The Consumer Financial Protection Bureau (CFPB) finalized the long-awaited small business lending rule on March 30, 2023. The rule implements section 1071 of the Dodd-Frank Act, which amends the Equal Credit Opportunity Act (ECOA/Regulation B) and requires financial institutions to collect and report specific data points about their small business lending activity.
As described in the CFPB’s rule summary, the purpose of collecting and reporting this data will facilitate “…enforcement of fair lending laws and [enable] the identification of business and community development needs and opportunities for women-owned, minority-owned and small businesses.”
How is a small business defined?
The final rule defines a small business as having had $5 million or less in gross annual revenue for its preceding fiscal year. Nonprofit organizations and governmental entities are not small businesses under the final rule.
What transactions are covered?
Covered credit transactions can include loans, lines of credit, credit cards, merchant cash advances and credit products used for agricultural purposes. Among other exemptions, it is important to note that Home Mortgage Disclosure Act (HMDA) reportable transactions are exempt under this rule. And similarly to HMDA, financial institutions must collect and report data on covered small business loan applications and originations.
When does this rule go into effect?
The final rule establishes three date tiers to phase in compliance; the largest financial institutions will be required to comply first.
- A financial institution must begin collecting data and otherwise complying with the final rule on October 1, 2024, if it originated at least 2,500 covered originations in both 2022 and 2023.
- A financial institution must begin collecting data and otherwise complying with the final rule on April 1, 2025, if it originated at least 500 covered originations in both 2022 and 2023; did not originate 2,500 or more covered originations in both 2022 and 2023; and originated at least 100 covered originations in 2024.
- A financial institution must begin collecting data and otherwise complying with the final rule on January 1, 2026, if it originated at least 100 covered originations in both 2024 and 2025, but did not originate at least 500 covered originations in both 2022 and 2023.
The final rule includes a transitional provision that financial institutions may use to determine the number of covered originations they originated in 2022 and 2023. One of the provisions permits an institution to annualize data from the fourth quarter of 2023 data and use this annualized number to determine its covered originations for 2022, 2023 or both years.
What else do I need to know?
While the required data points are reminiscent of HMDA data, there are some unique aspects to this final rule we don’t see with HMDA:
- Covered financial institutions must maintain procedures to identify and respond to signs of potential discouragement, including low response rates for applicant-provided data. The final rule notes that low response rates may indicate discouragement or another failure by a covered financial institution to maintain procedures to collect applicant-provided data at a time and in a manner that is reasonably designed to obtain a response.
- Employees and officers of a covered financial institution or its affiliate are prohibited from accessing an applicant’s responses to the final rule’s required inquiries regarding the applicant’s minority-owned, women-owned and LGBTQI+-owned business statuses and regarding its principal owners’ ethnicity, race and sex if that employee or officer is involved in making any determination concerning the applicant’s covered application. This prohibition does not apply to an employee or officer if the covered financial institution determines that the employee or officer should have access to one or more applicants’ responses to these inquiries and the covered financial institution provides a notice to the applicants whose responses will be accessed. Alternatively, a covered financial institution can provide the notice to a broader group of applicants, up to and including all applicants.
Other nuances under this rule require financial institutions to understand the definition of application; understand the differences in gathering demographic information under this rule versus their obligations under HMDA; and develop policies and procedures to collect, report and retain the required information.
If your financial institution needs help understanding what this means and how to implement the changes, RKL’s team of assurance professionals can help. Use the form below or reach out to your RKL advisor to start the conversation.
