On May 1, 2026, the CPFB published in the Federal Register the revised Small Business Data Collection Rule, or “1071 Rule” (the “2026 Final Rule”), which it had proposed revising in November 2025. The 2026 Final Rule becomes effective June 30, 2026, although as discussed below, the compliance date is January 1, 2028. As indicated in the preamble, the CFPB revised the initial 1071 Rule (the “2023 Final Rule”) based on the industry’s reactions and ongoing litigation. Upon reflection, the Bureau found that the approach it took in the 2023 Final Rule— including a broad initial coverage of credit products, lenders, small businesses and data points—was not conducive to the long-term success of the data collection regime. The 2026 Final Rule reflects the CFPB’s current belief that an “incremental approach” will better serve the statutory purposes of section 1071. The CFPB highlighted the value of adopting an incremental approach by comparing the approach taken under the Home Mortgage Disclosure Act (HMDA). The data reporting requirements under HMDA were gradually increased over time following its adoption in 1975. Although Congress voted to rescind the 2023 Final Rule (which action was vetoed by President Biden), the CFPB does not cite this as a basis for the 2026 Final Rule.
The 2026 Final Rule alters coverage of certain credit transactions and financial institutions, amends the definition of a “small business”, and narrows the data points that must be collected and reported to those statutorily required under section 1071 of Dodd-Frank and fewer number of discretionary data points.
Webinar
We will hold a webinar on the 2026 Final Rule at 1:00 pm Eastern on May 27, 2026. Click here to register for the webinar.
Key Definition Changes
Covered Credit Transactions
The Bureau concluded that the initial iterations of data collection under the rule should focus on the core, widely used lending products most likely to be foundational to small businesses’ formation and operation. To that end, the 2026 Final Rule excludes merchant cash advances (MCAs), agricultural lending, and small dollar loans from the definition of a “Covered Credit Transaction.”
The Bureau remarked that the 2023 Final Rule’s broad definition of “credit” included MCAs without taking into account their terms and features. The CFPB now believes that MCAs differ from traditional lending products, such that collecting data on MCA transactions under section 1071 may not produce information that is comparable to data collected on other types of transactions. The CFPB also noted that because MCAs have not been widely regulated, many smaller MCA providers may lack the infrastructure needed to manage compliance with regulatory requirements. Therefore, the Bureau concluded that requiring MCAs to be reported could lead to data quality issues contrary to the purposes of section 1071.
In the 2023 Final Rule the CFPB declined to exclude agricultural credit because it was not excluded under the Equal Credit Opportunity Act (ECOA). The CFPB now has decided to exempt such credit from the 2026 Final Rule and defines “agricultural lending” as “a transaction to fund the production of crops, fruits, vegetables, and livestock, or to fund the purchase or refinance of capital assets such as farmland, machinery and equipment, breeder livestock, and farm real estate improvements.” The Bureau reasoned that “agricultural loans are often secured by biological-based assets such as crops or livestock, which are subject to variables and risk from weather and disease. These characteristics create unique underwriting challenges that make such loans difficult to compare to those in other industries.” The Bureau believes this will simplify the rule by narrowing its scope to avoid covering a distinct and specialized lending sector that is already subject to a different regulatory reporting scheme.
The 2026 Final Rule additionally adopts the proposal to exclude small dollar loans of $1,000 or less. The Bureau asserted that loans of this size are typically “auxiliary features of business deposit accounts, such as overdraft facilities.” It concluded that a $1,000 threshold better distinguishes between credit that is circumstantial or ancillary to a deposit account and the more purposeful commercial credit that section 1071 is intended to monitor. The Bureau declined to adopt any of the higher thresholds recommended by commenters because it is concerned about losing data necessary to fulfill the statutory purposes of section 1071. The $1,000 amount will adjust for inflation in $100 increments every five years after January 1, 2030.
The Bureau also declined to adopt the additional categorical product exclusions suggested by commenters, including indirect lending transactions, trade credit provided by financial institutions, and loans secured by non-owner-occupied commercial real estate.
Covered Financial Institutions
The 2026 Final Rule makes two key changes to the term “Covered Financial Institution.” The term now excludes Farm Credit System (FCS) lenders from coverage. The CFPB noted that the 2023 Final Rule failed to account for the differences between FCS lenders and other types of lenders.. Specifically, FCS borrowers typically include agricultural businesses and rural homeowners. The Bureau reasoned that “as owners of the FCS lending associations, these borrowers can receive patronage dividends that reduce borrowing costs and make FCS loans difficult to compare to loans issued by non-FCS lenders.” Moreover, the fact that FCS lenders are subject to a separate regulatory regime underscored the Bureau’s rationale for excluding FCS lenders.
The 2026 Final rule also raises the origination threshold from 100 to 1,000 covered credit transactions for each of the two preceding calendar years. The 2023 Final Rule prioritized the collection of data from the largest volume lenders first because they have more resources, and account for the bulk of small business lending volume. However, the Bureau now believes a single 1,000-transaction threshold is more appropriate. While the 1,000-origination threshold will carve out many smaller volume lenders, the Bureau emphasized that the 2026 Final Rule will still cover the vast majority of small business loan originations (approximately 92 to 93 percent, compared to approximately 94 to 95 percent at the 100-origination threshold).
The Bureau further declined to adopt an asset-based threshold, in lieu of or in addition to an origination-based threshold, for defining the term “Covered Financial Institution.” It maintains that a threshold based on lending activity is more directly related to a financial institution’s role in the small business lending market than is a measurement of the financial institution’s size based on total assets, particularly for non-banks.
Small Business
The 2023 Final Rule defined a “small business” as any business with gross annual revenue in the preceding fiscal year of $5 million or less. The 2026 Final Rule decreases gross annual revenue from $5 million to $1 million or less. According to the CFPB, this threshold will capture most small businesses as defined by the Small Business Administration’s (“SBA”) size standards, while also reducing the regulatory burden on financial institutions. The Bureau has obtained SBA approval for this alternate small business size standard pursuant to the Small Business Act. The $1 million amount will adjust for inflation in $100,000 increments (rather than $500,000 increments) every five years after January 1, 2030.
Data Points
In the 2023 final rule, the Bureau included several discretionary data points—that is, data points not required by section 1071 but added under the CFPB’s authority to include additional data points. The discretionary data points were for pricing information, time in business, three digit North American Industry Classification System (NAICS) code, number of non-owner workers, application method, application recipient, denial reasons, and number of principal owners. For consistency with executive orders concerning the collection of demographic data and to minimize regulatory burdens, the 2026 Final Rule focuses on the statutory data points required by the Dodd-Frank, and a limited number of discretionary data points needed to facilitate the collection of data. The CFPB notes that “[t]he Bureau does not believe that alignment with the statutory purposes of section 1071 requires the use of its discretionary authority to collect data with such a breadth of scope.” The following discretionary data points were removed: application method, application recipient, denial reasons, pricing information, and number of workers.
Several key changes were made to the demographic data points.
- The 2026 Final Rule no longer requires Covered Financial Institutions to obtain information about LBGTQI+-owned status, although it continues to require the collection of information on women-owned or minority-owned status. This change reflects the Bureau’s current belief that the sensitivities involved in this inquiry exceed any utility this data point might provide.
- The sample data form was revised to replace the free form text field for a principal owner’s sex/gender with a designation of the owner’s sex using the categories Male and Female (or the option not to provide the information). The CFPB stated that this change was made to be more consistent with section 1071 and the Defending Women Executive Order (14168).
- All disaggregated categories of race and ethnicity were removed from the sample data collection form.
As was the case with the 2023 Final Rule, under the 2026 Final Rule an applicant may refuse to provide any or all demographic information, and the Covered Financial Institution must inform the applicant of their right to refuse before presenting the ethnicity, race, and sex categories. However, the 2026 Final Rule provides that when requesting demographic information orally a financial institution must present the applicant’s right to decline to provide such information before listing the aggregate ethnicity, race, and sex categories that may be selected. Additionally, the sample data collection form was revised to highlight the applicant’s right to decline to provide the information.
Discouragement Provisions, Time and Manner of Data Collection
The 2023 Final Rule included provisions prohibiting a Covered Financial Institution from discouraging applicants from responding to requests for information. However, in the November 2025 proposed amendments the Bureau questioned whether “[a] low response rate for applicant-provided data may indicate discouragement or other failure by a Covered Financial Institution to maintain procedures to collect applicant-provided data that are reasonably designed to obtain a response.” Accordingly, it proposed removing the discouragement provisions, believing that they were “redundant and add[ed] unnecessary regulatory complexity.”
The Bureau maintained this mindset after its review. After reviewing comments from various community groups and trade associations, it concluded that “the prescriptive monitoring requirements and rigid time and manner restrictions in the 2023 final rule created redundant layers of compliance.” Moreover, it noted that “penalizing lenders or mandating strict peer comparisons based on response rates could lead to misleading conclusions and unjustified burden.” Therefore, the 2026 Final Rule removes the anti-discouragement and monitoring requirements, a change that we support. Based on the low response rates to requests for demographic information under HMDA, we were critical of the 2023 Final Rule provision that a low response rate may indicate improper discouragement efforts by a financial institution.
In the 2026 Final Rule the Bureau further acknowledged that “in certain instances, where an application is forwarded by an intermediary, the reporting financial institution may have no direct contact with the applicant until after notifying the applicant of the credit decision.” Therefore, it agreed that requiring data collection from an applicant by the reporting financial institution prior to notification of the credit decision may be impractical. To address this, the Bureau revised the timing requirement to provide that the initial request for information must occur “prior to notifying an applicant of final action taken on [a] covered application, or at another time reasonably designed to obtain a response.”
Compliance Dates and Grace Period
All Covered Financial Institutions that originate at least 1,000 covered credit transactions in 2026 and 2027 must comply with the 2026 Final Rule starting on January 1, 2028. For purposes of determining whether a financial institution is a Covered Financial Institution as of January 1, 2028, a financial institution is permitted to use its originations of covered credit transactions for small businesses in 2025 and 2026, rather than 2026 and 2027. The 2026 Final Rule maintains a 12-month grace period for data collected in 2028. During the grace period, any errors in a Covered Financial Institution’s initial submission will not require resubmission unless the errors are material. The CFPB does not intend to assess any penalties for unintentional and good faith errors. The Bureau hopes that Covered Financial Institutions will take advantage of the grace period to identify any gaps that may hinder implementation of the Final Rule and make improvements in their compliance management systems for future data submissions.
Litigation Update
The RISE Economy v. Vought lawsuit seeking to force the CFPB to implement the 2023 Final Rule was dismissed without prejudice on May 15, 2026, by the federal district court for the District of Columbia.
The Monticello Banking Co. v. CFPB lawsuit challenging the 2023 Final Rule was stayed until June 30, 2026, by the federal district court for the Eastern District of Kentucky.
A status report must be filed by June 3, 2026, with the U.S. Court of Appeals for the Fifth Circuit in the Texas Bankers Association v. CFPB lawsuit challenging the 2023 Final Rule.
A status report must be filed by June 30, 2026, with the federal district court for the Southern District of Florida in the Revenue Based Finance Coalition v. CFPB lawsuit challenging the 2023 Final Rule.