CFPB Issues Final Section 1071 Rule on Small Business Lending Data Collection
On May 1, 2026, the Consumer Financial Protection Bureau (“CFPB” or “Bureau”) issued its final rule substantially revising subpart B of Regulation B, which implements section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”)1 (the “Final Rule”). This rule requires lenders to collect and report data on their lending activities to women-owned, minority-owned, and small businesses. The rule significantly scales back certain aspects of the agency’s prior rulemaking efforts, but maintains at its core an implementation and enforcement mechanism for section 1071 of the Dodd-Frank Act, including the required collection of the small business lending data points identified in the statute. Accordingly, while the new Final Rule may be somewhat less burdensome than its predecessor, the Final Rule still imposes substantial compliance obligations on small business lenders.
Background
Congress enacted section 1071 in 2010, requiring creditors to collect, and report to the CFPB, certain information designed to identify fair lending gaps and opportunities to women-owned, minority-owned, and small businesses. In 2019, as the CFPB still had not conducted rulemaking on the requirement, two community groups and two individuals filed suit to compel the agency to commit to a timeline for the rulemaking.2 Pursuant to the 2020 settlement of that action,3 the Bureau issued a final rule in 2023 (the “2023 Rule”), which adopted broad coverage of lenders, products, and data points.4 The 2023 Rule quickly became the subject of criticism and litigation,5 and the Bureau thereafter issued interim final rules extending compliance deadlines in accordance with court orders.6
In 2025, the Bureau published a notice of proposed rulemaking (the “2025 NPRM”) seeking to narrow the 2023 Rule’s scope, citing feedback from stakeholders, ongoing litigation, and directives under Executive Orders 14192 and 14219 concerning regulatory burden and efficiency.7 The Bureau provided a 30-day comment period and received approximately 410 comments. The Bureau, under its new leadership, reasoned that the 2023 Rule had given insufficient weight to qualitative differences among lender types and to the compliance challenges facing smaller lenders, and that a narrower initial collection—modeled on the gradual development of data collection under the Home Mortgage Disclosure Act (“HMDA”)—would better serve section 1071’s statutory purposes over the long term.
Key Aspects of the Final Rule
The Final Rule makes significant changes to the 2023 Rule, generally reducing the scope of the requirements, including with respect to covered transactions, covered financial institutions, and requirements imposed on covered financial institutions. The Final Rule largely adopts the rule as proposed in the 2025 NPRM, with some adjustments.
Below, we highlight the key provisions of the Final Rule.
Covered Credit Transactions: The definition of a “covered credit transaction” under the Final Rule reflects a focus on “core” lending products: loans, lines of credit, and credit cards. To that end, the definition expressly excludes three additional categories of credit from the definition of “covered credit transaction” as compared to the 2023 Rule: merchant cash advances (“MCAs”), agricultural lending, and small-dollar loans of $1,000 or less. Notably, in the preamble to the Final Rule, the CFPB signals that it may walk back its prior interpretation that MCAs are credit under ECOA, stating: “The Bureau believes . . . that further analysis is required to determine what subset of MCAs constitute credit for purposes of ECOA.” MCAs are defined under the Final Rule as agreements “under which a small business receives a lump-sum payment in exchange for the right to receive a percentage of the small business’s future sales or income up to a ceiling amount.” The CFPB’s decision to exclude MCAs conforms with the Bureau’s stated focus on core lending products—MCAs are structured as purchases of future receivables, rather than as loans extending credit. Still, the CFPB recognized in the Preamble to the Final Rule that certain advances could resemble loans, signaling that the CFPB may consider conducting further analysis. For now, however, MCA transactions are excluded from the Final Rule. The Final Rule continues to exclude trade credit, HMDA-reportable transactions, insurance premium financing, incidental credit, factoring, true leases, purchases of a credit transaction, purchases of an interest in a pool of credit transactions, and purchases of a partial interest in a credit transaction.
Covered Financial Institutions: The Final Rule makes two principal changes to the definition of “covered financial institution.” First, it raises the origination threshold for a “covered financial institution” to from 100 to 1,000 covered credit transactions in each of two consecutive calendar years. According to the Bureau's data, the 1,000-loan threshold will still capture 92 to 93 percent of small-business loan volume while materially reducing compliance costs for lower-volume lenders.
Indirect Lending: The Final Rule clarifies that, in indirect lending contexts (e.g., auto lending), if the last financial institution with authority to set material terms is not a covered financial institution, the application is not reported. The CFPB also noted in the Final Rule that commentary to the rule makes clear that “covered credit transaction” does not include the purchase of an originated credit transaction.
Definition of Small Business: The Final Rule reduces the gross annual revenue threshold in the definition of “small business” from $5 million or less to $1 million or less. The CFPB supported this change by asserting that the updated threshold “strikes the right balance between maintaining broad coverage of small businesses and reducing regulatory burden on financial institutions,” including because this threshold better aligns with other existing financial regulatory requirements.
Data Points: The Final Rule removes the following discretionary data points previously required under the 2023 Rule: application method, application recipient, denial reasons, pricing information, and number of workers. The Bureau concluded that these discretionary data points were not statutorily required, were not intertwined with the statutorily required data points, and added operational complexity that threatened data quality. The Final Rule also modifies collection of business ownership status data and the format of demographic data concerning principal owners, including removal of the LGBTQI+-owned business status data point.
Anti-discouragement: The Final Rule removes anti-discouragement provisions and monitoring requirements, including the peer-comparison response-rate monitoring provisions. The 2023 Rule would have required financial institutions to maintain procedures to identify and respond to signs of potential discouragement, including low applicant response rates. The Bureau determined these provisions were redundant of the general obligation under the rule for covered financial institutions to request applicant data. The CFPB asserted that based on those obligations and its authority under the rule to supervise and enforce the rule, the anti-discouragement provisions and monitoring requirement was unnecessary. Moreover, the CFPB determined that the provisions were subjective compliance standards based on anticipatory (not evidence-based) concerns of evasion and raised First Amendment concerns insofar as they restricted lenders from sharing non-misleading opinions critical of the rule.
Compliance Dates and Transition: The Final Rule establishes a single compliance date of January 1, 2028 for all covered financial institutions, instead of the 2023 Rule’s tiered compliance timeline based on origination volume. Accordingly, covered financial institutions must begin data collection and reporting for the calendar year beginning January 1, 2028. The Final Rule adopts a special transition rule that permits (but does not require) financial institutions to use calendar years 2025 and 2026—rather than 2026 and 2027—as the look-back period for determining initial coverage. The effective date of the Final Rule itself is June 30, 2026.
Privacy and Public Disclosure of Data: The Final Rule does not address privacy and data publication discussions from the 2023 Rule. The CFPB plans to address these issues in a separate NPRM, likely following the collection of the first year’s worth of data under the Final Rule.
Grace Period: The Final Rule retains the grace period under the 2023 Rule, updated to cover January 1, 2028, through December 31, 2028. The grace period provides that during the initial year of mandatory data collection, the CFPB generally will not assess penalties for data errors, provided lenders make good-faith efforts to comply.
Differences Between the Final Rule and the 2023 Rule
The 2026 Final Rule substantially narrows the 2023 Rule. The principal differences are summarized below.
| Topic | 2023 Final Rule | 2026 Final Rule |
|---|---|---|
| Covered credit transactions | Broad coverage, including MCAs and agricultural loans. | Excludes MCAs, agricultural lending, and small-dollar loans of $1,000 or less. |
| Covered financial institution – origination threshold | 100 covered originations in each of two preceding calendar years. | 1,000 covered originations in each of two preceding calendar years. |
| Small-business definition | Gross annual revenue of $5 million or less. | Gross annual revenue of $1 million or less. |
| Data points | Included statutorily required and discretionary data points. | Removes data points on application method, application recipient, denial reasons, pricing information, and number of workers; modifies collection of demographic data points. |
| Anti-discouragement and monitoring | Required financial institutions to maintain procedures on anti-discouragement. | Removes anti-discouragement provisions. |
| Compliance dates | Tiered compliance dates based on volume. | Single compliance date of January 1, 2028 for all covered institutions, plus an optional 2025–2026 alternative look-back period. |
| Privacy and data publication | Preliminary, non-binding assessment of selective deletion/modification; no final vehicle identified. | Does not adopt any privacy framework; Bureau anticipates a separate notice-and-comment rulemaking after the first year of data collection. |
****
The updated Section 1071 Final Rule will likely be less burdensome for covered financial institutions to implement than the 2023 Rule. However, implementing processes, policies, and procedures to comply with the Final Rule are still likely to require significant effort and resources. Accordingly, small-business lenders will need to adjust their plans for compliance based on the updated Final Rule and continue to build out processes to collect and report the required information. Mayer Brown is available to assist in navigating the complexities of the small-business data collection rule as it applies to your business.
1 CFPB, Small Business Lending Under the Equal Credit Opportunity Act (Regulation B), 91 Fed. Reg. 23,530 (May 1, 2026).
2 See CFPB Finally Makes Progress on Implementing Small Business Lending Data Collection Requirements (Sept. 20, 2020); CFPB Holds Symposium on Dodd-Frank Section 1071; Outlines Plan in Court Documents (Nov. 13, 2019); Ladies and Gentlemen, (Re)start Your Engines — CFPB Symposium on Women/Minority/Small Businesses Credit Data (Oct. 30, 2019).
3 See Long-Awaited Section 1071 Small Business Rulemaking Is Finally on the Horizon (Feb. 26, 2020).
4 CFPB, Small Business Lending Under the Equal Credit Opportunity Act (Regulation B), 88 Fed. Reg. 35,150 (May 31, 2023). For a detailed summary of the 2023 Rule, please see CFPB Finalizes Long-Awaited Small Business Data Collection Rule (Apr. 3, 2023). See also CFPB Issues Proposed Small Business Lending Rule (Sept. 1, 2021).
5 For prior coverage of litigation on the CFPB’s 2023 Rule, please see: 1071 Small Business Data Collection Rule Stayed (Again) (Feb. 7, 2025); Federal Court Issues Nationwide Injunction In Small Business Data Collection Rule Lawsuit (Nov. 2, 2023). See also, e.g., Texas Bankers Association v. CFPB, No. 24-40705, 2025 WL 429913 (5th Cir. Feb. 7, 2025).
6 See CFPB, Small Business Lending Under the Equal Credit Opportunity Act (Regulation B); Extension of Compliance Dates, 90 Fed. Reg. 25,874 (June 18, 2025); CFPB, Small Business Lending Under the Equal Credit Opportunity Act (Regulation B); Extension of Compliance Dates, 89 Fed. Reg. 55,024 (July 3, 2024).
7 CFPB, Small Business Lending Under the Equal Credit Opportunity Act (Regulation B), 90 Fed. Reg. 50,952 (Nov. 13, 2025).
