CFPB Issues Final Section 1071 Rule on Small Business Lending Data Collection

Why It Matters

The revisions cut compliance costs for most lenders while preserving essential data to monitor fair‑lending gaps, directly affecting credit access for underserved businesses and shaping industry reporting standards.

Key Takeaways

• CFPB raises loan‑originations threshold to 1,000, covering 92% volume.
• Excludes merchant cash advances, ag loans, and loans ≤ $1,000.
• Small‑business revenue definition cut to $1 million.
• Discretionary data points and anti‑discouragement rules removed.
• Single compliance date set for Jan 1 2028 with 2028 grace period.

Pulse Analysis

Section 1071 was created to shine a light on credit disparities affecting women‑owned, minority‑owned and small enterprises. Since its 2010 enactment, the CFPB has wrestled with how to balance comprehensive data collection against the operational burden on lenders. The 2023 rule attempted broad coverage but sparked litigation and industry pushback, prompting the agency to revisit its approach. By issuing the 2026 final rule, the CFPB aligns its data‑gathering mandate with lessons from the Home Mortgage Disclosure Act, focusing on core credit products while still capturing the majority of small‑business lending activity.

The final rule’s most consequential shifts include a higher loan‑origination threshold—1,000 covered transactions over two years—yet still captures roughly 92‑93% of loan volume, according to CFPB estimates. Excluding merchant cash advances, agricultural loans, and micro‑loans under $1,000 narrows the reporting universe to traditional loans, lines of credit and credit cards. The definition of a small business now caps annual revenue at $1 million, tightening eligibility and reducing the number of firms subject to reporting. By stripping discretionary data points such as denial reasons and pricing, and removing anti‑discouragement monitoring, the agency reduces reporting complexity and potential First Amendment concerns.

For lenders, the single compliance date of January 1, 2028 simplifies planning but demands robust data‑collection infrastructure well before that deadline. The optional 2025‑2026 look‑back period offers a brief window to assess coverage, while the 2028 grace year shields institutions from penalties for good‑faith errors. Industry observers anticipate that the refined data set will still enable regulators to identify credit gaps, but with a more manageable reporting load. As the CFPB signals a forthcoming rulemaking on privacy and public disclosure, firms should embed flexible data‑governance practices now to accommodate future transparency requirements.