The CFPB is here to stay: What’s next for the small business lending data collection rule?

On March 30, 2023, the Consumer Financial Protection Bureau (CFPB) issued a final rule amending its Equal Credit Opportunity Act (ECOA) regulations pursuant to Section 1071of the Dodd-Frank Wall Street Reform and Protection Act (Dodd-Frank).¹ Section 1071 required covered financial institutions to collect and report loan data on small businesses, including those owned by women or minorities, and the CFPB’s small business lending data final rule became known as “Section 1071 regulations.”

Also in 2023, a Federal judge² paused the final rule’s compliance timelines until the U.S. Supreme Court reached a decision in a case involving a constitutional challenge to the CFPB.

The Supreme Court issued its decision³ on May 16, 2024, ruling in the CFPB’s favor. As a result, there are implications for a number of ongoing lawsuits against the CFPB in lower courts, including challenges to the small business lending data regulations.

Although the Section 1071 regulations remain the focus of ongoing litigation and may be challenged on other grounds, the industry cannot remain in a “wait and see” mode. The CFPB’s tiered implementation structure is based on the number of covered originations. Following a court order, the CFPB announced on May 17, 2024, that it will extend compliance dates until July 18, 2025 (reporting June 1, 2026) for Tier 1 institutions, and January 16, 2026 and October 18, 2026 for Tier 2 and Tier 3 institutions. Tiers 2 and 3 will both be required to report data on June 1, 2027.⁴ Although the CFPB announced an extension, institutions in the first tier will still need to follow a fairly aggressive timeline for data collection and reporting.

Wolters Kluwer recommends that impacted institutions become familiar with the final rule, inform all applicable lines of business of new reporting requirements, develop an action plan to ensure the requirements are implemented on time, and closely monitor related legal proceedings.

There are four actions that impacted institutions should consider today, prior to applicable compliance dates.⁵

1. Determine relevancy within your organization.

Institutions should determine whether they are subject to the final rule. Covered financial institutions⁶ include a range of entities that engage in any financial activity, and had at least 100 covered originations in each of the two preceding calendar years. Covered transactions include the following to small businesses or small farms with gross annual revenues of $5 million or less (for the preceding year):

• Loans
• Lines of credit
• Credit cards
• Merchant cash advances
• Credit products used for agricultural purposes

Covered originations may include refinancings (but not extensions), renewals, or other amendments of existing transactions, unless there is an increase to the existing transaction. ⁷

It is imperative that institutions distinguish covered transactions from those that are not reportable, such as applications under the Home Mortgage Disclosure Act (HMDA). In addition, institutions should understand which business line(s) to engage with to establish data capture and reporting in advance of required timelines. Wolters Kluwer recommends adopting an implementation strategy early (an approach that is supported by the CFPB), such as working with core systems to understand how data is currently collected and stored, and develop a process guide that lists the mandated field names and the corresponding source materials to validate future compliance.

2. Lessons learned from expanded HMDA-data reporting.

Similar to the CFPB’s HMDA regulations that took effect in 2018, institutions should rely on the strength of their compliance management system (CMS)— including but not limited to loan officers, underwriters, senior management, and the board of directors — understand how their role will be impacted by the new data requirements.

3. Assess the Fair Lending Impact.

Conduct a full risk assessment that evaluates all small business and small farm loan products, taking into account the associated inherent risks and the adequacy of risk controls, not the least of which is how the newly required fields will be captured, how the institution will monitor and test for compliance (especially regarding the new mandates on race and sex/gender), and how the audit function (internal or external) will be engaged to provide an independent perspective. Other considerations include the projected rate of growth in the impacted portfolios, the delivery channels for accepting small business applications, and how to assess the level of third-party engagement (e.g., assistance in capturing, reporting, and evaluating the data). Leveraging your institution’s HMDA implementation plan could be a helpful starting point for defining best practices.

Impacted institutions should remember that the final rule is a revision to the ECOA regulations, making it critical to ensure that underwriting and pricing of covered transactions comply with applicable industry-leading standards related to fair treatment and equity.

4. Leverage technology.

The small business lending data requirements are among many changes that institutions will need to plan for in 2024 and beyond. Although compliance dates under the modernized Community Reinvestment Act (CRA) regulations remain uncertain due to active litigation, the CFPB maintains that Section 1071 regulations complement the overall Federal efforts focused on fair lending and community development through the ECOA and the CRA. The collection and reporting of Section 1071 data, will provide additional transparency to the small business lending market⁸, according to the CFPB.

Covered institutions should consider expanding their evaluation of fair lending and other compliance related risks associated with the small business lending requirements. For instance, how does the institution plan to train commercial loan officers, agricultural lenders, underwriters, and others to ensure that all data points are collected at application, including applicant/owner race and sex/gender information? How will marketing dollars and outreach be allocated to majority minority census tracts in order to foster small business development?

Software tools, such as Small Biz Wiz⁹ are available to assist with Section 1071 data collection, reporting, and analysis.

Recommended Next Steps.

In addition to the recommended actions outlined above, there are additional steps that covered institutions can to optimally prepare for the new rule and to ensure compliance is maintained.

1. Read the final rule and determine how it may impact your institution. Rely on the strengths of the CMS and take the lessons learned from implementing past regulatory changes, especially given the tiered implementation.
2. Establish processes and procedures tailored to your institution’s lending strategies, such as creating a data and process guide, establishing a data integrity review schedule, and determining feasibility of automation to help ensure compliance (e.g., Firewall for demographic information).
3. Understand the required data by establishing where the data will be maintained and by whom; becoming familiar with regulatory edit definitions, especially for institutions that are not current HMDA reporters; properly training staff; and sharing information with senior management and the board of directors.
4. Assess any impact on compliance with consumer protection laws and regulations, such as Unfair, Deceptive, or Abusive Acts or Practices (UDAAP). Failure to adhere to fair lending laws and relevant regulations can lead to increased levels of legal and reputational risks and significant financial penalties.
5. Consider visiting Wolters Kluwer’s Section 1071 Resource Center¹⁰ to learn more about other tools available for covered institutions. Wolters Kluwer’s Advisory Services team offers a variety of targeted compliance expertise to support data collection, reporting, and analytics to comply with the small business lending data collection and reporting regulations.

The Resource Center includes a free Project Planning Tool to help covered institutions assess compliance readiness. This tool can be used in whole or in part to better understand where your organization stands today from a preparation perspective. While the tool can be utilized by anyone in the organization, it is best suited for completion by someone with Section 1071 familiarity and enterprise-wide knowledge.

For more information about available assistance with Section 1071, or any other regulatory matter, please contact us.

The authors work in Fair and Responsible Banking and the Community Reinvestment Act in the Financial & Corporate Compliance division at Wolters Kluwer.

² The plaintiffs in a TX lawsuit are the Texas Bankers Association, the American Bankers Association, and Rio Bank (McAllen, TX). Section 1071 regulations were also challenged in a Federal court in KY.

³ See 22-448 Consumer Financial Protection Bureau v. Community Financial Services Assn. of America, Ltd. (05/16/2024) (supremecourt.gov).

⁴ See Small business lending rulemaking | Consumer Financial Protection Bureau (consumerfinance.gov) for more information.

⁵ Note that these recommendations are based on the final rule issued on March 20, 2023.

⁶ This includes both depository and non-depository institutions. See https://files.consumerfinance.gov/f/documents/cfpb_1071-final-rule.pdf (12 CFR § 1002.105) for more information.

⁷ See https://files.consumerfinance.gov/f/documents/cfpb_1071-final-rule.pdf (12 CFR § 1002.103(b)) for more information.

⁸ See Small Business Lending Data Collection under the Equal Credit Opportunity Act (Regulation B) (consumerfinance.gov) for more information.

⁹ See https://www.wolterskluwer.com/en/solutions/wiz/small-biz-wiz for more information.

¹⁰ See https://www.wolterskluwer.com/en/know/regulation-1071 for more information.