Executive Letter: CFPB Releases Final Section 1071 Business Data Collection Rule

By Rose Oswald Poels

Last Thursday, the Bureau of Consumer Financial Protection (CFPB) issued its long-awaited final Section 1071 business data collection rule. The Wisconsin Bankers Association (WBA) has been engaged in the rulemaking process since the proposal’s inception. While I know the general requirements for this rule came directly from the Dodd-Frank Act, CFPB chose to add in many more data points than what the law required which have made this rule very burdensome for the banking industry and intrusive for banks’ small business customers.

Just this past fall, I, along with several Wisconsin bankers, shared specific concerns of the proposal directly with CFPB Director Rohit Chopra. I am disappointed our concerns were largely disregarded given the requirements within the final rule. Our concerns of data privacy for small business customers remain.

Given the low threshold for rule applicability, the amount of data to be collected and reported, and the changes in process that will need be implemented, the rule will be burdensome to implement. While I and the WBA Legal team are currently working through the final rule and accompanying resources, below are highlights of the final Section 1071 rule. WBA will certainly be hosting educational events and will be creating resources around the final rule in the forthcoming months.

Highlights

• The final rule applies to banks that originated at least 100 covered originations in both of the two previous years.
• “Small business” means one with gross revenue of $5 million or less in the preceding fiscal year.
• Small businesses will be able to self-identify as women-, minority-, or LGBTQI+ owned.
• Lenders will be able to rely on financial and other information provided by the small business applicant.
• Mandatory compliance dates are staggered based upon the number of covered originations made by each bank, in particular:
  • A bank must begin collecting data and otherwise complying with the final rule on October 1, 2024, if it originated at least 2,500 covered originations in both 2022 and 2023.
  • A bank must begin collecting data and otherwise complying with the final rule on April 1, 2025, if it:
    • Originated at least 500 covered originations in both 2022 and 2023;
    • Did not originate 2,500 or more covered originations in both 2022 and 2023; and
    • Originated at least 100 covered originations in 2024.
• A bank must begin collecting data and otherwise complying with the final rule on January 1, 2026, if it originated at least 100 covered originations in both 2024 and 2025.

As mentioned above, the CFPB has created resources which accompany the final rule. The resources include an executive summary, quick reference guides, and a data point chart.