On May 1, the CFPB finalized a substantially revised Section 1071 rule, which implements the small business lending data collection and reporting requirements under the Equal Credit Opportunity Act (ECOA) and Regulation B, as established by Section 1071 of the Dodd-Frank Act. The revised rule will become effective 60 days after publication in the Federal Register, with a compliance date of January 1, 2028.The CFPB’s revised rule significantly narrows the scope of covered institutions, covered credit products, and required data collection compared to the CFPB’s 2023 rule, which the Bureau has characterized as abandoning the prior “maximalist” approach in favor of a long-term, incremental model.
The CFPB stated that the revised rule is intended to take a more “incremental approach” to implementing Section 1071 while reducing compliance burdens associated with small business lending data collection. Specifically, the final rule:
- Raises the reporting threshold and narrows institutional coverage. Financial institutions will generally become subject to the rule only if they originate at least 1,000 covered credit transactions in each of the two preceding calendar years, replacing the prior threshold of 100 originations. The final rule also explicitly excludes Farm Credit System (FCS) lenders from the definition of covered financial institution, regardless of origination volume. In multi-party origination structures, only the last financial institution with authority to set material credit terms (such as pricing, amount, or repayment duration) is required to count and report the origination. Purchases of loans or interests in loans after origination are not treated as covered credit transactions.
- Narrows the definition of small business. The rule reduces the revenue threshold for a “small business” from $5 million in gross annual revenue to $1 million, significantly reducing the number of reportable applications. The CFPB noted that, even at this lower threshold, the rule is expected to capture data on approximately 92 to 93 percent of small businesses. The $1 million threshold will be adjusted every five years based on the Consumer Price Index for All Urban Consumers.
- Excludes certain products from coverage. Merchant cash advances (defined as lump-sum payments in exchange for a percentage of future sales or income up to a ceiling amount), agricultural lending transactions, and small dollar business loans of $1,000 or less are excluded from the final rule’s reporting requirements. The CFPB declined requests to exclude other categories of business credit, including point-of-sale products, equipment finance, and other specialty finance models. Lenders with mixed product sets will need to conduct careful product mapping to distinguish covered from excluded transactions.
- Removes several data collection requirements and revises demographic data collection. The CFPB eliminated numerous discretionary data points from the rule, including pricing information, denial reasons, application submission method, and employee-count data. The rule also removes requirements related to collecting information regarding LGBTQI+-owned. Race and ethnicity data will be collected using only aggregate categories, without disaggregated national origin or subgroup data. The final rule also removes the 2023 rule's "anti-discouragement" framework, which had treated low demographic data response rates as evidence of discouragement and imposed extensive monitoring and remediation obligations. Instead, institutions must maintain procedures reasonably designed to obtain responses but are no longer subject to prescriptive response-rate benchmarks. The final rule retains the firewall concept preventing loan decisionmakers from accessing demographic responses and adds detail regarding safe harbors and bona fide error tolerances for data reporting.
The CFPB stated that the revised framework is intended to preserve core Section 1071 reporting objectives while minimizing operational disruption to small business lenders. The final rule is scheduled to take effect on January 1, 2028, with the first Small Business Lending Application Register due by June 1, 2029.The CFPB indicated that its supervisory focus during the first 12 months of data collection will emphasize good-faith compliance efforts rather than strict liability.
The CFPB also deferred decisions regarding privacy and public disclosure of Section 1071 data, stating that it will conduct a separate notice-and-comment rulemaking to determine what application-level information will be made public and what modifications are necessary to protect borrower privacy and proprietary business information.
Putting It Into Practice:After litigation, revisions, and multiple compliance date-extensions (previously discussed here, here, and here), the CFPB has now finalized a revised Section 1071 rule.Although the revised rule substantially reduces the number of covered institutions and required data points, banks, fintech lenders, and other small business finance providers should continue evaluating whether their origination volumes, products, and application processes may trigger future reporting obligations.Institutions should also monitor ongoing litigation and potential legislative efforts involving Section 1071, as additional changes to the reporting framework may still emerge.