CFPB faces legal minefield in crafting rule on small-business loan data
A recent report by the Consumer Financial Protection Bureau underscores the puzzle facing regulators as they consider asking small-business lenders for data on their borrowers.
On the one hand, the CFPB wants more data as it conducts fair-lending exams of small-business lenders to assess redlining risks. Yet the Equal Credit Opportunity Act's prohibition on collecting race and gender information from small businesses has made it difficult for the bureau to write rules on what data to collect.
“The CFPB expects supervised entities to keep better information to determine if they are discriminating in small-business lending,” said Jeff Naimon, a partner at Buckley Sandler. “Exactly what data a financial firm is supposed to have is unclear since there isn’t a regulation allowing them to collect data.”
The CFPB said in its Supervisory Highlights report earlier this month that the data limitations could impact the CFPB’s ability to monitor and regulate supervised entities.
“Institutions collect and maintain (in usable form) only limited data on small business lending decisions,” the CFPB said in the report. “Limited availability of data could impede an institution’s ability to monitor and test for the risks of ECOA violations through statistical analyses.”
Although the Dodd-Frank Act mandated that the CFPB write rules on data collection for small-business lenders — similar to the mortgage data collection framework under the Home Mortgage Disclosure Act — the potential conflict with ECOA has led to delays in implementing the provision. The agency has found navigating around the various statutory decrees difficult under both former CFPB Director Richard Cordray and under current acting Director Mick Mulvaney.
"The fact that the previous leadership wasn't able to do it in seven years, [means] that it's difficult to accomplish what the statute wants,” Mulvaney said in a speech to the U.S. Chamber of Commerce in March. “Small-business lending is different than credit cards, it's different than large commercial banking — it's hard to do.”
At the same time, industry representatives may prefer that the baton was passed to the Mulvaney-led agency — which has moderated the bureau's aggressive approach toward lenders under Cordray — on a small-business loan data rule, since that makes it more likely the data requirements will be tailored to the industry's liking.
"It’s going to be a massive cumbersome process, but it’s something we want done with people in there who understand how difficult it is," said Kate Larson Prochaska, vice president and regulatory counsel at the U.S. Chamber of Commerce.
Prochaska specifically praised Grady Hedgespeth, the CFPB's assistant director of small- business lending markets, who would likely be undertaking the effort. Previously an official at the U.S. Small Business Administration, Hedgespeth was hired by Cordray.
“We do want [the CFPB] to move forward ... because we think they have a good project leader who has decades of small-business experience," said Prochaska. "Hopefully, we can get this done in the next couple of years under this administration.”
ECOA prohibits discrimination in consumer transactions, but it also applies to business-purpose credit transactions such as small-business loans. The CFPB’s report did not find any violations of ECOA among small-usiness lenders. But the report and the CFPB’s latest rulemaking agenda indicate the bureau may finally add language to Regulation B, which implements ECOA, that would require financial institutions to compile, maintain and submit to the bureau certain data on credit applications by women- and minority-owned small businesses.
Mulvaney has repeatedly said the CFPB under his leadership will stick to its statutory mandate, and he has cited the Reg B addition as a requirement. But his focus on strict legal adherence suggests criticism of Cordray, whom Mulvaney says went beyond the agency's legal authority.
“We have to do this. [Dodd-Frank] says: Thou shalt promulgate rules on small-business lending,” Mulvaney said at the Chamber speech. “Figuring out a way to implement this statute has been extraordinarily difficult."
Mulvaney already has assured lenders that he would ease the expanded HMDA requirements imposed by Cordray that would have exposed lenders to far greater scrutiny of fair-lending violations. Reg B is often viewed as a HMDA-like rulemaking for small-business lenders.
Bank trade groups have long been concerned that any small-business data collection would impose rigidity on small businesses, limiting the ability of banks and financial firms to do high-touch, customized lending.
Underwriting of consumer loans is far more standardized while the decisions and factors that go into small-business lending — including the fact that there often is no formal applications but rather a give-and-take between a loan officer and a small-business owner — can be more complicated, industry experts say.
"The reason why [the CFPB] waited so long to do this is because they don’t really know how to test for fair lending of small-business loans," said Lyn Farrell, a senior advisory board member at the consulting firm Treliant.
In the short term, supervised entities are expected to create procedures to collect data internally that would identify fair-lending risks in small-business loans.
Fair-lending exams for small-business lenders became a priority for the CFPB in 2016 and 2017, after the bureau pulled back from targeting indirect auto lenders.
“Examination teams may evaluate an institution’s fair lending risks and controls related to origination or pricing of small business lending products,” the CFPB's report stated. “Some reviews may include a geographic distribution analysis of small business loan applications, originations, loan officers, or marketing and outreach, in order to assess potential redlining risk.”
Richard Horn, founding attorney and managing member at the law firm Garris Horn and a former CFPB senior counsel and special adviser, said the CFPB's intent to scrap the expanded HMDA data while adding a statutorily required data collection requirement for small-business lenders could be viewed as "conservatively adhering to statutory mandates."
“It fits with the viewpoint that government should help businesses thrive,” he said.