The Consumer Financial Protection Bureau (CFPB)’s long-delayed prepaid card rule has been delayed once again—and further delays may lie ahead, as the CFPB considers whether to make additional changes. The additional time gives prepaid providers and other stakeholders another bite at the apple to advocate for changes to this regulation.

On April 20, the CFPB issued a final rule officially delaying the prepaid rule’s effective date by six months, to April 1, 2018, after proposing that delay in light of calls from the industry for the need for more time to implement compliance. Along with announcing the delay, the CFPB stated that it also has “decided to revisit at least two substantive issues in the prepaid accounts rule through a separate notice and comment rulemaking process. We expect to release that proposal in the coming weeks.” Those two issues are “the linking of credit cards to digital wallets that are capable of storing funds” and “error resolution and limitations on liability for prepaid accounts that cannot be registered, have not yet been registered, or for which consumers have attempted but have not successfully completed the registration process.”

The CFPB also stated that it “may address a limited number of other topics in the proposal as well.” For now, it is unclear which those might be. Possibilities include overdraft features, which consumer advocates have long urged the CFPB to ban on prepaid cards, but which some industry proponents have argued give important flexibility to consumers. The proposal also could include a new look at the way fees must be disclosed, another point of contention in the rulemaking.

But at this point, it should not be presumed that any aspect of the rule is off limits for comment—including whether the rule should go into effect at all. The prepaid card rulemaking was not mandated by law, and so the CFPB could choose to withdraw it without risk of contravening any Congressional mandate.

While the CFPB has not indicated an intention to withdraw the rule, the uncertainty surrounding the CFPB’s future continues and industry participants opposing some or all of the rule have some support in Washington these days. Some legislators have made efforts to block the rule, including a bill in February 2017 aiming to use the Congressional Review Act to prevent the rule’s implementation. The House Financial Services Committee also held a hearing on April 26 discussing the Financial CHOICE Act, the legislation to replace the Dodd-Frank Act introduced by Committee Chair Rep. Jeb Hensarling (R-TX); depending on its ultimate content, this legislation, if enacted, could curtail the CFPB’s power and inhibit its ability to issue rules.

But even if the rule never goes into effect, it is important to keep in mind for compliance purposes that a number of existing laws and regulations continue to apply to prepaid cards. For instance, while the prepaid rule specifically addresses deposit insurance disclosures, FDIC regulations already restrict the use of terms relating to FDIC insurance. If a product does not provide FDIC insurance, its advertisements should not use the official FDIC advertising statement (“Member FDIC”), or any other statement or symbol that implies or suggests the existence of FDIC insurance. And the broad federal prohibition on unfair, deceptive, or abusive acts or practices (UDAAP) should be considered in connection with any consumer financial product. To mitigate UDAAP risk, it is important to be sure, for instance, that any disclosures around the features of the product are accurate and clear. Regulators have taken actions against entities involved in providing prepaid cards for alleged UDAAP violations. In a November 2016 action, for example, the Federal Trade Commission (FTC) charged that prepaid card provider NetSpend engaged in deceptive practices by making misleading or untrue statements about its prepaid cards, including that the cards would offer immediate access to funds, that consumers were “guaranteed approval” for a card, and that provisional credit on the card would be provided while cardholders’ disputes were investigated. Last month, NetSpend agreed to settle the action with the FTC.