The Consumer Financial Protection Bureau issued a final rule in late March amending its regulations that implement the Equal Credit Opportunity Act pursuant to Section 1071 of the Dodd-Frank Wall Street Reform and Protection Act. Section 1071 requires covered financial institutions to collect and report data on loan applications for small businesses, including those that are owned by women or minorities.
To facilitate information exchange and further knowledge sharing, Wolters Kluwer recently hosted a webinar with representatives from the CFPB to discuss operationalizing the new 1071 rule. As the industry continues to digest the 888-page rule, Wolters Kluwer sought a dialogue with the CFPB that summarized 1071 and fleshed out ideas to ensure lender compliance well before the earliest reporting date.
Attendees heard from CFPB officials on myriad topics, including an overview of the rule, the data collection requirements, the tiered compliance schedule, and next steps to begin preparing to comply with this new rule.
Implementing the rule
More than 2,100 attendees representing banks, credit unions, regulators and others attending the session participated in several polling questions to gauge how they are feeling about Section 1071 compliance. Nearly two-thirds of respondents expressed a moderate level of confidence in preparing for and implementing requirements under the newly announced final rule.
A majority of respondents identified as a Tier III reporter (those making more than 100 small business loans; first submission due June 1, 2027), followed by Tier II (those making more than 500 small business loans; first submission due June 1, 2026) and Tier I (those making more than 2,500 small business loans; first submission due June 1, 2025). In sum, respondents have begun working on their structures, and are aware of the provisions that will likely pose the greatest confusion for their organizations.
What did the CFPB cover?
The CFPB provided an overview of their final rule implementing Section 1071 and those transactions that are covered and not covered under the rule, emphasizing that the purpose of the rule and the underlying statutory provisions is to “facilitate enforcement of fair lending laws” and “enable communities, governmental entities, and creditors to identify business and community development needs and opportunities of women-owned, minority-owned and small businesses.”
This is an important point. Covered institutions should be focusing not just on collecting and reporting the data, but also on what their data says: Are loans being made in majority-minority census tracts? Are there outreach strategies to women-owned businesses? Are there targeted efforts to market to LGBTQI+ business owners? Does the data present potential geographic redlining issues that need to be explored further?
While institutions have not been able to capture the demographic data under the legacy ECOA, efforts can be made today to begin better fostering partnerships both internally and externally to maximize applications from targeted businesses (and farms) well before the first reportable line is filed.
Next, the CFPB covered the definition of a small business and small farm. Because the CFPB’s rule follows the definition used by the Small Business Administration, a covered institution can begin looking at its current customer base to identify those businesses with gross annual revenues (for its preceding fiscal year) of $5 million or less now. Identifying this universe early may help a covered institution determine when a customer is up for a refinancing, whether the transaction would be covered under the rules, and whether all of the required data points are available in the current system(s) including, but not limited to, the time in business, number of workers, and the 3-digit North American Industry Classification System code.
The CFPB described the publication of aggregate data, the administrative sanctions under ECOA for violations of the rule, safe harbors and tolerance thresholds for certain types of errors, voluntary collecting and reporting of data, and the limitations on disclosure of demographic data to third parties. Most notably, the CFPB noted that it will be providing a grace period for covered institutions within its supervisory and enforcement jurisdiction that engage in good-faith efforts, for the first 12 months of data collection.
Covered institutions not directly supervised by the CFPB are encouraged to talk with their primary regulator about the grace period, but it is reasonable to surmise that they will institute a similar approach. Effective compliance dates were addressed. The CFPB intends to issue a supplementary proposal that would, if finalized, provide additional implementation time for small lenders that have demonstrated high levels of success in serving their local communities, as measured by their performance under relevant frameworks like the Community Reinvestment Act and similar state laws. No specifics were provided about what that proposal may contain, but it is not unreasonable to assume that small banks, for example, with “Outstanding” CRA ratings could benefit.
Most importantly, the CFPB stated that covered financial institutions may begin collecting demographic data one full year prior to their mandated data submission deadline (without violating ECOA) to help prepare for compliant submissions. The bureau also noted that covered financial institutions can use “any reasonable method” to estimate their volume of originations to small businesses in 2022 and 2023. Although “reasonable” was not defined, the CFPB appears willing to discuss individual circumstances with any institution well before their effective compliance deadline.
Best practices and resources for getting started
The webinar closed with some valuable tips and best practices to prepare for implementing and operationalizing Section 1071:
- Covered institutions are encouraged to start early and set up a project team, with assigned accountabilities to read and understand the final rule to ensure that their implementation plan includes sufficient time to establish procedures, processes and testing protocols up front.
- Covered institutions should reach out to third-party providers early and, as needed, rely on those trusted vendors for data software and data processing to work on your institution’s specific needs.
- Covered institutions should also develop training materials to ensure all impacted business lines know and understand the rule, including those in direct and indirect customer-facing roles.
The CFPB reminded attendees that filing instructions have also been released, along with an enforcement policy statement, a sample data collection form (in English and non-English formats), the code for the digital version of the sample data collection form, and a small entity compliance guide.
The CFPB encourages attendees to submit questions about the rule. Informal guidance can be requested via reginquiries.consumerfinance.gov; responses can be expected within 10-15 business days. For more technical questions, inquiries can be made to [email protected] with an expected turnaround within 24-48 hours.
The CFPB emphasized the need to begin preparing now for compliance, while striving for institutional awareness of the rule at all levels of an organization. While larger lenders have 18 months or so to begin complying, small lenders have over 30 months. Regardless, with the appropriate controls in place and a reliance on a good compliance management system that mitigates risk and ensures rigorous controls, covered institutions can and will comply successfully with Section 1071 requirements.
Jason Keller is an Associate Director for Fair and Responsible Banking and the Community Reinvestment Act in the Financial & Corporate Compliance division at Wolters Kluwer.
Wolters Kluwer offers advisory services including geocoding (geo-spatial analysis), customized tables providing an overview of a covered institutions’ lending in low- and moderate-income census tracts and in majority minority areas, and technical and operational support to implement Section 1071. Assistance with collecting and submitting data as well as conducting fair lending risk reviews is also available.
In addition, Wolters Kluwer will begin offering in the near term a technology solution to help with the data collection, analysis and reporting requirements under Section 1071. For information, visit the Wolters Kluwer 1071 Small Business Lending Resource Center: