CFPB's 2026 Section 1071 Overhaul: Narrower Scope, a Single January 2028 Deadline, and What Small Business Lenders Must Do Now

TL;DR:

• The CFPB issued a new Section 1071 final rule on May 1, 2026, substantially narrowing the small business lending data collection requirements from the 2023 version.
• The coverage threshold jumps from 100 to 1,000 originations per year; only lenders meeting this threshold in BOTH 2026 and 2027 face a January 1, 2028 compliance date.
• The “small business” definition shrinks from $5M to $1M in gross annual revenue — meaning fewer loans qualify, and many lenders will find their covered loan population significantly reduced.
• Most discretionary data points from 2023 (pricing data, denial reasons, application method, number of workers, disaggregated race/ethnicity) were eliminated. Only the mandatory statutory data points remain.
• The first SBLAR is due June 1, 2029, with a 12-month good-faith grace period on penalties during 2028.

Three Years of Litigation, One New Rule

Section 1071 of the Dodd-Frank Act required the CFPB to collect data on lending to women-owned, minority-owned, and small businesses. The CFPB finally issued that rule in 2023. Then came three rounds of litigation-driven stays, a Congressional Review Act challenge, and enough implementation uncertainty that most lenders eventually stopped serious planning until the legal picture cleared.

It has now cleared — with a substantially different rule.

On May 1, 2026, the CFPB issued a final rule revising Section 1071 that is narrower in scope, leaner in data requirements, and simpler in timeline than the 2023 version. The 2026 rule raises the coverage threshold, reduces the small business revenue cap, eliminates most discretionary data fields, and replaces a tiered compliance schedule with a single date.

For lenders who built implementation plans around the 2023 version, most of those plans need to be revisited. For lenders who paused planning during the litigation, this is where to start.

Who Is (and Isn’t) Covered: The 1,000-Origination Threshold

The most consequential change is the coverage threshold: it moves from 100 covered credit transactions to 1,000 covered originations per year, measured over two consecutive calendar years.

To face the January 1, 2028 compliance date, a lender must originate at least 1,000 covered credit transactions for small businesses in both 2026 and 2027. A lender that originates 1,400 small business loans in 2026 but only 700 in 2027 does not meet the threshold and is not covered.

This is not a minor adjustment. The 100-loan threshold in the 2023 rule would have captured significant numbers of community banks, credit unions, CDFIs, and smaller specialty lenders. The 1,000-origination threshold cuts the covered population substantially — and the concurrent change to the “small business” definition makes it even narrower.

What counts toward the 1,000-origination threshold:

• Covered originations only (denied applications and withdrawn applications do not count)
• Originations to small businesses at or below the $1M revenue cap (see below)
• Domestic originations only
• Certain excluded transaction types do not count: agricultural loans, merchant cash advances, loans of $1,000 or less

The Small Business Revenue Cap: $1M, Not $5M

The 2026 rule reduces the gross annual revenue cap defining a “small business” from $5 million to $1 million. This compounds the threshold change in a way that will remove more lenders from coverage than the threshold change alone suggests.

The effect is compounding because the revenue cap applies in two places:

1. To the threshold calculation. Only originations to businesses with $1M or less in gross annual revenue count toward the 1,000-origination threshold.
2. To the data collection requirement. Only loans to $1M-and-under businesses need to be collected and reported, even once a lender clears the threshold.

For banks and lenders whose “small business” portfolios include a substantial share of businesses earning between $1M and $5M in revenue — companies that would be “small business” under the SBA definition or under the lender’s own underwriting criteria — those loans are now outside the 1071 coverage universe entirely.

Before you can assess your own coverage, you need to know what share of your small business originations go to businesses with $1M or less in gross annual revenue. For many community banks with agricultural and rural small business portfolios, this will require actual data work.

What Was Removed: Discretionary Data Points

The 2023 rule included both mandatory data points (required by the statute) and a substantial set of discretionary data points added by the CFPB under its authority to collect “any additional data that the Bureau determines would aid in fulfilling the purposes of this section.”

The 2026 rule eliminates most of those discretionary data points.

The removal of pricing data drew significant criticism from community groups. NCRC argued this substantially limits the rule’s fair lending utility, since pricing differentials are one of the primary signals of disparate treatment in small business lending. The CFPB’s position is that the mandatory data points still permit meaningful analysis for Section 1071’s core purposes.

The operational implication for lenders: if you already built or spec’d a data collection system around the 2023 data fields, you have fields to remove. That may require additional system configuration work even as the overall requirements shrink.

What Remains: The Mandatory Statutory Data Points

Covered lenders must collect and report the data points that the statute itself requires:

• Application identification: Application number, date, and action taken (originated, approved but not accepted, denied, withdrawn, incomplete)
• Loan characteristics: Amount applied for, amount originated or approved, loan type (term loan, line of credit, etc.) and loan purpose
• Applicant classification: Whether the applicant is a women-owned business, a minority-owned business, or a small business
• Principal owner demographics: Race, sex, and ethnicity — collected via applicant self-identification
• Business financial profile: Gross annual revenue (used to confirm small business status), NAICS code, number of principal owners
• Geography: Census tract of the applicant’s principal place of business

These are the fields your loan origination system (LOS) needs to capture. The applicant self-identification mechanism for principal owner demographics — the screen or form where owners self-identify their race, sex, and ethnicity — still needs to be designed, built, and tested. That piece remains and is non-trivial.

Categorical Exclusions: Who Is Definitely Out

The 2026 rule explicitly excludes:

Farm Credit System lenders — categorically excluded regardless of origination volume. The 2023 rule had not categorically excluded FCS lenders; the 2026 rule does.

Agricultural loans — excluded from “covered credit transactions” even if originated by a covered financial institution. This has specific implications for community banks with agricultural portfolios.

Merchant cash advances — explicitly excluded. MCAs are legally structured as purchases of future receivables, not loans, but their exclusion is now codified in the rule.

Loans of $1,000 or less — excluded from covered transactions and from the threshold calculation.

What is NOT excluded: traditional commercial loans, SBA-guaranteed loans, commercial real estate loans to small businesses, equipment financing, and lines of credit to businesses with $1M or less in revenue remain subject to the rule if the institution meets the 1,000-origination threshold.

The Compliance Timeline: One Date, Not Three

The 2023 rule had three compliance dates, tiered by origination volume — all of which were stayed by litigation. The 2026 rule replaces all three with a single date:

January 1, 2028 — all covered financial institutions begin data collection.

June 1, 2029 — first SBLAR (Small Business Loan Application Register) filing, covering the 2028 calendar year.

The coverage determination works as follows: if you originate 1,000+ covered small business loans in both 2026 and 2027, you are covered and must begin collecting on January 1, 2028. You won’t know your 2027 count until early 2028, but you’ll have your 2026 count by Q1 2027 — which is your planning checkpoint.

The 12-month grace period (January 2028 through December 2028) means the CFPB will not assess civil money penalties for data errors or omissions if you are making good-faith efforts to comply. Examinations during 2028 are limited to diagnosing weaknesses rather than pursuing penalties. Good-faith compliance requires you to actually be collecting data, training staff, and filing the SBLAR — the grace period is not a license to skip implementation.

Five Things Covered Lenders Should Do Now

For any lender that might approach the 1,000-origination threshold, June 2026 is the right time to start:

1. Run your coverage numbers. Calculate your 2025 actual originations to businesses with $1M or less in gross annual revenue. This gives you a proxy count. Then build a 2026 monitoring process so you have real-time visibility into where you stand against the threshold throughout the year.

2. Audit your “small business” data. The $1M revenue cap is a hard cutoff. If your LOS or credit system doesn’t currently capture or store gross annual revenue for all small business applicants, you need to understand the data gap. Collecting revenue data on new originations is straightforward; identifying historical revenue data on your existing portfolio may be harder.

3. Assess your LOS configuration requirements. The mandatory data fields — demographics self-identification, census tract, NAICS code — require LOS changes. Most commercial lending platforms will build 1071 data collection modules, but you need to know where you are in your vendor’s release cycle and whether your configuration timeline aligns with your January 2028 start date.

4. Build the demographic self-identification experience. The applicant self-identification flow for principal owner race, sex, and ethnicity still needs to be built. This requires both a system component (the collection interface) and a process component (how you explain it to applicants, what you do when applicants decline to identify, how you store and retrieve the data).

5. Calendar the threshold monitoring milestones. Set a Q1 2027 milestone to run the final 2026 origination count and confirm coverage status. If you clear the 2026 threshold, begin LOS configuration in earnest in Q2 2027. If you’re on the margin, monitor 2027 monthly starting in January.

So What? The Fair Lending Stakes Remain Even With a Narrower Rule

The 2026 Section 1071 rule is operationally simpler and covers fewer institutions than the 2023 version. But it’s not regulatorily inert.

The statute’s fair lending purpose remains: covered lenders will be required to report data on lending to women-owned and minority-owned small businesses. That data will eventually be public. State attorneys general, community development organizations, and civil rights groups will analyze it. CFPB examiners will continue conducting fair lending reviews of small business lending even for institutions below the 1071 threshold.

For the regulatory change management process and CFPB-related fair lending compliance context, the most important immediate action is getting your coverage determination right. If you might clear the 1,000-origination threshold using the $1M revenue definition, begin your LOS assessment now — January 2028 is 18 months away, and commercial LOS implementations reliably take longer than expected.

For the compliance tracking and exam-readiness tools that keep 1071 milestones from falling through the cracks, the Compliance Essentials bundle includes regulatory change tracking, compliance calendar frameworks, and monitoring tools you can use for 1071 implementation management.

Sources: Mayer Brown — CFPB Issues Final Section 1071 Rule on Small Business Lending Data Collection; Greenberg Traurig — CFPB Final Rule Narrows Small Business Lending Data Collection Requirements; Consumer Financial Services Law Monitor — Narrower Scope, Later Compliance Date, and a Leaner Data Collection Regime; NCRC Analysis of the CFPB’s Section 1071 Rule of 2026; CFPB Small Business Lending Compliance Resources