CFPB Slims Small-Business Borrower Data Collection Rule

The CFPB’s final Section 1071 “reconsideration” rule dramatically narrows who must report small‑business lending data and what must be reported, pushes compliance out to 2028, and largely exempts smaller institutions.

What the new rule does

• Raises coverage threshold to institutions originating at least 1,000 small‑business loans in each of the prior two years, up from 100 in the 2023 rule, reducing covered lenders from roughly 2,500 to about 280.

• Cuts required data fields from 81 to 13, eliminating detailed pricing metrics and many application‑level attributes.

• Scraps requirements to collect and report principal owners’ race, ethnicity, and LGBTQ+ status, moving instead to much more limited aggregate demographic categories, at least initially.

• Tightens the “small business” definition to entities with gross annual revenue of no more than about 1 million dollars, down from 5 million dollars in the 2023 rule, further narrowing reportable applications.

• Excludes certain products and markets (including agricultural lending and merchant cash advances) from coverage calculations, reducing the number of institutions that pass the origination threshold.

• Extends initial compliance date to January 1, 2028, with the rule effective 60 days after Federal Register publication.

Impact on lenders vs. fair lending data

Lender/compliance side

• Most community banks and credit unions will now fall below the 1,000‑loan threshold and avoid Section 1071 data‑collection requirements altogether.

• Covered lenders face a much leaner data‑collection build: fewer fields, no granular pricing data, and less complex demographic‑information workflows, which the CFPB estimates will save about 166 million dollars annually in compliance costs.

• Longer runway to 2028 reduces implementation pressure, especially for vendors and multi‑product organizations that had paused builds during litigation and the reconsideration process.

Fair lending / market‑monitoring side

• Regulators, advocacy groups, and private plaintiffs will have access to significantly less granular data to analyze small‑business credit outcomes by protected class, geography, and product.

• The sharp reduction in covered institutions and products will make it harder to see disparities in local or niche markets where smaller lenders play an outsized role.

• Commentators already frame the rule as a major rollback of a Biden‑era framework that was designed to bolster fair‑lending enforcement in the small‑business space.

Quick comparison: 2023 rule vs. 2026 rule

Practical takeaways for institutions

For lenders above the new 1,000‑loan threshold:

• You still need a Section 1071 program, but the architecture should be re‑scoped around the 13 surviving data fields and simplified demographic framework.

• Expect less “HMDA‑style” analytics pressure but continued scrutiny on underwriting, pricing, and steering using other data sources (e.g., CRA small‑business data, HMDA, internal MI).

For lenders below the threshold:

• You avoid formal 1071 reporting, but fair‑lending risk remains under ECOA and state UDAP/UDAAP regimes, and you may still want voluntary internal monitoring using a subset of data fields.

• Vendor contracts and in‑flight 2023‑rule implementation projects should be revisited quickly; many requirements will no longer be necessary under the new regime.

For regulators/advocates and market analysts:

• Analyses will lean more heavily on partial 1071 data from large players plus qualitative and complaint trends to infer small‑business credit frictions.