Codify — Article

HB 941 delays enforcement and narrows scope of CFPB small‑business lending data rule

Creates a 3‑year compliance window plus a 2‑year penalty-free safe harbor and raises thresholds that limit which lenders and loans must report under ECOA small‑business data rules.

The Brief

HB 941 amends Section 704B of the Equal Credit Opportunity Act to push back immediate enforcement of the CFPB’s small‑business lending data collection rule and to tighten the set of entities and loans subject to reporting. The bill directs the Consumer Financial Protection Bureau to provide a three‑year period from the date the CFPB issued the Regulation B small‑business rule for institutions to come into compliance, followed by a two‑year safe harbor during which institutions must comply but are shielded from penalties for failures to comply.

The measure also narrows who counts as a ‘‘financial institution’’ for these reporting duties by applying a 500‑originations‑per‑year threshold (measured over the two prior calendar years) and sets the statutory small‑business revenue cutoff at $1,000,000 in gross annual revenues. Together, those changes reduce the number of firms required to report, delay enforcement pressure, and reshape what small‑business loans will appear in the CFPB’s data set—shifts that matter to compliance teams, regulators, researchers, and lenders competing for small‑business customers.

At a Glance

What It Does

The bill requires the CFPB to give covered institutions a three‑year window from the issuance date of its Regulation B small‑business rule to meet its obligations, then a two‑year safe harbor in which compliance is required but violations carry no penalties. It also amends the definitions in Section 704B so only entities that originated at least 500 small‑business credit transactions in each of the prior two calendar years are ‘‘financial institutions’’ for reporting purposes, and it defines ‘‘small business’’ as entities with gross annual revenues of $1,000,000 or less.

Who It Affects

Community banks, credit unions, fintech platforms, and specialty lenders whose small‑business originations fall below the 500‑per‑year threshold will be exempted from reporting duties; larger lenders that clear that threshold remain subject to the rule and the later safe harbor. CFPB enforcement staff, bank compliance officers, loan aggregators and third‑party service providers that collect and transmit HMDA/ECOA data will see their workloads and legal exposure change under the new timing and definitions.

Why It Matters

By narrowing who must report and delaying penal enforcement, the bill changes the volume and composition of data available to regulators, researchers, and enforcement agencies for spotting discriminatory or unfair small‑business lending patterns. The timing and definitional changes also create practical questions about counting originations, handling third‑party origination channels, and the incentive structure for building reporting systems.

More articles like this one.

A weekly email with all the latest developments on this topic.

Unsubscribe anytime.

What This Bill Actually Does

HB 941 operates through two parallel levers: timing and scope. On timing, it instructs the CFPB to treat its May 31, 2023 final Regulation B small‑business rule as having a built‑in runway for compliance: three years from the rule’s issuance date for institutions to meet the substantive data‑collection requirements, followed by a two‑year period in which institutions must comply but will not face penalties for lapses.

That structure leaves the rule on the books and requires institutions to implement it, but temporarily removes the stick of enforcement penalties for up to five years from the rule date.

On scope, the bill narrows which entities count as ‘‘financial institutions’’ required to report. The statutory test now has two parts: the entity must be in the business of financial activity and must have originated at least 500 small‑business credit transactions in each of the two prior calendar years.

That changes the delineation between institutions that must build reporting pipelines and those that can avoid them because of scale. Separately, the bill sets a clear revenue ceiling for what the statute calls a ‘‘small business’’—any entity with gross annual revenues of $1,000,000 or less in its most recently completed fiscal year—so the definition for which loans are included in the reporting universe is tightened.Practically, the bill does not repeal the CFPB rule; it creates a phased approach that preserves the rule’s technical requirements while softening immediate enforcement pressure and shrinking the population of reporters.

That will affect how and when banks and nonbank lenders invest in internal systems, third‑party integrations, and compliance staffing. It also changes the data picture available to the CFPB, other regulators, and outside analysts by likely excluding many lower‑volume lenders and by tightening the revenue cutoff for reported borrowers.The text is short and mechanically focused—there are no new data fields, exemptions for particular loan products, or alternative recordkeeping standards in the bill.

Instead, HB 941 uses timing and definitional thresholds to reallocate compliance costs and enforcement risk across the mortgage of small‑business lending stakeholders.

The Five Things You Need to Know

1

The bill adds a new subsection to 15 U.S.C. 1691c–2(g) requiring a 3‑year compliance period measured from the issuance date of the CFPB’s Regulation B small‑business rule, followed by a 2‑year safe harbor with no penalties for noncompliance.

2

It expressly defines the ‘‘covered rule’’ as the CFPB final rule titled ‘‘Small Business Lending Under the Equal Credit Opportunity Act (Regulation B)’’ (88 Fed. Reg. 35150, published May 31, 2023).

3

The amended statutory definition of ‘‘financial institution’’ requires that an entity have originated not less than 500 small‑business credit transactions in each of the previous two calendar years to be covered by Section 704B reporting duties.

4

The bill sets the statutory small‑business revenue threshold at gross annual revenues of $1,000,000 or less in the borrower’s most recently completed fiscal year for purposes of the reporting rule.

5

During the 2‑year safe harbor the bill requires institutions to comply with the rule but bars the Bureau from imposing penalties for failure to comply—leaving compliance voluntary in practice but formally required.

Section-by-Section Breakdown

Every bill we cover gets an analysis of its key sections. Expand all ↓

Section 704B(g)(4)

Three‑year compliance window and two‑year penalty‑free safe harbor

This new paragraph directs the CFPB to give covered institutions a three‑year period from the date it issued the Regulation B small‑business rule to achieve compliance, then a two‑year safe harbor during which institutions must comply but cannot be penalized for failures. Practically, the provision keeps the rule’s obligations intact while stripping immediate enforcement teeth for up to five years from the rule date, which affects enforcement timing and the urgency of institutions’ implementation plans.

Section 704B(h)(1)

New scale test for which entities must report

The bill revises the ‘‘financial institution’’ definition to add a size threshold: an entity must have originated at least 500 small‑business credit transactions in each of the prior two calendar years to trigger reporting obligations. That mechanistic threshold narrows the reporting population and raises questions about counting methodology (e.g., how to treat participations, sold loans, or platform‑facilitated originations) and whether the test is binary or subject to good‑faith disputes.

Section 704B(h)(2)

Revenue cap that defines a small business

The bill sets a single, bright‑line definition of ‘‘small business’’ for reporting at gross annual revenues of $1,000,000 or less in the most recently completed fiscal year. That cutoff determines which borrowers’ credit transactions enter the data set and will materially affect the scope and demographic composition of the reported universe compared with broader or higher‑threshold definitions.

At scale

This bill is one of many.

Codify tracks hundreds of bills on Finance across all five countries.

Explore Finance in Codify Search →

Who Benefits and Who Bears the Cost

Every bill creates winners and losers. Here's who stands to gain and who bears the cost.

Who Benefits

  • Small and community lenders that originate fewer than 500 small‑business loans per year — they avoid the immediate compliance burden, system upgrades, and potential enforcement exposure while the safe harbor is in effect.
  • Fintech platforms and emerging lenders with low small‑business origination volumes — the threshold-exemption reduces near‑term reporting costs and delays the need to invest in complex data pipelines and audit controls.
  • Institutions concerned about penalty exposure — the two‑year penalty‑free period lowers legal and regulatory risk, giving them breathing room to phase in compliance without facing fines or administrative sanctions.

Who Bears the Cost

  • CFPB and enforcement arms — the Bureau loses immediate leverage to enforce timely, complete reporting and may face political and technical challenges overseeing a phased roll‑out without penalty tools.
  • Researchers, civil‑rights groups, and policymakers — reduced and delayed data collection will produce a thinner, later data set, limiting early detection of discriminatory patterns and weakening evidence available for enforcement or policy change.
  • Large banks and high‑volume lenders that exceed the 500‑originations threshold — they still must build reporting systems and may incur relatively higher per‑loan compliance costs, while competing peers face a temporary reporting reprieve.
  • Third‑party service providers and data vendors — uncertainty about scale thresholds and counting methods complicates product roadmaps and may concentrate demand unpredictably among a smaller set of clients.

Key Issues

The Core Tension

The bill pits two legitimate objectives against each other: lowering compliance and enforcement burdens on smaller, lower‑volume lenders versus preserving a comprehensive, timely data set that regulators and researchers need to detect discrimination and inform policy. The chosen mechanism—delayed enforcement plus higher exclusions—solves administrative cost concerns but weakens monitoring and creates incentives that may delay real compliance and shrink the evidence base for enforcement.

The bill’s principal trade‑off is straightforward but consequential: it preserves the structure of the CFPB’s Regulation B reporting requirements while muting enforcement incentives through a long compliance runway and a penalty‑free period. That approach lowers short‑term costs for many smaller lenders but also reduces the urgency to develop reliable data pipelines and internal controls.

When regulators and external analysts depend on consistent, timely data to detect lending disparities, delaying both compliance and penalties risks creating gaps in surveillance and enforcement for multiple years.

Several implementation ambiguities in the text will matter in practice. The 500‑originations test is measured ‘‘in each of the previous 2 calendar years,’’ but the bill does not define ‘‘originated’’ relative to retail platform facilitation, sold or participated loans, or referrals—areas where lenders commonly disagree.

The safe harbor language bars penalties but does not specify whether it limits supervisory actions, cease‑and‑desist orders, or private remedies; courts and regulators could interpret the protection differently. Finally, narrowing the revenue cutoff to $1,000,000 will materially change the reported borrower pool, but the statute does not address transitional recordkeeping (for example, how to treat prior fiscal years or multi‑entity borrowers) or the data quality steps the CFPB should require before accepting reduced or delayed submissions.

Try it yourself.

Ask a question in plain English, or pick a topic below. Results in seconds.