Complying with CFPB's small business data collection and reporting rule

Challenge

In March 2023, the Consumer Financial Protection Bureau (CFPB) issued its anticipated Final Rule 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act requiring covered lenders to collect and report loan application data for small businesses. The Rule allows the CFPB to enforce fair-lending laws and to identify business and community development opportunities for women-owned, minority-owned, and LGBTQI+-owned small businesses. For Tier 1 institutions, starting July 18, 2025, lender applications must capture demographic information that will then be reported to the CFPB starting June 1, 2026.¹

A large financial institution turned to Guidehouse for assistance with understanding how the Rule will impact its business and how to ensure compliance. We were tasked with conducting a current-state assessment and developing an implementation roadmap for the client’s small-business lending products in order to comply with the Rule.

Solution

After conducting a detailed analysis of the Rule, including breaking it into digestible and actionable requirements that we could map to the client’s systems, processes, policies, procedures, and controls, our team:

• Reviewed product walkthroughs to better understand and document the current state of the client’s small business lending options.
• Conducted interviews with stakeholders across the client’s business, product, legal, and compliance teams to understand current processes for collecting and maintaining customer loan application data.
• Performed a gap assessment to determine updates needed to loan applications, back-end systems, data storage and reporting, and system controls, policies, and procedures to meet the Rule’s requirements.
• Delivered a high-level implementation roadmap that included a timeline for updates to be made. 
• Created a sample Lender Application Register using the CFPB’s reporting instructions. 

 

Impact

Now that the roadmap is in place, the client will be able to implement the recommendations with our team’s assistance. This will include:

• Executing recommended updates to each of the client’s applicable products to meet the Rule’s collection requirements, including disclosures. 
• Developing a permissions-based firewall for segregating applicant demographic data from the application. 
• Updating company policies, procedures, trainings, and scripts. 
• Performing data mapping. 
• Conducting a fair-lending analysis ahead of the reporting compliance date.