On August 31, 2021, the Consumer Financial Protection Bureau (CFPB) published a 918-page notice of proposed rulemaking (NPRM) to implement Section 1071 of the Dodd-Frank Act.  That section amends the Equal Credit Opportunity Act (ECOA) to require financial institutions to collect and report certain data in connection with credit applications made by women- or minority-owned businesses and small businesses.

• Compliance with a final rule will be mandatory 18 months after publication, which is expected by March 2023. 
• While final compliance is delayed, there are steps that need attention now.

Key aspects of the proposal include, but are not limited to:

• Who is covered - The rule applies to financial institutions, however a proposed activity-based exemption would exempt financial institutions that originate less than 25 “covered credit transactions” to “small businesses” in each of the two preceding calendar years. It is estimated that the rule will apply to approximately 3,600 to 3,800 (70% to 73% of the total) banks and Savings Associations.
• What is a “Small Business” - The CFPB is proposing to define a “small business” as one that had $5 million or less in gross annual revenue for its preceding fiscal year.  
• What is an “Application” – The NPRM proposes to adopt the Regulation B definition of an “application” but exclude:
  • Reevaluation requests, extension requests, or renewal requests on an existing business account, unless the request seeks additional credit; and 
  • Inquiries and prequalification requests.
• What is a “covered credit transaction” - The CFPB is proposing to define a “covered credit transaction” as one that meets the definition of business credit under Regulation B.  The term:
  • Includes loans, lines of credit, credit cards, and merchant cash advances.  
  • Does not include trade credit, public utilities credit, securities credit, and incidental credit as defined in Regulation B.
• What information is collected and reported – Financial institutions must collect 21 fields of data including the race, sex, and ethnicity of the principal owners of the business, the credit type, the amount applied for, action taken, pricing, census tract, gross annual income, the NAICS code, and much more. The sex of the applicant includes, “male”, “female”, “I do not wish to provide this information”, and “I prefer to self-identify as_____”.

The proposed revisions to Regulation B represent one of the most significant new regulatory events in recent history. All financial institutions, except those that originate less than 25 “covered credit transactions” to “small businesses” in each of the two preceding calendar years, must implement a full compliance management system, including policies, procedures, training, and audit. Actions needed now include budgeting for 2023/24, initial staff training, commercial and agricultural customer orientation, and selection of a system to collect and report data.

Topics include:

• Who is covered by the new regulation
• The definition of “small business”
• The definition of “application”
• Which transactions are reportable and which are exempt from reporting
• The 21 data fields to be collected
• The data collection form
• The tolerances applied to the collected data
• The “firewall” concept
• The rules for reporting data to the CFPB
• What data gets published, when it gets published, and how it gets published
• The recordkeeping requirements
• The enforcement provisions
• The likely effective date of the rule
• The five critical steps that need attention now