New CFPB rule could raise costs for credit unions

Credit unions are threatening to retreat from originating small-business loans due to the cost of complying with the Consumer Financial Protection Bureau's final data collection rule.

The CFPB's rule requires that financial institutions collect and report data on small-business lending applicants. Data on application volumes and types of credit made to women and minority-owned small businesses will be used to enforce fair lending law. The rule, issued March 30, will go into effect for the largest lenders starting in September 2024.

The small-business data collection rule capped an arduous 13-year journey that saw little movement until a court-ordered settlement reached in the 2019 lawsuit by the California Reinvestment Coalition mandated that the CFPB complete the final rule by March 31. The CFPB declined to comment further before the deadline.

Regulation and compliance

CFPB finalizes data-reporting rule for small-business lenders

March 30, 2023 4:47 PM

"Some financial institutions are going to decide that availing themselves of this rulemaking isn't worth it, and they're gonna withdraw some of their business lending offerings," said Alexander Monterrubio, deputy chief advocacy officer and managing counsel at Credit Union National Association. "But I think we really need to see how the rulemaking ultimately gets implemented to see how that will play out."

Phil Sutliff, head of business banking at the $5.6 billion-asset Citadel Credit Union in Exton, Pennsylvania, said he is trying to educate small businesses about the federal requirements and address privacy and security concerns about the data.

"The intended outcome of [the rule] is to facilitate fair lending laws and help identify some opportunities for community involvement, which aren't bad goals but it's important to ensure that those goals are met in a way that's fair," Sutliff said.

Credit unions, banks and other lenders are required to comply with the rule if they originate at least 100 small -business loans a year, up from 25 loans a year that had been in the 2021 proposal. The bureau also defined a small business as one with gross revenues of under $5 million a year.

The CFPB is allowing for the voluntary collection of data on "minority-owned, women-owned and LGBTQI+-owned business status," the rule states, removing a controversial provision that would have allowed lenders to determine the race and ethnicity of an applicant's principal owner using visual traits.

The CFPB received roughly 2,100 comments from lenders, trade groups and consumer advocates to a 2021 proposal on the small-business data collection, which is known as section 1071 of the Dodd-Frank Act. The National Association of Federally-Insured Credit Unions and the CUNA lobbied for major changes.

A key concern for credit unions is that the majority of small-business loans and credit lines are far below $50,000. Many credit union executives are concerned that the cost of compliance is unfair and overly burdensome on the small institutions.

Further, the National Credit Union Administration doesn't require credit unions to report loans below $50,000 as member business loans because such loans are excluded from both the commercial loan and member business loan classification.

Yet the CFPB used NCUA call report data to analyze how the rule would impact lenders and estimated that roughly 100 credit unions would be covered — or only 2% of the overall U.S. credit union population. The bureau said that the proposed version of the rule would have encompassed roughly 7% of credit unions.

Dale Baker, regulatory affairs counsel for NAFCU, had lobbied for the CFPB to establish a minimum threshold of $50,000 to reduce the burden on smaller credit unions that have limited economies of scale.

"The average [loan amount] that we found among our members of small-business lines of credit and credit cards is about $10,000 to $12,000," Baker said. "So if the average line of credit is coming in at $10,000, it is never going to show up on the call report data," that the CFPB was relying on when it was doing its impact analysis of these various thresholds.

But the CFPB did not provide a carve-out. It said "adopting such a threshold would exclude significant amounts of the data that the bureau is looking to gather," based on 2021 Small Business Administration data. The CFPB based its determination on SBA data that found more than 87% of Paycheck Protection Program loans in 2021 were for less than $50,000.

Many small credit unions will have to either build software or work with a third-party to comply, Baker said. The bureau is providing a range of resources to help lenders comply and plans to launch a platform to give tailored responses to questions on data collection and reporting obligations.

Many credit unions are also facing the added challenge of securing sensitive member data throughout the collection and reporting processes while the CFPB continues gathering public input on these issues.

Sutliff was recruited by Citadel Credit Union to help launch a business banking division in August 2022 — along with other recruits from Santander Bank  — to develop the initial framework and seek out partnerships with clients throughout the eastern Pennsylvania region. The group has underwritten more than $50 million in small-business loans so far.

"We are a stable and growing financial institution with the proper procedures in place to ensure that we're meeting the regulatory requirements," he said. "But procedures definitely can evolve and change as this regulation rolls out over time [and] may involve incremental headcount increases depending on how much support we receive from our software partners."

The CFPB plans to offer eligible institutions a 12-month grace period in which reporting errors will not be penalized.