CFPB issues pared-down small business data collection rule

Al Drago/Bloomberg

• Key Insight: The Consumer Financial Protection Bureau is slated to publish a new proposed small business data collection rule in the Federal Register Thursday that scales back the scope of data to be collected and lenders subject to the rule.
• What's at Stake: The small business data collection rule finalized under the Biden administration drew sharp criticism and legal challenges from banks, who complained that the rule was overly burdensome.
• Forward Look: The rule will be open for public comment for 30 days following publication in the Federal Register.

The Consumer Financial Protection Bureau has rewritten its small business data collection rule, dramatically scaling back the scope of the rule from its earlier version in a way that will likely reduce costs for banks and lenders. 

The 2025 proposed rule, to be published on Thursday in the Federal Register, is most notable for extending compliance until January 2028 and eliminating all discretionary data points. Though the Dodd-Frank Act originally outlined only 13 mandatory data points, the rule promulgated under the Biden administration included 81 mandatory data fields, an expansion that lenders objected to as onerous and unnecessary. The rule will be open for public comment for 30 days following publication.

The proposal also eliminates a requirement that lenders identify the principal owner of a small business based on their race, ethnicity and sexual orientation, including LGBTQ+ status, which became a flashpoint for many small lenders and some Republican lawmakers.   

The Thursday proposal also changes the definition of a small business to cover companies with up to $5 million in gross annual revenue, up from $1 million. It significantly raises the minimum number of loans a lender has to make to be subject to the reporting rules from 100 per year to 1,000.

The 198-page proposed rule, signed by acting CFPB Director Russell Vought, also excludes a wide range of products — including merchant cash advances, small-dollar business credit and all agricultural lending — from reporting requirements. Lenders in the Farm Credit Administration system are completely exempt from the rule.

All financial institutions have a longer timeline to comply with the rule as well, with the new compliance deadline set for January 1, 2028, compared with tiered compliance dates that began in mid-2026 for the largest lenders under the previous rule.

"The main expected benefit of the proposed rule to impacted financial institutions comes in the form of cost savings," the bureau said. 

Currently there is little data collected on small business lending, and the CFPB dragged its feet for a decade because agency leadership didn't want to implement the unpopular rule.

The CFPB was ultimately sued in 2019 for failing to begin the data collection mandated by Dodd-Frank nine years earlier. The rule was ultimately finalized in 2023 by then-CFPB Director Rohit Chopra. An interim final rule issued in June and finalized in October extended the previous rule's compliance dates.

Vought justified the major changes by citing "widespread industry concerns" that the rule would create "compliance burdens," and increase costs. The CFPB said that larger-volume lenders are "core to small business lending," and that excluding smaller lenders would not significantly change the amount of data being collected.

"Larger lenders are better resourced and can better sustain the complexities and cost of compliance with the rule," the bureau said. "The CFPB believes that it should work with larger lenders to better understand potential difficulties associated with collecting data before considering whether to expand the rule to require that smaller lenders comply with the rule."

Still, the CFPB faced dueling lawsuits over the rulemaking. 

A lawsuit filed in Texas that initially won a nationwide injunction against the rule, was later overturned last year on appeal. In July, community groups filed a new, separate lawsuit to force the CFPB to implement the rule, but it is currently on hold due to previous court orders. The CFPB also had said it will not prioritize enforcement of the Biden-era rule. 

The Texas Bankers Association, Rio Bank, a small community bank, and the American Bankers Association sued the CFPB in 2023 challenging the rule known as 1071 for its section in Dodd-Frank.

Chris Furlow, president of the Texas Bankers, called the CFPB's new proposal "a major victory for banking regulatory reform" and "a pivotal win for community banks." He called the 1071 rule finalized by Chopra "the poster child for gross government over-reach.""

Furlow said the previous rule would have forced banks to comply with 888 pages of regulation and collect 81 data points on "highly personal customer information."

Banks are still lobbying Congress to repeal section 1071 but Furlow thanked Vought and the Trump administration "for taking this common-sense step."