Understanding 1071 Voluntary Reporting

Since its initial publication in the spring of 2023, section 1071 of the Dodd Frank Act left compliance and risk leaders scratching their heads. The size and complexity of the rule are matched only by the staggering cost estimates for compliance. 

One of the many complex aspects of the CFPB’s new 1071 rule is the option for voluntary reporting. Covered financial institutions want to know what this option entails, why they might want to do this, and the pros and cons of voluntary reporting. 

What is voluntary reporting?

Voluntary reporting is the opportunity for covered lenders to benefit from a 1071 data collection trial run.  

Historically, the demographic data required by 1071 has generally been off limits for financial institutions. Financial institutions are expressly prohibited from collecting personal data from potential borrowers that does not directly pertain to their ability to repay the credit under 12 CFR 1002 (Regulation B) – part of the CFPB’s implementation of the Equal Credit Opportunity Act (ECOA). Regulation B prohibits the collection of data points such as sex, sexual orientation, religion, and race of potential borrowers.1071 upends this longstanding rule by requiring covered lenders to collect certain demographic data.  

The CFPB knows that it won’t be easy for lenders to suddenly start collecting data to report – they will need time to fine tune processes. CFPB introduced voluntary reporting to give covered institutions an opportunity to practice 1071 data collection ahead of time or to continue collecting data if they meet certain parameters. With voluntary reporting, in some instances institutions can collect, analyze, and report on 1071 data before they are required to do so. 

(The voluntary collection provision of 1071 essentially overrides Regulation B to allow covered lenders to collect this data up to 12 months before they are required to do so under 1071.) 

The finalized deadline requirements are broken down by tiers:  

• Tier 1 institution is permitted to begin collecting protected demographic information on or after July 18, 2024. 
• Tier 2 institution may begin on or after January 16, 2025. 
• Tier 3 institution may begin on or after October 18, 2025. 

1071’s voluntary reporting provisions come with time limitations and other nuances that your institution should understand before engaging in voluntary reporting. See section 2.6 of the Small Business Lending Rule – Small Entity Compliance Guide.  

Related: Section 1071 Resources 

Why would a financial institution collect this data early?

Compliance with 1071 will be extremely complex, with numerous data fields and strict firewall requirements to protect the privacy of potential borrowers. These requirements are unprecedented for most lenders and a huge lift.  

Voluntary reporting gives covered institutions: 

More time and opportunity to prepare

It’s rare for everything to go 100% smoothly the first time a process is implemented. Policies and procedures may not be clear. Staff may not understand what they are supposed to do. Systems might be buggy.  

Financial institutions that embrace voluntary reporting will gain more time and opportunity to work out the kinks and refine their processes. Whether there are gaps in processing or staff needs more training, voluntary reporting gives covered lenders the ability to identify weaknesses and correct them. By the time the compliance deadline arrives, they can be confident that they can accurately and efficiently collect the required data. 

Related: Mid-Year Regulatory Landscape 2024 

Resolve potential fair lending issues before exam time 

No financial institution wants to discriminate, but data analysis often reveals unintended discrimination.  

Regulators are on the lookout for:  

• Overt discrimination. Overt discrimination is when a lender openly and/or actively discriminated against on a prohibited basis factor. If a lender offers a lower interest rate only for people in a certain age bracket and not others, this would be an example of discrimination on a prohibited basis factor.   

• Disparate treatment. Disparate treatment is when members of a prohibited basis group are treated differently than others based on prohibited characteristics. It doesn’t have to be deliberate. For instance, if a loan officer waives a specific fee for friends who are similarly situated (i.e. non-Hispanic middle-aged white males), it can result in better terms and pricing for some groups compared to prohibited basis groups. 

• Disparate impact. Disparate impact is when a neutral policy or practice that is applied equally to all individuals nevertheless has a disproportionately adverse impact on a protected class of people. For example, a lender might set a minimum loan amount of $150,000. This policy seems neutral on the surface since it's applied to all applicants. However, if many of those borrowers come from a protected class are seeking small-dollar business loans, it can have a disparate impact even though there was no intention to discriminate. (In such cases, a lender might be required to justify the policy as a business necessity or adjust it to mitigate the disproportionate effect on protected groups.) 

Are there any risks with voluntary reporting?   

Not every institution will adopt voluntary reporting.  

The time, cost, and complexity of complying with Section 1071 has paralyzed some institutions into inaction, leaving them overwhelmed by the sheer volume of new data collection and reporting requirements. The fear of missteps, coupled with the need for significant investments in technology, staff training, and process overhauls, has caused some institutions to delay or avoid taking proactive measures. As a result, these institutions risk falling behind their more prepared counterparts when the regulatory deadlines take effect. 

However, this strategy is risky. Delaying compliance efforts could leave institutions scrambling to meet requirements at the last minute if the rule remains intact. It’s like the student that puts off their homework in hopes school will be cancelled due to snow. Rolling the dice on flurries isn’t a good strategy. 

Should my financial institution voluntarily report for 1071?  

If possible, yes.  

Now that the Federal Court has upheld 1071 wholesale, we can be sure that this regulation is not going anywhere. While the ABA will likely appeal the ruling, it’s doubtful that the regulation will be substantially changed.  

In fact, many institutions have taken a “wait and see” approach and, as a result, have already missed out on a key preparation opportunity.  

When the compliance deadline arrives, you’ll want to be as ready as possible. Just like in sports, practicing ahead of game day is essential. Engaging in voluntary reporting now is highly recommended for all covered and eligible institutions. 

No matter the outcome of the current legal challenges, it is highly probable that 1071 will endure in some capacity. Preparing now allows you to adjust your approach as needed, rather than scrambling at the last minute to assemble a compliant system. Get ahead by discussing your compliance plan with your team and identifying steps your institution can take today to be ready for 1071 compliance. 

What do you do with your collected data?  

The final rule specifically calls out the requirements of the rule your institution must follow if it will voluntarily collect data. For example, your institution must comply with the firewall requirement or notice exception and ensure the Loan Application Register (LAR) does not contain personally identifiable information (such as name or a specific address).  

 As to what you should do with this data once you’ve collected it, you are not required to file this with the CFPB and you do not have to retain this data under the recordkeeping requirements of the rule. Basically, as long as you keep the demographic information and business status of the principal owners away from the loan file or provide applicants with the appropriate notice, this data is for your institution to work with internally. Once you are required to comply with the rule, the other requirements of the rule will apply regarding data transmittal to recordkeeping. 

Learn how N1071 can help you implement Section 1071