Preparing for the New Small Business Data Collection Rule

It’s taken more than ten years for the Consumer Financial Protection Bureau to issue a regulation to implement Section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. Now that it is here, financial institutions are weighing the potential impacts of compliance on their business and operations.

Section 1071 amended the Equal Credit Opportunity Act (ECOA) to require covered financial institutions to collect and report data regarding covered credit applications made by women-owned, minority-owned and small businesses, including but not limited to: the purpose of the loan, amount applied for and approved, actions taken and the race, sex and ethnicity of the business owners. Section 1071 has two statutory purposes: to facilitate enforcement of fair lending laws, and to enable the identification of business and community development needs and opportunities for women-owned, minority-owned and small businesses.

There was no action by the CFPB to issue a regulation to implement Section 1071 until 2019, when a lawsuit filed by a California community group alleged the CFPB unlawfully withheld and unreasonably delayed agency action by failing to implement Section 1071. That action ultimately led to the CFPB issuing the Small Business Data Collection Rule (“final rule“) on March 30, 2023.

The final rule provides detail on the specific data points that must be collected and how to report those to the CFPB. It clarifies which financial institutions are covered financial institutions and key definitions for a covered application, credit transaction and small business.

Financial institutions can determine whether they are a covered financial institution annually by counting their number of covered originations, and need to begin complying with the final rule according to the following timeline:

• 2,500 or more in both 2022 and 2023 must comply by October 1, 2024
• At least 500 in 2022 and 2023 and at least 100 in 2024 must comply by April 1, 2025
• At least 100 in both 2024 and 2025 must comply by January 1, 2026

The final rule also introduces several new disclosure requirements, a sample safe-harbor data collection form for certain demographic data, and a firewall requirement on covered financial institutions to prevent certain employees involved in the application decision making from having access to applicant demographic data.

An executive summary of the final rule can be found here.

Failure to comply with the new data collection and reporting requirements of the final rule could result in penalties or fines by the CFPB. So it is essential that financial institutions take steps now to determine whether they are covered, and if so, to ensure they have processes in place to collect and report the required small business loan application data before their compliance start date.

Larger financial institutions and those already subject to Home Mortgage Disclosure Act and Community Reinvestment Act data collection requirements may be better positioned to absorb the compliance burdens that come with the final rule. But smaller financial institutions that have historically been exempt from this type of data collection and reporting requirements will need to act quickly to set up new operational processes and partnerships with their financial technology providers to ensure compliance. Financial institutions may also want to consider developing employee training programs to ensure application data is collected properly.

In terms of preparation, financial institutions need to consider both business and operational impacts. The change is far more than a compliance program problem or a data management problem. For some financial institutions, compliance with the final rule will require widespread organizational changes.

Financial institutions should connect with their loan origination providers now to ensure that they have a system in place to comply with the final rule. While some industry providers have already started making enhancements to their systems based on the proposed rule, others have opted to wait for the issuance of the final rule to begin implementing changes based upon customer feedback.

This article has been prepared for general information purposes only and is not legal advice. The information in this article is not intended to create, and receipt of it does not constitute, an attorney-client relationship.