The Consumer Financial Protection Bureau (CFPB) finalized its long‑awaited rule implementing Section 1071 of the Dodd‑Frank Act, a rulemaking designed to address funding gaps facing women-owned, minority-owned and small businesses by requiring data collection and reporting on loan applications.
Although the final rule is significantly narrower than the final rule published during the Biden administration (2023 rule), it nonetheless establishes a federal data collection and reporting regime that will have material implications for certain small‑business lenders. Once reporting begins, the data is expected to inform supervisory activity, enforcement priorities and broader policies around access to small‑business credit.
Overview of the rule
Section 1071 of the Dodd-Frank Act amended the Equal Credit Opportunity Act (ECOA) to require that financial institutions collect and report to the CFPB certain data regarding applications for credit for small businesses, including women-owned and minority-owned small businesses.
The final rule, promulgated 16 years after the Dodd-Frank Act was enacted, requires covered lenders to collect and report data on the sex, race and ethnicity of small‑business loan applicants, along with certain application‑level information.
The CFPB’s proposed rule released in November 2025 represented a scaled‑back approach compared to the expansive 2023 rule; the final rule largely tracks the proposed rule, with a few notable changes.
Fewer covered financial institutions
The final rule applies only to financial institutions that originate at least 1,000 covered credit transactions for small businesses for each of two consecutive years. Unlike in the 2025 proposed rule, a “covered financial institution” now excludes Farm Credit System (FCS) lenders. Of note, the threshold is much higher than the 100‑loan threshold proposed in the 2023 rule and, per reporting, limits the universe of covered lenders to approximately 280 institutions, down from approximately 2,500 under the earlier framework.
Narrower covered credit transactions
Noting the scaled-back approach to focus the rule on “core lending products, lenders, small businesses, and data points,” the rule excludes from the definition of “covered credit transactions” all merchant cash advances (MCAs), agricultural loans and small-dollar loans (less than or equal to $1,000).
Small business definition
The final rule narrows the definition of “small business” to enterprises with $1 million or less in gross annual revenue, compared to $5 million in the 2023 rule.
Data fields
The final rule requires data collection on the data points statutorily required under Section 1071 (in addition to a small number of other data points necessary to facilitate the collection of these data points). The final rule removes certain discretionary data points, such as for application method, application recipient, denial reasons, pricing information and number of workers. The final rule also omits disaggregated race and ethnicity categories.
Anti-discouragement
The 2023 rule would have treated low response rates as indicating that the lender was discouraging applicants from providing information. The new final rule still requires that lenders maintain procedures reasonably designed to obtain responses for data collection, but no longer automatically considers low response rates to be evidence of discouragement.
Compliance timeline
Covered institutions must begin collecting required data on January 1, 2028 and reporting that data to the CFPB in 2029.
Looking ahead
The finalization of the Section 1071 rule marks a yearslong, pivotal moment in the regulation of small‑business lending. For affected lenders, building compliant data collection processes, training staff and integrating new requirements into application workflows will require sustained effort well in advance of the formal compliance dates.
It is also important to note that the final rule may not be the last word from the CFPB on this issue. The CFPB explicitly leaves open the possibility of future expansion of the final rule’s obligations based on learnings from the data collection. In addition, the CFPB has left open how it will handle publication of results from a privacy perspective.