On August 26, the United States District Court for the Southern District of Texas issued a decision upholding the legality of the CFPB Small Business Lending Rule (the “Rule”) (designed to implement section 1071 of the Dodd-Frank Act) in a lawsuit filed by plaintiff trade associations challenging the CFPB’s authority in promulgating the Rule (previously discussed here and here).

The Rule, issued in March 2023, requires financial institutions, including banks, credit unions, and non-banks, to collect and report several types of data from commercial loan applications. This includes data about a loan recipients’ race, ethnicity, and gender, as well as geographic information, lending decisions, and credit pricing. It also creates the first comprehensive database of small business credit applications in the U.S.

The trade associations challenged the Rule on two grounds. First, they claimed the Rule is outside the agency’s authority, arguing that the Rule did not advance Section 1071’s purpose (i.e., to facilitate the enforcement of fair lending laws, and enable the identification of business and community development needs and opportunities of women and minority-owned small businesses.) The court rejected the plaintiffs’ argument, holding that the allegations attacked the Rule’s effectiveness and not its purpose and were accordingly misplaced. Relatedly, plaintiffs alleged that the additional data requirements imposed by the Rule are unlawful because the Bureau cannot require reporting data that financial institutions would otherwise not collect. The court found that the statute’s text contradicted plaintiffs’ claims. 

The second challenge raised to the Rule was that it was arbitrary and capricious because the CFPB failed to adequately consider the disproportionate costs it will impose on customers and financial institutions. The court disagreed with the plaintiffs’ contention and noted the agency engaged in a detailed analysis of the costs and benefits associated with the Rule, utilizing available data and economic principles to make informed predictions about its impact. 

The court delayed entry of a final judgment to consider additional motions. So while the decision appears to be final, it is not yet ready for appeal. 

Putting it into Practice: While the litigation continues to play out, it remains increasingly likely that the Rule is here to stay. As such, what are the takeaways for commercial lenders?

1. Review Compliance Requirements. The rule has not been stayed. Accordingly, Tier 1 institutions will need to comply by July 18, 2025. Lenders should closely review the final rule’s requirements to ensure full compliance by the applicable deadlines.
2. Assess Operational Impacts. If they have not done so, institutions should assess the operational impacts of the new reporting requirements, including any necessary changes to data collection and reporting processes.
3. Implement Training Programs. It may be beneficial to implement training programs for staff responsible for data collection and reporting to ensure they are well-versed in the new requirements. That should begin as soon as possible.
4. Evaluate Strategic Implications. Institutions should consider the strategic implications of the enhanced data reporting requirements, including potential opportunities to better understand and serve the needs of small, women-owned, minority-owned, and rural businesses.