On May 1, 2026, the Consumer Financial Protection Bureau (CFPB) issued a final rule making substantial revisions to the Section 1071 small business lending rule, which revises Regulation B, subpart B, and implements the small business lending data collection requirements in Section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “2026 Rule”). The 2026 Rule became effective on June 30, 2026, and significantly narrows the scope of the Section 1071 final rule that was first issued on March 30, 2023 (the “2023 Rule”). This article summarizes the principal changes the 2026 Rule makes to the 2023 Rule and what they mean for covered financial institutions. While the 2026 Rule’s narrower scope excludes certain lenders that would have been covered under the 2023 Rule, financial institutions that remain covered should begin evaluating their compliance obligations and preparing for implementation. The 2026 Rule has a mandatory compliance date of January 1, 2028.
Background
Section 1071 of the Dodd-Frank Act amended the Equal Credit Opportunity Act (ECOA) to require financial institutions to compile, maintain, and submit to the CFPB certain data on business credit applications from small businesses. Congress enacted Section 1071 to facilitate the enforcement of fair lending laws and to help identify business and community development needs and opportunities of women-owned, minority-owned, and small businesses, with the overall goal of reducing discrimination against such businesses to make it easier for them to access credit.
Lawsuits challenging the 2023 Rule were filed shortly after it was issued, and its original compliance deadlines were extended twice, as we discussed in our September 2025 article covering this topic. In November 2025, the CFPB issued a proposed rule that would significantly revise the 2023 Rule, explaining that the 2023 Rule’s broad initial coverage was not conducive to the long-term success of the data collection regime. The CFPB further indicated that industry reactions to the 2023 Rule, including the ongoing litigation, suggested that it should begin with more modest requirements that could be expanded over time. Accordingly, the 2026 Rule reflects the CFPB’s view that an “incremental approach” to data collection that focuses on core lending products, providers, and data points will better advance the purposes of section 1071 and minimize any negative initial impact on small business lending markets and data quality.
Key Changes in the 2026 Final Rule
- Higher Covered Financial Institution Threshold
The 2026 Rule raises the threshold for covered financial institutions from originations of 100 to 1,000 covered credit transactions for each of the preceding two calendar years. The CFPB estimates this will still capture approximately 92 to 93 percent of small business loan volume, compared to approximately 94 to 95 percent under the 100-origination threshold. The 2026 Rule also excludes Farm Credit System lenders from the definition of “covered financial institution.”
- Narrower Covered Credit Transactions
The 2023 Rule covered business credit products broadly, including loans, lines of credit, credit cards, and merchant cash advances, and did not exclude agricultural credit. The 2026 Rule excludes merchant cash advances (MCAs), agricultural lending, and small-dollar loans of $1,000 or less from the definition of “covered credit transaction.”
- Revised Small Business Definition
The 2023 Rule defined a “small business” as one with a gross annual revenue of $5 million or less in the preceding fiscal year. The 2026 Rule reduces that threshold to $1 million or less, adjusting for inflation in $100,000 increments every five years after January 1, 2030.
- Streamlined Data Points and Demographic Data
The 2023 Rule included statutory data points specifically identified in Section 1071, as well as several discretionary data points. The 2026 Rule removes the following discretionary data points: application method, application recipient, denial reasons, pricing information, and number of workers. With respect to demographic data, the 2026 Rule no longer requires the collection of LGBTQI+-owned business status data.
- Removal of Anti-Discouragement Provisions
The 2023 Rule prohibited covered financial institutions from discouraging applicants from responding to requests for demographic information and required them to maintain procedures to monitor for signs of potential discouragement. The 2026 Rule removes the anti-discouragement and monitoring requirements because the CFPB concluded they were redundant and added “unnecessary regulatory complexity” to covered financial institutions’ obligation to request applicant-provided data.
- Single Compliance Date of January 1, 2028
The 2026 Rule replaces the 2023 Rule’s tiered compliance timeline, establishing a single compliance date of January 1, 2028, for all covered financial institutions. The 2026 Rule also maintains a twelve-month grace period for 2028 data. During this period, covered financial institutions generally will not be required to resubmit data unless errors are material, and the CFPB does not intend to assess penalties for unintentional and good-faith errors.
Looking Ahead
The 2026 Rule represents a meaningful scaling back of the original 2023 Rule. By raising the covered-institution threshold, narrowing the small-business definition, excluding certain credit products, and streamlining data points, among other changes, the CFPB has adopted an approach that reduces the compliance burden for many lenders while still capturing the vast majority of small business lending. However, for financial institutions that remain covered, the 2026 Rule leaves many of the 2023 Rule’s fundamental compliance obligations largely unchanged. Accordingly, those institutions should use the time before the January 1, 2028, compliance date to reassess their coverage status under the revised thresholds, determine whether any of their products are excluded from coverage, evaluate changes needed to forms and data collection processes, and confirm that reporting systems can support compliance under the new framework. Institutions should also continue monitoring further CFPB guidance and litigation developments that could affect implementation.
Riyana Daulat, a student at Duke University School of Law, contributed to this article while working as a summer associate at FBT Gibbons.