On March 30 of this year, the Consumer Financial Protection Bureau (CFPB) released its final rule implementing Section 1071 of the Dodd-Frank Act. Consistent with Section 1071, the final rule will require financial institutions to collect and provide to the Bureau data on lending to small businesses, defined as an entity with gross revenue under $5 million in its last fiscal year, the results of which the Bureau will ultimately publish.

This is essentially a data gathering requirement that does not necessarily deem itself as a loan approval quota regulation, but it is clear that the data being gathered has the purpose of making financial institutions more conscious of the need to make more small business loans – if they are in the business lending arena – to those in what the CFPB considers protected classes.

Just this week the CFPB issued a guide designed to help financial institutions better understand – or in their words “parse” – the complexities of the reporting requirements under Section 1071.

https://files.consumerfinance.gov/f/documents/cfpb_small-business-lending-rule_small-entity-compliance-guide.pdf

As explained in the Guide, the final rule is intended to foster transparency and accountability by requiring financial institutions—both traditional banks and credit unions, as well as non-banks—to collect and disclose data about small business loan recipients’ race, ethnicity, and gender, as well as geographic information, lending decisions, and credit pricing.

The credit application information will be compiled in a comprehensive, publicly available database that is designed, in the words of the CFPB, to help policymakers, borrowers, and lenders better address economic development needs and adapt to future challenges. The final rule also contains a sample data collection form that lenders can, but are not required to, use to collect applicants’ demographic data.

Most financial institutions, concerned about how the CFPB will view their development of their own reporting forms, are almost certain to use the CFPB’s sample data collection form.

https://files.consumerfinance.gov/f/documents/cfpb_sbl_sample-data-collection-form.pdf

While small businesses are given the option not to provide this information, lenders must not discourage applicants in any way from supplying this data.

The Bureau also released a report – although much more in-depth than necessary – detailing user testing research used to learn about lenders’ likely experience in filling out the sample data collection form, as well as a report describing the agency’s methodology for estimating how many lenders will be required to report under the final rule and for producing cost estimates associated with implementing the final rule.

We do not feel it necessary at all to encourage you to read the information in the link below about the user testing research CFPB utilized to determine that this is not going to be a real burden on financial institution. We include the link just to let you know how far a governmental agency will go to prove that burdensome is really not, just trust us on this because we researched it.

https://s3.amazonaws.com/files.consumerfinance.gov/f/documents/cfpb_1071-final-rule-user-testing-report.pdf

The final rule does contain some changes from the proposed rule issued in September 2021. That proposed rule received a great deal of negative response during the comment period, but the CFPB seemed committed to following through with a final rule.

Explaining that these changes were designed to make the final rule more effective and easier to follow, the Bureau stated that larger lenders will be required to collect and report data earlier than small lenders.

The reporting requirements begin once a lender originates at least 100 covered small business loans in each of the two prior calendar years—a threshold that “accounts for more than 95 percent of small-business loans by banks and credit unions,” the Bureau said in its press release, noting that it was raised from the originally proposed 25-loans-per-year threshold.

While the final rule is effective 90 days after publication in the Federal Register, lenders will follow a tiered compliance date structure:

Lenders that originate at least 2,500 covered small business loans in both 2022 and 2023, must begin collecting data on October 1, 2024.

Lenders that originate at least 500 covered small business loans in both 2022 and 2023, must begin collecting data on April 1, 2025.

Lenders that originate at least 100 covered small business loans in both 2022 and 2023 must begin collecting data on January 1, 2026.

Lenders that did not originate at least 100 covered small business loans in both 2022 and 2023, but subsequently originated at least 100 transactions in two consecutive calendar years may begin collecting data no earlier than January 1, 2026.

Lenders that originate between 100 and 500 small business loans in both 2024 and 2025, must begin collecting data on January 1, 2026.

Other changes from the proposal include allowing applicants to self-identify demographic information, including race and ethnicity, rather than requiring loan officers to make the determination. The final rule also now includes an exclusion for mortgage loans that must be reported under HMDA.

CFPB Director Rohit Chopra commented that the final rule’s impact “will be in the comprehensive data that it produces, which can be used by lenders, borrowers, and the broader public to achieve better credit outcomes for small businesses and communities across the country.”

Sounds innocuous, right. Just a little data we need, guys. Bear with us on this as it is for a good purpose.

Yet, interestingly, the final rule itself was almost 900 pages. Quite a bit of verbiage for a mere reporting requirement. But for those of you who would like to access a copy of the actual CFPB Section 1071 Final Rule, a link is provided below:

https://s3.amazonaws.com/files.consumerfinance.gov/f/documents/cfpb_1071-final-rule.pdf

Most important to recognize, credit unions are covered by this rule. The NCUA will be enforcing the data gathering and reporting requirement rule for credit unions with less than $10 billion in assets, and the CFPB itself will enforce it for credit unions with over $10 billion in assets.

This is an example of what credit unions can expect more of from the CFPB in its efforts to get as many regulations in place as possible while the current CFPB Director is in the rulemaking position – which is only guaranteed through the 2024 presidential election.

It is going to be a very activist eighteen months at CFPB.  And, regardless of the noble public purpose upon which such requirements are based, they do indeed add compliance burden, regulatory costs and potential for mistakes that can result in fines and penalties.

Again, I repeat my Dollar-ism proven through decades of my regulatory experience on both sides of the equation: Regulation always creeps. It often leaps. But it never retreats.

The Section 1071 of Dodd-Frank was enacted in 2010 to simply gather some data, just one of many sections of legislation designed to make sure the financial crisis of that era never happened again. Today this one small section is now a 900 page final CFPB rule that every financial institution in America that offers small business lending – so desperately needed in our economy and essential to its viability – must comply with or decide to get out of this important and crucial lending arena.

As the option to leave the small business lending world is not a viable one for most credit unions, the answer is – once again – prepare for compliance with Section 1071 and make the organizational changes and investments necessary to make sure you do it right.

Until next time.

Dennis Dollar