in effect
This is an interim final rule from the Consumer Financial Protection Bureau (CFPB) that also asks the public for comment. It changes Regulation B to push back the deadlines by which certain lenders must start collecting and reporting data on their small business loan applications — a data-collection program required by Section 1071 of the 2010 Dodd-Frank Act. The CFPB says it is delaying the dates because several courts have paused the rule’s deadlines in ongoing lawsuits, and the agency also plans to start a new rulemaking to reconsider parts of the original 2023 rule.
Each compliance deadline is moved back by roughly one year (about 350 days) and shifted to the first day of a month. The largest-volume lenders (Tier 1, at least 2,500 covered small business loans a year) must now begin collecting data on July 1, 2026, with their first report due June 1, 2027; moderate-volume lenders (Tier 2, at least 500 loans) begin January 1, 2027, and the smallest covered lenders (Tier 3, at least 100 loans) begin October 1, 2027, both with first reports due June 1, 2028. The annual filing deadline stays June 1 following the year the data was collected, and lenders may choose which two-year period — 2022–2023, 2023–2024, or 2024–2025 — to count their loans and figure out which tier they fall in. Lenders may voluntarily start collecting applicants’ demographic data 12 months before their deadline to test their systems. The CFPB also updated its grace period: for the first 12 months of data after a lender’s start date, it does not intend to penalize good-faith, unintentional reporting errors and will treat exams as diagnostic.
The direct effect falls on “covered financial institutions” — banks, credit unions, and other lenders that make small business loans above the volume thresholds; the CFPB estimates about 100 Tier 1, 450 Tier 2, and 2,000 Tier 3 institutions. These lenders get more time before they must build systems and report, which the CFPB estimates delays their compliance costs. The data itself concerns credit applications from women-owned, minority-owned, and small businesses, so those business owners are affected indirectly through when this information starts being collected and made available.