New York Department of Financial Services Rule Will Require Banks to Collect Demographic Data with Commercial Credit Applications

Currently, lenders typically only collect demographic data, such as the race or ethnicity of an applicant, with home mortgage loan applications—in large part because federal law currently places significant restrictions on the collection of such data in other circumstances. The NYDFS Rule, together with a similar federal rule which the Consumer Financial Protection Bureau (CFPB) is currently finalizing that will also require lenders to collect detailed demographic and financial data in connection with business credit (the Section 1071 Rule), will therefore require lenders to make substantial operational changes. These rules will also impose significant new compliance obligations and give regulators access to new information that they will likely use to begin conducting more detailed fair lending reviews of lenders’ business credit programs.

Despite many similarities between the NYDFS Rule and Section 1071 Rule, there are several key differences in the proposed rules. Institutions subject to both rules will therefore need to prepare to implement varying operational changes and compliance obligations.

Comments on the NYDFS Rule must be submitted by December 12, 2022. The comment period for the Section 1071 Rule is closed, and the CFPB has agreed to finalize the Section 1071 Rule by March 2023. The NYDFS will likely follow a similar timeline for issuing a final rule.

The New York Legislature’s CRA Amendments
Congress enacted the federal CRA, 12 U.S.C. § 2901, et seq., in 1977. New York enacted a corresponding state CRA, New York Banking Law § 28-b, the following year, and is one of a small number of states that has its own CRA. Both the federal and New York CRA require regulators to evaluate the extent to which banks meet the credit needs of the entire communities in which they operate, with a particular focus on low- and moderate-income individuals and communities.

The CRA statutes are implemented through detailed regulations. (Federal banking regulators are currently revising and modernizing the regulations that implement the federal CRA.) Regulators conduct examinations of banks based on tests set forth in the regulations and assign banks a rating of either outstanding, satisfactory, needs to improve or substantial noncompliance. Banks that do not maintain a satisfactory or outstanding CRA rating are subject to significant restrictions on their operations, including limitations on mergers.

Historically, the requirements under the New York CRA have mirrored the requirements under the federal CRA. However, in 2020, the New York legislature expanded the scope of New York’s CRA to require the NYDFS to specifically evaluate how banks regulated by the NYDFS meet the credit needs of minority- and women-owned businesses when the NYDFS conducts CRA exams. New York banks will now be subject to more wide-ranging CRA evaluations than federally chartered banks, or banks chartered in other states.

The NYDFS Rule
When it amended the New York CRA in 2020, the New York legislature did not include a mechanism for the NYDFS to collect data to carry out its new statutory mandate to evaluate banks’ lending to minority- and women-owned businesses. The NYDFS initially published a Notice of Proposed Rulemaking to collect this data on November 3, 2021. Following a public comment period, the NYDFS issued the current revised proposed rule on October 26, 2022.

The NYDFS Rule will apply to New York state chartered banks, and FDIC-insured branches of foreign banks regulated by the NYDFS, that originated at least 25 business credit transactions in each of the two preceding calendar years. Banks that are subject to the NYDFS Rule will be required to collect and maintain nearly two dozen data points with business credit applications, including the date of the application and loan decision, the action taken, the reason for any denial of credit, the loan amount and pricing terms, whether the business is minority- or women-owned, and the race and ethnicity of the principal owners of the business. The NYDFS Rule states that the NYDFS will issue a sample data collection form which banks may use to collect this information.

Banks would be required to retain information required by the NYDFS Rule for six years. The NYDFS Rule as currently drafted would require banks to comply within six months after a final rule is published, with limited exceptions for certain provisions of the rule that would give banks additional time to come into compliance.

Key Similarities and Differences between the NYDFS Rule and the Section 1071 Rule
Section 1071 of the Dodd-Frank Act amended the Equal Credit Opportunity Act (ECOA) to require financial institutions to compile, maintain, and submit to the CFPB certain data on applications for credit for women-owned, minority-owned and small businesses. In 2011, the CFPB issued an interpretation stating that it would not require compliance with Section 1071 until it issued implementing regulations. The CFPB was ultimately sued for not timely promulgating regulations, and in connection with resolving that litigation agreed to issue the final Section 1071 Rule by March 2023.

The NYDFS Rule and the Section 1071 Rule will be similar in many respects to the federal Home Mortgage Disclosure Act (HMDA), which requires mortgage lenders to collect and report detailed demographic and financial data on mortgage applicants. However, extending these obligations to business credit and applying them to commercial lenders that have not previously had to comply with the HMDA’s requirements will be a sea change.

Several aspects of the NYDFS Rule and the Section 1071 Rule will be similar. For example, New York banks that originate at least 25 small business loans in each of the two preceding years will generally be subject to both rules. In addition, the categories of data that lenders will be required to collect in connection with loan applications is very similar under both rules. Both rules also prohibit employees or officers involved in making credit determinations from accessing the demographic data lenders must collect under the rule, but permit an exception where this restriction is not feasible operationally.

In recognition of this overlap, the NYDFS has included in its proposal a provision stating that the NYDFS may, in its discretion, determine that compliance with the Section 1071 Rule constitutes compliance with the NYDFS Rule. However, the NYDFS also notes in its proposal that there are key differences between the rules, and that compliance with the Section 1071 Rule may therefore not be sufficient to comply with the NYDFS Rule.

Key differences between the NYDFS Rule and Section 1071 Rule include:

• The NYDFS Rule will apply to all business credit; the Section 1071 Rule will apply only to small business credit, as defined by the rule.
• The Section 1071 Rule will apply to all lenders, including banks and non-banks; the NYDFS Rule will only apply to New York state chartered banks and FDIC-insured branches of foreign banks regulated by the NYDFS.
• The NYDFS Rule will apply to covered banks that make 25 or more business loans of any kind in each of the preceding two calendar years; the Section 1071 Rule will only apply to lenders that make 25 or more small business loans, as defined in the rule, in each of the preceding two calendar years.
• The NYDFS is promulgating its rule primarily to evaluate banks’ performance under the New York CRA; the CFPB is promulgating the Section 1071 Rule based on the requirements of the ECOA.
• The Section 1071 Rule will require covered lenders to annually report data to the CFPB; although the NYDFS Rule will authorize the NYDFS to require banks to report the data they collect, it is likely that the NYDFS will primarily collect the data from banks on an individual basis in connection with CRA exams.

Preparing for New Commercial Credit Data Collection Requirements
The NYDFS Rule and the Section 1071 Rule are further evidence of an emerging trend among legislators and regulators of treating commercial lending, particularly smaller dollar commercial loans and loans to small businesses, more like consumer lending, with corresponding operational and compliance challenges for lenders. In another example of this trend, several states have recently enacted new disclosure requirements for commercial credit that are on the verge of becoming effective. The disclosure requirements in California, the first state to enact these new requirements, will become effective on December 9, 2022.

Institutions that will be impacted by the NYDFS Rule or the Section 1071 Rule—or both—should be proactively preparing for implementation and compliance obligations. Institutions should consider identifying covered business credit transactions, reviewing and updating data collection and storage policies and processes, and noting systems and applications that will be impacted and may require updates. Institutions should also strongly consider conducting a comprehensive fair lending analysis of their business credit portfolio as regulators will be using the data that lenders will now be required to collect from applicants in their fair lending examinations of regulated institutions.