US Codex
C.F.R.
Browse by date

View an earlier version

Latest
Current
Browse all versions by date
Notes

12 C.F.R. §§ 1002.107–1002.112

6 sections in range

§1002.107. Compilation of reportable data.

12 C.F.R. § 1002.107

(a)
Data format and itemization. A covered financial institution shall compile and maintain data regarding covered applications from small businesses. The data shall be compiled in the manner prescribed herein and the Filing Instructions Guide for this subpart for the appropriate year. The data compiled shall include the items described in paragraphs (a)(1) through (20) of this section.
(1)
Unique identifier. An alphanumeric identifier, starting with the legal entity identifier of the financial institution, unique within the financial institution to the specific covered application, and which can be used to identify and retrieve the specific file or files corresponding to the application for or extension of credit.
(2)
Application date. The date the covered application was received or the date shown on a paper or electronic application form.
(3)
-(4) [Reserved]
(5)
Credit type. The following information regarding the type of credit applied for or originated:
(i)
Credit product. The credit product.
(ii)
Guarantees. The type or types of guarantees that were obtained for an extension of credit, or that would have been obtained if the covered credit transaction were originated.
(iii)
Loan term. The length of the loan term, in months, if applicable.
(6)
Credit purpose. The purpose or purposes of the credit applied for or originated.
(7)
Amount applied for. The initial amount of credit or the initial credit limit requested by the applicant.
(8)
Amount approved or originated.
(i)
For an application for a closed-end credit transaction that is approved but not accepted, the amount approved by the financial institution; or
(ii)
For a closed-end credit transaction that is originated, the amount of credit originated; or
(iii)
For an application for an open-end credit transaction that is originated or approved but not accepted, the amount of the credit limit approved.
(9)
Action taken. The action taken by the financial institution on the covered application, reported as originated, approved but not accepted, denied, withdrawn by the applicant, or incomplete.
(10)
Action taken date. The date of the action taken by the financial institution.
(11)
-(12) [Reserved]
(13)
Census tract. The census tract in which is located:
(i)
The address or location where the proceeds of the credit applied for or originated will be or would have been principally applied; or
(ii)
If the information in paragraph (a)(13)(i) of this section is unknown, the address or location of the main office or headquarters of the applicant; or
(iii)
If the information in both paragraphs (a)(13)(i) and (ii) of this section is unknown, another address or location associated with the applicant.
(iv)
The financial institution shall also indicate which one of the three types of addresses or locations listed in paragraphs (a)(13)(i), (ii), or (iii) of this section the census tract is based on.
(14)
Gross annual revenue. The applicant's gross annual revenue for its preceding fiscal year.
(15)
NAICS code. A 3-digit North American Industry Classification System (NAICS) code for the applicant.
(16)
[Reserved]
(17)
Time in business. The time the applicant has been in business.
(18)
Minority-owned and women-owned business statuses. Whether the applicant is a minority-owned and/or women-owned business. When requesting minority-owned and women-owned business statuses from an applicant, the financial institution shall inform the applicant that the financial institution cannot discriminate on the basis of minority-owned or women-owned business statuses, or on whether the applicant provides this information. The financial institution must also inform the applicant of its right to refuse to provide this information.
(19)
Ethnicity, race, and sex of principal owners. The ethnicity, race, and sex of the applicant's principal owners. When requesting ethnicity, race, and sex information from an applicant, the financial institution shall inform the applicant that the financial institution cannot discriminate on the basis of a principal owner's ethnicity, race, or sex, or on whether the applicant provides this information. The financial institution must also inform the applicant of its right to refuse to provide this information.
(20)
Number of principal owners. The number of the applicant's principal owners.
(b)
Reliance on and verification of applicant-provided data. Unless otherwise provided in this subpart, the financial institution may rely on information from the applicant, or appropriate third-party sources, when compiling data. If the financial institution verifies applicant-provided data, however, it shall report the verified data.
(c)
Time and manner of collection—
(1)
In general. A covered financial institution shall maintain procedures to collect applicant-provided data under paragraph (a) of this section and shall otherwise maintain procedures to collect such data at a time and in a manner that are reasonably designed to obtain a response.
(2)
Applicant-provided data collected directly from the applicant. For data collected directly from the applicant, procedures that are reasonably designed to obtain a response shall include provisions for the following:
(i)
The initial request for applicant-provided data occurs prior to notifying an applicant of final action taken on a covered application, or at another time reasonably designed to obtain a response;
(ii)
The request for applicant-provided data is prominently displayed or presented; and
(iii)
[Reserved]
(iv)
Applicants can easily respond to a request for applicant-provided data.
(3)
-(4) [Reserved]
(d)
Previously collected data. A covered financial institution is permitted, but not required, to reuse previously collected data to satisfy paragraphs (a)(13) through (15) and (17) through (20) of this section if:
(1)
To satisfy paragraphs (a)(13), (15), and (17) through (20) of this section, the data were collected within the 36 months preceding the current covered application, or to satisfy paragraph (a)(14) of this section, the data were collected within the same calendar year as the current covered application; and
(2)
The financial institution has no reason to believe the data are inaccurate.
Notes, amendments, and revision history

Amendments

[88 FR 35528, May 31, 2023, as amended at 91 FR 23605, May 1, 2026]

Source

Source: 88 FR 35528, May 31, 2023, unless otherwise noted.

Authority

Authority: 12 U.S.C. 5512, 5581; 15 U.S.C. 1691b. Subpart B is also issued under 15 U.S.C. 1691c-2.

Source

Source: 76 FR 79445, Dec. 21, 2011, unless otherwise noted.

Amendments

[88 FR 35528, May 31, 2023, as amended at 91 FR 23605, May 1, 2026]

§1002.108. Firewall.

12 C.F.R. § 1002.108

(a)
Definitions. For purposes of this section, the following terms shall have the following meanings:
(1)
Involved in making any determination concerning a covered application from a small business means participating in a decision regarding the evaluation of a covered application from a small business or the creditworthiness of a small business applicant for a covered credit transaction.
(2)
Should have access means that an employee or officer may need to collect, see, consider, refer to, or otherwise use the information to perform that employee's or officer's assigned job duties.
(b)
Prohibition on access to certain information. Unless the exception under paragraph (c) of this section applies, an employee or officer of a covered financial institution or a covered financial institution's affiliate shall not have access to an applicant's responses to inquiries that the financial institution makes pursuant to this subpart regarding whether the applicant is a minority-owned business or a women-owned business under § 1002.107(a)(18), and regarding the ethnicity, race, and sex of the applicant's principal owners under § 1002.107(a)(19), if that employee or officer is involved in making any determination concerning that applicant's covered application.
(c)
Exception to the prohibition on access to certain information. The prohibition in paragraph (b) of this section shall not apply to an employee or officer if the financial institution determines that it is not feasible to limit that employee's or officer's access to an applicant's responses to the financial institution's inquiries under § 1002.107(a)(18) or (19) and the financial institution provides the notice required under paragraph (d) of this section to the applicant. It is not feasible to limit access as required pursuant to paragraph (b) of this section if the financial institution determines that an employee or officer involved in making any determination concerning a covered application from a small business should have access to one or more applicants' responses to the financial institution's inquiries under § 1002.107(a)(18) or (19).
(d)
Notice. In order to satisfy the exception set forth in paragraph (c) of this section, a financial institution shall provide a notice to each applicant whose responses will be accessed, informing the applicant that one or more employees or officers involved in making determinations concerning the covered application may have access to the applicant's responses to the financial institution's inquiries regarding whether the applicant is a minority-owned business or a women-owned business, and regarding the ethnicity, race, and sex of the applicant's principal owners. The financial institution shall provide the notice required by this paragraph (d) when making the inquiries required under § 1002.107(a)(18) and (19) and together with the notices required pursuant to § 1002.107(a)(18) and (19).
Notes, amendments, and revision history

Amendments

[88 FR 35528, May 31, 2023, as amended at 91 FR 23606, May 1, 2026]

Source

Source: 88 FR 35528, May 31, 2023, unless otherwise noted.

Authority

Authority: 12 U.S.C. 5512, 5581; 15 U.S.C. 1691b. Subpart B is also issued under 15 U.S.C. 1691c-2.

Source

Source: 76 FR 79445, Dec. 21, 2011, unless otherwise noted.

Amendments

[88 FR 35528, May 31, 2023, as amended at 91 FR 23606, May 1, 2026]

§1002.109. Reporting of data to the Bureau.

12 C.F.R. § 1002.109

(a)
Reporting to the Bureau—
(1)
Annual reporting.
(i)
On or before June 1 following the calendar year for which data are compiled and maintained as required by § 1002.107, a covered financial institution shall submit its small business lending application register in the format prescribed by the Bureau.
(ii)
An authorized representative of the covered financial institution with knowledge of the data shall certify to the accuracy and completeness of the data reported pursuant to this paragraph (a).
(iii)
When the last day for submission of data prescribed under paragraph (a)(1) of this section falls on a Saturday or Sunday, a submission shall be considered timely if it is submitted on the next succeeding Monday.
(2)
Reporting by subsidiaries. A covered financial institution that is a subsidiary of another covered financial institution shall complete a separate small business lending application register. The subsidiary shall submit its small business lending application register, directly or through its parent, to the Bureau.
(3)
Reporting obligations where multiple financial institutions are involved in a covered credit transaction. Where it is necessary for more than one financial institution to make a credit decision in order to approve a single covered credit transaction, only the last covered financial institution with authority to set the material terms of the covered credit transaction is required to report the application. Financial institutions report the actions of their agents.
(b)
Financial institution identifying information. A financial institution shall provide each of the following with its submission:
(1)
Its name.
(2)
Its headquarters address.
(3)
The name and business contact information of a person that the Bureau or other regulators may contact about the financial institution's submission.
(4)
Its Federal prudential regulator, if applicable.
(5)
Its Federal Taxpayer Identification Number (TIN).
(6)
Its Legal Entity Identifier (LEI).
(7)
Its Research, Statistics, Supervision, and Discount identification (RSSD ID) number, if applicable.
(8)
Parent entity information, if applicable, including—
(i)
The name of the immediate parent entity;
(ii)
The LEI of the immediate parent entity, if available;
(iii)
The RSSD ID number of the immediate parent entity, if available;
(iv)
The name of the top-holding parent entity;
(v)
The LEI of the top-holding parent entity, if available; and
(vi)
The RSSD ID number of the top-holding parent entity, if available.
(9)
The type of financial institution that it is, indicated by selecting the appropriate type or types of institution from the list provided.
(10)
Whether the financial institution is voluntarily reporting covered applications from small businesses.
(c)
Procedures for the submission of data to the Bureau. The Bureau shall make available a Filing Instructions Guide, containing technical instructions for the submission of data to the Bureau pursuant to this section, as well as any related materials, at https://www.consumerfinance.gov/data-research/small-business-lending/filing-instructions-guide/.
Notes, amendments, and revision history

Source

Source: 88 FR 35528, May 31, 2023, unless otherwise noted.

Authority

Authority: 12 U.S.C. 5512, 5581; 15 U.S.C. 1691b. Subpart B is also issued under 15 U.S.C. 1691c-2.

Source

Source: 76 FR 79445, Dec. 21, 2011, unless otherwise noted.

§1002.110. Publication of data and other disclosures.

12 C.F.R. § 1002.110

(a)
Publication of small business lending application registers and associated financial institution information. The Bureau shall make available to the public generally the data reported to it by financial institutions pursuant to § 1002.109, subject to deletions or modifications made by the Bureau if the Bureau determines that the deletion or modification of the data would advance a privacy interest. The Bureau shall make such data available on an annual basis.
(b)
Publication of aggregate data. The Bureau may compile and aggregate data submitted by financial institutions pursuant to § 1002.109, and make any compilations or aggregations of such data publicly available as the Bureau deems appropriate.
(c)
Statement of financial institution's small business lending data available on the Bureau's website. A covered financial institution shall make available to the public on its website, or otherwise upon request, a statement that the covered financial institution's small business lending application register, as modified by the Bureau pursuant to § 1002.110(a), is or will be available from the Bureau. A financial institution shall use language provided by the Bureau, or substantially similar language, to satisfy the requirement to provide a statement pursuant to this paragraph (c).
(d)
Availability of statements. A covered financial institution shall make the notice required by paragraph (c) of this section available to the public on its website when it submits a small business lending application register to the Bureau pursuant to § 1002.109(a)(1), and shall maintain the notice for as long as it has an obligation to retain its small business lending application registers pursuant to § 1002.111(a).
(e)
Further disclosure prohibited—
(1)
Disclosure by a financial institution. A financial institution shall not disclose or provide to a third party the information it collects pursuant to § 1002.107(a)(18) and (19) except to further compliance with the Act or this part or as required by law.
(2)
Disclosure by a third party. A third party that obtains information collected pursuant to § 1002.107(a)(18) and (19) for the purpose of furthering compliance with the Act or this part is prohibited from any further disclosure of such information except to further compliance with the Act or this part or as required by law.
Notes, amendments, and revision history

Source

Source: 88 FR 35528, May 31, 2023, unless otherwise noted.

Authority

Authority: 12 U.S.C. 5512, 5581; 15 U.S.C. 1691b. Subpart B is also issued under 15 U.S.C. 1691c-2.

Source

Source: 76 FR 79445, Dec. 21, 2011, unless otherwise noted.

§1002.111. Recordkeeping.

12 C.F.R. § 1002.111

(a)
Record retention. A covered financial institution shall retain evidence of compliance with this subpart, which includes a copy of its small business lending application register, for at least three years after the register is required to be submitted to the Bureau pursuant to § 1002.109.
(b)
Certain information kept separate from the rest of the application. A financial institution shall maintain, separately from the rest of the application and accompanying information, an applicant's responses to the financial institution's inquiries pursuant to this subpart regarding whether an applicant for a covered credit transaction is a minority-owned business and/or a women-owned business under § 1002.107(a)(18), and regarding the ethnicity, race, and sex of the applicant's principal owners under § 1002.107(a)(19).
(c)
Limitation on personally identifiable information in certain records retained under this section. In reporting a small business lending application register pursuant to § 1002.109, maintaining the register pursuant to paragraph (a) of this section, and maintaining a separate record of information pursuant to paragraph (b) of this section, a financial institution shall not include any name, specific address, telephone number, email address, or any other personally identifiable information concerning any individual who is, or is connected with, an applicant, other than as required pursuant to § 1002.107 or paragraph (b) of this section.
Notes, amendments, and revision history

Amendments

[88 FR 35528, May 31, 2023, as amended at 91 FR 23606, May 1, 2026]

Source

Source: 88 FR 35528, May 31, 2023, unless otherwise noted.

Authority

Authority: 12 U.S.C. 5512, 5581; 15 U.S.C. 1691b. Subpart B is also issued under 15 U.S.C. 1691c-2.

Source

Source: 76 FR 79445, Dec. 21, 2011, unless otherwise noted.

Amendments

[88 FR 35528, May 31, 2023, as amended at 91 FR 23606, May 1, 2026]

§1002.112. Enforcement.

12 C.F.R. § 1002.112

(a)
Administrative enforcement and civil liability. A violation of section 704B of the Act or this subpart is subject to administrative sanctions and civil liability as provided in sections 704 (15 U.S.C. 1691c) and 706 (15 U.S.C. 1691e) of the Act, where applicable.
(b)
Bona fide errors. A bona fide error in compiling, maintaining, or reporting data with respect to a covered application is one that was unintentional and occurred despite the maintenance of procedures reasonably adapted to avoid such an error. A bona fide error is not a violation of the Act or this subpart. A financial institution is presumed to maintain procedures reasonably adapted to avoid such errors with respect to a given data field if the number of errors found in a random sample of the financial institution's submission for the data field does not equal or exceed a threshold specified by the Bureau for this purpose in appendix F to this part. However, an error is not a bona fide error if either there is a reasonable basis to believe the error was intentional or there is evidence that the financial institution does not or has not maintained procedures reasonably adapted to avoid such errors.
(c)
Safe harbors—
(1)
Incorrect entry for application date. A financial institution does not violate the Act or this subpart if it reports on its small business lending application register an application date that is within three business days of the actual application date pursuant to § 1002.107(a)(2).
(2)
Incorrect entry for census tract. An incorrect entry for census tract is not a violation of the Act or this subpart if the financial institution obtained the census tract by correctly using a geocoding tool provided by the FFIEC or the Bureau.
(3)
Incorrect entry for NAICS code. An incorrect entry for a 3-digit NAICS code is not a violation of the Act or this subpart, provided that the financial institution obtained the 3-digit NAICS code by:
(i)
Relying on an applicant's representations or on an appropriate third-party source, in accordance with § 1002.107(b), regarding the NAICS code; or
(ii)
Identifying the NAICS code itself, provided that the financial institution maintains procedures reasonably adapted to correctly identify a 3-digit NAICS code.
(4)
Incorrect determination of small business status, covered credit transaction, or covered application. A financial institution that initially collects data regarding whether an applicant for a covered credit transaction is a minority-owned business or a women-owned business and the ethnicity, race, and sex of the applicant's principal owners pursuant to § 1002.107(a)(18) and (19) but later concludes that it should not have collected such data does not violate the Act or this part if the financial institution, at the time it collected this data, had a reasonable basis for believing that the application was a covered application for a covered credit transaction from a small business pursuant to §§ 1002.103, 1002.104, and 1002.106, respectively. A financial institution seeking to avail itself of this safe harbor shall comply with the requirements of this subpart as otherwise required pursuant to §§ 1002.107, 1002.108, and 1002.111 with respect to the collected data.
Notes, amendments, and revision history

Amendments

[88 FR 35528, May 31, 2023, as amended at 91 FR 23606, May 1, 2026]

Source

Source: 88 FR 35528, May 31, 2023, unless otherwise noted.

Authority

Authority: 12 U.S.C. 5512, 5581; 15 U.S.C. 1691b. Subpart B is also issued under 15 U.S.C. 1691c-2.

Source

Source: 76 FR 79445, Dec. 21, 2011, unless otherwise noted.

Amendments

[88 FR 35528, May 31, 2023, as amended at 91 FR 23606, May 1, 2026]