Despite facing challenges both from Congress and in court, the Consumer Financial Protection Bureau’s (CFPB’s) “Small Business Lending Under the Equal Credit Opportunity Act (Regulation B)” (Small Business Rule) is likely here to stay.

In December 2023, President Biden vetoed the congressional challenge to the rule. And as long as the Supreme Court rules in CFPB v. Community Financial Services Association of America that the CFPB’s funding structure does not violate the Appropriations Clause of the Constitution, we also expect the rule to survive the legal challenges currently pending in Texas and Kentucky.

Assuming it survives, large lenders must begin complying with the rule’s extensive and detailed provisions by October 2024, with smaller lenders to follow in 2025 and 2026. 12 CFR §1002.114(b). Those dates of compliance are currently stayed pending the ongoing litigation, but financial institutions may need to prepare for the possibility that the rule will soon come into effect.

The CFPB’s Small Business Rule

The Small Business Rule, issued on March 30, 2023, implements Section 1071 of the Dodd-Frank Act, which requires creditors to determine whether a business “is a women-owned, minority-owned, or small business.” Specifically, Section 1071(e) requires financial institutions to request 13 particular data points from businesses, such as the race, sex, and ethnicity of the principal owners of the business.

But the CFPB’s final rule implementing Section 1071 goes further, requiring financial institutions to request dozens of additional data points, including LGBTQI+ data. 12 CFR §1002.107. Gathering this detailed information would allow the CFPB to determine whether any enforcement or other actions are warranted against lenders.

The financial services industry has expressed numerous concerns about the CFPB’s rule:

• Lenders assert that the rule will lead not only to further government enforcement actions, but also to additional class action lawsuits.
• The Conference of State Bank Supervisors asserted that the rule’s expansion beyond those data requests enumerated in Section 1071 imposes significant new compliance obligations and associated costs.
• The American Bankers Association asserted that the rule is “government run amok” and will increase the cost of small business credit, causing lenders to exit the market and therefore reducing the overall availability of credit for small businesses. Similarly, the Credit Union National Association criticized the rule as overly broad and contended that the complexity and costs of compliance will ultimately lead to less favorable outcomes for small businesses.
• The Independent Community Bankers of America cited additional consumer privacy risks inherent in seeking sensitive personal information beyond the data points required in Section 1071.

Congressional Disapproval of the Small Business Rule

Under the Congressional Review Act, agencies are required to report rules to Congress, which can then consider legislation to overturn these rules. 5 U.S.C. §801(a). If a resolution disapproving of a rule is passed by both houses of Congress and signed by the President — or Congress overrides a Presidential veto — the rule cannot go into effect. 5 U.S.C. § 801(b).

On October 18, 2023, the Senate passed Senate Joint Resolution 32 to disapprove the Small Business Rule.¹ The bipartisan 53-44 majority included three Democrats and two independents. On December 1, 2023, the House passed the disapproval resolution in a 221-202 vote, with six Democrats voting to overturn the rule.²

President Biden vetoed the disapproval on December 19, 2023. The President’s veto message stated that the CFPB rule “would bring much needed transparency to small business lending and improve the ability of lenders and community organizations to meet the most critical needs of America’s small businesses” as there are “acute gaps in capital access for minority- and women-owned businesses.”

On January 10, 2024, the Senate voted 54-45 to override the veto, but that fell short of the two-thirds required.³

Judicial Scrutiny

Although the Small Business Rule survived congressional disapproval, it continues to face judicial challenges by financial institutions and interest groups that argue that the rule constitutes regulatory overreach. Prior to the congressional action, the rule suffered two adverse judicial rulings.

• In Texas Bankers Association v. CFPB, No. 7:23-CV-00144 (S.D. Tex.), a private bank and two trade associations asserted that the rule was invalid because the funds used to promulgate the rule were drawn from the CFPB’s unconstitutional funding structure, which is being challenged in the pending Supreme Court case CFPB v. Community Financial Services Association of America.The plaintiffs further argued that the CFPB violated the Administrative Procedure Act (APA) in issuing the rule because (1) it abused its discretion by expanding the 13 data points in §1071 to 81 data points in the final rule and (2) it acted arbitrarily and capriciously by not undertaking a proper cost/benefit analysis and ignoring comments from parties that would be burdened by the costs of compliance with the rule.On July 31, 2023, the court granted a limited injunctionto the plaintiffs pending the Supreme Court decision. The plaintiffs filed for summary judgment on March 1, 2024.
• In Monticello Banking Company v. CFPB, No. 6:23-cv-00148-KKC (E.D. Ky.), eight banks and one trade association asserted that the rule was invalid for the same reasons argued in Texas Bankers Associationas well as on First Amendment grounds, contending that it includes a content-based restriction on speech that prevents financial institutions from informing applicants that they may refuse to provide information requested under the rule. The plaintiffs argued that 12 CFR §1002.107(c)(1) prohibits institutions from “discourag[ing] an applicant from responding to requests for applicant-provided data” while 15 U.S.C. §1691c-2(c) states that “any applicant for credit may refuse to provide any information requested [under the rule].”On September 14, 2023, the Monticello Banking court granted a nationwide injunction until the Supreme Court rules on the constitutionality of the CFPB’s funding structure.

Should the Supreme Court hold that the CFPB’s funding structure is permissible under the Constitution, the Texas and Kentucky courts will still need to address the APA and First Amendment arguments. Although those courts have yet to signal their view of those arguments, APA and First Amendment claims are often difficult to prove. If, however, the Supreme Court eliminates Chevron deference when it decides the Loper Bright Enterprises v. Raimondo case this term, that could strengthen the plaintiffs’ APA claims.

Outcome and Potential Effect of a Future Administration

We expect that the rule will ultimately survive legal challenge, but it could still come under fire in a future administration led by a Republican president and CFPB director. Nevertheless, any potential proposal to roll back the rule would still need to go through lengthy notice-and-comment rulemaking. In sum, the CFPB’s Small Business Rule is likely here to stay, at least for the foreseeable future.

ENDNOTES

1 169 Cong. Rec. 171 (2023).

2 169 Cong. Rec. 198 (2023).

3 170 Cong. Rec. 5 (2024).

This post comes to us from Skadden, Arps, Slate, Meagher & Flom LLP. It is based on the firm’s memorandum, “Lenders May Soon Need To Prepare To Comply With the CFPB’s Small Business Rule,” dated March 18, 2024, and available here.