The CFPB’s Small Business Lending Data Collection Rule Has Potentially Devastating Enforcement Implications for Community Banks

Posted May 04, 2023

By Stephanie Kalahurka and Mat Petersen

On March 30, 2023, the Consumer Financial Protection Bureau ("CFPB") issued its final rule ("Final Rule") implementing the changes to the Equal Credit Opportunity Act ("ECOA") made by Section 1071 of the Dodd-Frank Act. The Final Rule requires financial institutions to collect and report to the CFPB data on applications for credit from "small businesses," which includes any business that had $5.0 million or less in gross annual revenue for its preceding fiscal year. When implemented, the Final Rule will require banks and other lenders to collect 20 separate data points on each covered small business loan application, including data regarding the minority-owned status of the business.

Much of the initial attention given to the Final Rule has focused on implementation, and concern with the administrative burden of data collection and reporting requirements. While those aspects will be time-consuming and onerous, financial institutions are accustomed to shouldering new regulatory-mandated workloads (e.g., the 2013 "ability to repay" mortgage rules and TILA-RESPA Integrated Disclosure rules). Rather than being overly concerned about short-term implementation, community banks should be far more concerned about how the Final Rule's reported data points will be used in future fair lending examinations. If the data is used in the way that the CFPB has stated that it will be—to identify unexplained discrepancies and to facilitate fair lending enforcement—the Final Rule has potentially devastating implications for the relationship small business lending models employed by most community banks. Under the bank regulators' existing enforcement methodology, the Final Rule is likely to remove almost all lender flexibility from small business loan pricing and underwriting, effectively eliminating the strategic advantage of community banks to customize loans to the individual need of a particular small business.

Understanding the Regulatory Process for Fair Lending Examination and Enforcement.

The full implications of the Final Rule must be considered in the context of the current, and largely statistical, regulatory process for fair lending examination and enforcement. Fair lending exams are rigorous, and the regulatory process for proving discrimination under fair lending examination standards are largely unpredictable. Within the current framework, a pattern or practice of discrimination does not require any evidence of discriminatory intent. While discrimination may be proven with overt evidence, more often, violations are supported by statistical evidence of "disparate treatment" or "disparate impact." Data collected under the Final Rule will be used primarily to support findings of ECOA violations based upon evidence of "disparate treatment."

Disparate treatment occurs when a lender treats a credit applicant differently because of a prohibited basis, which generally include the applicant's: (i) race or color; (ii) religion; (iii) national origin; (iv) sex; (v) marital status; (vi) age (provided the applicant has the capacity to contract); (vii) receipt of income derived from any public assistance program; or (viii) exercise, in good faith, of any right under the Consumer Credit Protection Act. Importantly, a violation based upon evidence of disparate treatment does not require any showing that the treatment was motivated by prejudice or a conscious intention to discriminate against a person beyond the difference in treatment itself. In other words, the currently regulatory standard requires only a showing of difference in treatment, and the regulatory agency may then presume that difference is due to protected class status, resulting in a fair lending violation, unless the lender can prove otherwise.

As an example, regulators often employ a statistical regression or similar analysis when testing for disparate treatment as evidence of pricing or underwriting discrimination in consumer lending. As part of that process, examiners will typically identify a sample (sometimes, a small sample) of a specific type of loan, such as mortgage loans or unsecured consumer loans. Examiners gather data relating the pricing or underwriting of those loans and information on the associated applicants from a combination of file review and interviews with bank officers. This data is sent to the regulators' statisticians, who perform a complex regression analysis to determine whether there are statistically significant differences in rates charged, or approvals/denials with respect to protected class versus non-protected class borrowers. If statistically significant differences are identified, then based solely upon the statistical modeling, the regulators may conclude that an ECOA violation has occurred. This process of collection and analysis takes time and may cause a compliance examination to be held open for a year or more. When the analysis is complete, and if a statistical disparity has been detected, the institution is typically given a mere fifteen days to respond to the preliminary findings. If the bank is unable to disprove the purported violation, the regulators are permitted under applicable examination procedures to presume that the disparity is due to applicants' protected class status and proceed with enforcement.

Applying current regulatory examination procedures, the standard puts a significant burden on community banks to prove the absence of discrimination, where the regulators benefit from statistical techniques that are subject to sample size and omitted variable bias and the right of examiners to second guess an institution's policy with 20/20 hindsight. Historically, application of this type of statistically driven enforcement has been limited to consumer loans, which are fairly uniform with respect to both credit terms and underwriting criteria; and mortgage loans, for which uniformly reported data (e.g., HMDA data), including the applicant's minority status, are available. Importantly, this statistical approach has not previously focused on small business loans, largely because the testing data was not as uniform or readily available. With the CFPB's issuance of the Final Rule, that is all about to change.

Implications for the Final Rule under Statistical Fair Lending Enforcement Processes.

After the Final Rule has been implemented, regulatory agencies will have quantitative data available to: (i) identify the protected class status of small business loan applicants; and (ii) determine whether there are unexplained disparities in the underwriting or pricing of small business loans made to similarly situated borrowers. Under currently regulatory guidelines, the determination of whether borrowers are "similarly situated" may, in the discretion of the regulator, depend solely on reported data points.

The regulators' data-based approach to fair lending testing has reshaped how banks are required to price and underwrite consumer loans, and banks have adapted. It will not be so easy to adapt in the commercial loan context. Due to the larger and more complex nature of commercial loans, a statistical approach to fair lending enforcement will not be consistent with prudent credit practices, will not benefit small business applicants and will ultimately strip community banks of their primary strategic advantage. Community banks' primary strategic advantage in small business lending has been their ability to lend based upon intangible, "relationship" factors, for the benefit of their small business customers. Larger banks tend to have strict, uniform underwriting criteria and more centralized decision-making that can leave small businesses without access to credit. Community banks have been able to fill the gap in small business lending by taking a more qualitative approach that recognizes the individualized characteristics of a particular business that makes it creditworthy.

The regulators' statistically-driven fair lending enforcement methodology has driven most banks to utilize stringent underwriting metrics and pricing guidelines for consumer loans. Risk of unexplained discrepancies have eliminated almost all loan officer discretion from the consumer lending process. To mitigate fair lending risk, banks of all sizes now employ consistent underwriting and pricing criteria for consumer loan products. Those criteria are typically uniform and quantifiable, including factors such as (among others) the size of the loan, the age and type of collateral, the borrower's income, credit score, and the amount of the borrower's deposit relationship. For consumer loans, the risk-mitigating benefits of these types of quantitative controls can be achieved without materially hampering a bank's ability to serve its customers or to underwrite credit in a safe and sound manner.

The same is not true for commercial lending. The inherent complexity and higher level of credit risk associated with commercial loan products mandates a dramatically different approach to underwriting and pricing. Commercial loans are typically larger, more complex, and accordingly, pose a higher risk to the lender than consumer loans. As such, a safe and sound approach to underwriting small business loans requires consideration of, and the interplay between, numerous and varied non-discriminatory factors that are not uniformly present in consumer loan applications. Those factors also extend well beyond the 20 data points to be collected under the Final Rule.

For small business loans, lenders cannot simply "run the numbers." The loan officer must understand the business. To that end, he or she must consider all relevant information contained in the borrower's loan application, in the customer's file or on the bank's data system if the borrower is an existing customer, and information from third parties and other data sources. This information generally includes factors that can be quantified, such as debt to income and loan to value. This information may also include business revenues, type of credit, time in business and other of the data points to be collected under the Final Rule. Importantly, however, this information must also include factors that are not quantifiable, such as the borrower's business acumen and management experience, market conditions, industry-specific risks and the borrower's reputation among customers and suppliers.

For commercial loans, the bank's own experience may even factor in. For example, heightened underwriting standards might be appropriate for a small business loan where the institution's credit personnel have less experience and knowledge of the industry, or where they have less practical ability to monitor the ongoing financial health or business prospects. For small business loans, it would not be practical, or even possible, to translate all these legitimate, non-discriminatory and necessary considerations into quantitative policy matrices or limits. Ultimately, the exceptions would negate the policy, or alternatively, the inflexibility of the policy would undermine the bank's ability to effectively serve its customers.

Notably, the bank regulatory agencies acknowledged that community banks' more flexible, and non-standardized approach to underwriting small business loans benefits small businesses. The following is from the FDIC's Small Business Survey:

"An important potential difference between small and large banks stemming from their distinct approaches is the way they manage loan requests from small businesses, and specifically whether they apply preset criteria. Two common preset criteria are a required minimum loan amount and the use of standardized loan products. Small banks' use of nonstandard information may lead to greater flexibility and willingness to customize loans according to the individual needs of a small business… The advantages to small businesses from using standardized loan products are that the underwriting can be quicker to process and the products can offer more competitive interest rates. The disadvantages are that only a subset of small businesses may be able to satisfy the standard criteria required to qualify for them, and the small businesses seeking the loans may prefer loan terms different from the ones offered…

The survey supports the understanding that small banks are relationship lenders and approach small business lending in a more flexible and customized, case-by-case way compared with large banks; and as a result of this approach may be that less established firms are more likely to receive credit. Small banks are found less likely than large banks to use minimum loan amounts on their top products or to rely on standardized loan products. And small banks are more likely than large banks to accept real estate collateral, a practice that is consistent with small banks' having a more intimate knowledge of their local communities. Further, small banks … often evaluate a wide set of additional information, including relationship-based soft information such as owner's experience or the management team's skills."

Community banks engage in traditional relationship lending that is based, in many cases, upon numerous, non-discriminatory, but often intangible factors. They can do this because they have personal knowledge of both their customers and their community. These factors cannot accurately be captured in any number of data points under the Final Rule. They cannot be quantified or controlled for in the statistical models currently used for fair lending testing. Accordingly, after implementation of the Final Rule, community banks that continue to act as relationship lenders to their small business customers will have significantly heighted levels of fair lending risk to due to the inevitably of having to answer for "unexplained disparities" in their small business loan data.


From a legislative and regulatory policy standpoint, we should remember and continually emphasize that bankers are in the business of managing risks. As part of that process, bankers may decide that they simply cannot manage the heightened regulatory risks posed by the current, purely statistical, "no-intent-required" approach to fair lending enforcement. Rather than tiptoe this perilous regulatory tightrope, many bankers have simply decided to cease offering certain types of loans at all. Smaller unsecured consumer and mortgage loans, which are more often subject to heightened fair lending scrutiny, have been widely de-emphasized or even abandoned by many community banks in favor of larger, commercial loan products. As regulated financial institutions exit this space, we have seen non-bank and payday lenders step in, eager to satisfy the resulting demand, but at higher rates and without the same level of oversight.

The CFPB has openly stated that data collected under the Final Rule is intended to be used for fair lending enforcement in small business lending. For the reasons discussed in this article, the more flexible, qualitative small business lending model used by most community banks, which ultimately benefits many small business borrowers, will not fare well under this type of statistical examination and enforcement. At the end of the day, the current statistical approach to fair lending enforcement will likely have the unintended consequence of "protecting" many small businesses out of broad access to lower-cost, more individualized commercial credit. For these reasons, community bankers should continue to support their associations' and others' efforts to oppose or seek modification of the Final Rule. Lawmakers and the federal banking agencies should consider the consequences of the Final Rule, and at a minimum, adjust examination and enforcement procedures to accommodate and permit the continued tradition of relationship lending by smaller community banks.

Originally posted May 4, 2023