The Consumer Financial Protection Bureau (CFPB) finalized the rule to implement changes to the Equal Credit Opportunity Act made by Section 1071 of the Dodd-Frank Act that requires lenders to collect and report information about the small business credit applications they receive, including geographic and demographic data, lending decisions and the price of credit. The rule will work in concert with the Community Reinvestment Act, which requires certain financial institutions to meet the needs of the communities they serve.

“Many local businesses were shuttered during the COVID-19 pandemic after they struggled to obtain credit under the Paycheck Protection Program,” Rohit Chopra, director of the CFPB, said. “This small business loan census will give the public key data on this market to ensure that banks and nonbanks are serving small businesses fairly.”

U.S. Congress passed the Dodd-Frank Act in 2010, including Section 1071 and its amendments to the Equal Credit Opportunity Act. The CFPB first proposed a rule to issue the Congressional mandate to implement Section 1071 requirements in 2021 after being sued by the California Reinvestment Coalition for failing to implement said rulemaking. The CFPB said it received more than 2,1000 comments about the proposed rule before finalizing the rule this week.

The final rule covers lenders making more than 100 covered small business loans per year, which accounts for more than 95% of small business loans by banks and credit unions. Like with mortgages, lenders will submit data points required by Congress, as well as additional data points that are typically already included in lender files.

The final rule covers closed-end loans, lines of credit, business credit cards, online credit products and merchant cash advances by banks, credit unions and other lenders. Non-depository financial institutions will be required to collect and report data, as will banks, savings associations and credit unions.

The final rule defines a small business as one with gross revenue under $5 million in its last fiscal year.

In terms of timing for implementation at the lender level, the final rule requires the largest lenders, which account for most of the small business lending market, to collect and report data earlier than smaller lenders. Specifically, lenders that originate at least 2,500 small business loans annually must collect data starting Oct. 1, 2024, while lenders that originate at least 500 loans annually must collect data starting April 1, 2025, and lenders that originate at least 100 loans annually must collect data starting Jan. 1, 2026.

The CFPB also noted that lenders originating fewer than 100 loans per year will still be required to adhere to fair lending laws. In addition, the CFPB intends to issue a supplementary proposal that would, if finalized, provide additional implementation time for small lenders that have demonstrated high levels of success in serving their local communities as measured by their performance under relevant frameworks like the Community Reinvestment Act and similar state laws.

Under the new rule, small businesses will be able to self-identify as women-, minority-, or LGBTQI+-owned. Loan officers will not be required to make their own determinations of an applicant’s race, ethnicity or any other demographic information.

“The final rule just issued by the CFPB to codify Dodd Frank’s small business lending data collection and reporting requirements represents new ground for a wide range of lenders and poses significant implementation and analytical challenges,” Timothy Burniston, senior advisor for regulatory strategy at Wolters Kluwer Compliance Solutions, said. “Now that the contours of the compliance requirements are established, particularly around the reporting threshold levels, the data elements that need to be captured and reported and the substantive revisions made to create a phased-in implementation schedule, covered institutions should immediately ramp up efforts to operationalize the final rule. That should start by engaging key stakeholders across the enterprise and preparing a robust internal implementation plan if one has not yet been developed. It is essential to optimize the implementation schedule provided by the CFPB.”