We must decide whether a credit card company violates the Truth in Lending Act when it fails to disclose potential risk factors that allow it to raise a cardholder’s Annual Percentage Rate.
I
A
Walter and Cheryl Barrer held a credit card account with Chase.1 The Barrers received and accepted the Cardmember Agreement (“the Agreement”) governing their relationship at the relevant time in late 2004. In February 2005, Chase mailed to the Barrers a Change in Terms Notice (“the Notice”), which purported to amend the terms of the Agreement, in particular to increase the Annual Percentage Rate (“APR”) significantly. It also allowed the Barrers to reject the amendments in writing by a certain date. They did not do so, and continued to use the credit card. Within two months, the new, higher, APR became effective.
According to the Barrers’ First Amended Complaint (which is the operative complaint), they enjoyed a preferred APR of 8.99% under the Agreement. In a section entitled “Finance Charges,” the Agreement provided a mathematical formula for calculating preferred and non-preferred APRs and variable rates. In the event of default, the Agreement stated that Chase might increase the APR on the balance up to a stated default rate. The Agreement specified the following events of default: failure to pay at least a minimum payment *886by the due date; a credit card balance in excess of the credit limit on the account; failure to pay another creditor when required; the return, unpaid, of a payment to Chase by the customer’s bank; or, should Chase close the account, the consumer’s failure to pay the outstanding balance at the time Chase has appointed.
Another section entirely, entitled “Changes to the Agreement,” provided that Chase “can change this agreement at any time, ... by adding, deleting, or modifying any provision. [The] right to add, delete, or modify provisions includes financial terms, such as APRs and fees.” The next section, entitled “Credit Information,” stated that Chase “may periodically review your credit history by obtaining information from credit bureaus and others.” These sections appeared five and six pages, respectively, after the “Finance Charge” section.
Around April 2005, the Barrers’ noticed that their APR had “skyrocketed” from 8.99% to 24.24%, the latter a rate close to a non-preferred or default rate. None of the events of default specified in the Agreement, however, had occurred. When the Barrers contacted Chase to find out why their APR had increased, Chase responded in a letter citing judgments it had made on the basis of information obtained from a consumer credit reporting agency. In particular, Chase wrote that: “outstanding credit loan(s) on revolving accounts ... [were] too high” and there were “too many recently opened installment/revolving accounts.” The Barrers do not dispute the facts underlying Chase’s judgments.
Despite the Barrers’ surprise, the Notice they had received in February contained some indication of what would be forthcoming. Specifically, it disclosed that Chase would shortly increase the APR to 24.24%, a decision “based in whole or in part on the information obtained in a report from the consumer reporting agency.”
The Barrers paid the interest on the credit account at the new rate for three months before they were able to pay off the balance. Then they sued Chase in federal district court.
B
The Barrers filed a class action lawsuit on their own behalf and on behalf of all Chase credit card customers similarly harmed and similarly situated. The complaint asserted one cause of action under the Truth in Lending Act (“the Act”), 15 U.S.C. §§ 1601 et seq., and Regulation Z, 12 C.F.R. § 226, promulgated thereunder. The Barrers claim to have been the victims of a practice they now call “adverse action repricing,” which apparently means “raising ... a preferred rate to an essentially non-preferred rate based upon information in a customer’s credit report.” Though the Barrers do not claim that the practice itself is illegal, they do claim that it was illegal for Chase not to disclose it fully to them or to the other members of the putative class.
Chase moved to dismiss the Barrers’ cause of action for failure to state a claim under the Act, or alternatively to compel arbitration in accordance with the terms of the Agreement’s arbitration provision. The magistrate judge recommended in favor of Chase on both motions. Because the district court agreed that the Barrers’ cause of action should be dismissed, and their case with it, it never reached the magistrate judge’s recommendation regarding Chase’s motion to compel arbitration, but simply entered judgment for Chase.2 The Barrers timely appeal.
*887II
The Truth in Lending Act is designed “to assure a meaningful disclosure of credit terms so that the consumer will be able to compare more readily the various credit terms available to him and avoid the uninformed use of credit.” 15 U.S.C. § 1601(a). Rather than substantively regulate the terms creditors can offer or include in their financial products, the Act primarily requires disclosure. See Hauk v. J.P. Morgan Chase Bank USA, 552 F.3d 1114, 1120 (9th Cir.2009). The Barrers’ credit card is considered to be an “open end credit plan,”3 one of the products the Act regulates. Under the typical commercial arrangement, credit card holders pay a fee, called a finance charge, in order to draw on their credit account. The interest rate or rates used to compute the finance charge generate an APR, a number which is a typical, and therefore useful, comparative measure of the price of the credit the company sells to the consumer. See 15 U.S.C. §§ 1605(a) & 1606(a)(2).
In general, the Act regulates credit card disclosures at numerous points in the commercial arrangement between creditor and consumer: at the point of solicitation and application, at the point the consumer and the creditor consummate the deal, at each billing cycle, and at the point the parties renew their arrangement. Id. § 1637(a)-(d). Specifically, creditors must disclose “[t]he conditions under which a finance charge may be imposed,” “[t]he method of determining the amount of the finance charge,” and, “[w]here one or more periodic rates may be used to compute the finance charge, each such rate ... and the corresponding nominal annual percentage rate.” Id. § 1637(a)(1), (a)(3) & (a)(4). Subsection 1604(a) directs the Board of Governors of the Federal Reserve System (“the Board”) to “prescribe regulations to carry out the purposes of’ the Act.
Regulation Z, 12 C.F.R. § 226, provides the precise regulations that the Barrers claim Chase violated. In general, these regulations establish two conditions a creditor must meet. “First, it must have disclosed all of the information required by the statute.” Rossman v. Fleet Bank (R.I.) Nat’l Ass’n, 280 F.3d 384, 391 (3d Cir.2002). That is, disclosures must be complete. “And second, [they] must have been true — i.e., ... accurate representation[s] of the legal obligations of the parties at [the] time [the agreement was made].” Id.
Section 226.6 lists the initial disclosures required of a creditor under a new credit agreement. The list includes “each periodic rate that may be used to compute the finance charge ... and the corresponding annual percentage rate.” 12 C.F.R. § 226.6(a)(2). The Board has interpreted this regulation in a staff commentary,4 comment 11, which provides that “[i]f the initial rate may increase upon the occurrence of one or more specific events, ... the creditor must disclose the initial rate and the increased penalty rate that may apply” and “an explanation of the specific *888event or events that may result in the increased rate.” 12 C.F.R. Pt. 226 Supp. I, par. 6(a)(2), cmt. 11. Even if the rate itself is indeterminate at the time of the initial disclosure, the creditor must still disclose the specific event or events leading to a rate increase. Id. As examples of a specific event, the comment lists “a late payment or an extension of credit that exceeds the credit limit.” Id.
Just as section 226.6 states what must be disclosed, so section 226.5 describes how to disclose it. Among other things, creditors must make the required disclosures “clearly and conspicuously in writing.” 12 C.F.R. § 226.5(a)(1).5 And, again, any disclosures must “reflect the terms of the legal obligation between the parties.” Id. § 226.5(c).
Creditors are not required to be clairvoyant, however, for “[i]f a disclosure becomes inaccurate because of an event that occurs after the creditor mails or delivers the disclosures, the resulting inaccuracy is not a violation of [Regulation Z].” Id. § 226.5(e). The Board has also recognized that creditors may reserve the general right to change the credit agreement, as Chase did in this case. See 12 C.F.R. Pt. 226 Supp. I, par. 6(a)(2), cmt. 2 (recognizing the use of general reservation clause). Should the creditor make changes in these ways, it may have to disclose anew under § 226.9(c). Id.
Finally, although the text of the Act and regulations governs, we construe that text in favor of the cardholder by strictly enforcing its regulation against the creditor. Jackson v. Grant, 890 F.2d 118, 120 (9th Cir.1989).
Ill
The Barrers argue that Chase consciously shielded its “adverse action repricing” program from its customers, deceiving them as to why their APRs might increase. To phrase it in the language of the Act, they allege that Chase failed to disclose completely under the Act why it would change the APRs of its cardholders, in violation of subsection 226.6(a)(2) of Regulation Z.6
The Barrers do not argue that either the Agreement or the Notice failed to disclose the APR, which their complaint puts at 8.99% under the Agreement and 24.24% under the Notice. Rather, they argue that Chase violated the Act by failing to disclose “(1) the existence of the [adverse action re-pricing] practice; (2) the credit factors that trigger an adverse action reprice of a customer’s preferred APR; and (3) that information obtained from a consumer’s credit report will be used for this purpose.” Thus, the gravamen of the Barrers’ complaint is that Chase did not disclose that if a cardholder’s credit report revealed certain information, what Chase calls “risk factors,” the APR might go up.
*889A
Subsection 226.6(a)(2) states that “[t]he creditor shall disclose to the [cardholder] ... each periodic rate that may be used to compute the finance charge ... and the corresponding annual percentage rate.” There is, again, no dispute that Chase disclosed the new APR after it had calculated it and before it went into effect. Comment 11, however, indicates that more is required. Most importantly, even if the creditor could not know what a potential' increased rate would be when it made the original disclosures, “the creditor must provide an explanation of the specific event or events that may result in the increased rate.” 12 C.F.R. Pt. 226 Supp. I, par. 6(a)(2) cmt. 11. According to the Barrers, the risk factors that Chase considered under its adverse action repricing program are “specific events that may result in the increased rate,” and Chase had to disclose them.
Chase counters that the risk factors are too general to fall under the meaning of “specific events.” It points to the .examples of events comment 11 provides: late payments and credit draws in excess of the credit limit. By contrast, Chase claims, the reasons the complaint alleges Chase raised APRs are more like judgment calls, assessments of a cardholder’s risk as the credit history unfolds: outstanding credit loans on revolving accounts that were “too high”; “too many recently opened installmeni/revolving accounts”; debts on loan finance trades that were “too high”; or an average time accounts had been opened that was “too short.” Chase contends that it needs flexibility to adjust the terms on which it offers credit according to such risk factors, but that it cannot possibly disclose every factor it might consider because the list is potentially infinite and constantly changes as market conditions change.
We recognize that, as we noted above, neither the Act nor Regulation Z demands clairvoyance from creditors. The comments specifically contemplate general reservation clauses, and Regulation Z recognizes that subsequent events, specific or not, can render inaccurate a creditor’s initial disclosures and require new ones. See 12 C.F.R. Pt. 226 Supp. I, par. 9(c), cmt. 1; 12 C.F.R. § 226.5(e). But this does not dispose of the issue. At its core, the Barrers’ complaint alleges not that Chase adjusted APRs based on unknown future events that forced it to reprice the credit it offered. Rather, the Barrers specifically accuse Chase of having a pre-existing program, at the time of the Agreement, whereby it planned to raise their APR if certain risk factors appeared in their credit history.
But even if Chase did maintain such a program,7 the language of comment 11 would not require its disclosure. We agree with Chase that it must be. able to adjust the price of credit according to how risky it is to lend to a given cardholder. Indeed, the risk of the cardholder — the likelihood he or she will fail to pay off credit balances — is a basic element in the price of credit. In this sense, “adverse action re-pricing” is simply a way of describing the normal way a credit card company prices its product. Not only will the facts that make a cardholder risky emerge over time, but their importance to Chase may vary as market conditions fluctuate. For example, just a few years ago creditors were much less wary than they appear to be today of cardholders and other loan recipients who carry high levels of debt. As a credit card company’s liquidity decreases, it may suddenly decide to curb the cardholders to whom it had happily *890given the car keys only the previous year. These decisions do indeed reflect judgments that creditors make more than they do specific, triggering events which creditors know in advance “may result in [an] increased [APR].” 12 C.F.R. Pt. 226 Supp. I., par. 6(a)(2), cmt. 11.
B
Comment 11, however, does not exhaust the requirements that Chase'had to meet. Regulation Z also requires that creditors disclose any APR “that may be used to compute the finance charge,” and that they do so “clearly and conspicuously.” 12 C.F.R. §§ 226.6(a)(2) & 226.5(a)(1) (emphasis added). The point is not that Chase had to disclose every factor relevant to the APRs it imposed or that it reserved the right to change the agreement; neither the Act nor Regulation Z requires such disclosures. Moreover, we have recently rejected the notion that credit card companies must disclose more than what the laws actually require in order to avoid liability for some type óf “bait-and-switch.” See Hauk, 552 F.3d at 1122 (“We hold that a creditor’s undisclosed intent to act inconsistent with its disclosures is irrelevant in determining the sufficiency of those disclosures under sections 226.5, 226.6, and 226.9 of Regulation Z.”). Rather, the question is what disclosures Chase must have made in order to disclose clearly and conspicuously what Regulation Z does demand: namely, any APR “that may be used.” 12 C.F.R. § 226.6(a)(2) (emphasis added).
1
We have yet to determine the meaning of the word “may” in subsection 226.6(a)(2), but one of our sister circuits has done so. In Rossman v. Fleet Bank, the Third Circuit rejected the argument that the word means “might ever be” at some future date, because Regulation Z explicitly contemplates that creditors will make changes to an agreement “that do not affect the accuracy of a previous disclosure.” 280 F.3d at 392. (citing provisions of Regulation Z and the Act) (emphasis omitted). Instead, it held that “may” means “is permitted to” by the agreement at issue. Id. at 393. Rossman pointed to the Board’s comment, albeit in reference to a different subsection of the regulation, that “[t]he disclosures should reflect the credit terms to which the parties are legally bound at the time of giving the disclosures.” Id. at 391 (quoting 12 C.F.R. Pt. 226, Supp. I § 5(c), cmt. 1) (emphasis added). In light of that observation, the Third Circuit concluded that “may” in this context connoted permission, not possibility. Id. at 393.
We are persuaded by this interpretation. Although our recent Hauk opinion disagreed with the reasoning of Rossman in some respects, see Hauk, 552 F.3d at 1121-22, it confirmed that “our circuit has focused on subsection 226.5(c)’s requirement that disclosures ‘reflect the- terms of the legal obligation between the parties,’ ” id. at 1121. Our interpretation of subsection 226.6(a)(2) is consistent with full disclosure of contractual terms. Creditors, including Chase, therefore violate subsection 226.6(a)(2) when they do not disclose in an agreement any APR that such agreement permits them to use.
2
Chase argues that the Agreement permitted it to change the Barrers’ APR on the basis of risk factors that it discovered in their credit history, by virtue of the reservation of the right to change terms (“change-in-terms provision”). Furthermore, Chase contends that the disclosure of that contractual right, coupled with the disclosure that Chase would periodically *891review credit history, meets its disclosure obligation under subsection 226.6(a)(2).
a
We are persuaded that Chase adequately disclosed the APRs that the Agreement permitted it to use simply by means of the change-in-terms provision. That provision reserved Chase’s right to change APRs, among other terms, without any limitation on why Chase could make such a change. The provision thus disclosed that, by changing the Agreement, Chase could use any APR, a class of APRs that logically includes APRs adjusted on the basis of adverse credit information. Apart from the gloss of Comment 11, neither the Act nor Regulation Z require Chase to disclose the basis on which it would change or use APRs.8 Therefore the failure to disclose the reason for the change to the B'arrers’ APR — adverse credit information — and that Chase would look up their credit history to acquire that information does not undermine the adequacy of Chase’s disclosure.9
b
Even so, such disclosure must be clear and conspicuous. 12 C.F.R. § 226.5(a)(1);' 15U.S.C. § 1632(a). Neither the Act nor Regulation Z define clarity and conspicuousness in this context. *892The Staff 'Commentary explains only that “[t]he clear and conspicuous standard requires that disclosures be in a reasonably understandable form.” 12 C.F.R. Pt. 226, Supp. I, par. 5(a)(1), cmt. 1. The same standard for clarity and eonspicuousness also appears in other areas of commercial law, which matters because “[w]hen a federal statute leaves terms undefined or otherwise has a ‘gap,’ we often borrow from state law in creating a federal common law rule.” See Am. Gen. Fin., Inc. v. Basset (In re Bassett), 285 F.3d 882, 884-85 (9th Cir.2002). Under the Uniform Commercial Code, a term is considered conspicuous when it is “so written, displayed, or presented that a reasonable person against which it is to operate ought to have noticed it.” U.C.C. § l-201(b)(10). We borrowed from this definition in the context of the Bankruptcy Code, which also requires certain disclosures to be “clear and conspicuous” without defining that term, concluding that “conspicuousness ultimately turns on the likelihood that a reasonable person would actually see a term in an agreement.” Bassett, 285 F.3d at 886.
Clear and conspicuous disclosures, therefore, are disclosures that a reasonable cardholder would notice and understand. No particular kind of formatting is magical, see Bassett, 285 F.3d at 886, but, in this case, the document must have made it clear to a reasonable cardholder that Chase was permitted under the agreement to raise the APR not only for the events of default specified in the “Finance Terms” section, but for any reason at all.
Although “[w]e decide conspicuousness as a matter of law,” Bassett, 285 F.3d at 885, we need not promulgate here a code of conspicuousness. It is enough to observe that the change-in-terms provision appears on page 10-11 of the Agreement, five dense pages after the disclosure of the APR. It is neither referenced in nor clearly related to the “Finance Terms” section. This provision, as part of the APRs allowed under the contract, is buried too deeply in the fine print for a reasonable cardholder to realize that, in addition to the specific grounds for increasing the APR listed in the “Finance Charges” section, Chase could raise the APR for other reasons.
Therefore, the Barrers have stated a claim because Chase cannot show that, as a matter of law, the Agreement made clear and conspicuous disclosure of the APRs that Chase was permitted to use.
IV
For the foregoing reasons, we reverse the district court’s grant of Chase’s motion to dismiss for failure to state a claim and remand for further proceedings.
REVERSED and REMANDED.
Partial Concurrence and Partial Dissent by Judge GRABER.. According to Chase, the account was in Walter Barrer’s name only; Cheryl Barrer was an "Authorized User,” and therefore not legally responsible for the account. For simplicity's sake, we refer to the couple collectively as "the Barrers.”
. In their briefs, the Barrers challenged the magistrate judge’s conclusion regarding *887Chase’s motion to compel arbitration out of an abundance of caution. Their counsel conceded at oral argument that the challenge was not ripe.
. The Act defines an "open end credit plan” as "a plan under which the creditor reasonably contemplates repeated transactions, which prescribes the terms of such transactions, and which provides for a finance charge which may be computed from time to time on the outstanding unpaid balance.” 15 U.S.C. § 1602(i).
. "Unless demonstrably irrational, Federal Reserve Board staff opinions construing the Act or Regulation should be dispositive....” Ford Motor Credit Co. v. Milhollin, 444 U.S. 555, 565, 100 S.Ct. 790, 63 L.Ed.2d 22 (1980).
. Subsection 226.5(a)(2) also requires that the finance charge and APR, "when required to be disclosed with a corresponding amount or percentage rate, shall be more conspicuous than any other required disclosure." This provision does not apply here, however, because we do not address the required disclosure of a specific APR. We therefore express no opinion on it, beyond clarifying its non-application to this case.
. The complaint also claimed, in the alternative, that "to the extent Chase has issued subsequent disclosures that purported to increase Plaintiffs’ and the Class’ APR based on factors, events, or circumstances not reflected in the original [Agreement], ... such disclosures violate [the Act] and Regulation Z in that they fail to accurately reflect the legal obligations of the parties.” We do not reach this theory of liability, premised on allegedly inaccurate disclosure in the Notice in violation of § 226.5(c), because we find the Barrers’ first theory sufficiently states a claim.
. Because we are at the Rule 12(b)(6) stage, we take this allegation as true.
. The Barrers point to the language of subsection 226.6(a) requiring disclosure of "[t]he circumstances under which a finance charge will be imposed and an explanation of how it will be determined.” But that phrase is immediately followed by the words, "as follows,” and a list of specific requirements. Thus, only the items enumerated in the list must be disclosed. Disclosure of the basis for increases in a periodic rate (such as an APR) is not on that list.
. Although we construe the Act liberally in favor of the consumer, see Jackson, 890 F.2d at 120, this does not protect against every sharp credit practice. We have emphasized that the Act "is only a disclosure statute and does not substantively regulate consumer credit but rather requires disclosure of certain terms and conditions of credit.” Hauk, 552 F.3d at 1120 (internal quotation marks omitted). The Barrers might argue that a general change-in-terms provision is an inadequate disclosure of the terms of an agreement, because it fails to communicate the implications of those terms. Such a characterization, however, is neither natural nor compelled. We decline to adopt it because it amounts to a challenge to a substantive term in the agreement, namely the general change-in-terms provision, for such provisions would be effectively illegal if creditors had to specify the general circumstances under which they anticipated changing terms.
Furthermore, we recently concluded that "a creditor's undisclosed intent to act inconsistent with its disclosures is irrelevant in determining the sufficiency of those disclosures under section[] ... 226.6 [of Regulation Z].” Id. at 1122. If that is true, it would be odd to say that a creditor's undisclosed intent to pursue a particular a course of action consistent with its disclosures, though somewhat more specific than the general policy that was disclosed, was not only relevant to determining the sufficiency of those disclosures, but actually causes them to violate section 226.6.
Finally, Judge Graber worries that our interpretation would open the door for creditors to adjust the terms of a credit agreement for such bizarre reasons as the color of the cardholder's hair. See Partial Dissent at 893. We do not have such a freakish fact pattern before us, but we doubt that Regulation Z would permit a creditor to use a general change-in-terms provision to punish a cardholder on any whim whatsoever. Recall that Comment 11 requires the disclosure of the "specific event or events that may result in the increased' rate.” 12 C.F.R. Pt. 226 Supp. I, par. 6(a)(2) cmt. 11; see also supra, at 888-90. Our conclusion that Comment 11 does not require the disclosure of risk-based pricing rests, in part, on the fact that pricing credit on the basis of cardholder risk is how credit card companies normally do business. Clearly, the same could not be said for pricing credit on the basis of hair color or any other peccadillo that might offend some over-punctilious creditor.