The Consumer Financial Protection Bureau (CFPB) has issued its final rule to implement the rule required by Congress that is intended to increase transparency in small business lending, promote economic development and combat unlawful discrimination. This is probably the last provision of the Dodd-Frank Act of 2010 to be implemented.

The CFPB stated that it undertook significant planning to simplify implementation of the new rule and prepare for the submission of data from thousands of lenders. Many of these lenders already report mortgage data under the Home Mortgage Disclosure Act (HMDA). The CFPB recognizes that small business lending has important differences from mortgage lending.

Background

In 2010, Congress enacted requirements that would result in lenders making data available to the public about their small business lending activity in Section 1071 of the Consumer Financial Protection Act, as part of the Dodd-Frank Act. However, the CFPB did not issue rules to implement this requirement. The California Reinvestment Coalition sued the CFPB in 2019, leading to a court order requiring the CFPB to finalize the rule by March 31, 2023.

The CFPB has undertaken significant planning to simplify implementation and prepare for the submission of data from thousands of lenders. While many of these lenders already report mortgage data, the CFPB recognizes that small business lending has a number of key differences from mortgage lending. After considering a wide range of feedback and thousands of public comments, the CFPB has finalized the rule and planning for implementation.

Under the new rule, lenders will collect and report information about the small business credit applications they receive, including geographic and demographic data, lending decisions and the price of credit. The rule will work in concert with the Community Reinvestment Act (CRA), which requires certain financial institutions to meet the needs of the communities they serve. The increased transparency is expected to benefit small businesses, family farms, financial institutions and the broader economy.

Covered Lenders

The CFPB is defining the term “financial institution,” consistent with the definition in section 1071 of the Dodd-Frank Act, as any partnership, company, corporation, association (incorporated or unincorporated), trust, estate, cooperative organization or other entity that engages in any financial activity.

Under this definition, the requirements of the new rule apply to a variety of entities that engage in small business lending, including depository institutions (i.e., banks, savings associations and credit unions), online lenders, platform lenders, community development financial institutions (CDFI), Farm Credit System lenders, lenders involved in equipment and vehicle financing (captive financing companies and independent financing companies), commercial finance companies, governmental lending entities and nonprofit nondepository lenders.

Phased Implementation

The CFPB considered a wide range of feedback and thousands of public comments in this rulemaking process. The agency finalized the rule and planned for implementation to take a phased approach.

During its rulemaking process, the CFPB found that there were key differences in how large financial institutions would implement the rule, compared to relationship-based local lenders. The CFPB is adopting a tiered compliance date schedule because it believes that smaller and mid-sized lenders would have particular difficulties complying within the single 18-month compliance period in the original proposed rule. So, the final rule takes a phased approach that requires the largest lenders, which account for most of the small business lending market, to collect and report data earlier than smaller lenders.

This phased schedule provides for compliance beginning as follows:

• Lenders that originate at least 2,500 small business loans annually must collect data starting Oct. 1, 2024.
• Lenders that originate at least 500 loans annually must collect data starting April 1, 2025.
• Lenders that originate at least 100 loans annually must collect data starting Jan. 1, 2026.

The term “covered financial institution” is a financial institution that originated at least 100 covered credit transactions for small businesses in each of the two preceding calendar years (with compliance phased in based on the loan volumes above). Only financial institutions that meet this loan-volume threshold are required to collect and report small business lending data under the final rule.

For the phased implementation, lenders are to look at their lending in 2022 and 2023 to determine their coverage. For lenders in the third tier, if the financial institution did not originate at least 100 covered credit transactions for small businesses in each of calendar years 2022 and 2023 but subsequently originates at least 100 such transactions in two consecutive calendar years, it must comply with the requirements of this rule, but in any case, no earlier than Jan. 1, 2026.

The new rule provides that covered financial institutions may begin collecting applicants’ protected demographic information one year before their compliance date to help prepare for coming into compliance with this final rule. The CFPB is also adopting a new provision to permit financial institutions that do not have ready access to sufficient information to determine their compliance tier (or whether they are covered by the rule at all) to use reasonable methods to estimate their volume of originations to small businesses for this purpose.

While the new rule requires data collection and reporting for only those that make at least 100 loans annually, the rule will cover the vast majority of bank small business lending, based on the CFPB’s analysis. In addition, the CFPB notes that lenders originating less than 100 loans per year will still have to adhere to fair lending laws (even though they are not having to report this loan data).

Final Rule & Additional Resources

The final rule may be accessed at https://files.consumerfinance.gov/f/documents/cfpb_1071-final-rule.pdf.

The CFPB has also developed a number of resources for financial institutions, including:

• Filing Instructions Guide (FIG) for reporting the newly required data
• Small entity compliance guide
• Frequently asked questions (FAQ)
• A set of Quick References
• Sample data collection form from the regulation
• Slide deck from a recent RegCast on the coverage of the rule

Go to https://www.consumerfinance.gov/compliance/compliance-resources/small-business-lending-resources/small-business-lending-collection-and-reporting-requirements/ to access these resources. As the agency develops additional resources related to this rule, we can expect these to become available on this webpage.

To emphasize financial institutions’ obligations to collect this important data, the CFPB is also issuing a policy statement noting that it intends to focus its supervisory and enforcement activities in connection with the new rule on ensuring that lenders do not discourage small business loan applicants from providing responsive data, including responses to the requests to provide demographic information about their ownership. This policy statement is available at https://files.consumerfinance.gov/f/documents/cfpb_1071-enforcement-policy-statement.pdf.

Implementation Note

It is possible that the implementation schedule spelled out in the final rule (discussed above) will be delayed. A lawsuit has been filed, petitioning the court to push the implementation dates back to allow more time for financial institutions to develop their compliance programs for this rule. So, the expected schedule may be delayed, or may not be.

One thing to keep in mind is that, even if the implementation dates are pushed back, they will eventually arrive. Therefore, all financial institutions that are active in small business lending should proceed with their planning and implementation process to be ready to comply when the rule does become effective for their institution.