Court Upholds CFPB's Heightened Reporting Requirements on Collecting Loan Data
Commentary by Steven Lofchie
A US District Court upheld a CFPB rule requiring heightened data reporting by banks and financial institutions on loans to women-owned, minority-owned and small businesses.
The United States District Court for the Southern District of Texas granted the CFPB Summary Judgment against the Texas Bankers Association et. al., ("plaintiffs") who challenged the CFPB rule that introduced the heightened reporting requirements for financial institutions under the Equal Credit Opportunity Act ("ECOA") and Dodd-Frank Act Section 1071 ("Small business data collection"). The Court held that the CFPB's rules were within its authority under the Dodd-Frank Act to enforce fair lending laws and to improve transparency in credit availability for women-owned, minority-owned and small businesses. The Court also rejected plaintiffs' arguments that the rule was arbitrary and capricious under the Administrative Procedure Act. (See previous coverage.)
The plaintiffs contended further that the CFPB requirements to collect and report extensive data on credit applications impose undue burdens and, as a result, would harm small banks and restrict credit availability to small businesses. The Court rejected the argument that the rule's costs outweighed its benefits, noting that the CFPB adjusted the compliance requirements to mitigate burdens on smaller institutions.
Commentary
The CFPB's rule has now survived challenges both from Congress and in court, which suggests that the rule is likely here to stay. Assuming that appeal from this case, or any other litigation challenges that may affect this rule are unsuccessful, lenders should prepare to meet these compliance obligations now, if they have not already started. The requirements are significant and will require changes to loan application intake, tracking, privacy and recordkeeping procedures.
Based on the updated compliance deadlines, lenders with the highest volume of small business loans must begin collecting data by July 18, 2025; moderate volume lenders by January 16, 2026; and the smallest volume lenders by October 18, 2026. Because the deadline for reporting small business lending data to the CFPB remains June 1 following the calendar year for which data are collected, high volume lenders will first submit data by June 1, 2026, while moderate and low volume lenders will first submit data by June 1, 2027. (Note, lenders may choose to start collecting data earlier, as the rule allows lenders to collect demographic data up to one year before their compliance date to test their procedures and systems.) The CFPB also reminded lenders that it "does not intend to assess penalties for reporting errors for the first 12 months of collection," and it intends "to conduct examinations only to assist lenders in diagnosing compliance weaknesses, so long as lenders engage in good faith compliance efforts."