The section 1071 small business lending rule requires covered lenders to collect and report data on credit applications from small businesses, including the owners' demographic information, to the CFPB. After the 2026 revisions, it covers lenders with at least 1,000 qualifying originations in each of two years, and compliance starts January 1, 2028.
What does the section 1071 small business lending rule require?
The section 1071 small business lending rule requires covered lenders to collect a set of data points on each covered application from a small business, keep the demographic answers away from decision makers where feasible, and report the data to the CFPB. It lives in subpart B of Regulation B.
Section 1071 of the Dodd-Frank Act amended the Equal Credit Opportunity Act to require this collection. The CFPB issued its first final rule in 2023. It then reconsidered it, and published a revised final rule in the Federal Register on May 1, 2026, effective 60 days after publication.
The CFPB's 2026 final rule revising the small business lending rule states the statute's two purposes: to help enforce fair lending laws, and to help communities, governments and creditors find the business and community development needs of women-owned, minority-owned and small businesses.
The revision narrowed the rule on purpose. The CFPB wrote that a long-term data collection should "start with a focus on core lending products, lenders, small businesses, and data points." The changes touch four areas: which credit is covered, which lenders are covered, the definition of a small business and the data points collected.
For lenders who read bank statements to underwrite, the rule is mostly about what happens around the decision rather than the decision itself. It asks applicants questions, records what the lender did with the application and sends the result to the CFPB. It does not tell a lender how to underwrite.
Which lenders and credit products does the section 1071 rule cover?
The section 1071 rule covers a lender that originated at least 1,000 covered credit transactions for small businesses in each of the two preceding calendar years. A small business is one with gross annual revenue of 1 million dollars or less in its preceding fiscal year. Farm Credit System lenders are excluded.
The 2026 rule raised both thresholds sharply. The origination test went from 100 to 1,000 transactions a year. The revenue line for a small business fell from 5 million dollars to 1 million dollars.
Covered credit is business credit that is not on the excluded list. The 2026 rule added three exclusions to the earlier ones:
- Merchant cash advances. The rule defines these as a lump sum given in exchange for a share of the business's future sales or income, up to a ceiling amount.
- Agricultural lending. Credit to fund crops or livestock, or to buy or refinance farm assets.
- Small dollar credit. Transactions of 1,000 dollars or less.
The MCA exclusion has a stated reason. The final rule says the CFPB "erred in the 2023 final rule by prematurely determining" that all MCAs are credit, and that it will keep watching the MCA market to see whether a subset should be included later.
Section 1071 data points after the 2026 revisions
Section 1071 data points after the 2026 revisions are the fields the statute names, plus a few that support them. The CFPB removed the discretionary fields for application method, application recipient, denial reasons, pricing and number of workers, and dropped LGBTQI+-owned status.
The current list is in Regulation B section 1002.107. The table below shows each kept field with an example value, and the removed fields beneath. The example values are invented for one imagined application.
| Data point (kept) | Example value |
|---|---|
| Unique identifier | Lender's application ID |
| Application date | 2028-03-04 |
| Credit type: product, guarantees, term | Term loan, personal guarantee, 36 months |
| Credit purpose | Working capital |
| Amount applied for | 75,000 |
| Amount approved or originated | 60,000 |
| Action taken | Originated |
| Action taken date | 2028-03-19 |
| Census tract | Tract of the business address |
| Gross annual revenue | 840,000 |
| NAICS code (three digits) | 722, food services |
| Time in business | Seven years |
| Minority-owned and women-owned status | As the applicant answers |
| Ethnicity, race and sex of principal owners | As each owner answers |
| Number of principal owners | Two |
| Data point (removed in 2026) | Status |
|---|---|
| Application method | Removed |
| Application recipient | Removed |
| Denial reasons | Removed |
| Pricing information | Removed |
| Number of workers | Removed |
| LGBTQI+-owned business status | Removed |
Gross annual revenue matters twice. It is a reported field, and it decides whether the applicant is a small business at all. A lender that reads twelve months of statements may see deposits that differ from the revenue the applicant reports. The data point is about the applicant's revenue, not the lender's deposit average, so the lender should record how it got the figure.
Collecting the demographic answers online raises a documents question. If the questions and notices go out electronically, the lender's process for ESIGN consent for loan documents should cover them.
The section 1071 firewall between demographic answers and underwriters
The section 1071 firewall bars employees and officers who make decisions on an application from seeing the applicant's answers to the demographic questions. The 2026 rule kept it unchanged. Where a decision maker should have access as part of their job, the lender may allow it if it gives each affected applicant a notice.
The firewall is in Regulation B section 1002.108. It covers minority-owned and women-owned status and the ethnicity, race and sex of principal owners. "Involved in making a determination" means taking part in a decision about evaluating the application or the applicant's creditworthiness.
The exception works like this:
- The lender decides that a specific employee, or a group, should have access, meaning they may need to collect, see, consider or use the information to do their assigned work.
- The lender gives a notice to each applicant whose answers those people will see, saying that people involved in decisions may have access.
- The notice goes with the demographic questions. If given orally, it must come before the questions are asked.
The final rule turned down requests to remove the firewall, noting that it is written into the statute itself. It said the flexibility built into the feasibility exception largely answers concerns about cost and relationship banking.
Small lenders often use the exception, because the loan officer who takes the application is also the one who underwrites it. Larger lenders with separate intake and credit teams can usually keep the answers in a system field that credit staff never see.
Demographic answers are also personal data under state privacy law. A lender operating in California should check how CCPA rules for lenders apply to information it collects for federal reporting.
Section 1071 compliance dates and the January 2028 start
Section 1071 compliance starts on January 1, 2028, for every lender that remains covered. The 2026 rule replaced the earlier staggered tiers with this single date. A lender decides whether it is covered from its 2026 and 2027 originations, or, if it prefers, from 2025 and 2026.
The final rule also kept the grace period from the 2023 rule, now running from January 1, 2028, through December 31, 2028, to line up with the single start date.
Planning steps for a lender near the threshold:
- Count 2025 and 2026 covered originations to small businesses under the 1 million dollar revenue test. If both years reach 1,000, the lender is covered from 2028 under the optional look-back.
- Count 2026 and 2027 as well, since that is the default test.
- Exclude MCAs, agricultural loans and transactions of 1,000 dollars or less from the count.
- Map each data point to the field in the lender's application or loan system that holds it.
- Design the firewall or decide which staff fall under the notice exception.
Lenders that are below the threshold in both look-back periods are not covered in 2028. They should keep counting each year, because crossing the threshold later brings them into the rule.
Section 1071 edge cases for MCA funders and bank statement lenders
Section 1071 edge cases come up for lenders that offer both excluded and covered products. An MCA funder that also makes term loans to the same merchants must count and report the term loans if it meets the threshold, even though its advances are excluded. Product labels do not settle coverage on their own.
Points to watch:
- Mixed product shelves. A funder that moves a merchant from an advance to a term loan has changed the product. The loan may be a covered transaction.
- Revenue from the application, not the statements. Many lenders compute revenue from deposits. The reported gross annual revenue should follow the rule's definition, and a deposit total that includes transfers or loan proceeds will overstate it.
- Time in business. Lenders often confirm business age with a secretary of state record or a call to a reference. That check is a verification step, much like a verbal verification of employment on a consumer file, and it is separate from recording the applicant's answer.
- Applications that straddle the start date. Applications received before January 1, 2028, and decided after it need care, so lenders should set a cutoff rule in their systems before go-live.
For lenders that compute revenue from statements, TrueBankFlow separates transfers between an applicant's own accounts and records which deposits the reviewer counted, so the figure that reaches the application can be traced back to statement lines.