Consumer Financial Protection Bureau Finalizes Small Business Lending Data Rule

Background of Section 1071 

Congress originally enacted the small business lending data requirement more than a decade ago in Section 1071 of the Dodd-Frank Act. (Because of this, the requirement is commonly referred to as “Section 1071” or the “1071 Rule.”) However, the CFPB issued an interpretation in 2011 stating that compliance with Section 1071 would not be required until the CFPB issued implementing regulations. The CFPB did not take concrete action to issue regulations for many years, and was ultimately sued in 2019 for not timely issuing regulations. In connection with resolving that litigation, the CFPB agreed to a timeline by which it would issue proposed and final regulations, and has now issued the final 1071 Rule.

The 1071 Rule Applies to Broad Categories of Small Business Lenders

The 1071 Rule applies to “covered financial institutions,” which are broadly defined as any entity that made at least 100 “covered originations” in each of the preceding two calendar years. This threshold is one of the few significant changes from the CFPB’s proposed rule, which would have applied to lenders who made 25 or more covered transactions in each of the preceding two calendar years.

Because the scope of the rule is determined by the volume of lending rather than the category of lender, it will apply to both traditional and alternative small business lenders, many of which have not previously been subject to CFPB rules. These include online lenders, platform lenders, community development financial institutions, nonprofit lenders, lenders involved in equipment and vehicle financing, merchant cash advance providers and governmental lending entities, as well as banks and credit unions.

An origination is a “covered origination” and therefore within the scope of the 1071 Rule if it is a “covered credit transaction” to a “small business.” A business is a “small business” under the 1071 Rule if it had $5 million or less in gross annual revenue for its preceding fiscal year. Nonprofits and governmental entities are excluded from the definition of small businesses. 

“Covered credit transactions” include loans, lines of credit, credit cards, merchant cash advances and credit products used for agricultural purposes. Certain transactions are exempt under the 1071 Rule, including factoring, leases, purchases of credit transactions (including through a loan participation agreement), and securities credit.

In another change from the proposed rule, the final 1071 Rule exempts loans that are already reportable under the Home Mortgage Disclosure Act in an attempt to eliminate inconsistencies or duplicative reporting. The CFPB also stated that it believes the 1071 Rule will work in concert with a new final rule to amend the federal Community Reinvestment Act (CRA) regulations, which also require lenders to collect and report commercial lending data. (As we discussed in a previous client alert, the federal banking agencies are in the midst of an effort to overhaul the existing CRA regulations.)

Lenders Will Be Required to Collect and Report Detailed Small Business Lending Data

Lenders that are subject to the 1071 Rule will be required to collect and report approximately two dozen data points, including: the date of the application and loan decision; the action taken; the reason for any denial of credit; the loan amount and pricing terms; whether the applicant is a minority-owned, women-owned or LGBTQI+-owned business; and the race and ethnicity of the business’s principal owners. 

The 1071 Rule includes a model form that lenders may use to collect demographic data. Although covered lenders must ask an applicant to provide this data, lenders cannot require applicants to provide the information. In one of the significant changes from the proposed rule, lenders will also not be required to make their own determinations of an applicant’s race or ethnicity, or any other demographic information.

The CFPB intends to use the data it collects from lenders to establish a comprehensive, publicly accessible database that will include geographic and demographic data, credit decisions and pricing terms. This database will allow the CFPB, other regulators and the general public to conduct detailed statistical analyses of lenders’ practices, including for potential fair lending violations. 

The 1071 Rule Will Become Effective on a Rolling Basis

The 1071 Rule will have a phased-in effective date depending on the amount of loans lenders originate in a calendar year. The largest lenders—those that originate at least 2,500 small business loans annually—must collect data starting October 1, 2024. Lenders that originate at least 500 loans annually must collect data starting April 1, 2025. Lenders that originate at least 100 loans annually must collect data starting January 1, 2026. The CFPB also stated that it intends to issue a supplementary proposal that would, if finalized, provide additional implementation time for small lenders that have demonstrated high levels of success in serving their local communities, as measured by their performance under relevant frameworks like the CRA and similar state laws.

States Are Also Increasing Regulatory Pressure on Commercial Lenders

States are also increasingly extending complex, consumer-style requirements to commercial financing. As described in our prior client alert, California, New York and several other states have recently imposed complex new disclosure requirements on certain commercial financing transactions. In addition, New York recently imposed data collection and reporting requirements that are similar to the 1071 Rule on New York state-chartered banks. We expect that other states will join California and New York in enacting statutes and regulations that increase the regulation of commercial financing.

Preparing for the 1071 Rule and New State Requirements

The 1071 Rule continues the growing trend of legislators and regulators treating commercial lending, particularly smaller dollar commercial loans and loans to small businesses, more like consumer lending, with corresponding operational and compliance challenges for lenders. Institutions that are covered by the 1071 Rule and new state regulatory requirements should be proactively preparing for implementation and compliance obligations. Institutions should consider identifying covered business credit transactions, reviewing and updating data collection and storage policies and processes, and identifying systems and applications that will be impacted and may require updates. Institutions should also strongly consider conducting a comprehensive review of their fair lending compliance programs, because regulators will be using the data that lenders will now be required to collect from applicants in their fair lending examinations of regulated institutions.