CFPB's Final Rule on Small Business Lending Data (Section 1071)

On May 1, 2026, the CFPB published its final rule implementing section 1071 of the Dodd-Frank Act, the small business lending data collection and reporting rule (Final Rule or Rule). The rule is finalized largely as proposed, except that the final rule removes disaggregated data fields for race/ethnicity. While the final rule is effective June 30, 2026, the compliance date is January 1, 2028. This memorandum provides a brief overview of the Rule.

Overview

This rule amends the 2023 small business lending data rule, which did not go into effect due to litigation and a change in administration. Under the Rule, the Bureau is amending coverage of certain credit transactions and financial institutions; the small business definition; inclusion of certain data points and how others are collected; and the compliance date. The purposes are to streamline the rule, reduce complexity for lenders, improve data quality, and advance the purposes of section 1071.

Based on reactions to the 2023 final rule, including continued feedback from stakeholders and the ongoing litigation, on comments received on the 2025 proposed rule, and on further consideration, the CFPB now believes that at the onset of a potentially long-term data collection regime, it should start with more modest requirements, focusing on core lending products, lenders, and data. Over time, as the Bureau and financial institutions learn from early iterations of data collections, the Bureau could consider amending the rule.

Covered Credit Transactions: To focus on core, widely used lending products, the Final Rule excludes merchant cash advances (MCAs), agricultural lending, and small dollar loans ($1,000 or less, with inflation adjustments) from the definition of covered credit transactions.

Covered Financial Institutions: To focus on larger core lenders, the Final Rule makes two changes to the covered financial institution definition: (1) excludes Farm Credit System (FCS) lenders from coverage; and (2) raises the origination threshold from 100 to 1,000 covered transactions for each of two consecutive years.

Small Business: The final rule changes the gross annual revenue threshold of the rule’s definition of small business from $5 million or less to $1 million or less (with an inflation adjustment every 5 years). This is so the Rule’s focus initially will be truly small businesses.

Data Points: The Bureau concludes that the initial iterations of data collection should focus on core data points and be consistent with other agency directives concerning the collection of demographic data to minimize any burden accompanying new collections. The Final Rule focuses data collection on data points specifically identified in section 1071 and a limited number of other data points needed to facilitate the collection of these statutory data points. The Final Rule removes the discretionary data points for application method, application recipient, denial reasons, pricing information, and number of workers. The Final Rule also contains changes to better conform with an executive branch mandate, resulting in modifications to the collection of data concerning business ownership status and to the format of demographic data collected concerning the principal owners of a small business. In the proposed rule, the CFPB sought comment on whether it should further revise the rule’s data collection requirements to require collection only of aggregate ethnicity and race categories. Based on the comments, the CFPB decided to eliminate the use of disaggregated categories in collecting principal owners’ race and ethnicity.

Additionally, the CFPB: (1) removed references to LGBTQI+-owned businesses; (2) removed references to the term “gender”; and (3) refined the collection to ask whether a principal owner is male or female.

Time and Manner of Data Collection: Regarding the time and manner of data collection, the Final Rule removes certain requirements that are not statutorily required and appear to anticipate or presume non-compliance with the rule. The Final Rule removes references to discouragement and monitoring for indicia of discouragement (such as low response rates).

It also adds a provision that emphasizes for applicants their statutory rights under the rule, including the right to refuse to answer inquiries regarding business status, and principal owners’ ethnicity, race, and sex.

Compliance Dates: The Final Rule extends the compliance date to January 1, 2028 for all financial institutions that remain covered by the rule (eliminating the tiered compliance dates). The first full year of data will be collected in 2028 and submitted to the Bureau by June 1, 2029. The Rule also adds certain special transition rules to provide flexibility to potentially covered financial institutions. Under the Final Rule, for purposes of determining whether a financial institution is covered as of January 1, 2028, a financial institution may use the period of 2025 and 2026 instead of 2026 and 2027.

Privacy and Data Publication: The CFPB has made no decisions on what data will be published and when. It commits to addressing these issues and findings in a notice of proposed rulemaking to be published likely after the collection of the first year’s worth of data.

Grace Period: The Bureau is retaining and updating the grace period articulated in the 2023 final rule. The grace period is now from January 1, 2028 through December 31, 2028, to align with the new compliance date of January 1, 2028.