On March 30, the Consumer Financial Protection Bureau (CFPB) issued its long-awaited final rule to implement Section 1071 of the Dodd-Frank Act. Section 1071 amended the Equal Credit Opportunity Act to require lenders to collect and report data on credit applications made by small businesses, including women- or minority-owned small businesses.
The final rule will apply to most companies that provide financing to small businesses, including banks, non-bank lenders, equipment and vehicle finance companies, and companies that purchase future receivables (but not traditional factoring companies). The final rule notably defines “credit” to include non-credit products. Only lenders (a term we use as shorthand for providers of “credit”) that originate fewer than 100 credit transactions per year with small businesses will be exempt, a slight improvement over the 25-transaction threshold in the proposed rule. The CFPB rejected requests to exempt smaller lenders based on their asset size.
The final rule also maintains the expansive definition of “small business” in the proposed rule, specifically a business that generates up to $5 million in annual revenue, thus capturing the vast majority of business enterprises in this country. Also like the original proposal, the final rule will require lenders to report to the CFPB up to about 20 data points for each credit application by a small business, depending on the action taken on the application.
While we are still studying the approximately 900-page final rule, here are some additional initial observations:
- “Compliance date tiers.” The rule contains different “compliance date tiers” that depend on the number of credit transactions a lender originates per year with small businesses. Specifically, the dates for compliance—meaning the date when the lender must begin to collect and record required data—are as follows:
- October 1, 2024, for lenders who originate at least 2,500 small business credit transactions in each of 2022 and 2023;
- April 1, 2025, for lenders who originate between 500 and 2,499 small business credit transactions in each of 2022 and 2023; and
- January 1, 2026, for lenders who originate between 100 and 499 small business credit transactions in each of 2023 and 2024.
- Generally, if a lender does not have information on how many credit transactions it originated with “small businesses” in 2022 or 2023, the final rule will allow it to use “any reasonable method” to estimate those numbers.
- Reporting of Data. Lenders are required to collect data on a calendar year basis and report it to the CFPB by June 1 of the following year. Thus, larger lenders who must begin to comply by October 1, 2024, for example, will report the data they collect from October–December 2024 to the CFPB by June 1, 2025.
- Lenders will not be required to judge race or ethnicity. Marking a substantial change from the proposed rule, the final rule does not require lenders to collect race and ethnicity by visual observation or surname where the applicant fails to provide that data. That data will only come, if at all, from the applicant.
- Lenders must, however, maintain procedures that are “reasonably designed” to obtain responses from applicants. In a Policy Guidance issued simultaneously with the final rule, the CFPB emphasized that it will prioritize resources to ensure that the required procedures are maintained, and may compare a lender’s response rates to those of its peers for evidence that the lender is discouraging responses.
- “Firewall” Provisions. The final rule maintains the proposal’s “firewall” provisions, which generally will require every lender either to (i) prevent its underwriters from having access to an applicant’s responses to demographic questions; or (ii) if preventing access by underwriters is “not feasible,” then provide all applicants a notice that underwriters may have such access. As many commenters on the proposed rule observed, such a notice could be perceived negatively by some applicants.
In addition to the final rule, the CFPB also issued a Factsheet, an Executive Summary and the Policy Guidance referred to above.
For more information, please contact any of the authors or the Manatt professional with whom you work.