Reprinted with Permission from Law360

In this article we highlight the role played by the Consumer Financial Protection Bureau in regulating small business lending. Broadly speaking, the bureau's jurisdiction is limited to the marketplace for consumer financial products and services (i.e., financial products or services used for personal, family or household purposes).1 However, the bureau does have limited jurisdiction over small business lending, and has recently taken steps to begin more active oversight of this market.

Indeed, CFPB Director Richard Cordray recently noted in testimony before the House Financial Services Committee that because "the line between commercial and consumer lending is blurry," "if [he] had [his] way, [the bureau] would seek to protect consumers but also small businesses, who often operate in the marketplace with no more clout than individual households."2 Below we summarize the bureau's limited jurisdiction over the marketplace for small business lending, and highlight recent and upcoming changes that have the potential to significantly reshape the regulatory landscape in this space.

The Bureau's Jurisdiction Over Small Business Lending

The bureau can exercise jurisdiction over small business lending through a variety of means. Most directly, Section X of the Dodd-Frank Wall Street Reform and Consumer Protection Act assigns the bureau primary responsibility for supervision and enforcement of the Equal Credit Opportunity Act. The ECOA prohibits discrimination in both consumer and commercial credit transactions.3 Additionally, Section 1071 of Dodd-Frank amended the ECOA by adding a provision requiring financial institutions4 to collect and maintain loan data for women-owned, minority-owned and small business credit applicants.5

Notably, the data collection provision makes the bureau the sole agency responsible for collecting and reviewing small business loan data under the ECOA, regardless of the lender's size or primary regulator, thereby giving the bureau oversight of smaller lenders that are excluded from its broader ECOA enforcement authority.6 Although the provision directs the bureau to prescribe rules and guidance necessary to implement the data collection program, the bureau has not yet done so.7

The bureau's authority over small business lending may not be limited to its mandate to regulate compliance with the ECOA. For example, individuals may use their personal credit, such as debt on their personal credit cards or home equity loans, to raise capital for small businesses, and lenders may require proprietors or small business officers to cosign or guarantee business purpose loans. This can blur the lines between consumer and commercial lending, and potentially exposes small business lending practices to bureau enforcement of federal consumer financial laws that may not obviously apply. In addition, the bureau's consumer response team is planning for future acceptance of complaints in the area of small business lending.8

Financial institutions should also be mindful that even where the bureau does not have jurisdiction over small business lending, other regulators may. For example, banking regulators' unfair, deceptive or abusive acts and practices authority is not limited to consumer-purpose transactions, and banks may be subject to supervision and UDAP enforcement concerning small business accounts by their prudential regulator. States too have recently sought to regulate small business lending in new ways. For example, a bill introduced in the Illinois state senate directed at marketplace lenders would apply to small business and consumer lending. This proposed legislation has some of the hallmarks of recent CFPB and state attorney general efforts to regulate payday lending and other consumer finance products -- notably, ability to repay requirements, limits on electronic transfers, extensive disclosure provisions, and referral compensation restrictions.9

The Bureau's Office of Small Business Lending Markets

In addition to Cordray's public comments noted above, other recent developments signal the bureau's intent to begin more active oversight of small business lending. On April 13, 2016, the CFPB announced the hiring of Grady Hedgespeth from the Small Business Administration's Office of Economic Opportunity as the assistant director for the CFPB's new Office of Small Business Lending Markets.10 The role was described by the bureau as a "once-in-a-career opportunity to make the market for small business finance fairer and more transparent."11 A primary responsibility of the new office will be to implement the data collection provisions called for in Section 1071 of Dodd-Frank.

The bureau is likely to begin the rulemaking process for the data collection program this year. Although the precise contours of the rule are not yet known, the statute calls for a data collection program in which lenders compile and disclose to the bureau whether an applicant for credit is a women-owned, minority-owned or small business.12 At a minimum, lenders must collect the following information:

  • The number of the application and the date on which the application was received;
  • The type and purpose of the loan or other credit being applied for;
  • The amount of the credit or credit limit applied for, and the amount of the credit transaction or the credit limit approved for such applicant;
  • The type of action taken with respect to such application, and the date of such action;
  • The census tract in which the principal place of business of the applicant is located;
  • The gross annual revenue of the applicant in the last fiscal year preceding the date of the application;
  • Reprinted with Permission from Law360
  • The race, sex and ethnicity of the principal owners of the business; and
  • Any additional data that the bureau determines would aid in fulfilling the purposes of this section.13

The statute generally prohibits financial institutions from allowing underwriters to access the information collected, meaning reliable controls will be needed to ensure underwriters are adequately segregated from the data.14 Furthermore, the statute requires that the data be retained for "not less than three years" (which the bureau may extend by regulation) and be made available to "any member of the public upon request."15 Bear in mind that the above requirements are the minimum required by Dodd-Frank, and that the bureau may, and likely will, expand upon these requirements in its implementing regulations.

Potential Impact of the Bureau's Increased Oversight

The bureau's entry into small business lending regulation will impact the market in a variety of ways. At a minimum, the new data collection requirements will impose additional compliance costs on financial institutions. Lenders will need to devote compliance and risk resources to develop processes and controls to obtain, maintain and disclose loan data. In addition, the data collection program will equip the bureau with tools to police small business lending for disparate impact discrimination, redlining and credit discrimination in emerging areas such as marketplace lending.

Disparate Impact: The new data collection program will provide a wealth of data upon which "disparate impact" claims under the ECOA could be based. Disparate impact involves a policy or practice that, although facially neutral, results in a disproportionate disadvantage to a protected class and cannot be justified by a legitimate, nondiscriminatory business purpose. Disparate impact claims cover a much broader swath of conduct as compared to other types of discrimination, which involve intentional discrimination, and therefore create increased risk for lenders.

In many areas of lending, disparate impact claims under the ECOA are complicated because regulators (or plaintiffs) lack solid demographic information about loan applicants to assess such claims.[16] In such circumstances, lenders also lack solid information with which to guard against violations or alleged violations. To assess a possible disparate impact claim, regulators must compile and analyze aggregated data from a large number of loans to determine whether a discriminatory impact is present. But outside the mortgage context and other limited circumstances, financial institutions do not maintain this sort of demographic information because they are prohibited from doing so.17

Thus, regulators and plaintiffs have historically been forced to rely on proxies for this data in consumer lending. For example, to support disparate impact allegations in the auto lending context, the bureau developed a proxy method that combines surname and geography-based information to determine probability for race and ethnicity.18 The reliability of these methods has been subject to significant criticism.19

Under the soon-to-be issued rules, however, financial institutions will be required to inquire whether a loan applicant is woman-owned, minority-owned or a small business, and maintain a record of the response in connection with an application for business-purpose credit.20 This information will create a trove of loan-level demographic data that can be analyzed for potential disparate impacts.

Redlining: The bureau might also use the small business data to advance so-called redlining claims predicated on a lack of credit availability in minority-dominated areas. Redlining has been an area of significant recent interest for the bureau -- indeed, Cordray has said that recent redlining settlements were a "shot across the bow" to the industry.21 Although these claims have historically been predicated on demographic data for mortgage loan applications collected under the Home Mortgage Disclosure Act (HMDA),22 the same tools and techniques will soon be available to the bureau for small business lending.

For example, regulators have used HMDA data to plot mortgage lending information for peer lenders onto maps of certain high-population minority areas, to determine whether certain lenders' practices lead to statistical disparities as compared to their peers.23 In a similar way, the newly collected data could allow the bureau to identify geographic regions in which women-owned, minority-owned and small businesses are underserved, and to develop redlining claims against lenders based on this information.

Marketplace Lending: Marketplace lending is another area that may be affected by the bureau's expanded oversight into small business lending. Marketplace lending is a rapidly growing industry in which nonbank, online entities connect consumers and small businesses with investors or lenders that provide credit. Recent press articles have speculated that certain marketplace lending practices raise fair lending concerns, such as possible redlining issues. At the same time, the CFPB and other regulators have expressed concerns that this industry is inadequately regulated, and the bureau recently highlighted that it accepts consumer complaints regarding marketplace lenders. The bureau's growing interest in small business lending coupled with its concerns about marketplace lenders makes this industry a natural focus for the bureau when it begins to collect small business loan data. And according to recent press reports, the bureau is working on a proposed rule that may bring certain marketplace lenders within its supervisory jurisdiction.24

Steps Lenders Can Take Now

Although the data collection program is still likely years away from full implementation, it is never too early to start preparing for what may be a resource-intensive effort to adapt to the new regime. Until the bureau provides more information about this program, the best places to look for guidance are the minimum requirements in Dodd-Frank, the analogous consumer reporting requirements in the HMDA, and the bureau's general expectations about compliance management systems.

Lenders should consider whether their current commercial lending systems can record HMDA-type data and whether adjustments to the loan application process will be necessary to comply with the new rule. In addition to possible process and technology changes, lenders will also need to develop new policies and procedures for compliance, along with employee training once the rule is issued. Should the bureau move to supervise marketplace lenders or other fintech companies, significant additional effort will be needed to prepare for bureau supervision.


Given the bureau's stated desire to expand its oversight role in the small business lending marketplace, financial institutions should expect that the bureau will use the data it collects to inform decisions about regulatory activity in this area, whether through supervision, enforcement or additional rulemaking. The creation of a new small business lending office, combined with existing staff and expertise in the fair lending office and elsewhere within the bureau, ensures that the bureau will have ample resources available to scrutinize small business lending markets and respond to perceived problems.