Within a little less than four weeks after the publication on March 30, by the Consumer Financial Protection Bureau (CFPB) of its nearly 900-page final rule related to small business data collection (the Final Rule) mandated by Section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the Dodd-Frank Act), the Texas Bankers Association and Rio Bank filed suit in federal court in Texas against the CFPB and the agency's director. The lawsuit was amended on May 14, when the American Bankers Association joined as a named plaintiff (the Amended Complaint). The lawsuit sets forth the plaintiffs' challenge to the Final Rule and seeks a judgment that the Final Rule is unlawful.

Section 1071 of the Dodd-Frank Act

At its heart, Section 1071 requires certain financial institutions (generally defined in the Final Rule as those lenders that originate at least 100 covered transactions in each of the two preceding calendar years) to inquire as to whether a commercial credit applicant is "women-owned, minority-owned, or small business" and to submit this data (which includes less than a dozen specific credit data points to be obtained in connection with the credit application) to the CFPB. (Note that the Final Rule defines "covered transactions" to include loans, lines of credit, credit cards, merchant cash advances, and other credit products used primarily for agricultural, business, or commercial purposes.) Although seemingly limited in prescribed scope based upon the statutory language in Dodd Frank, the Final Rule requires covered financial institutions to "comply with over 80 reporting requirements that have exponentially grown by the CFPB" since the Dodd-Frank Act was passed.

Bases for the Complaint

As set forth in the CFPB's Small Entity Compliance Guide for the Small Business Lending Rule (Guide), the Final Rule requires covered financial institutions to "maintain procedures reasonably designed to collect applicant-provided information, which includes the applicant's minority-owned, women-owned, and LGBTQI+-owned businesses" and to annually report data obtained through such processes to the CFPB. The Guide also provides that "[a] low response rate for applicant-provided data may indicate discouragement or a failure by a covered financial institution to maintain procedures reasonably designed to obtain a response to a request for applicant-provided data."

In the Amended Complaint, the plaintiffs assert that compliance with the Final Rule will "drive smaller providers from the [smaller commercial credit] market, causing a decrease in the products available to all customers including minority and women-owned small businesses." Specifically, the plaintiffs contend that those entities covered by the Final Rule will need to undertake a myriad of compliance activities to achieve compliance with the Final Rule's requirements, including "selecting new computer software . . .; training employees; and hiring outside managers for the implementation of the information collection, report preparation, intra-company segmentation procedures, and overall privacy protection needed to safeguard the extensive accumulation of personal, demographic, and sexual orientation data mandated" by the Final Rule. In total, the plaintiffs allege that this will cause covered financial institutions to incur "alarming costs."

The plaintiffs raise numerous issues in connection with the adoption of the Final Rule, including that the agency's "cost-benefit analysis" was "incomprehensible." To support this assertion, the complaint notes that the CFPB self-described its methodology in the following manner: "In particular, we use Bayesian independent univariate conditional multiple ordinary least squares (OLS) regression model. We can use a Bayesian multiple OLS regression model because the data are missing at random (MAR). We need to impute data for multiple variables, origination number and dollar volume. Because the missing variables are monotone, we can use an independent univariate conditional model to generate the multivariate imputations." The plaintiffs contend that such explanation is both "indecipherable" and that it fails to "account for the higher proportion of small business loans generated by rural, small and other community banks."

The Amended Complaint also asserts that the CFPB failed to consider numerous comment letters, including one filed by the US Small Business Administration.

Additionally (and as expected given the current state of the circuit split on the matter), the Amended Complaint also asserts that the CFPB is unconstitutional based upon the appropriations it receives to operate, predicated in the pending US Supreme Court hearing of CFPB v. Community Financial Services Assn. (5th Circuit, October 19, 2022), which will be argued during the US Supreme Court's 2023-2024 term.

Analysis

The decision to file the case in federal court in Texas by the oldest bankers association in the United State (the Texas Bankers Association) and a minority-owned insured depository institution with only $900 million in assets demonstrates an intentionality in the filing of the suit (as the amended complaint relies, in part, upon an argument about the alleged economic damage that compliance with the Final Rule will impose on smaller insured depository institutions). Moreover, the plaintiffs' arguments incorporate certain bases for the claims that a court likely cannot ignore, including the failure to consider comments provided by another federal agency (the US Small Business Administration) that is charged with monitoring the economic health of small businesses in the United States.

While this case raises concerns throughout the US banking industry (notably, the American Bankers Association has joined as a named plaintiff), it is notable that other industry participants believe the Final Rule did not go far enough. Case in point: the National Community Reinvestment Coalition's report on the Final Rule notes that the "[commercial credit] industry regularly expresses . . . overblown concerns [about compliance costs and their potential exit from the small business market], which are not supported by rigorous data analysis."

As of the date of this publication, there have been no further rulings on the case but "covered financial institutions" should watch this case closely as it moves through the courts because it may impact the Final Rule's compliance deadlines or, potentially, the Final Rule's validity and enforceability.