On March 30, 2023, the Consumer Financial Protection Bureau (“CFPB” or “Bureau) issued a final rule amending its regulations that implement the Equal Credit Opportunity Act pursuant to Section 1071 of the Dodd-Frank Wall Street Reform and Protection Act (“Dodd-Frank”).1 Section 1071 requires covered financial institutions to collect and report data on loan applications for small businesses, including those that are owned by women or minorities. Wolters Kluwer - recommends all covered institutions read the entire final rule, educate and inform all applicable lines of business of new reporting requirements, and move forward deliberately to ensure the rule is implemented on time. The final rule will be effective 90 days after publication in the Federal Register. There are three things that covered institutions can begin thinking about today, prior to the effective date.
1. Who’s in and What’s in?
A financial institution should determine whether it is subject to reporting under the CFPB’s rule. A covered financial institution2 is any partnership, company, corporation, association (incorporated or unincorporated), trust, estate, cooperative organization, or other entity that engages in any financial activity, and that originated at least 100 covered originations in each of the two preceding calendar years. If your institution meets this threshold, the next step is to understand what transactions are covered. Covered transactions to small businesses or small farms that had $5 million or less in gross annual revenue (for the preceding year) include:
- Loans,
- Lines of credit,
- Credit cards,
- Merchant cash advances; and
- Credit products used for agricultural purposes to small businesses or small farms.
Note that covered originations can be refinancings; however, extensions, renewals, and other amendments of existing transactions are NOT considered covered, even if they increase the credit line or credit amount of the existing transaction.3
It is imperative that institutions understand which transactions will be covered under this rule (and those that are not reportable, such as applications under the Home Mortgage Disclosure Act (“HMDA”)). In addition, institutions should understand which business line(s) to engage with in order to establish data capture and reporting from Day 1. Wolters Kluwer strongly recommends adopting an implementation strategy early, an approach that was similarly supported by Alan Michael Ellison, Small Business Lending Senior Program Manager, Division of Research, Markets & Regulation, at the CFPB. At a March 29, 2023, Consumer Bankers Association event in Las Vegas, Nev., Mr. Ellison said “the first advice is don’t wait ‘til the last moment. Don’t wait ‘til the last month and say, ‘gee, I’ve got a rule to implement – it’s important to start working on this.’”
One’s implementation plan, as recommended by Wolters Kluwer, should include, among other factors, working with core systems to understand how data is currently collected and stored, as well as developing a process guide that lists the regulatory field names and the corresponding source materials to validate future compliance.
The Bureau’s tiered implementation structure outlines mandatory reporting dates based on the number of covered originations in both 2022 and 2023. Those institutions in the first tier – which requires data collection beginning October 1, 2024 – need to follow a more aggressive timeline than those in the second and third tiers, which will not begin collection until 2025 and 2026, respectively. Software tools will become available to assist with data collection, reporting, and analysis under the final rule.
2. Build on the lessons learned from expanded HMDA-data reporting
Similar to the CFPB’s 2015 HMDA Final rule that took effect on January 1, 2018, institutions should rely on the strength of their compliance management system (“CMS”) to ensure that staff across the enterprise—including but not limited to loan officers, underwriters, senior management, and the board of directors—understand how their role will be impacted by this new data reporting requirement for small business and small farm loans.
Now that the rule is out, conduct a full risk assessment that evaluates all small business and small farm loan products. The assessment should take into account the associated inherent risks and the adequacy of risk controls, not the least of which is how the new required fields will be captured, how the institution will monitor and test for compliance (especially regarding the new mandates on race and gender), and how the audit function (whether that be internal or external) will be engaged to provide an independent perspective. Other factors to consider are the projected rate of growth in the impacted portfolios, the delivery channels accepting small business applications, and assessing to what level third parties will be engaged to assist in capturing, reporting, and evaluating the data. Leveraging the institution’s implementation plan from the HMDA changes could be a helpful place to identify best practices.
3. Look toward the future
The release of the small business lending rule is only the first of what regulated banks will have to plan for in 2023. Although an anticipated release date for a modernized Community Reinvestment Act (“CRA”) is unknown, the CFPB has said that the small business lending rule complements other federal efforts to ensure fair lending and to promote community development through ECOA and the CRA. In the final rule, the Bureau said the collection and subsequent reporting of this new data will provide much needed transparency to the small business lending market.
In looking forward, covered institutions are recommended to consider the expanded fair lending and other related compliance risks associated with the CFPB’s new small business lending regulations. How is the institution planning to train commercial loan officers, agricultural lenders, underwriters and others to ensure all data points are collected at application, including applicant/owner race and gender information, etc.? How are marketing dollars and outreach being allocated to majority minority census tracts to foster small business development?
The industry has been expecting these rules since 2010. Now that they are here, Step 1 is to read the rule and figure out how it impacts your institution. Rely on the strength of your CMS and take the lessons learned from implementing past regulatory changes. Because the CFPB has provided for tiered implementation out to 2026 (for some covered entities), it is important for institutions to use the available time to get processes and procedures set up and tailored to specific needs. Lastly, think about the future in how Section 1071 may impact your compliance with other consumer protection laws and regulations.
Wolters Kluwer offers a technology solution called Small Biz Wiz to help with the data collection, analysis and reporting requirements under the new 1071 Small Business Reporting rule. Wolters Kluwer’s Advisory Services team offers a variety of targeted compliance expertise to support data collection, reporting, and analytics to comply with the small business lending data collection and reporting regulations. Visit our 1071 Small Business Lending Resource Center for more information.
2 Entities that do small business (and small farm) lending include, but are not limited to, depository institutions (i.e., banks, savings associations, and credit unions), online lenders, platform lenders, community development financial institutions, lenders involved in equipment and vehicle financing, farm credit system lenders, commercial finance companies, merchant cash advance providers, governmental lending entities, and nonprofit lenders.
