Understanding Covered Financial Institutions Under Regulation B
A practical guide to which lenders are covered or exempt under Regulation B’s small business data collection rules.
Regulation B, which implements the Equal Credit Opportunity Act (ECOA), now includes detailed rules requiring certain lenders to collect and report data about small business credit applications. These obligations do not apply to every creditor. Instead, the rules focus on covered financial institutions that meet specific activity thresholds and carve out several categories of exempt institutions.
This guide explains, in practical terms, how a financial institution is defined, when a lender becomes a covered financial institution, who is exempt, and how mergers, acquisitions, and changes in lending volume affect coverage status.
1. Regulatory Background and Purpose
The Consumer Financial Protection Bureau (CFPB) administers Regulation B under ECOA, a federal law prohibiting discrimination in any aspect of a credit transaction on bases such as race, color, religion, national origin, sex, marital status, age, receipt of public assistance, or exercise of consumer protection rights.
Recent CFPB rulemaking added small business lending data collection requirements to improve transparency in the market and help enforce fair lending laws. Only financial institutions that meet certain thresholds are required to collect, maintain, and report this data.
- Goal of the rule: shed light on how small businesses, including those owned by women and minorities, access credit.
- Core mechanism: require covered financial institutions to report standardized data about covered credit transactions with small businesses.
- Scope limiter: volume-based thresholds and exemptions to avoid imposing data collection burdens on the smallest lenders.
2. What Counts as a “Financial Institution”?
Regulation B uses a very broad definition of financial institution. It covers essentially any entity, regardless of charter type, that engages in financial activity.
Examples of entities that may qualify as financial institutions include:
- Banks, savings associations, and credit unions
- Online and platform lenders
- Commercial finance companies and equipment/vehicle finance companies
- Community development financial institutions
- Farm Credit System institutions
- Nonprofit lenders, including some tax-exempt entities
- Government agencies or subdivisions that extend credit
The Future of AI: Preventing a Big Tech Monopoly >
If an organization is engaged in lending or other financial activities described in Regulation B, it is generally a financial institution for purposes of the small business data rule, even if it is not a traditional depository institution.
3. When Does a Financial Institution Become “Covered”?
Not every financial institution must collect small business lending data. The rule introduces the term covered financial institution, which is a financial institution that originates at least 100 covered credit transactions for small businesses in each of the two preceding calendar years.
3.1 The Two-Year Loan-Volume Test
The volume test has two key elements:
- Threshold: at least 100 originations of covered credit transactions for small businesses per year.
- Duration: must be met in each of the two immediately preceding calendar years.
In applying this test, a lender counts only originations of covered credit transactions (as defined elsewhere in Regulation B’s small business rule) to small businesses. Certain actions, such as refinancings or credit line increases, may not be counted as originations for the purpose of this threshold, even if they are treated as covered applications for other aspects of the rule.
3.2 How “Preceding Calendar Years” Work
Coverage is always determined by looking backward from the current year. In year N, the financial institution checks whether it originated at least 100 covered credit transactions for small businesses in each of years N−1 and N−2.
| Evaluation Year | Years Used for Threshold | Result if ≥100 in Each Year |
|---|---|---|
| 2029 | 2027 and 2028 | Covered in 2029 |
| 2030 | 2028 and 2029 | Covered in 2030 if both years meet threshold |
| 2031 | 2029 and 2030 | Coverage depends on those two years’ volumes |
Key point: coverage can change over time. An institution may be covered in one year and not covered in a later year if its originations drop below the 100-transaction threshold in one or both of the relevant preceding years.
3.3 Impact of Changes in Lending Volume
Because the test is based on originations in the preceding two years, a decline in small business lending can remove an institution from coverage, while growth can bring an institution into coverage in future years.
- If a lender grows and crosses the 100-originations threshold for two consecutive years, it will become a covered financial institution in the following year.
- If a lender’s originations fall below 100 in either of the two preceding years, it is not treated as a covered financial institution for the current year, although it may choose to collect and maintain data voluntarily.
4. What Types of Requests Count Toward the Threshold?
The rule distinguishes between different types of credit requests and their relevance for determining coverage. Although the full definition of a covered credit transaction is detailed elsewhere in Regulation B, the coverage provision emphasizes that only originations count toward the 100-transaction threshold.
Broadly:
- Include: new originations of covered credit transactions to small businesses.
- Exclude for threshold purposes:
- Requests to reevaluate, extend, or renew existing obligations (unless they constitute new originations under the rule).
- Credit line increases and other requests for additional credit amounts on existing accounts.
These types of requests may still be treated as covered applications for reporting in some circumstances, but they are not counted in evaluating whether the lender meets the 100-originations threshold.
5. Exempt Institutions and Special Carve-Outs
Regulation B also recognizes that certain institutions or activities should be exempt from the small business data reporting provisions. While the full list of exempt institutions appears in the regulatory text, typical exempt categories include certain small-volume lenders and some classes of governmental or specialized entities.
Common rationales for exemption include:
- Low lending volume: Institutions whose small business activity is minimal relative to the market.
- Nature of charter or supervision: Certain public or quasi-public entities may be exempt from the data collection requirements.
- Policy considerations: In some cases, Congress or the CFPB may decide that imposing data collection duties on particular entities could undermine other policy goals (such as promoting community development lending).
Even when exempt from small business data collection under Regulation B, institutions remain subject to ECOA’s core nondiscrimination requirements and other fair lending laws, such as the Fair Housing Act for housing-related credit.
6. Mergers, Acquisitions, and Coverage
Mergers and acquisitions add complexity to the coverage analysis because the surviving or newly formed institution may combine the lending volumes of several predecessors. Regulation B addresses how to evaluate coverage in these situations.
6.1 Combining Originations After a Merger
After a merger or acquisition, the surviving or newly formed financial institution determines coverage by examining the combined small business originations of all of the relevant components.
- If the combined originations for each of the two preceding years are at least 100 covered credit transactions for small businesses, the surviving or newly formed institution is treated as a covered financial institution.
- This combined analysis applies whether the transaction involved entire institutions or specific branches or business lines whose originations can be tracked.
6.2 Coverage for the Year Following a Merger
The rule also considers both the year before and the year of the merger:
- If the combined predecessor institutions would have reported at least 100 covered transactions for small businesses in the year before the merger, and
- The combined predecessor institutions plus the surviving or newly formed institution would have reported at least 100 such transactions in the year of the merger,
then the surviving or newly formed institution will meet the threshold for coverage in the year following the merger.
6.3 Reporting Responsibilities in the Merger Year
In the calendar year in which a merger occurs, reporting responsibilities depend on whether each party was a covered financial institution before the merger.
- Both parties previously covered: Data must generally be compiled, maintained, and reported for covered applications from both institutions, following the CFPB’s guidance on how to allocate reporting responsibilities.
- One covered, one not covered:
- Data reporting is mandatory for covered applications from the institution that was already covered.
- Reporting for covered applications from the previously non-covered institution is optional during the merger year, but if the surviving creditor chooses to report, it must comply fully with applicable reporting requirements.
7. Voluntary Data Collection by Non-Covered Institutions
Even when a financial institution does not meet the volume threshold—or becomes non-covered because its lending declines—it may choose to voluntarily collect and maintain small business lending data consistent with Regulation B’s framework.
Voluntary data collection can be valuable for:
- Internal fair lending monitoring: Identifying disparities in approval rates, pricing, or terms across demographic groups.
- Public accountability: Demonstrating a commitment to serving small businesses fairly and transparently.
- Regulatory readiness: Preparing for potential future coverage if lending volumes increase.
However, institutions choosing to voluntarily report to the CFPB must do so in accordance with the rule’s detailed data standards and reporting requirements; partial or inconsistent reporting is not permitted.
8. Compliance and Supervisory Implications
Coverage under § 1002.105 is not just a technical classification; it has substantial compliance consequences for small business lenders. Covered financial institutions must implement systems to identify covered applications, collect required data fields, ensure accuracy, and report to the CFPB.
Key implications include:
- Governance and policies: Institutions must update fair lending policies, procedures, and internal controls to reflect the small business data rule.
- Systems and operations: Loan origination and servicing systems may require modifications to capture new data, such as applicant demographic information, in a compliant and privacy-sensitive manner.
- Examination focus: Supervisors, including the CFPB and prudential regulators, may use collected data to evaluate whether institutions are complying with ECOA and other fair lending laws.
9. Practical Steps for Institutions Assessing Coverage
Any organization engaged in small business lending should conduct a structured review to determine whether it is currently a covered financial institution and whether it may become covered in upcoming years.
- Confirm status as a financial institution.
Identify all legal entities and business lines that engage in small business lending. Confirm they fall within the broad financial institution definition. - Calculate originations for the last two calendar years.
For each entity, calculate the number of originations of covered credit transactions to small businesses in each of the two preceding years. - Apply the 100-transaction test.
Determine whether at least 100 such originations occurred in each of those years. If yes, the entity is a covered financial institution for the current year. - Assess impact of corporate changes.
In the case of mergers, acquisitions, or branch purchases, combine volumes as required and reassess coverage for the surviving or newly formed institution. - Document and revisit annually.
Maintain written analyses of coverage determinations and update them each year as part of the institution’s compliance management system.
10. Frequently Asked Questions (FAQs)
Q1. If my institution originated 120 covered small business transactions in one year but only 80 the next year, are we covered?
No. To be a covered financial institution under Regulation B’s small business data rule, a financial institution must originate at least 100 covered credit transactions for small businesses in each of the two preceding calendar years. If either year falls below 100, the institution is not covered for the current year, although it may choose to collect data voluntarily.
Q2. Do credit line increases or renewals count toward the 100-transaction threshold?
Generally, requests to reevaluate, extend, or renew existing credit, as well as requests for credit line increases or additional amounts on existing accounts, are not counted as originations for purposes of determining whether the institution meets the 100-transaction threshold, even if they may be covered applications for other purposes under the rule.
Q3. How do we handle coverage after acquiring another lender mid-year?
After a merger or acquisition, the surviving or newly formed institution evaluates coverage by combining the small business originations of all relevant entities for each of the two preceding calendar years. If the combined volumes meet or exceed 100 covered originations in each year, the institution is treated as covered for the following year. During the merger year, reporting responsibilities depend on whether each party was previously covered and how the institution chooses to report optional data.
Q4. If we are not covered, do ECOA’s nondiscrimination rules still apply?
Yes. ECOA and Regulation B’s core nondiscrimination provisions apply broadly to creditors regardless of whether they are covered for small business data collection. The exemption from small business data reporting does not exempt an institution from fair lending laws.
Q5. Can a non-covered institution decide to collect and report small business data anyway?
Yes. Non-covered institutions may voluntarily collect and maintain data, and may also elect to report it, provided they comply with the same technical, privacy, and accuracy standards that apply to covered financial institutions. Voluntary reporting must be complete and consistent with the rule; selective or partial reporting is not permitted.
References
- 12 CFR § 1002.105 – Covered financial institutions and exempt institutions — Consumer Financial Protection Bureau / eCFR. 2023-03-30. https://www.consumerfinance.gov/rules-policy/regulations/1002/105/
- 12 CFR § 1002.105 – Covered financial institutions and exempt institutions — Legal Information Institute, Cornell Law School. 2023-03-30. https://www.law.cornell.edu/cfr/text/12/1002.105
- 12 CFR Part 1002 – Equal Credit Opportunity Act (Regulation B) — Consumer Financial Protection Bureau. 2023-03-30. https://www.consumerfinance.gov/rules-policy/regulations/1002/
- 12 CFR Part 1002 – Equal Credit Opportunity Act (Regulation B) — eCFR, Office of the Federal Register. 2023-03-30. https://www.ecfr.gov/current/title-12/chapter-X/part-1002
- Fair Lending, Comptroller’s Handbook — Office of the Comptroller of the Currency. 2010-08-01. https://www.occ.treas.gov/publications-and-resources/publications/comptrollers-handbook/files/fair-lending/pub-ch-fair-lending.pdf
- Small Business Lending Under the Equal Credit Opportunity Act (Regulation B); Proposed Rule — Consumer Financial Protection Bureau, Federal Register. 2025-11-13. https://www.federalregister.gov/documents/2025/11/13/2025-19865/small-business-lending-under-the-equal-credit-opportunity-act-regulation-b
Similar Articles
Read full bio of Sneha Tete
