- Manish Jain
View
Share
Section 1071 has confused small-business lenders for years, and 2026 reset the board again. The CFPB finalized a heavily revised version of its small-business lending data rule in May 2026. The new rule covers fewer lenders, collects far less data, and pushes the compliance date to 2028. Still, the reprieve is smaller than it looks. Coverage now depends on how many small-business loans you originate in 2026 and 2027. In other words, the clock that decides whether the rule applies to you is already ticking.
This guide explains the revised Section 1071 rule in plain English. We cover who is affected, what data is required, the key dates, and the practical steps lenders should take this year. Throughout, we link to the primary CFPB and Federal Register sources so you can verify every detail.
Section 1071 at a glance (2026 Final Rule)
What Is CFPB Section 1071?
Section 1071 comes from the Dodd-Frank Act. It amended the Equal Credit Opportunity Act, which Regulation B enforces. The provision requires covered lenders to collect and report data on small-business credit applications. Its purpose is fair-lending oversight — specifically, tracking access to credit for women-owned, minority-owned, and small businesses. Regulators use that data to spot discrimination and gaps in the small-business credit market.
The CFPB first finalized the rule in 2023. That version was sweeping, and lenders pushed back hard. Multiple lawsuits followed, and courts paused compliance repeatedly. Consequently, the CFPB reopened the rule and proposed a slimmer version in late 2025. The 2026 Final Rule is the result, and it narrows the original dramatically.
What Changed in the 2026 Final Rule
The headline is simple: less scope, less data, more time. The revised rule replaced the old tiered schedule with one compliance date. It also raised the bar for who must comply and trimmed the data burden sharply. According to the Federal Register notice, the rule became effective on June 30, 2026, with a compliance date of January 1, 2028.
Three changes matter most. First, the coverage threshold jumped from 100 loans to 1,000 covered small-business transactions across two consecutive years. As a result, the CFPB now estimates that only around 172 to 181 depository institutions fall under the rule. Second, the data burden shrank from more than 80 fields in the 2023 rule to roughly 13. Third, the scope narrowed to exclude merchant cash advances, agricultural lending, and loans of $1,000 or less. Notably, the rule defines a small business as one with $1 million or less in gross annual revenue.
2023 Rule vs. 2026 Final Rule at a glance
| Requirement | 2023 Rule | 2026 Final Rule |
|---|---|---|
| Coverage threshold | 100 transactions | 1,000 transactions |
| Small-business revenue cap | $5 million | $1 million |
| Compliance schedule | Tiered by volume | Single date · Jan 1, 2028 |
| Data points collected | 81 | ~13 core points |
| Merchant cash advances | Included | Excluded |
| Agricultural lending | Included | Excluded |
| Loans ≤ $1,000 | Included | Excluded |
| Pricing information | Required | Removed |
| Denial reasons | Required | Removed |
| Application method & recipient | Required | Removed |
| Number of workers | Required | Removed |
Sources: CFPB 2026 Final Rule and Federal Register (May 1, 2026); removed data points per Mayer Brown analysis. Core statutory fair-lending fields remain; several demographic categories are now reported in aggregate.
◆ Insight
A smaller rule is not a small project. Even 13 fields touch your loan origination system, your data governance, and your staff training. Those changes take quarters to build, not weeks. So the narrower scope buys breathing room — it does not remove the work.
The Section 1071 Timeline: Key Dates for Lenders
The dates tell a clear story. Lenders that hit the 1,000-loan threshold in both 2026 and 2027 must begin collecting data on January 1, 2028. They then file their first Small Business Lending Application Register by June 1, 2029. Meanwhile, the CFPB has kept a 12-month grace period. During 2028, it will focus on good-faith effort rather than penalizing minor data errors.
Who Is Covered by the Revised Rule?
Coverage now hinges on volume. A lender is covered if it originated at least 1,000 covered small-business credit transactions in each of the two preceding calendar years. For the first compliance cycle, that means 2026 and 2027. Therefore, your current origination pace is effectively an eligibility test. Many community banks and credit unions will fall below the line and escape the rule entirely.
That said, plenty of active small-business lenders will clear it. Banks, credit unions, and non-bank lenders all count if they meet the threshold and are not otherwise exempt. If you sit anywhere near 1,000 annual small-business originations, you should assume coverage and plan accordingly. Guessing wrong in either direction is costly.
Quick eligibility check
| Question | If Yes | If No |
|---|---|---|
| Are you a covered financial institution? | Continue | Review exemptions |
| Do you originate covered small-business credit? | Continue | Rule may not apply |
| ≥ 1,000 covered transactions in 2026? | Track 2027 | Monitor future volume |
| ≥ 1,000 again in 2027? | Jan 1, 2028 compliance | Initial 2028 date may not apply |
| Later hit 1,000 in two consecutive years? | Future coverage applies | Keep monitoring volume |
A simplified guide, not legal advice. Confirm coverage against the CFPB final rule and qualified counsel.
What Data Must Lenders Collect?
The revised rule keeps the core fair-lending purpose while cutting the field count. Lenders still capture application-level information and demographic data tied to women-owned and minority-owned business status. However, the CFPB streamlined how that data is gathered and reported. It also removed several fields from the 2023 version and limited some demographic categories to aggregate reporting. The net result is roughly a dozen required fields instead of the original eighty-plus.
Simplicity on paper still means complexity in practice. Each field must be captured accurately, stored securely, and reported in the correct format. Moreover, certain data must be handled so that it does not improperly influence underwriting decisions. That firewall alone forces process and system changes for many lenders.
What Lenders Should Do in 2026
Preparation beats scrambling, and the runway is shorter than the 2028 date suggests. Start by counting. Measure your 2026 small-business originations against the 1,000-loan threshold and project 2027. Next, gap-assess your systems. Compare your current data capture against the revised field list and flag what is missing. Then design the collection process, including where demographic data is gathered and how it stays separated from credit decisions.
From there, the work is operational. You will need to update your loan origination system, build reporting capability, and train front-line staff on clean data capture. Above all, document everything, because the grace period rewards demonstrable good-faith effort. Lenders who treat 2026 and 2027 as build years will glide into 2028. Those who wait will not.
◆ Insight
Section 1071 is fundamentally a data-operations problem wearing a compliance costume. The legal rules are finite. The hard part is capturing clean data on every application, every time, without slowing your lenders down. That is an execution challenge, and execution is where most programs stumble.
The Operational Lift — and Where Outsourcing Helps
Compliance ownership always stays with the lender. Still, much of the 1071 burden is repetitive back-office work. Someone must capture application data accurately, chase missing fields, validate records, and keep files audit-ready. That workload spikes exactly when origination volume rises. Consequently, many lenders extend their teams rather than hire for a one-time build.
This is where a nearshore back-office partner earns its place. Bilingual teams can support application data capture, records validation, and file governance under your policies and controls. SkyCom delivers this through its commercial lending outsourcing and back-office processing services, and it applies the same discipline to KYC and AML data work. You keep the compliance decisions. Your partner absorbs the volume. For context on how lenders structure that support, our overview of banking BPO services is a useful next read.
Could Section 1071 Change Again?
Possibly, so watch this space. Some litigation risk remains even after the 2026 rule. In addition, Congress has floated bills that could reshape the rule further. The Small LENDER Act, for example, cleared a House committee in April 2026 but has not become law. For now, the January 1, 2028 compliance date stands. Prudent lenders prepare for the current rule while monitoring the CFPB for updates.
Frequently Asked Questions
What is CFPB Section 1071?
Section 1071 is a Dodd-Frank provision that amended the Equal Credit Opportunity Act. It requires covered lenders to collect and report data on small-business credit applications, supporting fair-lending oversight for women-owned, minority-owned, and small businesses.
When is the Section 1071 compliance date?
The 2026 Final Rule sets a single compliance date of January 1, 2028, when covered lenders must begin collecting data. The first Small Business Lending Application Register is then due by June 1, 2029. The rule itself became effective June 30, 2026.
Who has to comply with the revised rule?
Lenders that originate at least 1,000 covered small-business credit transactions in each of two consecutive calendar years are covered. For the first cycle, that means 2026 and 2027, so current origination volume determines coverage.
What counts as a small business under the rule?
The rule defines a small business as one with $1 million or less in gross annual revenue. The revised scope also excludes merchant cash advances, agricultural lending, and loans of $1,000 or less.
How much data must lenders collect?
The revised rule requires roughly 13 data fields, down from more than 80 in the 2023 version. Core fair-lending data remains, but collection is streamlined and some demographic categories are reported in aggregate.
Is there a grace period for errors?
Yes. The rule keeps a 12-month grace period during the first year of mandatory collection in 2028. The CFPB will focus on good-faith compliance efforts rather than penalizing minor data errors during that window.
Can Section 1071 data work be outsourced?
The lender always owns compliance, but the operational load — application data capture, validation, and file readiness — can be supported by a back-office partner working under the lender’s policies and controls. That keeps decisions in-house while absorbing the volume.
Could the rule still change?
It could. Some litigation risk remains, and Congress has floated bills such as the Small LENDER Act, which cleared a House committee in April 2026 but has not passed. For now, the January 1, 2028 compliance date stands.
Conclusion: Narrower Rule, Same Discipline
The 2026 Section 1071 rule is a gift wrapped in a deadline. It covers fewer lenders and asks for less data, which is real relief. Yet the essential work has not changed. Covered lenders must capture clean data on every small-business application and report it accurately by 2029. The counting window that decides coverage is open in 2026 and 2027, right now. Lenders who use these two years to build calm, repeatable processes will meet 2028 without drama. The winners will treat 1071 as an operations discipline, not a last-minute fire drill.
Turning 1071 into an operations problem you can staff?
SkyCom’s bilingual nearshore teams support application data capture, validation, and file readiness for lenders — under your policies and controls, at 50–70% lower cost. Keep the compliance decisions; hand off the volume.
This article is for general information only and is not legal or compliance advice. Section 1071 remains subject to litigation and potential legislative change. Always confirm current requirements with the CFPB and qualified counsel before making compliance decisions.
