Four Things to Know About the CFPB’s New Small Business Lending Rule

On March 30, 2023, the Consumer Financial Protection Bureau (CFPB) issued its long-awaited final rule implementing the small business lending data collection requirements set forth in Section 1071 of the Dodd-Frank Act (Section 1071). The CFPB’s final rule (Final Rule) requires banks, credit unions, and nonbank lenders to collect and report certain data about covered loan applications from small businesses and allows for the creation of the first comprehensive public database that covers small business lending practices. This client Advisory provides an overview of the CFPB’s Final Rule, summarizes key requirements, and outlines supervisory and enforcement implications for covered financial institutions.

The Final Rule implements data collection requirements established in Section 1071 of the Dodd-Frank Act. Section 1071 amended the Equal Credit Opportunity Act to require that financial institutions collect and report to the CFPB data related to applications for credit for women-owned, minority-owned, and small businesses. Section 1071 directs the CFPB to prescribe such rules and issue guidance necessary to carry out these data collection requirements. Though Congress enacted Section 1071 in 2010, the CFPB only published its proposed rule implementing these requirements in 2021. The rulemaking process was accelerated by a 2019 lawsuit filed by the California Reinvestment Coalition that led to a court order requiring the CFPB to issue a final rule by March 31, 2023. The CPFB has finalized the proposed rulemaking and issued the Final Rule on March 30, 2023, narrowly meeting the court-imposed deadline.

What Financial Institutions and Transactions are Covered by the Final Rule?

The Final Rule applies to covered financial institutions, which under the Final Rule means any financial institution, including non-depository institutions, that originated at least 100 covered originations in each of the two preceding calendar years. A covered origination is a covered credit transaction (discussed below) that the financial institution originated to a small business, including refinancings. However, extensions, renewals, and other amendments of existing transactions are not considered covered originations even if they increase the credit line or credit amount of the existing transaction. The Final Rule applies to a wide variety of entities that engage in small business lending, including depository institutions, online lenders, platform lenders, commercial finance companies, nonprofit lenders, and other lenders that meet the definition of covered financial institutions.

Covered credit transaction means an extension of business credit under Regulation B. Thus, covered credit transaction includes loans, lines of credit, credit cards, merchant cash advances, and credit products used for agricultural purposes. However, the following transactions are excluded from coverage under the Final Rule even if they satisfy Regulation B’s definition of business credit:

• Trade credit, which is a financial arrangement wherein a business acquires goods or services from another business without making immediate payment in full to the business providing the goods or services
• Transactions reportable under the Home Mortgage Disclosure Act of 1975
• Insurance premium financing, which generally is a financing arrangement wherein a business agrees to repay a financial institution the proceeds advanced to an insurer for payment of the premium on the business’s insurance contract and wherein the business assigns to the financial institution certain rights, obligations, and/or considerations in its insurance contract to secure repayment of the advanced proceeds
• Public utilities credit²
• Securities credit³
• Incidental credit,⁴ but without regard to whether the credit is consumer credit, is extended by a creditor, or is extended to a consumer

What Data Must Be Collected and Reported?

Pursuant to the Final Rule, a covered financial institution is required to collect and report certain data points that the financial institution generates. For all covered applications, these data points include:

• A unique identifier
• The application date
• The application method (i.e., the means by which the applicant submitted its application)
• The application recipient (indicating whether the application was received directly or indirectly via an unaffiliated third party)
• The action taken by the covered financial institution on the application
• The date on which the action was taken

When a covered application is denied, financial institutions are required to collect and report the reasons for denial. When a covered application is approved but is not accepted or does not result in an origination, financial institutions are required to collect and report the amount of credit approved and related pricing information. The pricing information includes, as applicable, information regarding the interest rate, total origination charges, broker fees, initial annual charges, additional cost for merchant cash advances or other sales-based financing, and prepayment penalties.

The Final Rule also requires a covered financial institution to report data points based on information that could be collected from the applicant or an appropriate third-party source. These data points are:

• Credit type
• Credit purpose
• The amount of credit applied for
• A census tract based on an address or location provided by the applicant
• Gross annual revenue for the applicant’s preceding fiscal year
• A three-digit North American Industry Classification System (NAICS) code for the applicant
• The number of people working for the applicant
• The applicant’s time in business
• The number of the applicant’s principal owners

Finally, the Final Rule requires a covered financial institution to report certain data points based solely on the demographic information that could be collected from an applicant. These data points are:

• The applicant’s minority-owned business status, women-owned business status, and LGBTQI+-owned business status
• The applicant’s principal owners’ ethnicity, race, and sex

Financial institutions must collect small business lending data on a calendar year basis and report it to the CFPB on or before June 1 of the following year. The CFPB has provided a Filing Instructions Guide, which contains additional information regarding the submission of data.⁵

What is the Timing of These Requirements?

The Final Rule is effective 90 days after its publication in the Federal Register. The CFPB has implemented phase-in application of the Final Rule, which requires the largest lenders to collect and report data earlier than smaller lenders:⁶

• A financial institution must begin collecting data and otherwise complying with the Final Rule on October 1, 2024, if it originated at least 2,500 covered originations in both 2022 and 2023.
• A financial institution must begin collecting data and otherwise complying with the Final Rule on April 1, 2025, if it:
  • Originated at least 500 covered originations in both 2022 and 2023
  • Did not originate 2,500 or more covered originations in both 2022 and 2023
  • Originated at least 100 covered originations in 2024
• A financial institution must begin collecting data and otherwise complying with the Final Rule on January 1, 2026, if it originated at least 100 covered originations in both 2024 and 2025.

What Does This Mean for Financial Institutions?

The Final Rule creates substantial data reporting requirements for most lenders that provide credit to small businesses and creates additional compliance risks for financial institutions. These requirements will come into effect for different kinds of lenders at different times. Lenders should pay close attention to when they must begin complying with the data collection and reporting requirements of the Final Rule.

For many lenders, meeting these data collection and reporting requirements will require the development of new data compliance protocols that address the demands of the Final Rule. Some industry participants have raised concerns that the potentially high cost of complying with the Final Rule could even raise barriers to fair lending. For small community banks in particular, the cost of establishing a comprehensive compliance protocol addressing the Final Rule may curtail their ability to lend to small businesses.

Acknowledging the compliance risks created by the Final Rule, the CFPB also issued an Enforcement Policy Statement (Statement)⁷ regarding financial institutions’ policies and procedures on data collection. In the Statement, the CFPB provided that:

• The Final Rule requires that collection methods be designed not to have the effect of discouraging applicants from submitting responsive information.
• The Final Rule requires that requests for data be prominent to applicants, that applicants can easily respond to such requests, that such requests initially be made prior to notifying an applicant of the lender’s decision on the application, and that the time and manner of a lender’s collection procedures otherwise serve to obtain responsive information.
• Covered lenders must work to identify and respond to potential indicia of discouraging applicants from submitting responsive information in their practices, policies, and procedures. This includes promptly investigating any indicia of potential discouragement; taking prompt remedial action, monitoring for low response rates and for significant irregularities in any particular response; monitoring response rates and responses by division, location, loan officer, or other factors; and providing adequate training to employees involved in collecting data from loan applicants.

The CFPB further provided in the Statement that it intends to use its enforcement and supervisory authorities to focus on covered lenders’ compliance with these requirements, with particular attention to covered lenders’ response rates for data requested from applicants. In doing so, the CFPB stated that it intends to consider how a lender’s response rates compare to other financial institutions of similar nature and to consider, among other things, irregularities in particular responses that may indicate steering, improper influence, or other potential discouragement of applicants’ preferred responses.

*          *          *

Financial institutions interested in how the CFPB’s recent actions may impact their businesses may contact any of the authors of this Advisory or their usual Arnold & Porter contact. The firm’s Financial Services team would be pleased to assist with any questions about the CFPB’s new data collection and reporting requirements, CFPB supervision, or consumer finance more broadly.

Paul Lim and George Eichelberger contributed to this Advisory.

© Arnold & Porter Kaye Scholer LLP 2023 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.