On Friday, May 1, the Consumer Financial Protection Bureau (CFPB) issued a final rule revising the small business data collection and reporting rules implemented by Regulation B (commonly referred to as Section 1071, in reference to the section of the Dodd-Frank Act that mandates this amendment to the regulation). These revisions change the current rule in Regulation B. The original rule’s compliance dates had been on hold during a legal challenge. With the new, final rule, covered banks will have a compliance date of January 1, 2028.
The final rule closely mirrors the proposed rule published by the CFPB in November of last year. Proposed changes that have now been finalized include:
- Removing certain transactions from the definition of covered credit transaction, including agricultural loans;
- Raising the originations threshold for determining a covered financial institution;
- Reducing the gross annual revenue threshold in the definition of a small business;
- Eliminating certain discretionary data points from reporting requirements;
- Changing the requirements on how to collect information and what information to collect regarding the demographics of the owners of small businesses; and
- Eliminating the tiered compliance data system and requiring all covered financial institutions to begin compliance as of January 1, 2028, with coverage thresholds based on origination volumes in 2026 and 2027.
The proposed rule requested comment on whether to request disaggregated ethnicity and race data for each principal owner of a small business borrower, or simply require the collection of aggregated categories. The final rule did, in fact, eliminate disaggregated data in favor of aggregate categories only. For ethnicity, the aggregate categories will include Hispanic or Latino and Not Hispanic or Latino. For race, the aggregate categories will include American Indian or Alaska Native, Asian, Black or African American, Native Hawaiian or Other Pacific Islander, and White.
The final rule does not resolve the question of how the data collected will be publicly disclosed. Data modification and deletion standards would help to alleviate privacy concerns. With this final rule, the CFPB kicks that can down the road, stating they will release a notice of proposed rulemaking, with proposed modifications and deletion decisions for specific data points, after they have analyzed one year of the rule’s data. Bankers who have become used to waiting for further rule changes surrounding Section 1071 may be interested to put that date on their calendars in anticipation of a coming notice of proposed rulemaking. Until then, the big date to keep in mind will be January 1, 2028, for covered banks to begin compliance.
For any questions or concerns in the meantime, feel free to reach out to us on the Compliance Hub Hotline!
Elizabeth Holtrop, CCBCO, CBAP, FLE
Assistant Vice President and Compliance Advisor