Overview
On November 13, 2025, the Consumer Financial Protection Bureau (CFPB) released two proposed rules that would materially modify Regulation B and fair lending supervision and enforcement generally. Comments on both proposed rules are due by December 13, 2025. Steptoe’s Financial Innovation and Regulation group stands ready to assist with answering any questions or to discuss submitting a comment.
Brief Summary
Disparate Impact Proposal. The first rule would narrow certain of Regulation B’s restrictions on disparate impact. Specifically, the CFPB would modify Regulation B to: (1) provide that the Equal Credit Opportunity Act (ECOA) does not authorize disparate-impact liability; (2) clarify the scope of "discouragement;" and (3) revise certain requirements applicable to special purpose credit programs (SPCPs).
Small Business Lending Data Collection. The second rule proposes to modify the CFPB's rules, finalized in 2023, implementing Section 1071 of the Consumer Financial Protection Act (CFPA) covering small business data collection. Section 1071 amended ECOA to require that financial institutions collect and report to the CFPB certain data regarding applications for credit for women-owned, minority-owned, and small businesses in order to (1) facilitate enforcement of fair lending laws and (2) enable communities, governmental entities, and creditors to identify business and community development needs and opportunities of women-owned, minority-owned, and small businesses. Today's proposed rule would amend the CFPB's 2023 rule generally to restrict the scope of coverage of 1071 to focus on core lending products, lenders, and data rather than cover a broader group of providers and products. Specifically, the proposed rule would: (1) limit the scope of the definition of "covered credit transactions"; (2) limit the scope of the definition of "covered financial institutions"; (3) change the definition of "small business" to reduce the number of covered financial institutions; (4) limit the data points to be collected; (5) remove requirements related to the time and manner of data collection; and (6) extend the rule’s compliance date provisions.
Disparate Impact Proposal
1. Applicability of Disparate Impact
a. Current Rule: Regulation B, provides that Congress intended an "effects test" (Effects Test) concept, as established in the employment context by Griggs v. Duke Power Co. 401 U.S. 424 (1971) and Albemarle Paper Co. v. Moody, 422 U.S. 405 (1975), to be used to determine whether a creditor has impermissibly discriminated against an applicant on a prohibited basis. See 12 C.F.R. § 1002.6. The Commentary further details that creditors may not engage in practices that are facially neutral but that are discriminatory in effect due to their disproportionate negative impact on a prohibited basis, even absent a creditor’s intent to discriminate. See Comment 6(a)-2.
b. Proposed Rule: The proposed rule would provide that disparate-impact claims are not applicable under ECOA, and delete language in Regulation B and the associated Commentary describing the Effects Test as a means to identify disparate impact liability, and add language providing that ECOA does not recognize the Effects Test.
2. Scope of "Discouragement"
a. Current Rule: Currently, under Regulation B, creditors are prohibited from making certain statements to applicants or prospective applicants that would discourage applications on a prohibited basis. See 12 C.F.R. 1002.4(b).
b. Proposed Rule: The proposed rule would narrow the definition of "oral or written statement" to exclude acts or practices that could fall within the current scope of the prohibition on discouragement. Such acts or practices that would be excluded by the proposed rule include choices about where to locate branch offices or where to advertise. The proposed rule would also provide that creditors making encouraging statements to certain applicants or prospective applicants is not within the scope of the prohibition on discouragement. Discouraging oral or written statements, including visual images used in advertising or marketing campaigns, would still be within the scope of the prohibition under the proposed rule.
3. Requirements Applicable to SPCPs
a. Current Rule: An SPCP is a special entity, created pursuant to a carveout in ECOA, that is permitted to consider prohibited-basis information in credit transactions in order to meet specific social needs or aid an economically disadvantaged group of people. 12 U.S.C. § 1691(c), 12 C.F.R. § 1002.8. Currently under Regulation B, extensions of credit pursuant to an SPCP focused on meeting special social needs (which may require participants to share one or more common characteristic(s) that would otherwise be prohibited by ECOA) are required to establish and administer such programs pursuant to a written plan. See generally 12 C.F.R. 1002.8.
b. Proposed Rule: The proposed rule would prohibit an SPCP offered or participated in by a for-profit organization from using prohibited bases – race, color, national origin, sex, or any combination thereof – as common characteristics in determining eligibility for the SPCP. It would also restrict the use of religion, marital status, age, or income derived from a public assistance program as criteria for participation by requiring such SPCPs seeking to use those criteria to predicate their use on formal evidence and documentation that the fact of protected class membership is the cause of program participants’ inability to obtain credit. In practice, this change would eliminate the ability to offer an SPCP targeting customers on the basis of race, color, national origin, sex, or any combination thereof, while increasing compliance burdens associated with offering an SPCP targeting the remaining, permitted characteristics (religion, marital status, age, or income derived from a public assistance program).
Initial Observations
Because the FHA and state analogues to ECOA continue to provide for disparate impact, creditors subject to those laws would be wise not to migrate compliance programs too far away from disparate impact testing; however, greater focus on disparate treatment and proxy-discrimination seems a likely compliance outcome for many creditors if the proposed rule is finalized without material changes. Changes to the discouragement standard should allow creditors greater flexibility as to marketing practices and advertising strategies, assuming communications do not express discriminatory preferences or exclusions. As to SPCPs, such programs will face material redesign pressures. Many race‑ or sex‑based SPCPs presently offered by for‑profit organizations would be prohibited, while other SPCPs would require significant, plan‑level evidence and participant‑level documentation of necessity. Existing SPCPs that may be in place should be reviewed carefully with the proposed rule in mind. All this noted, we expect that, once the proposed rule is finalized (likely sometime in 2026), consumer advocates will advance litigation challenging it. If so, it will be some time (maybe years) before we know with certainty the final state of the proposed rule and what compliance adjustments may be warranted as a result. We will monitor these important developments closely and keep you apprised.
Small Business Proposal
Under the small business lending data collection rules, covered financial institutions that originate a number of covered credit transactions for small businesses are required to compile, maintain, and report certain lending data to the CFPB. The CFPB finalized its rule in 2023. But the CFPB now proposes to reduce the coverage and scope of the final rule to obligate fewer entities to participate and require less information to be provided. We think that this proposed rule would drastically limit the scope of small business lending data collection. Both the number of covered financial institutions and covered transactions would decrease, and a smaller set of data would be collected and reported to the CFPB.
1. Covered Credit Transactions
a. The proposed rule would modify the definition of a "covered credit transaction" under § 1002.104 to exclude merchant cash advances, agricultural lending, and small-dollar loans (defined as a transaction in an amount of $1,000 or less).
2. Covered Financial Institutions
a. Subpart B primarily requires "covered financial institutions" to collect, maintain, and report small business lending data. Any financial institution that originates at least 100 covered credit transactions for small businesses in each of the two preceding calendar years is currently considered a "covered financial institution." The proposed rule would modify the definition of a "covered financial institution" under § 1002.105 such that: (1) the definition excludes Farm Credit System lenders; and (2) the origination threshold is raised from 100 to 1,000 covered credit transactions for each of two consecutive years.
3. Small Business
a. The proposed rule would modify the definition of a "small business" under § 1002.106 to lower the gross annual revenue threshold of a covered entity from $5 million to $1 million. As the definition of a "covered financial institution" looks to the number of covered credit transactions originated for a small business, this proposal would restrict the number of covered financial institutions.
4. Compilation of Reportable Data
a. The proposed rule would make two modifications to § 1002.107(a).
i. First, Reg B currently requires the collection of data points specifically identified in the CFPA, as well as any additional data points added by the CFPB in its discretion. The proposed rule would limit the data points to be collected largely to the statutory data points, plus a very small number of discretionary data points. Data points that would be eliminated are: (1) application method, (2) application receipt, (3) denial reasons, (4) pricing information, and (5) number of workers.
ii. Second, the proposed rule would modify the collection of business ownership data and the formatting of data to conform with the "Defending Women" executive order, which requires the federal government to use "sex" rather than "gender" when administering sex-based distinctions, and to remove all communications "that promote or otherwise inculcate gender ideology." Aside from conforming to the use of "sex" rather than "gender," the proposal would remove references to and questions about "LGBTQI+"-owned businesses and require covered financial institutions to inform an applicant of the right to refuse to provide information about the ethnicity, race, or sex of the applicant business’ principal owners or about its women-, minority-, and LGBTQI+-owned business status.
5. Time and Manner of Data Collection
a. The proposed rule would modify § 1002.107(c): (1) to remove the prohibition on discouraging applicants from responding to requests for applicant-provided data; and (2) to remove related requirements to maintain procedures to obtain a response from the applicant, and (3) to monitor compliance with the anti-discouragement provision. The CFPB held that the prohibition and related requirements are overly complex and redundant, as covered financial institutions are already obligated to maintain systems reasonably designed to elicit responses. It would also modify the commentary to 1002.107(c) to provide compliance guidance, rather than imposing any obligations related to anti-discouragement.
6. Compliance Dates
a. Finally, the proposed rule would extend the rule’s compliance date to January 1, 2028 for all covered financial institutions, eliminating the previous "tiered" system that established different compliance dates for different institutions.
Furthermore, the CFPB’s proposed amendments cover two topics that are not included as formal proposals to modify Regulation B:
1. Privacy and Data Publication
a. The CFPB had previously discussed the publication of small business lending data and its privacy analysis related to such publication. For example, the CFPB suggested that it would take a year of data to conduct a privacy analysis before publishing the data, but that it may publish aggregated data before publishing data at the level of individual small business credit applications. However, it had not issued a definitive decision related to data publication or privacy-related issues. The proposal does not issue a definitive decision, but the CFPB announced that it would reconsider a number of issues and preliminary findings related to its privacy analysis, conveyance of its decision(s) related to privacy under Subpart B, the timeline for publication of application-level data, and publication of aggregate data.
2. Grace Period
a. In the original 2023 small business lending data collection final rule, the CFPB included a "Grace Period Policy Statement" stating that the CFPB would not assess penalties with respect to data submitted under Subpart B for the first 12 months after the various compliance dates in the original final rule. The CFPB announced its intention to maintain the 12-month grace period in its Grace Period Policy Statement and to alter the grace period to coincide with the new proposed compliance date (if finalized). In other words, the CFPB would not assess penalties with respect to small business lending data submitted from January 1, 2028 to January 1, 2029.
