CFPB’s Small Business Lending Rule Stayed
On March 30, 2023, the Consumer Protection Financial Bureau (CFPB) finalized a rule to “increase transparency in small business lending, promote economic development, and combat unlawful discrimination.”[1] This amendment was intended to implement Section 1071 of the Dodd Frank Act, which would, among other things, “require credit unions to collect data on applications for credit for minority-owned, women-owned and small businesses.”[2] In October, the Senate voted to halt the implementation of this new rule and House of Representatives followed suit in early December, leaving the fate of the rule in the hands of the President.
Section 1071
The amendment to Section 1071 of the Dodd Frank Act would create a requirement for all financial institutions that offer loans to small businesses to provide further data to the CFPB. This data includes the “loan recipients’ race, ethnicity, and gender, as well as geographic information, lending decisions, and credit pricing.” Small businesses in this ruling are “defined as an entity with gross revenue under $5 million in its last fiscal year.”[3] This ruling applies to all financial institutions who have originated at least 100 small business loans for each of the past two years. Should the rule pass, financial institutions will be required to adopt this practice in a tiered structure.
The following is the proposed initiation date for compliance with the ruling based on the size and earnings of each financial institution:
- Lenders that originate at least 2,500 covered small business loans in both 2022 and 2023 must start collecting data on October 1, 2024.
- Lenders that originate at least 500 covered small business loans in both 2022 and 2023 must start collecting data on April 1, 2025.
- Lenders that originate at least 100 covered small business loans in both 2022 and 2023 must start collecting data on January 1, 2026.
- Lenders that did not originate at least 100 covered small business loans in both 2022 and 2023 but originated at least 100 transactions in two consecutive calendar years must start collecting data no earlier than January 1, 2026.
- Lenders that originate between 100 and 500 small business loans in both 2024 and 2025 must start collecting data on January 1, 2026.
It’s important to note that financial institutions that are already compliant with the Home Mortgage Disclosure Act (HMDA) or the Community Reinvestment Act (CRA) likely have established practices in place to collect this data. The technology lift required for implementing Section 1071 is expected to have a greater impact on financial institutions that have no such established practices in place today.
The information to be gathered is intended to be utilized to determine if lenders are engaging in unfair or discriminatory practices. The CFPB would seek to leverage this information to increase fairness in lending offered by financial institutions and increase the amount of small business loans to groups to historically disadvantaged groups.
Community Response
On November 29, Jim Nussle, President and CEO of the Credit Union National Association, and Dan Berger, President and CEO of the National Association of Federally-Insured Credit Unions, issued a joint statement in a letter to the leaders of the House of Representatives urging them to not allow the amendment to go through. In their letter they claim “The overly broad scope of the CFPB’s rule will substantially raise the cost of small business borrowing” and the rule “will weigh disproportionately on credit unions in ways that ultimately lead to fewer and less favorable outcomes for all small business borrowers.”[4] Their letter also reveals that the technological requirements needed to conduct this new system of data gathering will be taxing even for larger financial institutions. They advocate that the ruling needs to be modified to enable these institutions to comply with updated practices that will ultimately protect the small business owners and not place this new burden of cost on smaller financial institutions.
Data Gathering and Security
Data gathering has been a contentious topic in most industries, with privacy rights a primary concern of individuals and businesses alike. No organization is immune to the potential threat. Earlier this year the CFPB was internally breached by an employee who sent the personal information of over 250,000 consumer accounts to their personal email.[5] This employee was terminated, and the timing of this incident raised more concerns about additional compliance requirements for data gathering.
Security breaches are becoming more common and financial institutions are continuing to adapt to meet the growing need for customer privacy and information protection. According to research by the Identity Theft Resource Center, there have been more data compromises in the first three quarters of 2023 than in the entirety of 2022.
Industry Effect
Should the rule implementing Section 1071 go into effect, many financial institutions could be expected to see an increase in the cost of business and a delay in loan processing times. It is yet to be determined what the total cost of this rule might be and whether its impact will protect the consumer from discrimination practices or ultimately limit their options in loan acquisition as the rising cost of business could limit the amount of loans that a financial institution could process. ILT will continue to monitor these developments and their potential impacts on our clients.
[1] https://www.consumerfinance.gov/about-us/newsroom/cfpb-finalizes-rule-to-create-a-new-data-set-on-small-business-lending-in-america/
[2] https://www.cutimes.com/2023/12/01/cuna-nafcu-asks-house-members-to-nullify-cfpbs-1071-rule/?kw=House%20Members%20Nullify%20CFPB%27s%201071%20Rule&utm_source=email&utm_medium=enl&utm_campaign=newsroomupdate&utm_content=20231204&utm_term=cut&oly_enc_id=4891F6323067I1I
[3] https://buckleyfirm.com/blog/2023-03-31/cfpb-finalizes-section-1071-rule-small-business-lending-data
[4] https://www.nafcu.org/system/files/files/11-29-23%20CUNA%20NAFCU%20Section1071%20SJRes%2032%20Letter.pdf
[5] https://www.politico.com/news/2023/04/19/cfpb-employee-consumer-data-breach-00092919
