CFPB Issues Interim Final Rule Extending Small Business Lending Rule Compliance Deadlines

The Consumer Financial Protection Bureau (CFPB) recently issued an interim final rule (2025 interim final rule) delaying compliance deadlines for a second time for its small business lending data collection rule, which amended Regulation B pursuant to Section 1071 of the Dodd-Frank Act.

The initial final rule promulgated in 2023 (2023 final rule) requires companies issuing a wide array of commercial credit products to small businesses to begin collecting and reporting demographic and lending data to CFPB. Under the rule, covered lenders will be required to compile and report information about the demographics of a small business applicant’s ownership, including whether the business applicant is minority-, women- or LGBTQI+-owned, as well as the ethnicity, race and sex of the applicant’s principal owners. Other required application-level information includes the type of credit product offered, credit pricing, types of guarantees, loan term, credit purpose, amount of money applied for and the action taken on the application by the institution.

The 2023 final rule initially required large lenders to comply by October 1, 2024, with later compliance dates for smaller lenders. The deadlines were extended for the first time in a June 2024 interim final rule following the US Supreme Court’s May 16, 2024, decision on the CFPB’s constitutionality in CFPB v. CFSA. Under the extended compliance deadlines, lenders with the highest volume of small business loans had until July 18, 2025, to begin collecting data, while moderate volume and smallest volume lenders had until January 16, 2026, and October 18, 2026, respectively.

New compliance deadlines

The 2025 interim final rule establishes the following new operative compliance and filing dates:

• Tier 1 (2,500+ originations annually): Compliance required beginning on July 1, 2026; first filing due June 1, 2027.
• Tier 2 (500 – 2,499 originations annually): Compliance required beginning on January 1, 2027; first filing due June 1, 2028.
• Tier 3 (100 – 499 originations annually): Compliance required beginning on October 1, 2027; first filing due June 1, 2028.

The compliance date is when covered institutions must begin collecting data from small business credit applicants. The first filing deadline is the date by which institutions must submit that calendar year’s collected data to the CFPB.

Further, covered institutions may begin collecting demographic data up to 12 months before their applicable compliance date for testing purposes. The CFPB will still implement the 12-month grace period found in the 2023 and 2024 versions of the rule, under which – to the extent a financial institution is engaged in good faith compliance efforts – the CFPB will not assess penalties for errors in data reporting and will conduct examinations only to diagnose compliance weaknesses. However, the CFPB notes that errors not made as the result of good faith efforts to comply will be subject to its supervisory and enforcement authority.

What’s next?

The CFPB had already announced that it would deprioritize enforcement for institutions not covered by a stay, signaling a temporary regulatory reprieve while the rule was reevaluated. The interim final rule now formalized what many in the industry have long awaited. What a final rule looks like – and when it is issued – remains to be seen, though for now the CFPB’s position as stated in the rule is that “this length of time should be sufficient to extend beyond the court-ordered stays and for the CFPB to issue a new proposal to reconsider certain aspects of the 2023 final rule.”

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction, and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may have been generated with the assistance of artificial intelligence (AI) in accordance with our AI Principles, may be considered Attorney Advertising and is subject to our legal notices.