12 C.F.R. § 1002.108 – Firewall.

(a) Definitions. For purposes of this section, the following terms shall have the following meanings:
1. (1) Involved in making any determination concerning a covered application from a small business means participating in a decision regarding the evaluation of a covered application from a small business or the creditworthiness of a small business applicant for a covered credit transaction.
2. (2) Should have access means that an employee or officer may need to collect, see, consider, refer to, or otherwise use the information to perform that employee's or officer's assigned job duties.
(b) Prohibition on access to certain information. Unless the exception under paragraph (c) of this section applies, an employee or officer of a covered financial institution or a covered financial institution's affiliate shall not have access to an applicant's responses to inquiries that the financial institution makes pursuant to this subpart regarding whether the applicant is a minority-owned business, a women-owned business, or an LGBTQI+-owned business under § 1002.107(a)(18), and regarding the ethnicity, race, and sex of the applicant's principal owners under § 1002.107(a)(19), if that employee or officer is involved in making any determination concerning that applicant's covered application.
(c) Exception to the prohibition on access to certain information. The prohibition in paragraph (b) of this section shall not apply to an employee or officer if the financial institution determines that it is not feasible to limit that employee's or officer's access to an applicant's responses to the financial institution's inquiries under § 1002.107(a)(18) or (19) and the financial institution provides the notice required under paragraph (d) of this section to the applicant. It is not feasible to limit access as required pursuant to paragraph (b) of this section if the financial institution determines that an employee or officer involved in making any determination concerning a covered application from a small business should have access to one or more applicants' responses to the financial institution's inquiries under § 1002.107(a)(18) or (19).
(d) Notice. In order to satisfy the exception set forth in paragraph (c) of this section, a financial institution shall provide a notice to each applicant whose responses will be accessed, informing the applicant that one or more employees or officers involved in making determinations concerning the covered application may have access to the applicant's responses to the financial institution's inquiries regarding whether the applicant is a minority-owned business, a women-owned business, or an LGBTQI+-owned business, and regarding the ethnicity, race, and sex of the applicant's principal owners. The financial institution shall provide the notice required by this paragraph (d) when making the inquiries required under § 1002.107(a)(18) and (19) and together with the notices required pursuant to § 1002.107(a)(18) and (19).