Originally published on November 24, 2025 following the CFPB’s proposed revisions to Section 1071. This article was updated on May 15, 2026 to reflect the finalized rule published in the Federal Register on May 1, 2026.
The Consumer Financial Protection Bureau (CFPB) finalized revisions to its Section 1071 small business lending rule on May 1, 2026. The final rule narrows institutional coverage, reduces required data collection fields, and establishes a uniform compliance timeline beginning with 2028 data collection and a June 1, 2029 submission deadline.
The May 2026 rule confirms and in some areas extends the scope reductions from the November proposal, resulting in a framework that is significantly narrower than the original 2023 rule.
For financial institutions that paused implementation efforts while awaiting regulatory clarity, the final rule now establishes the framework institutions must evaluate moving forward.
"This final rule is a significant recalibration. Fewer institutions are covered, fewer fields are required, and the timeline is clear. What has not changed is the need for accurate, defensible data. That is what we built the RiskExec 1071 module to deliver."
— Dr. Anurag Agarwal
President & Founder, RiskExec
The November 2025 proposal established the broad contours of the revised framework. The May 2026 final rule largely confirms those changes while adding two notable exclusions: merchant cash advances and agricultural credit are now explicitly excluded from covered credit transactions.
Demographic data collection, which drove much of the operational complexity in the original rule, has been removed entirely. Required data points have been reduced to approximately 13.
The compliance timeline is also now concrete. Institutional systems have to be operational by January 1, 2028 to prepare for and start an actual full year of 2028 data collection. That data must be submitted to the CFPB by June 1, 2029. With this timeline in place, most Institutions should have systems in place beginning January 1, 2027 to give themselves a full year of testing and validating new complex processes involved in this data collection and submission.
| Area | Original Rule (2023) | Proposed Revision (Nov 2025) | Final Rule (May 2026) |
| Covered Credit | Included factoring, leases, and trade credit | Excludes these; focuses on loans, lines, and credit cards | Same as proposed, plus merchant cash advances and agricultural credit now explicitly excluded |
| Coverage Threshold | 100+ transactions | 1,000+ transactions | 1,000+ transactions (confirmed) |
| "Small Business" Definition | SBA-aligned | ≤ $1M in gross annual revenue | ≤ $1M in gross annual revenue (confirmed) |
| Data Fields | 21 required fields plus optional fields (81 total data points) | Fewer required; drops pricing and denial reasons | ~13 required data fields; no demographic data collection |
| Compliance Date | Phased by institution size | Uniform date: January 1, 2028 | Uniform date: Systems live by January 1, 2028; collect 2028 data; submit by June 1, 2029 |
Section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act requires lenders to collect and report data on small-business credit applications. The purpose is to promote fair access to credit and identify potential barriers or disparities in lending to small businesses, including those owned by women and minorities.
The rule operates under Regulation B, the implementing regulation of the Equal Credit Opportunity Act (ECOA). The CFPB uses Section 1071 data to assess whether small businesses have equitable access to financing and to inform fair lending examinations.
The final rule focuses reporting on traditional business loans, lines of credit, and credit cards. Merchant cash advances, agricultural credit, sales-based financing, and small-dollar loans are all excluded. This narrowing is meaningful for institutions with diverse small business product sets that previously had to assess coverage across a broader range of products.
Only financial institutions that originated 1,000 or more covered small business credit transactions in each of the two preceding calendar years are required to report.
Many institutions that fell within scope under the original rule do not meet this threshold. Reassessing your institution's coverage status is the most immediate action item.
A "small business" is defined as an entity with gross annual revenue of $1 million or less.
This definition is narrower than the original SBA-aligned definition, which means fewer transactions will qualify as reportable even for covered institutions.
The final rule requires approximately 13 data fields, down from 81 in the original rule.
Demographic data collection has been removed entirely. Pricing, denial reasons, application method, and number of workers are also no longer required.
This substantially reduces the data infrastructure burden compared to what institutions were originally preparing to support.
Although the rule’s reporting deadline falls in 2029, institutions must collect a complete calendar year of 2028 data.
Many institutions may find that systems, workflows, and validation procedures should be operational well before January 1, 2028 to support testing, staff training, and data quality review.
| Milestone | Timeline |
| Operational preparation and testing | During 2027 |
| Begin required data collection | January 1, 2028 |
| First CFPB submission deadline | June 1, 2029 |
"This final rule is a significant recalibration. Fewer institutions are covered, fewer fields are required, and the timeline is clear. What has not changed is the need for accurate, defensible data. That is what we built the RiskExec 1071 module to deliver."
— Dr. Anurag Agarwal
President & Founder, RiskExec
Before building or adjusting any 1071 infrastructure, your institution should confirm whether you remain a covered reporter under the final rule. The combination of the 1,000-transaction threshold, the $1 million small business definition, and the narrowed product scope will remove a meaningful number of institutions from the reporting obligation entirely.
Institutions that built compliance infrastructure toward the original 81-field framework may have more than what the final rule requires. A 13-field submission is a different operational problem. Auditing your existing build against the final rule's actual requirements is a worthwhile step before investing further.
The final rule maintains the principle that merger activity does not erase or retroactively alter reporting responsibilities.
Institutions exploring strategic combinations should assess 1071 compliance implications early in the M&A process, both to understand whether the combined entity meets the coverage threshold and to manage integration timelines around the operational deadline.
Some states, including New York through the New York Department of Financial Services (NYDFS), maintain separate small business lending reporting requirements. State obligations are not affected by the federal final rule and require separate analysis.
"The required data fields for the final rule are already in RiskExec's platform. When the rule was finalized today, our clients did not have to wonder whether they were covered. That is exactly the position we want them in."
— Dr. Anurag Agarwal
President & Founder, RiskExec
The data fields required under the final rule are already supported in RiskExec's Small Business Lending (1071) module. The platform centralizes small business loan data capture, applies filing instruction guide validations, and includes built-in NYDFS reporting fields for institutions with state-level obligations.
RiskExec's team is reviewing the Federal Register publication in detail and will update the platform to reflect the final rule's specific requirements. Clients will not need to manage that transition manually. As updates ship, we will communicate clearly through release notes and direct outreach.
For institutions that have been waiting to begin their 1071 build, RiskExec provides a structured path to compliance: data collection, validation, analytics, and reporting in one place, without the fragmented tooling and manual processes that make compliance programs slower and harder to defend.
The operational deadline is concrete. Getting started now gives your institution time to implement thoughtfully, train your team, and collect clean data from day one of the collection year.
Request a demo of RiskExec's 1071 SBL Module to see how your institution can be ready.
The core purpose of Section 1071 remains intact.
The CFPB's interest in understanding access to credit for small businesses has not diminished; the rule has been calibrated, not abandoned. The requirement to track and report covered transactions remains in force for covered institutions. The Bureau has signaled that it will use this data in fair lending analysis, and institutions should maintain that context as they build their programs.
While this rule narrows the scope of small business lending data collection compared to the 2023 final rule, the CFPB makes clear throughout the preamble that this is a starting position.
The CFPB describes its approach as “incremental” and commits to ongoing monitoring of merchant cash advances, Farm Credit System lenders, agricultural lending, and other excluded categories, stating it "may revisit the scope of its coverage of credit products in future rulemakings."
The rule also preserves future reassessment mechanisms, including:
Discretionary data points removed from the current rule, including pricing, denial reasons, application method, and number of workers, are explicitly preserved as candidates for reintroduction. Lenders below today's thresholds or in excluded segments should treat this rule as a deliberate first iteration and expect future expansions to be on the table.
Section 1071 requires lenders to collect and report on small-business lending data to promote fair and equal access to credit.
No. The CFPB published the final rule in the Federal Register on May 1, 2026. It is now finalized.
Recommended by January 1, 2027. Institutions must prepare systems well in advance of the 2028 compliance date to meet the June 1, 2029 submission deadline.
Financial institutions that originated 1,000 or more covered small business credit transactions in each of the two preceding calendar years.
Approximately 13 data fields. Demographic data, pricing, denial reasons, and several other fields required under the original rule have been removed.
Regulation B enforces the Equal Credit Opportunity Act (ECOA), ensuring that credit applicants are treated fairly regardless of personal characteristics.
This article reflects our reading of the final rule as published on May 1, 2026 in the Federal Register. It is informational and does not constitute legal advice. Institutions should consult qualified counsel when making compliance determinations.
