117 F.3d 607, 620 (D.C. Cir. 1997). The attorney notes may lie in the former camp, but they are no less protected under Exemption 5.
Second, Frank contends that the notes are unprotected because they were made in preparation for settlement , not litigation. This argument must also be rejected. It is well established that attorney notes made during settlement discussions are protected work product so long as *55"litigation was fairly foreseeable" at the time the notes were created. Coastal States Gas Corp. v. Dep't of Energy, 617 F.2d 854, 865 (D.C. Cir. 1980). The question is "whether, in light of the nature of the document and the factual situation in the particular case, the document can fairly be said to have been prepared or obtained because of the prospect of litigation." United States v. Deloitte LLP, 610 F.3d 129, 137 (D.C. Cir. 2010) (internal quotation marks omitted). And with the attorney notes here, the answer is yes. At the time the notes were taken, the Bureau was investigating Encore's alleged violations of several statutes with civil remedies, including the Fair Debt Collection Practices Act. See Consent Order at 1. The Bureau represents that, had settlement discussions been unproductive, it may have challenged Encore's practices in court. Def.'s Reply & Opp. to Pl.'s Cross-Mot. ("Def.'s Reply") at 12. And determining the extent of Encore's violation was an important step in deciding whether litigation was advisable.
It is true, as Frank points out, that some cases have required the disclosure of interview notes notwithstanding Exemption 5. But these cases tend to involve vague or conclusory claims of privilege; documents prepared when no specific investigation was underway; or both. For example, the Department of Justice's bare assertion that withheld documents "were prepared by Civil Rights Division attorneys in anticipation of litigation," where "no active investigation [was] underway," did not cut it. Senate of Commonwealth of P.R. v. DOJ, 823 F.2d 574, 586 (D.C. Cir. 1987) ; see also Wisdom v. U.S. Tr. Program, 232 F.Supp.3d 97, 122 (D.D.C. 2017) (documents not protected where agency specified neither the creator of the documents nor the target or subject matter of the anticipated litigation). But the notes here were prepared during an active investigation into a potential target of a civil enforcement action. Because they would typically be protected as attorney work product, the Bureau properly withheld them under Exemption 5.
B. Second FOIA Request
The Bureau asserts that Frank cannot challenge the denial of its second FOIA request because that request is pending before the Bureau on remand and Frank has not paid the Bureau's record-review fee or narrowed the scope of the request. It reasons that, until Frank has done so, the firm has not fully exhausted its administrative remedies with respect to its second request. The Court agrees.
"[A] FOIA requester must exhaust administrative appeal remedies before seeking judicial redress." Citizens for Responsibility & Ethics in Wash. ("CREW") v. FEC, 711 F.3d 180, 182 (D.C. Cir. 2013). Frank at least initiated this administrative process: Again, after its second request was denied, it sought appellate review within the Bureau. The Bureau's appellate determination found that its FOIA Office had not conducted a proper segregability analysis and remanded Frank's request with instructions to do so. Lazier Decl. Ex. H. On remand, the FOIA Office timely informed Frank that its search was expected to yield over 48,000 responsive documents and required payment of a $52,603.10 processing fee, with half due up front. Lazier Decl. Ex. J. As an alternative, the FOIA Office suggested that Frank could work with the Bureau to narrow the scope of its request. Id.
Frank concedes that it has not paid the fee or sought to narrow its request. It does not dispute that agencies are permitted "to exact a reasonable charge for 'document search, duplication, and review, when records *56are requested for commercial use.' " Cause of Action v. FTC, 799 F.3d 1108 (D.C. Cir. 2015) (quoting 5 U.S.C. § 552(a)(4)(A)(ii)(I) ). Nor does it challenge the general premise that "[e]xhaustion does not occur until the required fees are paid or an appeal is taken from the refusal to waive fees." Oglesby v. U.S. Dep't of Army, 920 F.2d 57, 66 (D.C. Cir. 1990).
Instead, Frank makes three circumstance-specific arguments that it should be allowed to seek review of the Bureau's initial denial of its second request. First, it points to the fact that the Bureau's appellate determination was only partially favorable, and thus that it has exhausted the administrative appeal with respect to the unfavorable aspects of the decision-i.e. , the portions that "guide the FOIA Office's analysis on remand" with respect to several exemptions. See Lazier Decl. Ex. H, at 3. But to the extent that aspects of the Bureau's appellate determination are unfavorable, it is only because they might foreshadow a denial of Frank's request on remand. Nothing in the determination itself is adverse in the sense relevant to judicial review under FOIA. The statute grants reviewing courts a limited power: "to enjoin the agency from withholding agency records and to order the production of any agency records improperly withheld from the complainant." 5 U.S.C. § 552(a)(4)(B) (emphasis added). The Bureau's appellate determination did not uphold the FOIA Office's withholding decision-rather, it remanded the request with instructions to conduct a new assessment, which could theoretically result in full, partial, or no withholding. The Court therefore cannot review the appellate determination itself, as it would be impossible to deem any records "improperly withheld." Id. 1
Frank further argues that, in any event, the Bureau waived its right to collect fees with respect to this request. The Court disagrees. The Bureau's initial denial contained the following language: "Provisions of the FOIA allow us to recover part of the cost of complying with your request. In this instance, we have waived all fees related to the processing of your request." Lazier Decl. Ex. B, at 2. Given that the Bureau included this language in a decision withholding all requested documents in full under various FOIA exemptions, its waiver is best read as particular to the Bureau's denial, and not as a general waiver of the agency's right to collect fees related to that request even if remanded. After all, the permissible fees associated with review could well differ on remand, as agencies are permitted to charge not only *57for the costs of "determining whether the documents must be disclosed," but also "for the purposes of withholding any portions exempt from disclosure." 5 U.S.C. § 552(a)(4)(A)(iv). Indeed, as a practical matter, the fees associated with reviewing Frank's initial request were likely negligible compared with the potential costs of review on remand, given that the Bureau's initial review resulted in a blanket denial under three FOIA Exemptions and its review on remand must involve a document-by-document segregability analysis.
Finally, Frank claims that the Bureau should be estopped from arguing that Frank has failed to exhaust administrative remedies because its appellate determination ended with a sentence instructing Frank that it "may seek judicial review of this determination." Lazier Decl. Ex. H, at 6. The Bureau explains that this boilerplate language was inadvertently included in the appellate determination, and that it advised Frank of this fact after issuing the decision. Def.'s Reply at 15.
Estoppel against the government is a harsh remedy. The party claiming estoppel must show "that (1) 'there was a definite representation to the party claiming estoppel,' (2) the party 'relied on its adversary's conduct in such a manner as to change his position for the worse,' (3) the party's 'reliance was reasonable' and (4) the government 'engaged in affirmative misconduct.' " Morris Commc'ns, Inc. v. FCC, 566 F.3d 184, 191 (D.C. Cir. 2009) (quoting Graham v. SEC, 222 F.3d 994, 1007 (D.C. Cir. 2000) ). Frank, while disagreeing with the Bureau's legal position on exhaustion, does not assert that the Bureau included this boilerplate language to purposefully thwart it from obtaining relief. Pl.'s Opp. at 17-18. Moreover, Frank has not pointed to any significant consequences stemming from the Bureau's inclusion of the language in its appellate determination-it remains free to pay the Bureau's fee (or narrow its request) in order to get the review process rolling. See Gen. Accounting Office v. Gen. Accounting Office Pers. Appeals Bd., 698 F.2d 516, 526 (D.C. Cir. 1983) ("Estoppel generally requires that government agents engage-by commission or omission-in conduct that can be characterized as misrepresentation or concealment, or, at least, behave in ways that have or will cause an egregiously unfair result ." (emphasis added)). Thus, even assuming that Frank reasonably relied on the Bureau's representation to its detriment, the Bureau's conduct does not warrant estopping it from arguing that Frank has not exhausted its administrative remedies.
In sum, the Bureau is permitted to impose reasonable fees before processing a remanded FOIA request. Assuming that the remanded request could be granted, the requester may not seek judicial review of the appellate determination remanding it. If, after paying the fees or narrowing its request, Frank's second request is denied in whole or in part, it may seek administrative review of that decision and, if the Bureau upholds the withholding, it may seek judicial review of that decision.
C. Challenge to the Bureau's FOIA Policies
In its supplemental complaint, Frank alleges that two of the CFPB's withholding policies are inconsistent with FOIA and violate the APA. Suppl. Compl. ¶¶ 55-76. Specifically, Frank alleges that (1) the Board improperly treats documents produced by third parties in response to civil investigative demands ("CIDs") as being voluntarily produced and therefore subject to greater protection from disclosure under FOIA Exemption 4; and (2) the Bureau erroneously treats large debt collectors as "financial institutions" under FOIA
*58Exemption 8. The Bureau responds that Frank lacks standing to challenge its FOIA policies and that, in any event, the challenges fail on the merits. The Court addresses those issues in turn.
1. Standing
Before assessing the merits of these policy challenges, the Court must first ensure that it has jurisdiction to hear them, which includes deciding whether Frank has standing to challenge the policies. See Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 94-95, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). To establish Article III standing, the plaintiff must show (among other things) an "injury in fact" that is "actual or imminent." Lujan v. Defenders of Wildlife, 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). Having documents improperly withheld in response to a FOIA request is a well-established cognizable injury. But because a plaintiff must have standing for each remedy sought, a plaintiff seeking prospective relief like an injunction or declaration striking down an agency's FOIA policy must be able to point to an imminent future injury-one that is "certainly impending" or has a "substantial risk" of occurring. Susan B. Anthony List v. Driehaus, --- U.S. ----, 134 S.Ct. 2334, 2341, 189 L.Ed.2d 246 (2014) (quoting Clapper v. Amnesty Int'l USA, 568 U.S. 398, 410, 414 n.5, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013) ); see also Dearth v. Holder, 641 F.3d 499, 501 (D.C. Cir. 2011) (plaintiff seeking injunction or declaration "must show he is suffering an ongoing injury or faces an immediate threat of injury"). Past harm alone-for example, the agency's denial of a FOIA request based on a challenged policy-is sufficient only if the plaintiff shows he is "realistically threatened by a repetition of his experience." City of Los Angeles v. Lyons, 461 U.S. 95, 109, 103 S.Ct. 1660, 75 L.Ed.2d 675 (1983). In opposing summary judgment, the plaintiff must make this showing "by affidavit or other evidence," and not through mere allegations. Lujan, 504 U.S. at 561, 112 S.Ct. 2130.
This Court in Tipograph v. DOJ, 146 F.Supp.3d 169 (D.D.C. 2015), explained more particularly how a plaintiff challenging a FOIA policy may establish standing. A plaintiff may not rely on "generalized plans to file unspecified [FOIA] requests ... at some uncertain point in the future" that would implicate the challenged policies. Id. at 175. On the other hand, a plaintiff may establish a sufficiently imminent injury: (1) by showing that "its business depends on continually requesting and receiving documents that the policy permits the [agency] to withhold," (2) by pointing to pending FOIA requests that will likely implicate the agency's policy, or (3) by otherwise adducing specific, concrete plans to file a FOIA request that would implicate the policy. Id. at 175-76 (alteration in original) (quoting Newport Aeronautical Sales v. U.S. Dep't of Air Force, 684 F.3d 160, 164 (D.C. Cir. 2012) ).
Under this rubric, Frank has standing to seek prospective relief. In a declaration accompanying its motion, Frank establishes, through concrete assertions, that it will likely be imminently injured by the two allegedly unlawful FOIA policies it challenges. As to the Exemption 4 policy: Frank contends that the Bureau improperly treats records produced in response to CIDs as being voluntarily produced. As of the time the motions ripened in this case, Frank had two pending FOIA requests unrelated to the current litigation, each of which the Bureau denied in part based on Exemption 4. Decl. Gregory A. Frank Supp. Pl.'s Opp. ("Frank Decl.") at ¶¶ 5-8, 11-14. Frank believes that the Bureau's invocation of Exemption 4 in both cases "stemmed in part from the CFPB's use of *59a civil investigative demand" against a regulated entity-i.e. , that its reliance on Exemption 4 was caused by its policy with respect to that exemption. Id. ¶ 9. These two FOIA requests were granted in part and, to the Court's knowledge, the granted portions remain pending before the Bureau's FOIA Office and Frank has yet to administratively appeal the denied portions. This is just the sort of detailed showing of likely future injury that sustains a plaintiff's burden. Even if the pending FOIA requests could, in theory, be denied on grounds other than Exemption 4-or even granted-the fact that the agency invoked Exemption 4 when initially denying them suggests a high likelihood of an impending denial on appeal on that same ground. Cf. Susan B. Anthony List, 134 S.Ct. at 2345 ("[P]ast enforcement against the same conduct is good evidence that the threat of enforcement is not 'chimerical.' " (quoting Steffel v. Thompson, 415 U.S. 452, 459, 94 S.Ct. 1209, 39 L.Ed.2d 505 (1974) )).
The Bureau's arguments to the contrary ignore that Frank must show only a " 'substantial risk' of future injury"-not certain harm-that will result from the agency policy. Attias v. Carefirst, Inc., 865 F.3d 620, 627 (D.C. Cir. 2017). The fact that Frank has multiple FOIA requests pending with the agency and credibly anticipates filing more, Frank Decl. ¶ 4, suggests a substantial likelihood of future injury. See Nat'l Sec. Counselors v. CIA, 898 F.Supp.2d 233 (D.D.C. 2012) (noting plaintiff's "consistent habit of filing [similar] requests both before and after the commencement of [the] litigation"). Frank's alleged injury is far more concrete than those deemed insufficient in analogous cases. Cf., e.g., Tipograph, 146 F.Supp.3d at 177 (plaintiff had "neither assert[ed] that she has any FOIA requests pending that could implicate the alleged FBI policy or practice nor identifie[d] a specific FOIA request that she intends to file in the near future (internal quotations omitted)); Coleman v. DEA, 134 F.Supp.3d 294, 306 (D.D.C. 2015) (plaintiff challenging fee-waiver policy had "not averred that he has a pending FOIA request before the DEA; that he intends to make FOIA requests to the DEA in the future; or that, in connection with a future request, he will seek to invoke the public-interest fee waiver").
For similar reasons, Frank has standing to bring its Exemption 8 policy challenge-namely, that the Board improperly includes debt collectors (like Encore) within the definition of "financial institutions" whose records are protected under the exemption. True, Frank does not point to any pending FOIA requests that implicate the Bureau's allegedly unlawful policy. But Frank avers that, as of the filing of its declaration, the parties were negotiating the scope of a FOIA request related to the Encore consent order, and that they have discussed the possibility of Frank filing of "a series of new FOIA requests targeting narrow informational aspects of the Encore consent order." Frank Decl. ¶ 21. Frank expects that any such requests would be met with an invocation of Exemption 8. Id. ¶ 22. More generally, when combined with its intent to file further requests with the Bureau, Frank's line of work suggests a substantial risk of future injury stemming from the challenged policy. Frank is currently litigating several consumer class actions against debt collectors, Frank Decl. ¶ 4, and the challenged policy relates to the precise question of whether those entities are "financial institutions" for purposes of Exemption 8. Frank's anticipated future requests will therefore very likely implicate Exemption 8. Frank therefore has standing to challenge both policies.
2. Merits
That leaves whether the Bureau's challenged policies comply with FOIA.
*60a. Exemption 4
Some background on FOIA Exemption 4 is necessary to understand the parties' dispute. The exemption protects "trade secrets and commercial or financial information obtained from a person and privileged or confidential." 5 U.S.C. § 552(b)(4). The D.C. Circuit imposes different standards for withholding information under Exemption 4 as "confidential" depending on whether the information sought was submitted compulsorily-in which case the protection is more limited-or voluntarily-in which case it is more stringently protected. Deciding whether information is submitted mandatorily or voluntarily is an objective question: "actual legal authority [to compel disclosure], rather than parties' beliefs or intentions, governs judicial assessments of the character of submissions." Ctr. for Auto Safety v. Nat'l Hwy. Traffic Safety Admin., 244 F.3d 144, 149 (D.C. Cir. 2001).
Information provided voluntarily is shielded from disclosure if it "is of a kind that would customarily not be released to the public by the person from whom it was obtained." Critical Mass Energy Proj. v. Nuclear Regulatory Comm'n, 975 F.2d 871, 879 (D.C. Cir. 1992) (en banc). "[T]he purpose served by the exemption in such instances is that of 'encouraging cooperation with the Government by persons having information useful to officials.' " Id. at 878 (quoting Nat'l Parks & Cons. Ass'n v. Morton, 498 F.2d 765, 768 (D.C. Cir. 1974) ). In other words, if a regulated entity knows that confidential commercial information produced voluntarily to the government will be protected from subsequent FOIA requests, it will be more likely to share it.
On the other hand, "information provided to the Government on a mandatory basis" is granted less protection: it "is 'confidential' if 'disclosure would be likely either (1) to impair the Government's ability to obtain necessary information in the future; or (2) to cause substantial harm to the competitive position of the person from whom the information was obtained.' " Ctr. for Auto Safety, 244 F.3d at 147-48 (quoting Critical Mass, 975 F.2d at 878 ). Mandatory information is entitled to less protection because where the government has legal power to compel production of certain information, its "access to the information normally is not seriously threatened by disclosure" to third parties pursuant to future FOIA requests. Id. at 148.
Frank claims that the Bureau has a policy of treating information produced in response to its CIDs as being submitted voluntarily and thus deserving of greater protection from disclosure under FOIA Exemption 4. It contends that this policy flies in the face of Exemption 4 (as interpreted by the D.C. Circuit) because the Bureau's power to issue CIDs is formal, legal authority backed by a threat of judicial enforcement and because, even if non-compliance carries no immediate legal consequences, the Bureau has "less formal" mechanisms to induce compliance.
The Court agrees that the Bureau's formal authority to issue CIDs and, if need be, to obtain judicial enforcement, means that the submissions it receives in response to a CID should be treated as mandatory. The Bureau's power to issue CIDs is rooted in statute. "Whenever the Bureau has reason to believe that any person may be in possession, custody, or control of any documentary material or tangible things, or may have any information, relevant to a violation," it may "issue in writing, and cause to be served upon such person, a civil investigative demand." 12 U.S.C. § 5562(c)(1). The D.C. Circuit treats the Bureau's CIDs as functionally equivalent to administrative subpoenas.
*61CFPB v. Accrediting Council for Indep. Colls. and Schs., 854 F.3d 683, 688 (D.C. Cir. 2017). Like subpoenas, CIDs "are not self-enforcing, and non-compliance triggers no fine or penalty." John Doe Co. v. CFPB, 849 F.3d 1129, 1131 (D.C. Cir. 2017) (per curiam order). Rather, if an entity refuses compliance, the CFPB files a petition in federal court to enforce the CID. Id.; see 12 U.S.C. § 5562(e)(1). Judicial review of a CID petition, as with an administrative subpoena, "typically results in enforcement," though courts play a "limited role" by ensuring that the CID is within the scope of the Bureau's statutory authority. Accrediting Council, 854 F.3d at 688-89.
The D.C. Circuit has not considered whether this scheme renders disclosures made in response to CIDs voluntary or mandatory for purposes of Exemption 4. Judges in this district have, however, implied that an administrative subpoena constitutes just the sort of "legal authority" that would render a disclosure mandatory. See, e.g., Durnan v. U.S. Dep't of Commerce, 777 F.Supp. 965, 967 (D.D.C. 1991) ("[T]he Court rejects the plaintiff's argument that disclosure would not impair the DOC's ability to obtain necessary information through voluntary cooperation in light of the DOC's sub poena power.").
More importantly, the reasoning underlying the Circuit's distinction between the two types of disclosures supports a conclusion that CIDs result in mandatory disclosure, even absent a court order. Again, the relevant question is whether the Bureau has "actual legal authority" to obtain the information that was produced. Ctr. for Auto Safety, 244 F.3d at 149 (finding information submitted voluntarily where agency erroneously purported to have statutory authority to compel production). The reason for focusing on an agency's legal authority is that, where such authority exists, an entity's hesitation to share information (on the ground that it might be disclosed pursuant to a future FOIA request) does not inhibit the government's ability to obtain that information. And that is just the case when it comes to information "relevant to a violation" within the CFPB's enforcement jurisdiction, as 12 U.S.C. § 5562(c) grants the Bureau formal power to compel production of such information by serving a CID and, if necessary, obtaining a court order for enforcement.
In arguing to the contrary, the Bureau latches onto the fact that a recipient of a CID does not face immediate legal penalties for disregarding it unless the Bureau obtains a court order and the recipient disobeys it. John Doe Co., 849 F.3d at 1131. But, to repeat, the D.C. Circuit has held voluntariness does not turn on the recipient's perception of whether it must comply with the demand-it instead turns on the agency's power to induce compliance. See Center for Auto Safety, 244 F.3d at 149 ("[L]inking enforceability and mandatory submissions creates an objective test; regardless of what the parties thought or intended, if an agency has no authority to enforce an information request, submissions are not mandatory."). With inquiry into the recipient's sense of compulsion off the table, all that could support the Bureau's position would be a cramped reading what it means to have "legal authority" to induce compliance: the request would be mandatory only if penalties would flow directly from violation of the CID, and not just from violation of the subsequent court order. That formalistic approach would in no way promote the policy underlying the D.C. Circuit's differential treatment of voluntary and mandatory information. If an agency has statutory authority to get a court order, its ability to obtain the information is not in jeopardy regardless of whether a court has yet issued its order.
*62And, stepping back, the Bureau's approach would be out of step with the underlying thrust of FOIA, which suggests it is neither what Congress had in mind when crafting Exemption 4 nor what the D.C. Circuit had in mind when interpreting it. All administrative subpoenas, not to mention grand jury subpoenas, require judicial enforcement before penalties attach. See ICC v. Brimson, 154 U.S. 447, 485, 14 S.Ct. 1125, 38 L.Ed. 1047 (1894) ("The inquiry whether a witness before the commission is bound to answer a particular question propounded to him, or to produce books, papers, etc., in his possession and called for by that body, is one that cannot be committed to a subordinate administrative or executive tribunal for final determination."); see also, e.g., 12 U.S.C. § 5562(b) (Bureau's power to subpoena witnesses enforceable only through judicial application); Fed. R. Crim. P. 17(g) (providing for contempt upon noncompliance with court-issued subpoena). To accept the Bureau's reasoning would thus render all information submitted pursuant to an agency subpoena as "voluntary" absent a court order directing production. That result would accord enhanced protection to a large swath of information in agencies' possession, which is hard to square with FOIA's pro-disclosure goals. And it would be contrary to regulated entities' intuitive understanding of what it means to have their information subpoenaed-an understanding corroborated by the typical definition of a subpoena. See Webster's Second New International Dictionary 2512 ("A writ commanding the person designated in it to attend court under a penalty for failure ... or also requiring him to produce in court certain designated documents.").2
To summarize: Exemption 4 does not allow the Bureau to treat information produced in response to a CID issued by the Bureau pursuant to 12 U.S.C. § 5562(c)(1) as disclosed voluntarily. Any Bureau policy to that effect violates FOIA. The Court will therefore grant summary judgment in favor of Frank on Count III of its Supplemental Complaint and deny the Bureau's motion to dismiss that count.
b. Exemption 8
Frank also challenges the Bureau's interpretation of Exemption 8. That exemption protects records "contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions." 5 U.S.C. § 552(b)(8). Frank claims that the Bureau has a policy of interpreting the term "financial institutions" to cover entities that buy and collect on debts, and that this interpretation is inconsistent with FOIA. The Bureau justifies its policy by pointing to the plain meaning of the term "financial institutions," to the broad purposes of Exemption 8, and to the alignment between those purposes and the Bureau's supervision of debt buyers like Encore.3
*63The Court finds that the Bureau's interpretation accords with Exemption 8. The term "financial institution" is inherently broad. See, e.g., Black's Law Dictionary (10th ed. 2014) ("A business, organization, or other entity that manages money, credit, or capital, such as a bank, credit union, savings-and-loan association, securities broker or dealer, pawnbroker, or investment company."). Debt collectors-as a link in the credit-management chain-fit comfortably within that scope. Moreover, several other statutes regulating "financial institutions" expressly define the term to include debt-collecting entities like Encore. See Fair Credit Reporting Act, 15 U.S.C. § 1681s-2(a)(7)(A), (G) (cross-referencing definition of "financial institution" in 15 U.S.C. § 6809, which through 12 U.S.C. § 1843(k) and 12 C.F.R. § 225.28(b)(iv) includes "[c]ollecting overdue accounts receivable"); see also Financial Services Modernization Act of 1999, 15 U.S.C. § 6809(3) (relying on same definition). When Congress has sought to target a narrower set of institutions, it has chosen a narrower term. See Financial Institutions Reform, Recovery, and Enforcement Act of 1989, 12 U.S.C. § 1813(c) (covering "depository institution[s]," which are banks or savings associations).
Frank provides no reason to conclude that the term as used in FOIA should be interpreted narrowly. On the contrary, unlike with most FOIA exemptions, the D.C. Circuit "has explained time and again that Exemption 8's scope is 'particularly broad.' " Pub. Investors Arbitration Bar Ass'n ("PIABA") v. SEC, 771 F.3d 1, 4 (D.C. Cir. 2014) (quoting Cons. Union of U.S., Inc. v. Heimann, 589 F.2d 531, 533 (D.C. Cir. 1978) ). While "the primary reason for adoption of exemption 8" was to prevent runs on banks, courts have long recognized that it sweeps widely to encourage cooperation between financial institutions and their regulators. Heimann, 589 F.2d at 534. That purpose is directly implicated by the Bureau's relationship with large consumer debt collectors (like Encore) falling solidly within its regulatory jurisdiction. See 12 U.S.C. § 5514(a)(1). The Bureau's policy of treating debt buyers and collectors as "financial institutions" is consistent with Exemption 8.4
Finally, the Court finds that Frank cannot state a claim under the Administrative Procedures Act based on the Bureau's allegedly unlawful policies. The APA provides for judicial review of agency action only where "there is no other adequate remedy in a court." 5 U.S.C. § 704. The D.C. Circuit has, for decades, allowed challenges *64to agency FOIA policies through FOIA itself. See, e.g., Newport, 684 F.3d at 164 (explaining that challenge to agency policy allowed where policy "will impair the party's lawful access to information in the future"); Payne Enters., 837 F.2d at 494 ("FOIA imposes no limits on courts' equitable powers in enforcing its terms."). As a result, the Circuit has held that FOIA provides an adequate route for challenging agency FOIA policies, and thus that those challenges cannot be brought through the APA. See CREW v. DOJ, 846 F.3d at 1245. The Court will therefore dismiss Counts IV and V of Frank's Supplemental Complaint.5
IV. Conclusion
The CFPB properly withheld the records Frank sought in its first request under FOIA Exemptions 5 and 7(E). As for the records sought in its second request, Frank has not exhausted its administrative remedies. The Court will therefore grant the Bureau's Motion for Summary Judgment (ECF No. 19) and will deny Frank's cross-motion (ECF No. 22) with respect to those claims. Frank has standing to challenge the Bureau's FOIA policies with respect to Exemptions 4 and 8. The Bureau's policy with respect to Exemption 4 is inconsistent with FOIA, and thus the Court will grant summary judgment in Frank's favor on that challenge and accord it the equitable relief requested in Count III of the Supplemental Complaint. The Bureau's motion to dismiss that count will be denied. Frank's challenge to the Bureau's Exemption 8 policy, however, fails as a matter of law, and he has no cause of action to challenge either policy under the APA. The Court will therefore dismiss Counts II, IV, and V of Frank's Supplemental Complaint. A separate Order accompanies this Memorandum Opinion.
Seeking to evade the consequences of the Bureau's remand, Frank points to regulations demanding that the Bureau treat a remanded FOIA request "as a new request received by the CFPB as of the date when the General Counsel transmits the remand notification to the requester." 12 C.F.R. § 1070.21(e)(3) (emphasis added). In Frank's view, it follows that the appellate determination "extinguished" the request by remanding it, as the FOIA Office on remand will be considering a new request. Pl.'s Opp. at 18.
Not so. Read in context, the regulation directing the Bureau to treat remanded requests as new requests is clearly aimed to facilitate the agency's own compliance with FOIA-specifically, by explaining that the statutory clock begins running when the requester is notified of the remand. It would be unnatural to read that sort of ministerial provision as rendering the remanded request exhausted. Indeed, Frank's understanding of the scheme conflicts with the very purpose of requiring exhaustion. Any appellate decision remanding a request, so long as it contained one bit of adverse reasoning, would be immediately appealable, as the request would have been exhausted upon remand. The agency would never be permitted to "correct mistakes" identified in the appeals process, which is the exact result that the exhaustion doctrine seeks to avoid. Oglesby, 920 F.2d at 61.
The Court rejects Frank's alternative argument that the Bureau's informal enforcement mechanisms render the disclosures mandatory. While the D.C. Circuit has found certain "less formal" enforcement mechanisms relevant to the question of voluntariness, it has done so only in a limited context: that conditioning eligibility for a government contract on the disclosure of certain information renders the disclosure mandatory. See Morton, 498 F.2d at 770 (disclosure involuntary where it was a "mandatory condition of the concessioners' right to operate in national parks").
Given the language of Exemption 8, one might wonder why the parties' dispute centers on the definition of "financial institutions." The plain text, after all, does not require that the record sought to be protected is itself related to a financial institution, but rather covers records related to reports prepared by agencies generally responsible for the regulation of financial institutions. But the D.C. Circuit has read the exemption to require that the record must also be related to the regulation of a financial institution. See Pub. Investors Arbitration Bar Ass'n ("PIABA") v. SEC, 771 F.3d 1, 6 (D.C. Cir. 2014) ("[O]ne should read 'examination, operating, or condition reports' to mean 'examination, operating, or condition reports related to financial institutions .' "). The Court therefore must analyze whether debt buyers are "financial institutions."
In arguing to the contrary, Frank points to a recent D.C. Circuit decision that, while construing Exemption 8 broadly, expressly cabined its broad reading to institutions regulated by the Securities and Exchange Commission ("SEC"). See PIABA, 771 F.3d at 7. But the context of that case makes it unhelpful here. The court there was interpreting a provision of the Exchange Act of 1934, which clarifies that any entity the SEC "is responsible for regulating, supervising, or examining ... is a financial institution" for purposes of FOIA. See 15 U.S.C. § 78x(e). Thus, as the court expressly recognized, any of its proclamations about the scope of Exemption 8 were specific to the SEC, and the "opinion has nothing to say about the ability of other financial agencies-say, the Consumer Financial Protection Bureau-to withhold specific records." PIABA, 771 F.3d at 7 (emphasis added).
Frank, acknowledging the Bureau's "extraordinarily broad equitable powers under FOIA," justifies its APA claim on the ground that, aside from being inconsistent with FOIA, the Bureau's policies may be inconsistent with its own regulations. Pl.'s Opp. at 29-30. But Frank did not raise this allegation in its complaint and, in any event, the Court finds no record support for such an allegation.