The CFPB’s May 1, 2026, final rule updates Section 1071 small business lending data collection and reporting requirements under the Equal Credit Opportunity Act. Covered financial institutions must begin collecting required data on Jan. 1, 2028, with the first report due June 1, 2029. Lenders should use the time before 2028 to assess coverage, update workflows, prepare data controls, and monitor CFPB implementation updates. Access resources from Abrigo's industry thought leaders and the CFPB to get 1071 compliance off on the right foot.
Comply with section 1071: Info for lenders
CFPB 1071 – Compliance resources
Prepare for Dodd-Frank Section 1071 requirements
What the CFPB 1071 final rule means for lenders
Tackle 1071 with Abrigo
The CFPB’s Section 1071 rule remains a major reporting change for covered banks and credit unions. While the 2026 final rule narrows the 2023 requirements, institutions still need defensible processes for covered applications, required data, demographic information, firewall controls, and CFPB submissions. Abrigo supports 1071 readiness with small business loan origination software, life-of-loan workflows, advisory services, and experience serving 2,400+ financial institutions.*
*The information, content, and materials provided through this website are for informational purposes only and are not intended to constitute legal advice. Customers should consult with their legal counsel regarding the application of laws and regulations to their specific circumstances.
4 in 10 bankers expect 1071 compliance will be difficult.
According to the latest Abrigo survey
Learn moreDetails on small business lending data compliance
2026 CFPB 1071 rule at a glance
The 2026 final rule revises key portions of the 2023 rule, such as replacing the prior tiered compliance dates with a single compliance date of Jan. 1, 2028. The CFPB 1071 rule takes a deliberately incremental approach to small business lending data collection, focusing initial 1071 compliance on core lending products, major lenders, and mostly statutory data points. The table below summarizes the rule’s current coverage, timing, data, and reporting requirements.
Who is covered?
Financial institutions with at least 1,000 covered small business credit originations in each of the two preceding calendar years
What businesses are covered
Small businesses with $1 million or less in gross annual revenue.
What products are covered
Small business loans, lines of credit, and credit cards that meet the rule’s covered-credit criteria.
What products aren't covered
Merchant cash advances, agricultural lending, and small-dollar business credit of $1,000 or less.
What data is required
Application, credit, business, action-taken, location, ownership, and demographic data.
What demographic data is required
Women- and minority-owned business status, principal owners’ ethnicity, race, and sex; applicants may refuse to provide it.
What is the compliance date
Data collection begins Jan. 1, 2028.
When is the first filing deadline
2028 data is due to the CFPB by June 1, 2029.
How will data be published
The CFPB proposes a separate rule-making process to cover this.
What changed in the 2026 rule vs. the 2023 rule
Compared to the 2023 rule framework, the new rule:
- Raises the lender coverage threshold from 100 to 1,000 covered credit transactions in each of the two preceding calendar years.
- Excludes Farm Credit System (FCS) lenders from coverage.
- Excludes the following from the definition of covered credit transactions: merchant cash advances, agricultural lending, and small-dollar loans of $1,000 or less.
- Lowers the small business definition from $5 million or less to $1 million or less in gross annual revenue.
- Removes several data points, including application method, application recipient, denial reasons, pricing information, number of workers, and LGBTQI+-owned business status. The CFPB also revised available answers to questions about owners’ race, ethnicity, and sex.
Many of the requirements and and data points changed. Even so, CFPB estimated that the revised rule would still capture data covering up to 93% of small business loan originations by depository institutions.
Congressional and legal efforts to overturn or amend the rule continue, so lenders need a partner that can help them navigate the changing dynamics. Abrigo has advisors, product experts, and technology to help lenders tackle risk management and strategic planning for this regulatory requirement.
Key coverage rules for small business lenders
Who must comply with CFPB 1071
Under the 2026 final rule, a covered financial institution is a financial institution that originated at least 1,000 covered credit transactions for small businesses in each of the two preceding calendar years. Here are some of the specifics.
Origination threshold
Coverage under the 1071 rule is based on covered originations for small businesses, not applications received. However, covered lenders must collect data for applications rather than originations.
Two-year lookback
The 1,000-loan threshold must be met in each of two preceding calendar years. Use either 2026 and 2027 or 2025 and 2026 to determine whether you must comply by the deadline of Jan. 1, 2028.
Defining small business
A small business under 1071 has gross annual revenue for its preceding fiscal year of $1 million or less. This threshold adjusts for inflation in $100,000 increments every five years after Jan. 1, 2030.
Growing lenders
A financial institution that did not meet the threshold in 2026 and 2027 but later originates at least 1,000 such transactions in two consecutive calendar years must comply, but not before 1, 2029.
1071 data points for collection
Required data fields
Covered institutions must compile and report more than a dozen 1071 data points related to the application, loan, action taken, business, location, revenue, ownership, and demographics for covered small business applications. The CFPB is providing a sample data collection form for applicant-provided data.
Preparing for loan data collection requirements
Compliance readiness checklist
Use this short checklist to begin preparing your bank or credit union for the Jan. 1, 2028, compliance date and the June 1, 2029, reporting deadline.
Determine whether you are a covered financial institution.
Count your originations of covered credit transactions for small businesses in 2026 and 2027 (or, at your option, 2025 and 2026) against the 1,000-transaction threshold. If you cannot determine small business status from readily accessible information, you may use any reasonable method to estimate originations for 1071 purposes.
Confirm which of your transactions are covered.
Exclude merchant cash advances, agricultural lending, small-dollar credit of $1,000 or less, and the other excluded transaction types as described in the rule.
Apply the $1 million small business definition.
Update your systems to identify applicants with gross annual revenue of $1 million or less for their preceding fiscal year.
Build data collection for the required data fields.
Implement processes to collect and report the required data points using a borrower-facing collection form for applicant-provided data.
Establish the firewall.
Limit access to applicants' responses regarding minority-owned and women-owned business status and principal owners' ethnicity, race, and sex for employees involved in credit determinations, or provide the required notice if you rely on the feasibility exception.
Set up recordkeeping.
Retain evidence of compliance for at least three years, maintain demographic responses separately from the rest of the application, and exclude prohibited personally identifiable information.
Prepare for annual reporting.
Plan to submit your small business lending application register to the CFPB on or before June 1 following each collection year. Data collected in 2028 is due June 1, 2029.
Partner with Abrigo for CFPB 1071 compliance
Create confidence in your small business lending compliance efforts with Abrigo
Small business lending software
Financial institutions across the country already count on Abrigo’s small business loan origination software for a fast, digital, and compliant process. That won’t change with CFPB 1071. With Abrigo, banks and credit unions will have all the required data fields in a borrower-facing collection form, access to pre-built reports, the ability to export for CFPB reporting, and an easy way to enforce firewalls limiting access to 1071 personal data as required.
Consulting and expert assistance
Many lenders will require process changes to ensure compliance with the new 1071 rule. Experienced consultants with Abrigo Advisory Services can get your team up to speed on the rule, serve as your 1071 project manager, analyze the loan portfolio, help establish reporting and monitoring processes, and recommend any needed changes to current lending policies and procedures.
“Even under this streamlined Section 1071 rule, financial institutions still need to understand and prepare for operational and cultural obligations that will affect small business lenders for years to come.”
Bailey Barretto, Director, Abrigo Advisory Services
Get prepared
Regulatory guidance
Consumer Financial Protection Bureau resources on the 1071 rule
Note: Some CFPB implementation materials may still reflect earlier versions of the rule. Financial institutions should confirm whether a CFPB resource has been updated for the May 1, 2026, final rule before relying on it for compliance planning.
CFPB notice of final rule: Small business lending under the Equal Credit Opportunity Act (Regulation B) – May 1, 2026
Final rule as published in the Federal Register: Small Business Lending Under the Equal Credit Opportunity Act (Regulation B): A Rule by the Consumer Financial Protection Bureau on 05/01/2026
How the 2026 final rule differs from the 2023 final rule: Unofficial CFPB Redline of the Small Business Lending Reconsideration Final Rule
Sample data collection form for applicant provided data: Appendix E to Part 1001
Filing instructions guide: The CFPB has not updated this guide since 2024, but the final rule provides this link for a guide it says will be updated every year:
Previous CFPB guides on data points, FAQs, and small entity compliance have not yet been updated for the 2026 final rule. Stay tuned here for the latest CFPB resources.
Resources for CFPB small business data collection
Abrigo provides complimentary 1071 resources to help lenders navigate Section 1071. Experts providing our educational webinars are regular speakers at state, regional, and national conferences, as well as other forums. Based on their expertise and ongoing work with banks and credit unions, they share best practices and new developments via whitepapers, infographics, and FAQ blogs. We've been helping financial institutions understand and prepare for this effort since 2017.
One-pager of CFPB deadlines and details compliance.
An updated timeline and explainer for collecting and reporting data based on CFPB's compliance dates
Get the infographic
CFPB 1071 Compliance: Overview, dates, and details
A description of when financial institutions must comply and what's involved
Read the blog Abrigo is here to help
Ensure compliance with section 1071
with our industry-leading software and advisory services.
Learn more
Frequently asked questions about CFPB 1071
What is the effective date of the CFPB 1071 rule?
The 2026 final rule is effective on June 30, 2026. The compliance date—the date by which covered financial institutions must begin collecting and maintaining data—is January 1, 2028.
What data does Section 1071 require financial institutions to collect?
Covered financial institutions must collect a unique identifier, application date, credit type, credit purpose, amount applied for, amount approved or originated, action taken, action taken date, census tract, gross annual revenue, 3-digit NAICS code, time in business, minority-owned and women-owned business statuses, the ethnicity, race, and sex of principal owners, and the number of principal owners. The 2026 final rule removed application method, application recipient, denial reasons, pricing information, number of workers, and LGBTQI+-owned business status from the data collection.
Which institutions are exempt from 1071 reporting?
A financial institution is not required to report unless it originated at least 1,000 covered credit transactions for small businesses in each of the two preceding calendar years. Farm Credit System lenders are excluded entirely, regardless of volume. Institutions originating fewer than 1,000 covered transactions in either of the two preceding years are not covered financial institutions.
How many covered credit transactions must a lender originate to be covered?
A lender must originate at least 1,000 covered credit transactions for small businesses in each of the two preceding calendar years to be a covered financial institution. This number refers to originations, not applications received. Requests for additional credit amounts on existing accounts and transactions that extend, renew, or amend an existing transaction do not count as originations.
What is the definition of a small business under the 2026 1071 rule?
Under the 2026 final rule, a business is a small business if its gross annual revenue for its preceding fiscal year is $1 million or less. This threshold was lowered from the $5 million standard in the 2023 final rule and adjusts for inflation in $100,000 increments every five years after Jan. 1, 2030.
Which transactions are excluded from CFPB 1071 reporting?
Excluded transactions include trade credit, HMDA-reportable transactions, insurance premium financing, public utilities credit, securities credit, incidental credit, merchant cash advances, agricultural lending, and small-dollar business credit of $1,000 or less. Factoring, leases, and consumer-designated credit used for business purposes are also not covered credit transactions.
When must covered financial institutions report 1071 data to the CFPB?
Covered financial institutions must submit their small business lending application register on or before June 1 following the calendar year for which data was compiled. For the first compliance year (2028), data must be submitted to the CFPB by June 1, 2029.
Is there a grace period for 1071 compliance?
Yes. The CFPB is providing a 12-month grace period from Jan. 1, 2028, through Dec. 31, 2028. During this period, it does not intend to assess penalties for unintentional, good-faith errors in institutions’ initial data submissions and does not intend to require resubmission unless errors are material.
