CFPB Final Rule Exempts 98% of Lenders from Small Business Data Collection

On May 1, 2026, the Consumer Financial Protection Bureau (CFPB) finalized a sweeping revision to its small business lending data collection framework, fundamentally altering the scope of one of the most debated financial regulations of the last decade. The revised rule implements Section 1071 of the Dodd-Frank Act, a mandate designed to track demographic and financial data on small business loans.[2][5]

The most consequential change in the 2026 final rule is a massive contraction in who must report. The CFPB raised the compliance threshold from 100 annual loans to 1,000 covered credit transactions. By increasing the floor tenfold, the agency has effectively exempted 98 percent of all U.S. financial institutions from the data collection mandate.[1][4]

For thousands of community banks, credit unions, and small financial technology firms, the revision represents a monumental reprieve. Under the previous framework, local lenders warned that the cost of overhauling their software systems to capture and report the required demographic data would be catastrophic. Many smaller institutions had threatened to exit the small business credit market entirely rather than shoulder the compliance burden.[4]

The saga of Section 1071 has been a multidecade regulatory project. Passed in the wake of the 2008 financial crisis, the Dodd-Frank Act directed the CFPB to create a public database for small business lending, mirroring the Home Mortgage Disclosure Act (HMDA) that tracks residential mortgages. The goal was to identify patterns of discrimination and ensure equitable access to capital for minority- and women-owned businesses.[2]

When the CFPB issued its initial final rule in March 2023, it cast a wide net. The 100-loan threshold meant that almost any institution that regularly lent to local businesses was captured. The expansive scope triggered immediate backlash, culminating in a wave of industry lawsuits and a federal court stay that paused the rule's implementation.[2]

The 2026 revision reflects a stark pivot in regulatory philosophy. Acting CFPB Director Russell Vought framed the new framework as an opportunity to "start small, expand carefully." Acknowledging the operational complexity of building a nationwide data apparatus from scratch, the agency opted to focus its resources on the mega-lenders that dominate the market.[3]

Alongside the institutional exemptions, the CFPB significantly narrowed the definition of a "small business." The 2023 rule applied to any business with up to $5 million in gross annual revenue. The 2026 rule slashes that cap to $1 million or less.[2][3]

This revenue adjustment fundamentally changes the character of the data the government will collect. By lowering the threshold, the CFPB aims to focus the reporting burden on truly small, main-street enterprises—the local bakeries, auto shops, and independent contractors—rather than mid-market companies that have more complex, negotiated credit facilities.[4]

The revised rule also carves out entire categories of financial products that were previously caught in the dragnet. Merchant cash advances (MCAs)—a popular but controversial financing method where a business receives a lump sum in exchange for a percentage of future daily sales—are now explicitly excluded from the reporting requirements.[2]

The CFPB justified the MCA exclusion by noting that these products function differently than traditional term loans or lines of credit. Because MCAs lack standard interest rates and fixed repayment schedules, the agency concluded that mixing MCA data with traditional loan metrics would produce skewed, incomparable data sets that would confuse rather than clarify the market.[2]

Agricultural lending received a similar blanket exemption. The 2026 rule excludes transactions used to fund crop production, livestock, farmland, and agricultural equipment. The Bureau reasoned that farm credit is uniquely tied to biological assets and weather risks, making its underwriting fundamentally distinct from standard commercial lending.[2][3]

The agricultural exemption marks a major victory for the Farm Credit System, a government-sponsored network of lenders that provides roughly a third of all U.S. agricultural credit. Farm Credit institutions had lobbied aggressively against the 2023 rule, arguing that the reporting requirements would impose significant costs that would ultimately be passed down to their farmer-owners. Under the 2026 rule, Farm Credit System lenders are explicitly exempt.[3][6]

While the banking industry has celebrated the rollback, the contraction has alarmed civil rights groups and fair lending advocates. By exempting 98 percent of lenders, critics argue the CFPB is creating a "dark market" where discriminatory lending practices at the neighborhood level will go entirely undetected.[1]

Advocates point out that while mega-banks originate the highest dollar volume of loans, minority-owned businesses and rural enterprises disproportionately rely on local community banks and credit unions. Without data from these smaller institutions, the government will lack the visibility required to enforce the Equal Credit Opportunity Act in the communities that need it most.[1][2]

Regulatory pragmatists counter that the volume of data captured will still be immense. Because the U.S. banking sector is highly consolidated, the 2 percent of institutions that remain covered—primarily Wall Street banks, large regional lenders, and major fintech platforms—still account for the vast majority of all small business lending by dollar volume.[2]

To ease the transition for the remaining covered institutions, the CFPB has simplified the timeline. The agency scrapped the complex, tiered compliance schedule of the 2023 rule. Now, all financial institutions that meet the 1,000-loan threshold must begin collecting the required data by a single, universal compliance date: January 1, 2028.[1][5]

The rule also eliminates several discretionary data points that the CFPB had previously added on top of the statutory requirements, further reducing the operational strain on the IT departments of major banks. However, lenders are still strictly prohibited from discouraging applicants from providing demographic information, and underwriters must be firewalled from seeing the demographic data to prevent it from influencing credit decisions.[3][4]

As the 2028 deadline approaches, the largest financial institutions are already overhauling their loan origination systems to comply. While the 2026 rule represents a massive reduction in scope, it still establishes the first comprehensive, standardized data collection regime for commercial credit in U.S. history—a foundational shift that will reshape how the government monitors the financial system for decades to come.[3][4]