On April 30, the CFPB finalized a significantly pared-down version of its Section 1071 small business loan data collection rule. The rule — which implements a Dodd-Frank Act mandate to collect data on small business credit applications to aid antidiscrimination oversight — was substantially rewritten from the 2023 Biden-era version that never took effect due to legal challenges.
Key changes: the loan-volume threshold for covered lenders was raised tenfold (from 100 to 1,000 originations over two consecutive years); the revenue ceiling for what counts as a “small business” was cut from $5 million to $1 million; pricing information (interest rates and fees) was removed; merchant cash advances and certain other products were excluded; and demographic data requirements were reduced, including elimination of the requirement to ask about LGBTQ+ ownership. The rule takes effect January 1, 2028 for all covered lenders.
The CFPB estimates that approximately 172 to 181 banks and around 30 online lenders will now be covered — a dramatic reduction from the prior rule — though the agency projects it will still capture up to 62% of small business lending by banks in dollar terms.
What you should do: If your institution currently originates fewer than 1,000 small business loans annually, you are likely exempt. Confirm your origination volumes and document your determination. If you are covered, begin assessing data infrastructure now. 2028 seems distant, but the collection and reporting systems take time to build and test. Watch for any litigation from consumer groups still challenging the prior rule, as that could create uncertainty about which version of the rule ultimately governs.
CFPB 1071 rulemaking page: https://www.consumerfinance.gov/1071-rule/