The Consumer Financial Protection Bureau (CFPB) has issued its long-awaited final rule on small business lending. The 888-page rule implements Section 1071 of the Dodd-Frank Act. Although Congress enacted this provision in 2010, a proposed rule was not issued until 2021. There were approximately 2,100 comments on the proposal submitted to the CFPB. The purpose of the rule is to facilitate fair lending and improve lending opportunities for women-owned and minority-owned small businesses. This is intended to be effectuated by requiring covered financial institutions to collect and report several data points for applications from small businesses with $5 million or less in gross annual revenue for the preceding fiscal year. A covered financial institution includes not only depository institutions, but also online and platform lenders.

What Data Points Are Required to Be Reported

A covered financial institution will generally have to report various data points based on the information it generates, and information it collected from applicants or an appropriate third-party source. Doeren Mayhew has outlined the required reportable data points below. Institution-Generated Data

• A unique identifier
• Application date
• Application method (i.e., how the applicant submitted their application)
• Application recipient (indicating whether the application was received directly, or indirectly via an unaffiliated third party)
• Action taken by the covered financial institution on the application
• Action taken date

Data Collected from Applicants and Third-Party Sources

• Credit type
• Credit purpose
• The amount applied for
• A census tract based on an address or location provided by the applicant
• Gross annual revenue for the applicant’s preceding fiscal year
• A three-digit North American Industry Classification System (NAICS) code for the applicant
• Number of people working for the applicant
• Applicant’s time in business
• Number of the applicant’s principal owners
• The applicant’s minority-owned business status, women-owned business status and LGBTQI+-owned business status
• The applicant’s principal owners’ ethnicity, race and sex.

Timeline for Compliance

When does your institution need to start complying? There is a three-tiered approach to the compliance timeline. Each phase identifies when data must begin being collected based on annual loan origination sizes.

1. Oct. 1, 2024 – Lenders originating at least 2,500 small business loans annually
2. April 1, 2025 – Lenders originating at least 500 loans annually
3. Jan. 1, 2026 – Lenders originating at least 100 loans annually

Covered financial institutions must report data to the CFPB by June 1 of the year following the calendar year in which the institution collected the data.

Got Questions?

Do you have additional questions regarding this new rule? Doeren Mayhew’s Financial Institutions Group stands ready to help. Contact us today.