CFPB Finalizes Section 1071 Rule, Raising Lending Threshold Tenfold and Cutting Data Points

The Consumer Financial Protection Bureau has finalized a sweeping revision to its small business lending data collection mandate, raising the reporting threshold tenfold and slashing the number of required data points. Under the new framework for Section 1071 of the Dodd-Frank Act, financial institutions will only be required to report demographic and lending data if they originate at least 1,000 covered small business loans annually, up from the 100-loan threshold established in 2023. Furthermore, the rule lowers the definition of a "small business" from an entity with $5 million in gross annual revenue to one with $1 million or less. This regulatory pivot resolves a multi-year tension between the need for transparency in fair lending and the operational survival of community banks. By scaling back the mandate, the CFPB has effectively exempted thousands of smaller credit unions and local banks from a compliance burden that many warned would force them to exit the commercial lending market entirely.[1][2]

The mechanism behind the rollback reflects a fundamental shift in the CFPB's regulatory philosophy, moving from a maximalist data-gathering approach to an incremental one. Section 1071 was originally designed to do for small business lending what the Home Mortgage Disclosure Act did for residential mortgages: require lenders to collect and report data on the race, sex, and ethnicity of applicants to identify and prevent discriminatory practices. However, the 2023 iteration of the rule faced intense industry pushback and multiple federal court challenges over its expansive scope. In response, the 2026 final rule categorically excludes Farm Credit System lenders, merchant cash advances, agricultural loans, and any credit transactions under $1,000. The agency argues that starting with a narrower focus on core lending products and higher-volume lenders will ensure better data quality and prevent immediate disruptions to the availability of credit.[1]

Crucially, the agency has eliminated five discretionary data points that were previously required under the 2023 framework. Financial institutions will no longer have to report the application method, the application recipient, the specific reasons for a loan denial, pricing information, or the number of workers employed by the applicant. Lenders will now focus solely on the core statutory requirements, such as the demographic profile of the principal owners and basic loan approval metrics. The removal of pricing information and denial reasons is particularly significant, as these metrics are traditionally used by regulators to determine if minority applicants are being charged higher interest rates or rejected at higher frequencies than white applicants with similar financial profiles.

The compliance timeline has also been streamlined to provide the industry with a definitive window for implementation. The CFPB has replaced the complex, multi-tiered schedule of the previous rule with a single, unified start date of January 1, 2028, for all covered financial institutions. Additionally, the agency has instituted a 12-month good-faith grace period running through December 31, 2028. During this period, the CFPB's supervisory focus will be on helping institutions build effective compliance programs rather than imposing strict liability or penalties for unintentional reporting errors. This extended runway allows high-volume lenders to move past reactive compliance and systematically integrate the new threshold filters into their digital lending platforms.

The practical stakes of this revision are immense for both the financial sector and the small business owners it serves. For community banks and credit unions, the rollback translates directly into millions of dollars in saved compliance software upgrades and staffing costs. These institutions argue that the 2023 rule would have required them to pass those costs onto borrowers in the form of higher interest rates or steeper origination fees. Conversely, for fair lending advocates and minority business owners, the stakes involve the potential loss of visibility into systemic discrimination. Without mandatory reporting on the full spectrum of the market, civil rights groups warn that it will be significantly harder to hold lenders accountable for disparate impact in their underwriting algorithms and manual credit decisions.[3]

The case for the revised rule is anchored in the preservation of market competition and the prevention of credit contraction. Evidence from industry analysts and legal advisories suggests that the original 100-loan threshold captured too many institutions that lacked the economies of scale to absorb the regulatory overhead. By raising the threshold to 1,000 originations, the CFPB estimates that the rule will still cover approximately 92 to 93 percent of the total small business loan volume originated by depository institutions, while exempting the vast majority of the institutions themselves. This trade-off prioritizes the volume of capital flowing into the market over the absolute granularity of the data. Proponents argue that an incremental approach ensures that the data collection regime is sustainable and does not inadvertently harm small businesses by driving their local lenders out of business.[1]

The case against the rollback challenges the CFPB's assumptions about compliance costs and highlights the severe evidentiary gaps created by the new thresholds. Fair lending organizations point out that reducing the small business revenue cap from $5 million to $1 million excludes a massive swath of the commercial market from oversight. Evidence presented by the National Community Reinvestment Coalition indicates that businesses with revenues between $1 million and $5 million still face significant, documented obstacles to accessing credit, particularly when owned by women or minorities. Furthermore, critics argue that the analogy to the Home Mortgage Disclosure Act's 1975 rollout is flawed; modern loan origination software and cloud computing make data collection exponentially cheaper and more automated today than it was fifty years ago.

Evaluating the evidence on both sides reveals a stark division in how the two camps measure success. The banking sector measures success by the uninterrupted flow of capital and the avoidance of market consolidation, pointing to the fact that community banks fund a disproportionate share of local small businesses. If those banks were forced to sell or merge due to compliance costs, local credit availability would shrink. Fair lending advocates measure success by the ability to audit and enforce the Equal Credit Opportunity Act. They point to historical data showing that without strict reporting mandates, discriminatory practices persist in the shadows. The elimination of merchant cash advances from the reporting requirements is particularly contentious, as these high-cost financial products are frequently marketed to vulnerable small businesses that cannot secure traditional bank loans.[3]

Ultimately, this regulatory framework fits well when the primary policy goal is to maintain a high volume of active lenders in the market and to protect community institutions from being crushed by federal compliance overhead. It acknowledges the operational realities of smaller banks and prioritizes the availability of credit over the perfection of oversight. However, the 2026 rule does not fit when the objective is to achieve immediate, comprehensive transparency across the entire spectrum of commercial lending. It fails to provide the granular pricing and denial data necessary for aggressive fair lending enforcement, and it leaves mid-sized small businesses and users of alternative financing products outside the protective scope of the data collection regime.[3]