On March 30, 2023, the Consumer Financial Protection Bureau (CFPB) issued a Final Rule, Small Business Lending under the Equal Opportunity Act (Regulation B) [RIN 3170-AA09], which implements the small business lending data collection requirements contained in Section 1071 of the Dodd-Frank Act. That Act amended the Equal Credit Opportunity Act (ECOA) to require financial institutions to compile data regarding certain business credit applications and report that data to the CFPB. Per the CFPB summary of the Final Rule, the purposes of Section 1071 are to facilitate enforcement of fair lending laws and to enable the identification of business and community development needs and opportunities for women-owned, minority-owned, and small businesses.

The requirements of the Final Rule apply to “covered financial institutions” which include any entity that engages in any financial activity and that originated at least 100 “covered originations” in each of the two preceding calendar years.  These entities include, among others, depository institutions, i.e., banks, savings associations, and credit unions; online lenders; platform lenders; Community Development Financial Institutions; lenders involved in equipment and vehicle financing; Farm Credit System lenders; commercial finance companies; merchant cash advance providers; governmental lending entities; and nonprofit lenders.  So, all 7(a) lenders that meet the general minimum activity level will be subject to the new requirements.

For purposes of this rule, CFPB generally has defined a covered credit transaction as “an extension of business credit under Regulation B, including loans, lines of credit, credit cards, merchant cash advances, and credit products used for agricultural purposes”.  CFPB also has defined a small business as one that had $5 million or less in gross annual revenues for its preceding fiscal year. 

The Final Rule requires covered financial institutions to collect and report detailed data on covered credit transaction applications, including those that are denied.  The data to be collected includes:

  • Credit type;
  • Credit purpose;
  • Amount applied for;
  • Census tract based on an address or location provided by applicant;
  • Gross annual revenue for applicant’s preceding fiscal year;
  • Three-digit NAICS code for applicant;
  • Number of people working for applicant;
  • Applicant’s time in business;
  • Number of applicant’s principal owners;
  • Applicant’s minority-owned business status, women-owned business status and LGBTQI+-owned business status (based solely on the demographic information voluntarily provided by applicant); and,
  • Applicant’s principal owners’ ethnicity, race, and sex (based solely on the demographic information voluntarily provided by applicant).

Generally, covered financial institutions must report data to CFPB by June 1 of the year following the calendar year in which the data was collected.  For example, data collected for 2024 must be reported by June 1, 2025.  CFPB has indicated that its publication of data “will satisfy covered financial institutions’ statutory obligation to make data available to the public upon request”.   

The Final Rule will be effective 90 days after its publication in the Federal Register.  However, the date on which an individual covered financial institution must comply will depend on the number of covered originations it had in 2022 and 2023.  A financial institution must begin collecting data and otherwise complying with the Final Rule as follows:

  • By October 1, 2024 – if the financial institution originated at least 2,500 covered originations in both 2022 and 2023;
  • By April 1, 2025 – if the financial institution –
    • Originated at least 500 covered originations in both 2022 and 2023,
    • Did not originate 2,500 or more covered originations in both 2022 and 2023, and
    • Originated at least 100 covered originations in 2024; 
  • By January 1, 2026 – if the financial institution originated at least 100 covered originations in both 2024 and 2025.

The Final Rule also includes provisions regarding enforcement, how bona fide errors will be handled, and safe harbors related to incorrect determinations of small business statuses, covered credit transactions and covered applications. 

The 888-page Final Rule has not been published in the Federal Register yet, but it is available on the CFPB website.  And CFPB also has provided several summary documents describing the Final Rule, including an Executive Summary and a Fact Sheet.  Please refer to the CFPB-provided information for more complete information regarding the new regulations.  NAGGL will update this post when the Final Rule is published in the Federal Register and will provide additional information as it becomes available.