Much-maligned small-business data rule close to finish line

• Key insight: The small-business data collection rule is classified as a "significant" regulatory action necessitating a rigorous review due to its massive economic impact.
• What's at stake: Banks and lenders scored some wins, getting the CFPB to reduce the number of financial institutions and loan applicants covered by the rule. 
• Expert quote: "Kudos to the Trump Administration for actually producing a rule ... 17 years later!" said Todd Zywicki, law professor at George Mason University.

The Consumer Financial Protection Bureau is set to finalize a controversial rule that requires financial institutions to collect data on the sex, race and ethnicity of small-business loan applicants.

The CFPB's most recent proposed rule is currently being reviewed by the Office of Information and Regulatory Affairs and is expected to be published soon in the Federal Register, lawyers said. An OIRA review is triggered for "significant" regulatory actions that have an annual economic impact of $100 million or more. OIRA is housed within the Office of Management and Budget, of which Vought is the director. The agency ensures regulations are cost-effective and align with presidential priorities.

Under the latest proposal from the Trump administration, banks and lenders begin collecting the data in 2028 and begin reporting the results to the CFPB in 2029 — 19 years after the Dodd-Frank Act mandated the collection. 

The delay comes after multiple legal battles with consumer groups, and then banks, suing the CFPB to enact, and then halt the rule, resulting in multiple court-ordered stays, preliminary injunctions, and an eventual decision by acting CFPB Director Russell Vought last year to reconsider the rule. The Trump administration dramatically scaled back a 2023 rule that was finalized in the waning days of the Biden administration. 

Todd Zywicki, a law professor at George Mason University, said lenders have always been concerned that the CFPB would run an analysis to "find out which [financial institutions] it could prosecute." He praised the Trump administration and Vought for getting the rule over the finish line.  

"Regardless of what one thinks of the substance, kudos to the Trump Administration for actually producing a rule after all this time," Zywicki said. "It was never entirely clear to me why it was so difficult in the past to just produce something."

Meanwhile, Republican lawmakers are continuing their efforts to repeal the rule through legislation and to gut the rule through the appropriations process. Roughly 215 civil rights groups have asked House Financial Services Committee Chairman French Hill, R-Arkansas, to reject efforts to repeal or weaken the rule, known as Section 1071 for its section in the Dodd-Frank Act.

The 2025 rule requires the original 13 data fields that were statutorily mandated by Dodd-Frank, down from 81 data fields required by the 2023 rule finalized by former CFPB Director Rohit Chopra during the Biden administration. The CFPB said the data collection should initially focus on core lending products and larger lenders.

Chris Willis, a partner at the law firm Troutman Pepper Locke, said the 2025 final rule significantly reduced the overall data collection. Under Vought's revised rule, financial firms are covered if they originate 1,000 or more small-business loans, and a small business is defined as having $1 million in revenue, down from $5 million previously. 

Those changes reduce the number of banks and lenders covered by the rule to roughly 280 — down from roughly 2,500 under the 2023 rule.

"To my mind, the major change to the rule is reducing the number of lenders and loan applications that would be reporting," Willis said. "They are concentrating the burden of the rule on entities that make a lot of small business loans."

In November the CFPB released the unmarked text of the rule with changes marked in red with asterisks. In addition, the CFPB suggested that lenders tell applicants early and often that they can decline to provide the information, an about-face from the 2023 rule proposed by Chopra that would hold lenders responsible for low response rates, Willis said. 

In addition, the 2025 rule significantly narrows the scope of credit products by excluding several types of financing in Chopra's 2023 final rule, including closed-end loans, lines of credit, business credit cards and merchant cash advances. Instead, the rule only applies to loans explicitly outlined in the statutory language.

The rule's path to finalization has been a litigious one. Notably, a federal judge last year upheld the 2023 rule, stating that the CFPB did not exceed its authority by including merchant cash advance lenders in the rule's scope. 

Richard Cordray, the CFPB's first director, said the 1071 rule was a low priority during his tenure because the agency was focused on more pressing priorities, including mortgage rules mandated in the wake of the 2008 financial crisis. 

"During the first period when I was in charge, we just ran out of the running room to do the rule because we had so much to do on the mortgage market," Cordray said in an interview. 

Small business lending

Exclusive: GOP bill nixes small business data collection

February 4, 2025 5:00 AM

By Claire Williams

Because the CFPB had dragged its feet for more than a decade without enacting the rule, former CFPB Director Kathy Kraninger was sued in 2019 by the California Reinvestment Coalition, now renamed Rise Economy. Kraninger initiated a small-business review panel that laid the groundwork for a proposed rulemaking.

When Chopra took over under the Biden administration, he agreed to a court-ordered settlement, but caused an uproar with the inclusion of LGBTQI+ data along with dozens of other discretionary data points — an expansion that caused significant backlash among industry stakeholders and legislators.

"With Chopra, the concern was largely about the number of fields he wanted data on," said Zywicki. "There was a sense he was getting that info in order to be able to reverse-engineer disparate impact cases by slicing the data in particular ways."

When Vought was appointed acting director by President Trump, he said the CFPB would not comply with the 1071 rule, and then issued an interim final rule that extended the compliance deadlines by another year, to July 2026. The 2025 proposal extended compliance until January 2028.

An open question going forward is whether consumer groups will sue the CFPB when the latest iteration of the 1071 rule is finalized. Jesse Van Tol, president and CEO of the National Community Reinvestment Coalition, said that it's important that the industry begin to gain the valuable insights into small-business lending that only an implemented 1071 rule can provide.

"Section 1071 has become partisan, but supporting small businesses by creating transparency around credit shouldn't be," Van Tol said. "The law is clear, and it needs to be implemented so we can finally see where capital is flowing — and where it's falling short."