Supporting Statement A

Status: Original and derived artifacts are available for this document.

Download: docx | pdf | html

SUPPORTING STATEMENT FOR
EQUAL CREDIT OPPORTUNITY ACT
(REGULATION B)
OMB CONTROL NUMBER: 3170-0013

JUSTIFICATION

1.  Explain the circumstances that make the collection of information necessary.  Identify any legal or administrative requirements that necessitate the collection.  Attach a copy of the appropriate section of each statute and regulation mandating or authorizing the collection of information.

The Equal Credit Opportunity Act (ECOA)1 implemented by the Consumer Financial Protection Bureau’s (CFPB) Regulation B0 makes it unlawful to discriminate against any applicant, with respect to any aspect of a credit transaction, on the basis of sex, marital status, race, color, religion, national origin, age, or other prohibited bases under ECOA.  To aid in implementation of this prohibition, the statute and regulation subject creditors to various mandatory disclosure requirements, notification provisions informing applicants of action taken on their credit applications, credit history reporting, monitoring rules, and recordkeeping requirements.  These requirements are triggered by specific events and creditors must provide disclosures within the time periods established by the statute and regulation.  These provisions are contained in subpart A of Regulation B (Sections 1002.1-1002.16).  
In 2010, Congress passed the Dodd-Frank Act (Dodd-Frank or the Act).  Section 1071 of that Act amended ECOA to require that financial institutions collect and report to the CFPB certain data regarding applications for credit for women-owned, minority-owned, and small businesses. Section 1071’s statutory purposes are to (1) facilitate enforcement of fair lending laws, and (2) enable communities, governmental entities, and creditors to identify business and community development needs and opportunities of women-owned, minority-owned, and small businesses. 
Section 1071 specifies a number of data points that financial institutions are required to collect and report, and also provides authority for the CFPB to require any additional data that the CFPB determines would aid in fulfilling section 1071’s statutory purposes.  Section 1071 also contains a number of other requirements, including those that address restricting the access of underwriters and other persons to certain data, recordkeeping, and publication of small business lending data.  Additionally, section 1071 permits the CFPB to modify or delete data prior to publication if it determines that such a deletion or modification would advance a privacy interest.  Section 1071 is implemented in subpart B of Regulation B (Sections 1002.101-1002.114), which the CFPB published in 2023. 
Recordkeeping and Reporting Requirements
Subpart A
Section 1002.12(b) of Regulation B requires creditors to retain records relating to consumer credit applications for 25 months from the date that the applicant is notified of the action taken on the application or, where notice is not required, for 25 months from the date of the application.  When a creditor takes adverse action on an existing account, the creditor must retain records for 25 months after the applicant is notified of the action taken.  Records of business credit applications generally must be retained for 12 months, with certain exceptions. Regulation B also requires creditors who have been informed that they are the subject of an investigation regarding their compliance with ECOA to retain such records until the agency or a court informs them that retention is no longer necessary.  Regulation B also requires creditors to retain certain prescreened solicitation materials for 25 months after the date on which an offer of credit is made to potential customers (12 months for business credit, with certain exceptions).  Moreover, Regulation B requires creditors to retain all written or recorded information about a self-test (including corrective action), as defined in Section 1002.15 of Regulation B, for 25 months after a self-test has been completed (and longer under some circumstances). 
Section 1002.13 of Regulation B requires that creditors who receive applications for certain mortgage credit requests, as part of the application process, obtain information about the applicant’s ethnicity, race, sex, marital status, and age.  The applicant is asked but not required to supply the information.  If the applicant chooses not to provide the information or any part of it, the creditor must note that fact on the form and must note the applicant’s race/national origin and sex, to the extent that it is possible to determine these characteristics based on a visual observation or a surname.  The creditor is required to inform the applicant that the information is sought by the federal government to help monitor compliance with federal statutes that prohibit creditors from discriminating against applicants based on the above-noted factors.
	Subpart B
Subpart B of Regulation B contains recordkeeping requirements and collections of information regarding certain applications for credit for small businesses. 
Section 1002.107 addresses several aspects of collecting data on covered applications from small businesses.  Section 1002.107(a) requires covered financial institutions to compile and maintain the data points enumerated in section 1002.107(a)(1) through (20).  Under this final rule, the CFPB is  removing five of these data points and making modifications to others.  These data points must be collected and reported in accordance with the rule and the Filing Instructions Guide that the CFPB will provide for the appropriate filing year.  Certain of these data points are or could be collected from the applicant (or otherwise determined based on information from appropriate third-party sources), such as gross annual revenue.  Other data points are based on information within the financial institution’s control.
Section 1002.109 addresses several aspects of covered financial institutions’ obligations to report small business lending data to the CFPB.  First, section 1002.109(a) provides that data must be collected on a calendar year basis, compiled in a small business lending application register in a format prescribed by the CFPB, and submitted to the CFPB on or before June 1 of the following year.  Section 1002.109(a) also addresses collection and reporting requirements of subsidiaries of financial institutions and reporting requirements of financial institutions where multiple financial institutions are involved in a single covered credit transaction.  Second, section 1002.109(b) lists the information that financial institutions are required to provide about themselves when reporting data to the CFPB.
Section 1002.111 addresses several aspects of the recordkeeping requirements for small business lending data.  First, section 1002.111(a) requires a covered financial institution to retain evidence of compliance with subpart B, which includes a copy of its small business lending application register (the covered financial institution’s submission of data to CFPB), for at least three years after the register is required to be submitted to the CFPB pursuant to Section 1002.109.  Second, section 1002.111(b) requires a covered financial institution to maintain, separately from the rest of an application for credit and accompanying information, an applicant’s responses to a financial institution’s inquiries regarding the applicant-provided data points on the demographics of the applicant’s ownership, which addresses (i) pursuant to revisions of section 1002.107(a)(18), whether the applicant is a minority-owned or women-owned business, and (ii) pursuant to section 1002.107(a)(19), the ethnicity, race, and sex of the applicant’s principal owners (collectively, an applicant’s “protected demographic information”).  
Finally, section 1002.111(c) requires that, in reporting its small business lending application register, as well as the separately maintained protected demographic information pursuant to section 1002.111(b), a financial institution may not include any personally identifiable information concerning any individual who is, or is connected with, an applicant.
Disclosure
Subpart A
Section 1002.9 of Regulation B requires creditors to notify an applicant of action taken within specified time periods.  A notification given to a consumer credit applicant when adverse action is taken must be in writing, whereas a business credit applicant may be notified of the action taken orally or in writing.  An adverse action notification must generally contain: a statement of the action taken; the name and address of the creditor; a statement describing the antidiscrimination provisions of ECOA; the name and address of the federal agency that administers compliance with ECOA and Regulation B as to the creditor; and either a statement of specific reasons for the action taken or a notice of the applicant’s right to obtain such a statement. 
In part, section 1002.10 of Regulation B requires creditors that furnish credit information to consumer reporting agencies to designate new accounts to reflect the participation of both spouses, if the applicant’s spouse is permitted to use or is contractually liable on the account. 
Section 1002.13(c) of Regulation B requires the creditor to inform the applicant that ethnicity, race, sex, marital status, and age are being requested by the Federal government for the purpose of monitoring compliance.  The creditor shall also inform the applicant that he or she has the option of not providing the information, and that if the applicant chooses to not provide it, the creditor is required to note it by visual observation or surname. 
In connection with a credit application that is to be secured by a first lien on the dwelling, section 1002.14 of Regulation B requires that creditors provide applicants a copy of the appraisal report or other written valuation prepared in connection with an application.  The material must be furnished free of charge and promptly upon completion, or no later than three business days prior to consummation of the transaction (closed-end credit) or account opening (open-end credit), whichever is earlier. 
Under section 1002.5(b) and 1002.15 of Regulation B, creditors that collect applicant characteristics for purposes of conducting a self-test under Regulation B must disclose, orally or in writing:
(i) The applicant will not be required to provide the information;
(ii) The creditor is requesting the information to monitor its compliance with the Federal Equal Credit Opportunity Act;
(iii) Federal law prohibits the creditor from discriminating on the basis of this information, or on the basis of an applicant's decision not to furnish the information; and
(iv) If applicable, certain information will be collected based on visual observation or surname if not provided by the applicant or other person.
Subpart B 
Subpart B contains disclosure requirements for certain small business lending applications.
Section 1002.107 identifies the data points that must be collected and reported by covered financial institutions for covered applications from small businesses.  When requesting an applicant’s protected demographic information, a financial institution must inform the applicant that (i) the financial institution cannot discriminate on the basis of this protected demographic information, (ii) the applicant has a right to refuse to provide this information, and that (iii) Federal law requires it to ask for an applicant’s protected demographic information to help ensure that all small business applicants for credit are treated fairly and that communities’ small business credit needs are being fulfilled. 

Section 1002.108 implements section 1071’s requirement that an applicant’s protected demographic information collected pursuant to section 1071 be shielded from employees and officers involved in making determinations regarding applications for credit, if feasible; the CFPB refers to this as the “firewall.”  However, if the financial institution determines that certain persons should have access to protected demographic information, access is permissible if the financial institution provides a notice to the applicant regarding that access.  The notice must be provided to each applicant whose information will be accessed or, alternatively, the financial institution may also provide the notice to all applicants, including those whose responses will not or might not be accessed.  The CFPB provides sample language that a financial institution can, but is not required to, use in this notice.

Section 1002.110(c) requires a covered financial institution to publish on its website a statement that its small business lending data, as modified by the CFPB, are or will be available from the CFPB.  Section 1002.110(d) sets forth when a covered financial institution shall make this statement available and how long the financial institution shall maintain the statement on its website.  These requirements satisfy financial institutions’ statutory obligation to make data available to the public upon request.

2.  Indicate how, by whom, and for what purpose the information is to be used.  Except for a new collection, indicate the actual use the agency has made of the information received from the current collection.

Subpart A
The CFPB and other agencies use recordkeeping information to help identify unlawful discouragement or discrimination on the basis of race, sex, age, or other prohibited bases under ECOA.  Voluntarily collected self-test records (including for corrective action) are used by creditors to identify potential violations and reflect their efforts to correct the problem.  Absent the Regulation B requirement that creditors retain monitoring information, the agencies’ ability to detect unlawful discrimination and enforce the ECOA would be significantly impaired. 
The adverse action notice requirement apprises applicants of their rights under ECOA and of the basis for a creditor’s decision.  Applicants use their copy of the appraisal to review (and possibly challenge) the accuracy and/or fairness of the information contained within, and to determine the role that the appraisal played in the credit decision.  The self-testing disclosure explains to applicants why a creditor is collecting information and clarifies that applicants are not required to provide the information. 
Subpart B 
Users of the data resulting from the information collection requirements of subpart B of Regulation B—including the CFPB, other federal agencies charged with enforcing ECOA and other fair lending laws, applicants for credit, communities, governmental entities, and creditors—will use the data to advance section 1071’s statutory purposes, which are to (1) facilitate enforcement of fair lending laws, and (2) enable communities, governmental entities, and creditors to identify business and community development needs and opportunities of women-owned, minority-owned, and small businesses.  The provisions of subpart B will significantly enhance the ability of these individuals and entities to enforce fair lending laws and identify business and community development needs and opportunities. 
The CFPB, other federal agencies, applicants for credit, communities, governmental entities, and creditors will be able to use recordkeeping information to determine whether covered financial institutions have complied with the data collection requirements of subpart B.  The recordkeeping requirements will significantly enhance the ability of these individuals and entities to determine compliance with subpart B.
The notice requirements of section 1002.107(a)(18) and (19) will apprise applicants that the financial institution cannot discriminate on the basis of protected demographic information provided by applicants, and that Federal law requires it to ask for an applicant’s protected demographic information to help ensure that all small business applicants for credit are treated fairly and that communities’ small business credit needs are being fulfilled. Changes to section 1002.107(a)(18) and (19) will also emphasize that applicants have a right to refuse to provide this information.

The “firewall” notice requirements of section 1002.108(c) and (d) will apprise applicants that underwriters and certain other persons have access to the applicant’s protected demographic information (where applicable). 
The notice requirement of section 1002.110(c) and (d) will appraise a person who wishes to access the small business lending data of a covered financial institution that the institution’s data, as modified by the CFPB, are or will be available from the CFPB. 
3.  Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses, and the basis for the decision for adopting this means of collection.  Also, describe any consideration of using information technology to reduce burden.

Subpart A 
The disclosures required by subpart A of Regulation B may be provided to the consumer in electronic form, subject to compliance with the consumer consent and other applicable provisions of the Electronic Signatures in Global and National Commerce Act (E-Sign Act), 15 U.S.C. 7001 et seq.  Use of such electronic communications is consistent with the Government Paperwork Elimination Act (GPEA), Title XVII of Pub. L. 105-277, codified at 44 U.S.C. 3504 note.  The E-Sign Act and GPEA serve to reduce businesses’ compliance burden related to federal requirements, including Regulation B, by enabling creditors to utilize more efficient electronic media for disclosures and compliance.
Regulation B also permits creditors to retain records on any method that reproduces records accurately, including digitally.  Creditors need only retain enough information to reconstruct the required disclosure or other records.  Most creditors use technology solutions to calculate the required information and generate the mandated disclosures, thereby limiting the burden on these entities.  
Subpart B 
The rule requires covered financial institutions to submit small business lending data in electronic form.  The CFPB is developing a system to receive, process, and publish the data collected pursuant to subpart B.  In doing so, the CFPB will benefit from what it learned in its multiyear effort in developing the Home Mortgage Disclosure Act (HMDA) Platform, through which entities file data as required under the HMDA and Regulation C.  As it did in developing the HMDA Platform, the CFPB’s work in developing the small business loan data submission system will focus on satisfying all legal requirements, promoting data accuracy, and reducing burden.  Also as with HMDA, the CFPB is providing a Filing Instructions Guide and related materials for financial institutions.
4.  Describe efforts to identify duplication.  Show specifically why any similar information already available cannot be used or modified for use for the purposes described in Item A.2 above.

Subpart A 
For the most part, the information collections in subpart A of Regulation B do not duplicate other regulations.  There is some overlap with the Fair Credit Reporting Act (FCRA) for disclosure and retention of certain information, but they focus on populations which are not necessarily the same, and Regulation B is necessary to avoid circumvention of ECOA by creditors.  Additionally, there is some overlap with HMDA for collection of certain information, although in 2017 the CFPB updated Regulation B to ensure consistency among regulations and facilitate compliance with Regulation B and Regulation C by financial institutions.
The appraisals information collection does duplicate, in part, two other Federal requirements. Specifically, the information collection requirement duplicates in part the Truth in Lending Act (TILA) requirement to provide free copies of written appraisals for higher-risk mortgages.  See 15 U.S.C. 1639(h).  In addition, the requirement also duplicates in part the National Credit Union Administration’s (NCUA) regulation requiring national credit unions to provide copies of appraisal reports to loan applicants upon request.  See 12 CFR 701.31(c)(5).  However, where Regulation B and a duplicative requirement apply, a creditor need only provide an applicant one copy of each appraisal and other written valuation to comply with all TILA, ECOA, and the NCUA requirements in order to minimize burden.
Subpart B 
The information collections of subpart B overlap to some extent with several regulations.  The primary sources of information on small business lending by depository institutions are the Federal Financial Institutions Examination Council (FFIEC) and NCUA Consolidated Reports of Condition and Income (Call Reports), as well as reporting under the Community Reinvestment Act (CRA).  Under the FFIEC and CRA reporting regimes, small loans to businesses of any size are used in whole or in part as a proxy for loans to small businesses.  The FFIEC Call Report captures banks’ outstanding number and amount of small loans to businesses (that is, loans originated under $1 million to businesses of any size; small loans to farms are those originated under $500,000).  The CRA currently requires banks and savings associations with assets over a specified threshold to report loans in original amounts of $1 million or less to businesses; reporters are asked to indicate whether the borrower’s gross annual revenue is $1 million or less if they have that information.  The NCUA Call Report captures data on all loans over $50,000 to members for commercial purposes, regardless of any indicator about the business’s size.   The Small Business Administration also releases data concerning its loan programs, but these typically do not include demographic information, and this covers only a small portion of the overall small business financing market.
However, the information collections of subpart B to Regulation B differ in important respects from existing regulations.  First, subpart B collects data from new categories of lenders, including some smaller banks and non-depositories, not covered by current regulations.  Second, subpart B involves the publication of application-level and loan-level data; FFIEC and NCUA Call Reports and the CRA data are all available at a higher level of aggregation than loan-level, limiting fair lending and detailed geographic analyses since race, sex, and ethnicity as well as business location data are rarely disclosed.  Third, unlike subpart B, existing Federal regulations do not require the collection of certain data, such as information regarding applications.  Finally, other Federal regulations do not standardize small business lending data across agencies; as such, this data cannot be easily compared.  For example, the FFIEC Call Report collects small loans to businesses as a proxy for small business lending, whereas the NCUA Call Report collects loans to members for commercial purposes above $50,000 but with no upper limit. There are no similar sources of information about lending to small businesses by other non-depository institutions. 
The CFPB has attempted to minimize the challenges, complexity, and duplication of effort, as well as potential errors in the data.  In some instances, duplicate reporting has been eliminated—subpart B does not require the reporting of any HMDA-reportable applications.  The CFPB is also excluding agricultural loans, as well as loans made by Farm Credit System (FCS) lenders. (The FCS call reports capture aggregated information about the financial operations of FCS institutions, including their lending activities to young, beginning, and small farmers.)  Additionally, the CFPB attempted wherever possible (i.e., consistent with its statutory authorities) to borrow concepts or structures from other rules, such as the Financial Crimes Enforcement Network’s customer due diligence rule.  
5.  If the collection of information impacts small businesses or other small entities, describe any methods used to minimize burden.

Subpart A 
ECOA and subpart A of Regulation B accord special treatment to creditors that receive fewer than 150 applications each year.  Section 1002.9(d) of Regulation B states that such creditors may provide required notices to rejected applicants orally rather than in writing.  Where fewer written records are required to be created, the recordkeeping burden is correspondingly reduced. Additionally, section 1002.3(c) of Regulation B exempts providers of incidental credit, such as a doctor or lawyer who allows a patient or client to defer payment of a bill, as well as public utilities credit and securities credit, from many requirements including notifications under section 1002.9 of Regulation B and recordkeeping.  Additionally, as noted above, the CFPB has taken steps to minimize the situations in which creditors would need to provide copies of multiple versions of the same appraisal or other written valuation.
Subpart B 
Several provisions of subpart B help to minimize burden on smaller entities. 
Revisions to section 1002.104(b) exclude merchant cash advances, agricultural lending, and small dollar loans from the definition of covered credit transaction.
Revisions to section 1002.105(b) define the term covered financial institution as a financial institution that originated at least 1,000 covered credit transactions for small businesses in each of the two preceding calendar years and also exclude FCS lenders.  Only financial institutions that meet this loan-volume threshold are required to collect and report small business lending data under subpart B, including the specific information collection, recordkeeping, and disclosure requirements discussed above.  The CFPB believes that under this revision, smaller financial institutions are more likely to be exempt from any reporting obligations.  
Revisions to section 1002.106(b) define a business as small if its gross annual revenue for its preceding fiscal year is $1 million or less. The current provision states that a business is small if its gross annual revenue for its preceding fiscal year is $5 million or less. 
Revisions to section 1002.107(a), which identifies the data points that covered financial institutions must report to the Bureau, remove several data points from the rule, including application method, application recipient, denial reasons, pricing information, and number of workers, as well as LGBTQI+-ownership status and disaggregated race and ethnicity data for small business applicants’ principal owners. 
Section 1002.107(b) states that unless otherwise provided in subpart B, the financial institution may rely on statements of the applicant when compiling data unless it verifies the information provided, in which case it would be required to collect and report the verified information.  Requiring verification of applicant-provided data points would greatly increase the operational burden of the rule, and the CFPB believes that relying on applicant-provided data will ensure sufficient accuracy to carry out the purposes of section 1071.  However, requiring financial institutions to collect and report information that they have already verified will not add operational difficulty and will enhance the accuracy and usefulness of the data, thereby furthering the purposes of section 1071.
Section 1002.107(d) permits, but does not require, a financial institution to reuse previously collected data to satisfy section 1002.107(a)(13) through (15) and (17) through (20) if the data were collected within the applicable time frame (set forth below) and the financial institution has no reason to believe the data are inaccurate.  To satisfy paragraphs (a)(13), (15), and (17) through (20) of this section, the data must have been collected within the 36 months preceding the current covered application.  To satisfy paragraph (a)(14) of this section, the data must have been collected within the same calendar year as the current covered application.  The CFPB believes that, absent a reason to suspect otherwise, recently collected data are likely to be reliable.  Additionally, the CFPB believes that a flexible approach giving financial institutions discretion to reuse these data is consistent with helping facilitate compliance by small entities. 
Section 1002.110(c) requires that a covered financial institution make available to the public on its website, or otherwise upon request, a statement that the covered financial institution’s small business lending application register, as modified by the CFPB pursuant to section 1002.110(a), is or will be available from the CFPB.  The reasons for this approach are discussed in the 2023 final rule, including that this approach will reduce burdens on financial institutions associated with publishing modified data, will reduce privacy risks resulting from errors by individual financial institutions implementing any modifications or deletions required by the CFPB, and will be more efficient overall. 
Subpart B provides a sample form that covered financial institutions may use to help them comply with the rule’s requirements.
6.  Describe the consequence to federal program or policy activities if the collection is not conducted or is conducted less frequently, as well as any technical or legal obstacles to reducing burden. 

Subpart A 
If the notification of action taken requirement were eliminated, applicants could be deprived of the right to receive timely notice of the creditor’s decision, the reasons for any adverse action by the creditor, and notification of the applicants’ rights under ECOA.  Eliminating the requirement that creditors provide a copy of the appraisal report or notice of its availability would greatly impair applicants’ ability to assess the valuation’s impact on the creditor’s decision and to challenge it in a timely fashion.  Eliminating or changing the requirement to collect information about an applicant’s protected characteristics would impair the ability of the CFPB and others seeking to enforce compliance with ECOA to take action against creditors that may engage in unlawful discrimination.  Eliminating the self-test disclosure (which can be made orally or in writing) could disadvantage consumers who may then not understand the purpose of the information being collected, or their option not to provide it.  Finally, eliminating the credit history reporting requirement regarding spouses with shared accounts would undermine the goal of affording both spouses the benefit of that shared credit history in seeking further credit.
The current record retention period of 25 months supports the need for sufficient time to bring enforcement actions regarding ECOA issues.  If the retention period were shortened, applicants who sue under ECOA, and administrative agencies that enforce ECOA, might find that the records needed to prove ECOA violations no longer exist.
This information is not collected by the federal government.  The burdens on respondents are the minimum necessary to comply with the statute, and to assist borrowers in obtaining information with respect to application decisions. 
Subpart B
Were the requirement that financial institutions provide notice when underwriters or other employees or officials have access to applicants’ protected demographic information eliminated, applicants would be deprived of the right to receive timely notice that their protected demographic information was being accessed, and that the use of such information in making a credit decision is impermissible.  Eliminating the requirement that a financial institution must provide the public on its website, or otherwise upon request, a statement that the covered financial institution’s small business lending application register, as modified by the CFPB, is or will be available from the CFPB would make it more difficult for individuals and entities to use small business lending data to facilitate fair lending enforcement, or better identify business and community development needs and opportunities.  
Were the requirement that financial institutions collect data on the applications for credit by small businesses (including protected demographic information regarding the minority-owned or women-owned status of the applicant, and the ethnicity, race and sex of the principal owners of the applicant) eliminated or changed, the CFPB and others seeking to enforce fair lending laws and to identify business and community development needs and opportunities would not have that information and would thereby be disadvantaged in taking action against that creditor. 
The record retention period of 3 years after the submission of small business lending data to the CFPB supports the need for sufficient time to determine compliance with the requirements of the rule.  If the retention period were shortened, applicants for credit, and administrative agencies that enforce ECOA, might find that the records needed to prove ECOA violations no longer exist.
The burdens on respondents are the minimum necessary to comply with the statute, and to assist borrowers in obtaining information with respect to application decisions.
7.  Explain any special circumstances that would cause an information collection to be conducted in a manner:
    • requiring respondents to report information to the agency more often than quarterly;
    • requiring respondents to prepare a written response to a collection of information in fewer than 30 days after receipt of it;
    • requiring respondents to submit more than an original and two copies of any document;
    • requiring respondents to retain records, other than health, medical, government contract, grant-in-aid, or tax records for more than three years;
    • in connection with a statistical survey, that is not designed to produce valid and reliable results that can be generalized to the universe of study;
    • requiring the use of statistical data classification that has not been reviewed and approved by OMB;
    • that includes a pledge of confidentially that is not supported by authority established in statute or regulation, that is not supported by disclosure and data security policies that are consistent with the pledge, or which unnecessarily impedes sharing of data with other agencies for compatible confidential use; or
    • requiring respondents to submit proprietary trade secret, or other confidential information unless the agency can demonstrate that it has instituted procedures to protect the information's confidentially to the extent permitted by law.

Subpart A

The collections of information in these rules are consistent with the applicable guidelines contained in 5 CFR 1320.5(d)(2).  

Subpart B 
Section 1002.107(a) requires respondents to submit potentially confidential information.  Under ECOA section 704B(e)(4), Congress provided the CFPB with broad discretion to modify or delete data prior to public disclosure to advance privacy interests, and the CFPB is committing to conducting a notice-and-comment rulemaking to consider how it might implement this discretion in the future.  The data that are not modified or deleted will be made available to the public and are subject to this rule’s recordkeeping requirements.  The rest of the data will be considered confidential if the information: 

    • Identifies any applicants or natural persons who might not be applicants (e.g., owners of a business where a legal entity is the applicant); or
    • Implicates the relevant privacy interests of applicants, related natural persons, or financial institutions.
8.  If applicable, provide a copy and identify the date and page number of publication in the Federal Register of the agency's notice, required by 5 CFR 1320.8(d), soliciting comments on the information collection prior to submission to OMB.  Summarize public comments received in response to that notice and describe actions taken by the agency in response to these comments.  Specifically address comments received on cost and hour burden.

Describe efforts to consult with persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping, disclosure, or reporting format (if any), and on the data elements to be recorded, disclosed, or reported.

Consultation with representatives of those from whom information is to be obtained or those who must compile records should occur at least once every 3 years -- even if the collection-of-information activity is the same as in prior periods.  There may be circumstances that may preclude consultation in a specific situation.  These circumstances should be explained

In accordance with 5 CFR 1320.8(d)(1), on November 13, 2025 the Bureau published a notice of proposed rulemaking in the Federal Register that provided the public an opportunity to comment on its proposed amendments to subpart B of Regulation B and associated information collections.0  The comments received are summarized in the final rule. 

One commenter noted that the Bureau should have published a 60-day PRA notice. The Bureau believes that its notice was sufficient. This commenter also stated that the Bureau did not adequately update the collection burden analysis after having altered key parameters that affect respondent burden. The Bureau updated burden estimates of the collection requirements in accordance with the burden estimation presented in part VI of the final rule.
 	 	 	 	 	 
9.  Explain any decision to provide any payments or gifts to respondents, other than remuneration of contractors or grantees.
 
The Bureau will not provide neither payments nor gifts to respondents. 
 
10. Describe any assurance of confidentiality provided to respondents and the basis for the assurance in statute, regulation, or agency policy.
 
Subpart A
Some recordkeeping requirements contain private information about credit applicants.  Such information is protected by the Right to Financial Privacy Act, 12 U.S.C. 3401 et seq.  Subpart A does not mandate information collection by the CFPB; this information is used exclusively to ensure compliance with ECOA and that creditors are not discriminating against applicants.
To the extent that information covered by a recordkeeping requirement is “confidential information” pursuant to 12 CFR 1070.2(f), the confidentiality provisions of the CFPB’s rules on Disclosure of Records and Information, 12 CFR Part 1070, would apply.
Subpart B
Some of the information collection and recordkeeping requirements contain private information about the small business applicants for credit.  Section 1002.111(c) requires that, in reporting small business lending data to the CFPB pursuant to section 1002.109, a financial institution cannot include any name, specific address, telephone number, email address, or any other personally identifiable information concerning any individual who is, or is connected with, an applicant, other than as required pursuant to section 1002.107 or section 1002.111(b).  Further, section 1002.110(e) prohibits financial institutions and third parties from sharing protected demographic information collected under subpart B with third parties unless to further compliance with ECOA/Regulation B or as required by law.  
11. Provide additional justification for any questions of a sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private.  This justification should include the reasons why the agency considers the questions necessary, the specific uses to be made of the information, the explanation to be given to persons from whom the information is requested, and any steps to be taken to obtain their consent.

Subpart A

Sensitive information asked of applicants by creditors is either (for example) mandated for mortgage loan applications or optionally used for self-tests.  The information collected is used to ensure compliance with ECOA, and that creditors are not discriminating against applicants. 

Subpart B
The sensitive information asked of applicants is mandated by Congress for applications for credit from small businesses.  The information collected is to be used to (1) facilitate enforcement of fair lending laws and (2) enable communities, governmental entities, and creditors to identify business and community development needs and opportunities of women-owned, minority-owned, and small businesses. 
Subpart B requires that financial institutions, in reporting their small business lending application registers, not submit any name, specific address, telephone number, email address or any personally identifiable information concerning any individual who is, or is connected with, an applicant, other than as required pursuant to section 1002.107 or section 1002.111(b).  Revisions to subpart B remove data on LGBTQI+-ownership status and disaggregated race and ethnicity data for principal owners.
Nonetheless, publication of the data collected and reported pursuant to section 1002.107(a) in an unedited, application-level format could potentially affect the privacy interests and lead to the re-identification of, and risk of harm to, small businesses, related natural persons, and financial institutions.
Section 1071 states that the CFPB may, “at its discretion, delete or modify data collected under [section 1071] which is or will be available to the public, if the Bureau determines that the deletion or modification of the data would advance a privacy interest.” 15 U.S.C. 1691c-2(e)(4). 
The CFPB has not made a final decision on the best way to protect privacy interests through pre-publication modification and deletion of reported data.  The CFPB is committing in the final rule to conduct a notice-and-comment rulemaking to consider how to best to protect privacy interests, including by modification or deletions prior to publication, likely after receiving a full year’s worth of data to conduct the necessary privacy analysis. 
12.  Provide estimates of the hour burden of the collection of information.  The statement should:
    • Indicate the number of respondents, frequency of response, annual hour burden, and an explanation of how the burden was estimated.  Unless directed to do so, agencies should not conduct special surveys to obtain information on which to base hour burden estimates.  Consultation with a sample (fewer than 10) of potential respondents is desirable.  If the hour burden on respondents is expected to vary widely because of differences in activity, size, or complexity, show the range of estimated hour burden, and explain the reasons for the variance.  General, estimates should not include burden hours for customary and usual business practices.
    • If this request for approval covers more than one form, provide separate hour burden estimates for each form.
    • Provide estimates of annualized cost to respondents for the hour burdens for collections of information, identifying and using appropriate wage rate categories.  The cost of contracting out or paying outside parties for information collection activities should not be included here.  Instead, this cost should be included in Item 14.





The CFPB shares enforcement authority with other federal agencies for those non-depository institutions subject to the CFPB’s Regulation B.  The CFPB estimates about 12,000 depository institutions and assumes the burden of 167 depository institutions with more than $10 billion in assets.  Approximately 197,600 of the total 494,000 potential respondents are institutions over whom the CFPB has purview.

To calculate labor costs, the CFPB applies a market rate of $31 (the rounded hourly mean wage for loan officers from BLS).  Staff anticipates that the above requirements necessitate ongoing, regular training so that lenders stay current and have a clear understanding of federal mandates.  This training would be a small portion of the ordinary training that employees receive apart from that associated with collecting information toward comply with Regulation B.

To calculate labor costs for subpart B, CFPB calculated the average number of hours for senior staff, mid-level staff, and junior staff and assigned hourly wages using percentiles for “loan officers” from BLS to arrive at an average hourly wage of $57.0

13.  Provide an estimate of the total annual cost burden to respondents or record keepers resulting from the collection of information.  (Do not include the cost of any hour burden shown in Items 12 and 14).

Many lenders generally have some necessary equipment for other business purposes.  The additional one-time costs associated with coming into compliance with subpart B of Regulation B, subject to the finalized amendments, are detailed below.  The CFPB assumes that an institution will have to hire additional staff to comply with the rule on an ongoing basis.  The CFPB estimates the one-time hiring costs for the additional staff an institution expects to hire based on the number of applications the institution expects to receive each year.  The CFPB believes that the cost of printing and copying needed to comply with Regulation B is minimal, as many disclosures can be sent electronically.  Additional ongoing costs are detailed below.
Final Rule Estimated Total Annual Cost Burden to All CFPB Respondents or Recordkeepers 
Annualized One-time Costs
Description of Costs- Operations and Maintenance (O&M)
Per Unit Costs
Number of Reporters
Total Costs
Non-salary one-time expenses and one-time hiring expenses



       Depository Institutions
$53,983
170 
$9,177,110
       Nondepository Institutions
$31,046
31
$962,426
Total One-Time Costs (O&M) 				$10,139,536

Ongoing Costs

Description of Costs (O&M)
Per Unit Costs
Number of Reporters
Total Costs
Non-salary ongoing expenses:
    • Data Management software
    • External audit costs



       Type A Institution
$4,410
0 
$0
       Type B Institution
$16,380

0 
$0
       Type C Institution
$17,199
200
$3,439,800
LEI
$200
30
$6,000
Total Ongoing Costs (O&M) 		$3,445,800
Total Costs (O&M) - $13,602,535

14.  Provide estimates of the annualized cost to the Federal Government.  Also, provide a description of the method used to estimate cost, which should include quantification of hours, operational expenses (such as equipment, overhead, printing, and support staff), any other expense that would not have been incurred without this collection of information.  Agencies also may aggregate cost estimates from Items 12, 13, and 14 into a single table. 	 

Subpart A
As the CFPB does not collect any information under subpart A, there are no costs to the CFPB associated with this information collection.
Subpart B  
The estimated one-time cost to the Federal government to develop software for data submission, edit checks, communication with reporters, and geocoding is $13.5 million.0
15.  Explain the reasons for any program changes or adjustments.

The Bureau is finalizing certain program changes to this information collection.  Therefore, the Bureau is adjusting the burden estimate of this collection.  Specifically, the number of responses decreased from 269,041,540 to 269,037,000 (a decrease of 0.002%).  The reduction is attributable to changes to the coverage under Regulation B, subpart B, of (i) the number of financial institutions and (ii) the number of applications for credit.  There is also a decrease of the annual time burden from 9,603,625 to 5,921,957 hours (a decrease of 38%).   

16.  For collections of information whose results will be published, outline plans for tabulations, and publication.  Address any complex analytical techniques that will be used.  Provide the time schedule for the entire project, including beginning and ending dates of the collection of information, completion of report, publication dates, and other actions.
 
Subpart A

There are no plans to provide any publications based on the information collection of this regulation. 

Subpart B 
The information will be collected for use by the CFPB’s examination and enforcement programs, for disclosure to other federal and state government agencies subject to appropriate confidentiality protections, and for disclosure to the public after deletion or modification of certain sensitive data elements. 
17.  If seeking approval to not display the expiration date for OMB approval of the information collection, explain the reasons that display would be inappropriate.

The OMB control number and expiration date associated with this Paperwork Reduction Act (PRA) submission will be displayed on the Federal government’s electronic PRA docket at www.reginfo.gov, as well as on the relevant information collection instruments. 
 
18.  Explain each exception to the certification statement.

The CFPB certifies that this collection of information is consistent with the requirements of 5 CFR 1320.9, and the related provisions of 5 CFR 1320.8(b)(3) and is not seeking an exemption to these certification requirements.