CFPB Finalizes Scaled-Back Demographic Data Rule for Small Business Lenders

The Consumer Financial Protection Bureau (CFPB) has finalized its long-awaited Section 1071 rule, mandating demographic data collection on small business loans while drastically reducing the number of lenders required to comply. The revised framework, published in May 2026, represents a massive recalibration of a regulation that has been mired in litigation and industry pushback for years. By scaling back the scope, the agency aims to secure the rule's survival, though the concessions have sparked fierce criticism from civil rights groups.[1][2]

The most significant shift lies in the compliance threshold. Under the original 2023 rule, any financial institution originating 100 or more small business loans annually was required to report data. The 2026 final rule increases that threshold tenfold to 1,000 originations per year. This single adjustment removes thousands of community banks and credit unions from the regulatory perimeter, dropping the number of affected lenders from roughly 2,500 to just 280.[1][2]

The volume of information collected from borrowers has also been slashed. The previous iteration required lenders to report 81 distinct data points. The new rule narrows that list to 13, eliminating discretionary metrics that the CFPB had previously added. Lenders will no longer be required to report the pricing of the loan, the specific reasons for denying an application, or the LGBTQ+ status of the business owners. The demographic collection is now strictly aligned with binary sex categories, consistent with recent executive branch directives.[1][2]

The mechanism for collection requires covered lenders to present a standardized form to small business applicants, requesting details on the race, ethnicity, and sex of the principal owners. This data is then anonymized and submitted to the CFPB to build a public database. The underlying statutory authority comes from Section 1071 of the 2010 Dodd-Frank Act, which amended the Equal Credit Opportunity Act (ECOA) to mandate this collection specifically to identify fair lending gaps and community development needs.[2][4]

The ECOA, originally passed in 1974, makes it unlawful for any creditor to discriminate against any applicant on the basis of race, color, religion, national origin, sex, marital status, or age. The Department of Justice and the Federal Trade Commission share enforcement authority over the ECOA, using data to identify patterns or practices of discrimination. The new CFPB rule is designed to provide the data necessary to enforce these decades-old protections in the commercial lending space.[3][6][7]

To further narrow the rule's focus, the CFPB redefined what constitutes a "small business" for the purposes of data collection. The 2023 rule applied to businesses with up to $5 million in gross annual revenue. The 2026 revision lowers that cap to $1 million, ensuring the reporting burden only applies to loans issued to truly small enterprises.[1][2]

Several major lending categories have been entirely excluded from the new framework. Merchant cash advances, agricultural loans, and small-dollar loans under $1,000 are no longer considered covered credit transactions. The categorical exclusion of Farm Credit System lenders further reduces the regulatory footprint in rural and agricultural financing.[1]

The CFPB's pivot follows intense legal and political pressure. After the 2023 rule was finalized, industry groups launched multiple federal lawsuits, securing injunctions that paused the rule's implementation. Facing the prospect that a court might strike down the entire framework, the agency opted to revise the rule to focus strictly on the core statutory requirements.[1][5]

Regulators are framing the scaled-back rule as an "incremental approach" rather than a retreat. The CFPB explicitly compared the strategy to the Home Mortgage Disclosure Act, which began with basic data collection in 1975 and gradually expanded its reporting requirements over five decades. The agency views the 2026 rule as a foundational first step that can be broadened through future rulemakings once the core infrastructure is established.[1][2]

The financial industry has largely celebrated the revisions. Trade associations representing credit unions and community banks had long argued that the 2023 rule's operational complexity would force smaller institutions to exit the small business lending market entirely. Industry leaders praised the CFPB for listening to concerns, noting that the original rulemaking was significantly burdensome and would have restricted the very credit access it aimed to protect.[1]

The compliance timeline has been streamlined to provide certainty for the remaining covered lenders. The rule officially takes effect on June 30, 2026, but features a single, unified compliance date of January 1, 2028. To determine if they meet the 1,000-loan threshold, institutions will use a look-back period examining their origination volumes in calendar years 2026 and 2027.[1][2]

While lenders are relieved, fair lending advocates argue the CFPB has gutted the statute's intent. Consumer groups estimate that the combination of the higher lender threshold and the lower revenue cap will result in the loss of up to half of all small business loan data. Advocates contend that without this data, discriminatory lending practices will remain hidden in plain sight.[1]

The loss of pricing data is a particular point of contention for civil rights groups. Without knowing the interest rates and fees charged to different borrowers, advocates argue it will be impossible to determine if minority-owned businesses are being steered into more expensive credit products even when they are approved for loans.[1]

The exemptions also threaten to create geographic blind spots. Because the rule spares smaller community banks, advocates warn that data collection will be severely impaired in rural counties and smaller metropolitan areas where these exempt institutions are the primary source of small business capital.[1]

Despite the criticism, the 2026 final rule cements the regulatory landscape for the near future. The 280 largest small business lenders must now begin the massive operational lift of updating their loan origination systems, training staff, and implementing compliance controls ahead of the 2028 deadline. While the scope is narrower, the fundamental shift toward transparency in commercial lending is now permanently codified.[1][2]