The Consumer Financial Protection Bureau issued a civil investigative demand (CID) to the Source for Public Data, Inc., a company that provides public records to the public through an Internet-based search engine. Public Data objected to the CID for, among other things, failing to comply with the statute authorizing the CFPB to issue these demands. The CFPB eventually filed a petition to enforce the CID, and the district court granted the petition. Because the CFPB did not comply with the governing statute when it issued the CID, we now REVERSE and RENDER.

I.

Congress created the CFPB to "regulate the offering and provision of consumer financial products or services under the Federal consumer financial laws." 12 U.S.C. § 5491 (a). One of the CFPB's "primary functions" is to "supervis[e] covered persons for compliance with Federal consumer financial law, and tak[e] appropriate enforcement action to address violations of Federal consumer financial law[.]" Id. § 5511(c)(4). The CFPB may issue CIDs to "any person" whom the CFPB "has reason to believe" may have documents, tangible things, or information "relevant to a violation." Id. § 5562(c)(1). Each CID must "state the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable to such violation." Id. § 5562(c)(2). This is known as the "notification of purpose." 12 C.F.R. § 1080.5 . If a recipient does not comply with the CID, the CFPB may file a petition in federal court to enforce it. 12 U.S.C. § 5562 (e)(1).

*458 The CFPB issued a CID to Public Data. The CID's "Notification of Purpose" read:

The purpose of this investigation is to determine whether consumer reporting agencies, persons using consumer reports, or other persons have engaged or are engaging in unlawful acts and practices in connection with the provision or use of public records information in violation of the Fair Credit Reporting Act, 15 U.S.C. §§ 1681 , et. seq., Regulation V, 12 C.F.R. Part 1022, or any other federal consumer financial law. The purpose of this investigation is also to determine whether Bureau action to obtain legal or equitable relief would be in the public interest.

The CID required Public Data to produce documents, provide answers to interrogatories, and produce a written report.

During a meet-and-confer with the CFPB, Public Data asserted that the Notification of Purpose was inadequate. It also insisted that the CFPB did not have jurisdiction over Public Data. Public Data then filed a petition with the CFPB to set aside the CID. The CFPB's Director denied the petition in a written order. Public Data confirmed with the CFPB that it did not intend to comply, so the CFPB filed a petition in federal court seeking an order to enforce the CID.

The district court granted CFPB's petition. It rejected Public Data's argument that the CID failed to provide fair notice of the violation under investigation as required by 12 U.S.C. § 5562 (c)(2). The district court also rejected Public Data's argument that the CID should be quashed because the CFPB lacked jurisdiction. Accordingly, the district court ordered Public Data to respond to the CID, but this court granted a stay pending the resolution of this appeal. 1

II.

We review a subpoena enforcement order for abuse of discretion. United States v. Zadeh , 820 F.3d 746 , 751 (5th Cir. 2016). "We review the district court's conclusions of law underlying its decision to enforce the subpoena de novo , and its factual findings for clear error." Id.

III.

An administrative agency's authority to issue subpoenas is a creature of statute. Consumer Fin. Prot. Bureau v. Accrediting Council for Indep. Colleges & Schs. (ACICS) , 854 F.3d 683 , 690 (D.C. Cir. 2017). Section 5562(c)(2) requires that a civil investigative demand identify both: (1) "the nature of the conduct constituting the alleged violation which is under investigation;" and (2) "the provision of law applicable to such violation." This statutory requirement "ensures that the recipient ... is provided with fair notice as to the nature of the Bureau's investigation." ACICS , 854 F.3d at 690 .

The CFPB did not comply with 12 U.S.C. § 5562 (c)(2) when it issued this CID to Public Data. First, it did not state the "conduct constituting the alleged violation which is under investigation." According to its Notification of Purpose, the CFPB is investigating "unlawful acts and practices in connection with the provision or use of public records information." Simply put, this Notification of Purpose does not identify what conduct, it believes, constitutes an alleged violation. Providing and using public records are not violations of federal law, and the CFPB fails to explain how these activities violate federal consumer law.

Moreover, this CID does not identify "the provision of law applicable to such *459 violation." As discussed, the CID never identifies an alleged violation, so it is unsurprising that it fails to identify a relevant provision of law. Rather, the Notification of Purpose refers to the Fair Credit Reporting Act, an expansive law governing all activities relating to the reporting of consumers' credit information. Such a reference to a broad provision of law that the CFPB has authority to enforce does nothing to clarify what conduct is under investigation. Then, the Notification of Purpose states that the CFPB is investigating the violation of "any other federal consumer financial law." Such an uninformative catch-all phrase defeats any specificity provided by the reference to the FCRA. 2 See ACICS , 854 F.3d at 691-92 ("The inclusion of the uninformative catch-all phrase 'any other Federal consumer financial protection law' does nothing to cure the CID's defects.").

The D.C. Circuit recently rejected a CID like this one. See ACICS , 854 F.3d at 689-92 . The D.C. Circuit observed that the CFPB failed to explain what "the broad and non-specific term 'unlawful acts and practices' mean[t] in this investigation." Id. at 690 . Such an observation applies in equal force to our case. As to the applicable law, the Notification of Purpose referenced 12 U.S.C. §§ 5531 and 5536, as well as "any other Federal consumer financial protection law," and the D.C. Circuit held that "framing the applicable law in such a broad manner does not satisfy Congress's clear directive" spelled out in 18 U.S.C. § 5562 (c)(2). Id. at 691-92 . Accordingly, it determined that the CFPB failed to comply with the statutory requirements of 18 U.S.C. § 5562 (c)(2).

There are consequences to the "absurdity of giving a notification that notifies of no purpose whatsoever." Consumer Fin. Prot. Bureau v. Heartland Campus Sols., ECSI, No. 18-1516, --- Fed.Appx. ----, ----, 2018 WL 3831444 , at *6 (3d Cir. Aug. 13, 2018) (Rendell, J., dissenting). Applying our "reasonable relevance" standard, courts will enforce an administrative subpoena if: "(1) the subpoena is within the statutory authority of the agency; (2) the information sought is reasonably relevant to the inquiry; and (3) the demand is not unreasonably broad or burdensome." Zadeh , 820 F.3d at 755 (quoting United States v. Transocean Deepwater Drilling, Inc. , 767 F.3d 485 , 488 (5th Cir. 2014) ). Because the CID issued to Public Data fails to identify the conduct under investigation or the provision of law at issue, we cannot review it under our "reasonable relevance" standard. And if a court cannot exercise meaningful judicial review, a CID recipient has no opportunity to challenge an agency's investigatory authority. For instance, we cannot evaluate whether the CFPB requests information that is reasonably relevant to the CFPB's inquiry because we do not know what the inquiry actually is. Likewise, we cannot assess whether the CFPB's demand is "unreasonably broad or burdensome." Presumably, it would be reasonable for the CFPB to demand more information from a target of an investigation than a third party, but this Notification of Purpose does not indicate whether Public Data or one of its clients is the target of the investigation. As the D.C. Circuit observed, "[b]ecause the validity of a CID is measured by the purposes stated in the notification of purpose, the adequacy of the notification of purpose is an important *460 statutory requirement." ACICS , 854 F.3d at 690 (internal citation omitted).

Simply put, the CFPB does not have "unfettered authority to cast about for potential wrongdoing." In re Sealed Case (Admin. Subpoena) , 42 F.3d 1412 , 1418 (D.C. Cir. 1994). As such, it must comply with statutory requirements, and here it did not.

IV.

For the reasons above, we hold that the CFPB failed to advise Public Data of "the nature of the conduct constituting alleged violation which is under investigation and the provision of law applicable to such violation." 12 U.SC. § 5562(c)(2). Accordingly, we REVERSE and RENDER. 3