CFPB Section 1071 Small Business Lending Rule 2026: The Complete Guide After the May 1 Final Rule

1. What Section 1071 Is — And Why It Matters to Borrowers and Lenders

Section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act is a small business equivalent of the Home Mortgage Disclosure Act (HMDA). Where HMDA has required lenders to report demographic data on residential mortgage applications since 1975, Section 1071 extends a parallel reporting regime to small business credit applications. It was signed into law on July 21, 2010 as part of Dodd-Frank, codified at 15 U.S.C. § 1691c-2 as an amendment to the Equal Credit Opportunity Act (ECOA), and implemented through Regulation B (12 C.F.R. Part 1002, Subpart B).

The statutory purpose, set out in the law itself, is twofold. First, to facilitate enforcement of fair lending laws — the demographic data is intended to let regulators identify lending patterns that may indicate disparate treatment or impact under ECOA. Second, to enable communities, governmental entities, and creditors to identify business and community development needs for women-owned, minority-owned, and small businesses. Per the CFPB's 1071 rulemaking page, the rule operationalizes both goals through a structured Loan/Application Register (LAR) that covered financial institutions submit annually to the CFPB.

The rule has been in development for nearly 14 years. The CFPB issued the initial Final Rule on March 30, 2023, with tiered compliance dates beginning October 1, 2024. That rule was almost immediately tied up in litigation, was modified by an interim final rule extending deadlines, and was ultimately rewritten and re-finalized as the May 1, 2026 rule that is the subject of this guide.

Whether or not 1071 actually changes lending behavior in practice is the multi-billion-dollar open question. The American Bankers Association, in its May 1, 2026 statement, acknowledged that the narrowed rule was an improvement over the 2023 version but argued that even the narrowed version imposes "significant" compliance costs on community banks that ultimately reduce small-business credit availability. Consumer advocacy groups, including the National Community Reinvestment Coalition (NCRC), argue the opposite — that the 2026 narrowing eviscerated the rule's fair lending utility and left most small-business lending invisible to regulators.

2. The Statutory Foundation — ECOA, Regulation B, and the CFPB

Section 1071 does not stand alone. It is an amendment to the Equal Credit Opportunity Act (ECOA), itself enacted in 1974 (15 U.S.C. § 1691 et seq.) and historically focused on prohibiting discrimination in consumer credit on the basis of race, color, religion, national origin, sex, marital status, age, receipt of public assistance, or the good-faith exercise of rights under federal consumer credit law. ECOA's small-business application was always present in the statute (the term "credit" covers business credit), but in practice ECOA enforcement focused on consumer credit because the data infrastructure to evaluate small-business disparities did not exist. Section 1071 was Congress's answer to that data gap.

ECOA is implemented through Regulation B (12 C.F.R. Part 1002), which the CFPB inherited from the Federal Reserve in 2011 under the Dodd-Frank Title X transfer of authority. The CFPB's 1071 rulemaking inserts a new Subpart B into Regulation B (12 C.F.R. §§ 1002.101–1002.114), which contains the entire operational framework for small-business data collection.

The chain of authority therefore looks like this: Congress enacted Section 1071 in 2010 as an ECOA amendment; the CFPB has rulemaking authority under both ECOA and the Consumer Financial Protection Act of 2010; that rulemaking authority produced the 2023 rule, the 2025 interim extensions, and the 2026 Final Rule; and ECOA's penalty and private-right-of-action provisions apply directly to 1071 violations because 1071 violations are ECOA violations.

3. The Section 1071 Timeline — 2010 Through 2029

A 16-year arc from statutory enactment to first mandatory filing is unusual even by financial-regulation standards. The timeline below captures the major events that produced the rule small-business borrowers and lenders are now operating under.

A few points are worth flagging from this timeline. First, the 16-year gap between statutory enactment and first filing is the longest implementation delay of any major Dodd-Frank rule. Second, the May 1, 2026 final rule is not the first version of the rule — it is the second, and a third version (or partial reversion) is plausible if the political environment changes. Third, the underlying ECOA framework has been continuously in force throughout this period; lenders that have engaged in disparate treatment of women-owned and minority-owned small businesses have always been exposed to ECOA liability, regardless of whether 1071 data collection was active.

4. The May 1, 2026 Final Rule — The Centerpiece of This Guide

The 2026 Final Rule, formally captioned Small Business Lending Under the Equal Credit Opportunity Act (Regulation B) and assigned docket number CFPB-2025-0040 / RIN 3170-AB40, was published in the Federal Register on May 1, 2026. Its full text is available on the CFPB's 2026 final rule page; comprehensive industry analyses include the Baker Donelson Key Takeaways, the Husch Blackwell summary, the Mayer Brown legal update, and the KPMG Regulatory Alert.

The 2026 rule is narrower than its 2023 predecessor on every major dimension. The table below summarizes the core changes; the next several sections work through each in detail.

The bottom row deserves a moment of attention. The CFPB took a 10x cut to the coverage threshold and a 5x cut to the revenue cap, yet still claims it is capturing 92 to 93% of small-business loan volume. Both numbers can be true at the same time because small-business lending is highly concentrated. A small number of very large lenders originate the overwhelming majority of small-business credit; the long tail of small community banks and credit unions originates the remainder. The 2026 rule's coverage threshold strips out the long tail (most community banks and CDFIs) while keeping in scope the large banks, large credit unions, and large fintech lenders that actually move the small-business loan volume.

5. May 20, 2026 — The Goodwin Procter MCA Alert

Three weeks after the 2026 Final Rule was published, the MCA industry's preferred outside counsel — Goodwin Procter — issued a high-profile client alert (also distributed via JD Supra) detailing the rule's treatment of merchant cash advances. The headline takeaway was that MCAs are now expressly excluded from "covered credit transactions" under the 2026 Final Rule — meaning MCA providers have no 1071 data collection or reporting obligations.

The alert, however, was equally clear that the exclusion is narrower than it appears. The CFPB explicitly declined to adopt a categorical position on whether MCAs are "credit" under ECOA generally. Per the Goodwin analysis, the CFPB stated it "rejects categorical views that all MCAs are credit" and "rejects categorical views that no MCAs are credit." It further acknowledged that some MCAs — particularly those involving recourse against natural-person owners, fixed-payment structures, and personal guarantees — "involve debt, confer a right to payment, and are loans."

For borrowers, the MCA exclusion has a counter-intuitive implication. If you take an MCA, the demographic data collection that would otherwise have flowed to the CFPB never happens. That sounds like a borrower privacy benefit, but it also means the regulatory infrastructure that the 1071 LAR was supposed to build — structured documentation, firewall segregation, standardized adverse action coding — is not being built around your MCA application. If you later need to allege discrimination, you are working from an unstructured documentation environment. For our complete analysis of MCA risk, see our merchant cash advance trap guide.

6. The 1,000-Origination Coverage Threshold

The single most consequential change between the 2023 rule and the 2026 rule is the coverage threshold for "covered financial institution" status. Under the 2023 rule, an institution that originated 100 or more covered credit transactions for small businesses in each of the two prior calendar years was covered. Under the 2026 rule, the threshold is 1,000 originations in each of the two prior calendar years — a 10x increase.

A "covered credit transaction" is defined as the extension of credit to a small business, where "small business" means a business with gross annual revenue of $1 million or less in its preceding fiscal year. The "two prior calendar years" framing means coverage is calculated on a trailing two-year basis — an institution that crosses the 1,000-transaction threshold in one year only is not yet covered.

The CFPB's regulatory impact analysis (RIA) estimates that 172 to 181 depository institutions will be covered under the 1,000-transaction threshold — a ~94% reduction from the original 2023 rule's coverage population of roughly 3,000+ institutions. Per the Husch Blackwell analysis cited above, the covered institutions are concentrated among the top 50 banks by small-business loan volume plus a handful of large credit unions and online lenders.

Despite this dramatic reduction in covered institutions, the rule still captures 92 to 93% of small-business loan volume. That paradox — many fewer lenders, slightly less volume — reflects how concentrated small-business lending actually is at the volume level. The top 25 banks alone originate more than half of all U.S. small-business loans.

7. Covered and Excluded Transactions

A "covered credit transaction" under the 2026 rule is an extension of business-purpose credit to a small business (gross annual revenue $1M or less). The 2026 rule retains the 2023 rule's product exclusions and adds new ones. The result is a substantially narrower coverage footprint at the product level even before applying the institutional 1,000-transaction threshold.

Covered Transactions

• Term loans (secured and unsecured)
• Lines of credit (including revolving credit)
• Business credit cards (issued to small businesses)
• SBA 7(a), 504, and other SBA-guaranteed business loans
• Commercial real estate loans (where not HMDA-covered)
• Equipment loans (where structured as financing, not as true leases)

Excluded Transactions (Express Carve-Outs)

• Merchant cash advances (new in 2026 — see Section 5)
• Agricultural lending (new in 2026 — loans to farms and ranches for agricultural purposes)
• Loans under $1,000 (new in 2026)
• HMDA-covered residential mortgage loans (unchanged from 2023 — reported separately under HMDA)
• Invoice factoring (purchase of receivables, not credit)
• True equipment leases (no credit extension)
• Trade credit (open-account credit between firms)
• Consumer credit (governed by other Regulation B subparts, not 1071)
• Public utility credit
• Securities credit
• Incidental credit
• Renewals, extensions, modifications without new credit (see Section 9 below)

The agricultural exclusion deserves additional attention. Agricultural lending was always going to be a difficult fit for 1071 — farm and ranch credit has its own data collection regime through USDA Farm Service Agency programs and Farm Credit System reporting, and double-counting agricultural credit under 1071 risked duplicative reporting burden. The 2026 rule resolved the issue by categorically excluding agricultural credit. Per the ABA's statement, this was one of the most welcomed changes from the agricultural-lending segment.

8. The ~13 Data Points the 2026 Rule Collects

The 2023 rule required collection of approximately 81 data points per covered application. The 2026 rule cut that to approximately 13 core fields, organized into four buckets: application identifiers, product information, borrower characteristics, and demographic information. The full list is in the Federal Register notice; the operational summary is below.

A few details about this data set are important for borrowers and lenders alike. First, the borrower self-reports women-owned and minority-owned status — the lender does not classify the borrower. Second, the demographic information is collected only with respect to "principal owners" (generally, those owning 25% or more of the business). Third, the application is identified by application date, not by application number; multiple applications from the same borrower in the same year count as separate records. Fourth, the action-taken codes follow ECOA's existing adverse-action framework.

9. What the 2026 Rule Removed From the 2023 Rule

The 2026 Final Rule's most controversial design choice was its decision to remove three categories of data points that the 2023 rule had required: pricing data, denial reasons, and LGBTQI+-owned status. Each removal has implications, summarized below.

Pricing Data (APR, Origination Fees, Rates)

The 2023 rule required covered lenders to report the APR, rate set, origination fees, and other pricing information for approved transactions. The 2026 rule eliminates these fields. The CFPB's stated rationale was that pricing data is difficult to standardize across credit products and creates a substantial compliance burden. Consumer advocacy groups, including the NCRC, argue that pricing data is the single most important fair lending signal — that disparate treatment in pricing (rather than approval/denial) is the most common form of modern lending discrimination — and that removing pricing data effectively defangs the rule's enforcement utility.

Denial Reasons

The 2023 rule required covered lenders to report categorized denial reasons (insufficient cash flow, insufficient collateral, debt-to-income, time in business, credit history, etc.). The 2026 rule eliminates this requirement. Borrowers will continue to receive individualized adverse action notices under ECOA's general framework — that requirement is untouched. But the aggregated, structured denial-reason data set that would have allowed analysts to identify pattern-level disparities will not exist.

LGBTQI+-Owned Business Status

The 2023 rule included LGBTQI+-owned business status as a self-reported data field. The 2026 rule removes it pursuant to Executive Order 14168 (issued January 20, 2025), which directed federal agencies to eliminate references to gender identity in federal regulations and statistical collection. Per Banking Dive's coverage of the final rule, this was among the more contested removals, with industry groups split between supporting it on regulatory simplicity grounds and opposing it on the basis that statutory authority for the removal was contestable.

10. The Firewall Rule — 12 C.F.R. § 1002.108

One of the most borrower-protective features of the 2026 rule (carried over essentially unchanged from the 2023 rule) is the firewall provision at 12 C.F.R. § 1002.108. The firewall rule prohibits personnel involved in making credit decisions from having access to a borrower's demographic responses — race, ethnicity, sex, women-owned status, minority-owned status — collected under 1071.

The firewall is operationalized through two mechanisms. First, the demographic data must be physically or technologically segregated from the rest of the application file — stored separately, accessed through different credentials, and reviewed by different personnel. Second, the rule prohibits the lender from disclosing demographic responses to the underwriter, the credit committee, or any other person involved in the credit decision.

The 2026 rule does carry forward a narrow firewall exception. A lender that wishes to allow underwriting personnel to access demographic responses (for example, to comply with a special-purpose credit program targeting minority-owned businesses) may do so only after providing a written notice to the borrower in advance. The notice must explain that the demographic data may be used in the credit decision and identify the lender's intended use.

11. Compliance Dates, Reporting, and Recordkeeping

The 2026 rule simplified the compliance schedule dramatically. The 2023 rule had three tiered compliance dates based on origination volume (October 1, 2024 for the largest lenders; April 1, 2025 for mid-tier; and January 1, 2026 for the smallest covered lenders). The 2026 rule replaces all three with a single uniform compliance date: January 1, 2028.

Reporting is done through the LAR (Loan/Application Register), a structured electronic file submitted annually to the CFPB. The LAR uses fields and codes consistent with HMDA's LAR format (where applicable), facilitating cross-rule consistency. The CFPB is expected to issue a Filing Instructions Guide (FIG) and validation tools in advance of the first filing deadline.

Recordkeeping requirements: covered institutions must retain a copy of the LAR for at least three years after the LAR is required to be submitted. Underlying application files, including the demographic response forms, must be retained separately from the credit-decision file (per the firewall rule). Per RiskExec's compliance-deadline guidance, most large lenders are using the 2026 to 2028 window to deploy or upgrade their LAR data infrastructure.

12. Penalties, Enforcement, and the ECOA Private Right of Action

Because Section 1071 violations are ECOA violations, the penalty framework that applies to 1071 is the existing ECOA framework. There are three principal exposure tracks: CFPB administrative enforcement, ECOA private right of action, and state attorney general enforcement.

CFPB Administrative Enforcement

The CFPB has authority under 12 U.S.C. § 5565 to assess civil money penalties for violations of federal consumer financial law. The tiered framework: up to $5,000 per day for any violation; up to $25,000 per day for reckless violations; up to $1,000,000 per day for knowing violations. Penalties are inflation-adjusted annually. The CFPB has further authority to issue cease-and-desist orders, require remediation, order restitution, and impose other equitable remedies.

ECOA Private Right of Action (15 U.S.C. § 1691e)

Borrowers have a direct private right of action under ECOA for violations of Regulation B (including the 1071-implementing Subpart B). Available remedies: actual damages; punitive damages up to $10,000 in individual actions and the lesser of $500,000 or 1% of the lender's net worth in class actions; attorney's fees and costs to the prevailing party; equitable and declarative relief; five-year statute of limitations.

State Attorney General Enforcement

ECOA authorizes state attorneys general to bring civil actions in federal court for violations of ECOA. State AGs are not bound by CFPB enforcement priorities — a state AG can pursue an ECOA action even when the CFPB has formally de-prioritized enforcement.

13. Court Battles — Texas Bankers, Revenue Based Finance Coalition, Monticello, Rise Economy

The 1071 regulatory landscape has been shaped as much by litigation as by rulemaking. Four cases in particular have driven the implementation timeline and the design choices in the 2026 rule.

Texas Bankers Association v. CFPB (5th Cir. 24-40705)

Filed in July 2023 in the Southern District of Texas, this case became the lead industry challenge to the 2023 final rule. The plaintiffs — Texas Bankers Association, American Bankers Association, Rio Bank, and others — argued the rule exceeded CFPB statutory authority, violated the Administrative Procedure Act, and imposed unconstitutional compliance burdens. The district court issued a nationwide preliminary injunction in October 2023 pending the Supreme Court's resolution of CFSA v. CFPB. After CFSA was decided in May 2024 in favor of the CFPB on funding-structure grounds, the injunction was modified to apply only to plaintiff banks and bank-association members; the case was appealed to the 5th Circuit. Per the 5th Circuit docket, oral argument was held February 7, 2025. The 2026 Final Rule effectively mooted the merits portion of the case.

Revenue Based Finance Coalition v. CFPB (S.D. Fla. 1:23-cv-24882)

Filed in late 2023 in the Southern District of Florida, this MCA-industry challenge argued that MCAs are not "credit" under ECOA and therefore cannot be brought within 1071 coverage. Per the complaint text, the plaintiffs argued that MCAs are purchases of future receivables and lack the legal characteristics of credit. The 2026 Final Rule's express exclusion of MCAs from "covered credit transactions" resolved the immediate 1071 dispute, but the underlying MCA-is-credit-or-not question was not categorically answered — setting up further litigation in parallel matters.

Monticello Banking Company v. CFPB (E.D. Ky.)

A community-bank challenge from the Eastern District of Kentucky targeting both the 2023 rule's coverage and the CFPB's authority. The 2026 rule's coverage narrowing (1,000 threshold, $1M revenue cap) effectively gave the community-bank plaintiffs the relief they sought.

Rise Economy v. Vought (D.D.C., dismissed May 15, 2026)

Filed by consumer advocacy organizations to challenge the CFPB's April 2025 enforcement de-prioritization, this case was dismissed on standing and prudential grounds in May 2026. The dismissal left the de-prioritization in place but did not address its substance.

14. Impact on Small Business Borrowers

For a small business borrower applying for credit, the 2026 rule changes the application experience in modest but specific ways. The summary below is organized by the stages of a typical application.

Pre-Application

Pre-qualification inquiries and rate quotes are not "covered applications" under the 2026 rule. Borrowers can shop multiple lenders without triggering data collection. This is meaningful for borrowers running a multi-lender pre-qualification strategy — for example, comparing SBA 7(a) lenders — because the comparison phase remains outside the 1071 reporting framework. See our SBA loan products complete guide and SBA business acquisition financing guide for the full pre-qualification framework.

Application Submission

A formal application to a covered lender for a covered product (term loan, line of credit, business credit card, SBA loan, etc.) by a small business (gross annual revenue $1M or less) triggers 1071 data collection. The lender's application interface will include the structured 13-data-point set described in Section 8. The added time is typically two to five minutes.

Underwriting

The underwriter does not see the demographic responses (firewall rule, Section 10). The underwriting decision is made on the credit factors the borrower has always provided: revenue, time in business, cash flow, credit history, collateral. The decision should be no different from what it would have been pre-1071.

Decision and Notification

Approvals, denials, and other actions are tracked in the LAR. Adverse action notices remain governed by ECOA's general framework (30-day notice with principal reasons). The 2026 rule's removal of categorized denial reasons from the LAR does not affect the borrower-level adverse action notice — it affects only the aggregate regulatory reporting.

Renewals and Modifications

Renewals, extensions, and modifications of existing accounts are excluded from "covered applications" unless the borrower is requesting additional credit. A borrower renewing a $50,000 line of credit at the same limit triggers no new 1071 data collection. A borrower requesting an increase from $50,000 to $75,000 may trigger collection depending on the lender's process.

15. Impact on Lenders — Banks, Credit Unions, Fintechs

For covered lenders, the 2026 rule is a significant compliance build — but a substantially smaller build than the 2023 rule would have been. The key infrastructure components every covered lender must have in place by January 1, 2028 are summarized below.

Data Collection Infrastructure

A covered lender must have systems to: (a) detect that an incoming application is from a small business (revenue $1M or less); (b) present the demographic questionnaire to the borrower; (c) record the borrower's responses (including refusals); (d) segregate the demographic data from the rest of the application file (firewall); (e) tag the application with the ~13 required data points; and (f) maintain the records for three-year retention.

Firewall Infrastructure

Per 12 C.F.R. § 1002.108, the demographic data must be inaccessible to underwriters. Most large lenders are implementing this via role-based access controls in their loan-origination systems — the underwriter's view of the application file does not include the demographic fields. Per the OCC's Spring 2026 Semiannual Risk Perspective, fair lending and small-business lending data infrastructure remain among the bank regulators' top supervisory priorities even with CFPB enforcement de-prioritized.

LAR Generation and Submission

Covered lenders must generate the annual LAR file in the CFPB's specified format and submit it by June 1 of the year following the data-collection year. Most large lenders are leveraging existing HMDA LAR infrastructure (with appropriate modifications for the small-business data points) given the operational similarity.

Training and Procedures

Front-line lending staff, underwriters, and compliance personnel all require role-specific training. Application takers need to understand the structure of the demographic questionnaire and the borrower's right to refuse. Underwriters need to understand the firewall. Compliance personnel need to understand the LAR generation and submission process.

16. Impact on SBA Lenders — 7(a), 504, Microloan, CDFI Programs

SBA lenders occupy a particular position under the 2026 rule. SBA-guaranteed loan products (7(a), 504, microloan) are covered credit transactions where the borrower is a small business with revenue at or below $1M. However, "small business" under the 1071 definition is much narrower than the SBA's own size standards — the SBA's industry-specific size standards typically allow much larger businesses to qualify for SBA loan products. The result is that many SBA 7(a) loans go to borrowers that exceed the 1071 $1M revenue cap and therefore do not trigger 1071 data collection.

For the SBA 7(a) and 504 lenders that meet the 1,000-transaction-volume threshold (broadly, the top 50 SBA lenders by 2024 volume), the 1071 build is incremental on top of their existing SBA reporting infrastructure. The SBA's E-Tran system already captures most of the borrower characteristic data 1071 requires; the demographic data and firewall infrastructure are the principal additions.

The 2026 SBA cumulative loan cap increase (combined 7(a) + 504 cap of $10M, effective July 4, 2026) does not interact directly with 1071, but it does mean that more SBA loan volume will be flowing through covered SBA lenders — potentially pushing additional SBA lenders across the 1,000-transaction threshold. See our $10M cumulative cap guide and our SBA International Trade Loan guide.

SBSS Sunset and Underwriting Implications

The 2026 SBA underwriting environment is also reshaping around the SBSS (Small Business Scoring Service) sunset and the return to traditional 7(a) small-loan underwriting frameworks. See our SBSS sunset and 7(a) small-loan underwriting guide for full context. The interaction with 1071: SBA 7(a) small-loan underwriting under the post-SBSS framework requires more granular borrower documentation, which dovetails with the 1071 LAR's structured data requirements. Lenders building both at the same time can share infrastructure.

17. Impact on MCAs and Alternative Finance Products

The 2026 rule's exclusion of MCAs from data reporting was a substantial industry win for MCA providers — but the exclusion did not resolve the underlying question of whether MCAs are "credit" under ECOA. For products adjacent to MCAs (revenue-based financing, daily-debit short-term loans, factoring with recourse, etc.), the treatment varies and is often product-by-product.

The strategic takeaway for borrowers in the alternative-finance segment: the 2026 rule's MCA exclusion does not change the underlying risk profile of MCAs or other alternative-finance products. The product economics (factor rates of 1.3x to 1.5x, holdback structures, daily ACH debits, personal guarantees, confessions of judgment in some states) are unchanged. The regulatory de-classification of MCAs as non-credit does not make them cheaper or safer; it simply means the demographic data collection that would have flowed into the LAR doesn't happen.

18. Stacking Capital's Position — What This Means for Our Clients

Stacking Capital is a capital advisory firm. We do not originate loans, do not extend credit, and do not have direct 1071 compliance obligations. Every one of our lender partners that meets the 1,000-transaction threshold — which includes all Tier 1 stacking banks (Chase, Bank of America, American Express, U.S. Bank, Wells Fargo) and most large SBA lenders — is covered. Our clients' applications flow through those covered lenders.

Our position on the 2026 rule and what it means for the businesses we advise:

1. The capital architecture is unchanged. SBA 7(a), SBA 504, business lines of credit, Tier 1 business credit cards, federal AR factoring, PO financing, ROBS, and the SBA International Trade Loan all remain available, all remain subject to ECOA, and all benefit from disciplined sequencing. The 2026 rule does not change the products, does not change the structure, and does not change the sequencing logic.
2. Personal credit remains the foundation. SBA loans require personal guarantees. Tier 1 business credit cards underwrite to FICO. Personal credit utilization, age, mix, and recent inquiries all show up in business credit applications. The 1071 data collection is downstream of all of this. For the personal credit preparation playbook, see creditblueprint.org and our credit repair complete guide.
3. Tier 1 stacking bank discipline is unchanged. The five Tier 1 banks — Chase, Bank of America, American Express, U.S. Bank, and Wells Fargo — remain the foundation of any capital stack. They report consistently to the major business credit bureaus; their products stack predictably; their underwriting is disciplined. We do not recommend Citi, Capital One, or Discover for stacking purposes — their business products do not stack predictably with the Tier 1 institutions.
4. MCA risk remains real. The 2026 rule's exclusion of MCAs from data reporting does not make MCAs cheaper, safer, or more appropriate as primary working-capital products. MCAs remain a last-resort, situational product. See our MCA trap guide for the full risk picture.
5. The 2026 SBA changes matter more than 1071. The $10M cumulative cap (effective July 4, 2026), the new Made in America Loan (90% guarantee, effective May 1, 2026), and the SBSS sunset have larger near-term effects on capital architecture than the 1071 data-collection rule. See our cumulative cap guide, ITL guide, and SBSS sunset guide.

19. The Borrower Playbook — Pre-2028, 2028, and Beyond

For a small-business borrower navigating the 2026-to-2029 transition window, the practical playbook is straightforward. The principle is that the underlying credit fundamentals matter more than the data-collection rule.

Phase 1 — Pre-2028 Foundation (Now Through End of 2027)

• Stabilize personal credit at FICO 760+ with sub-10% revolving utilization.
• Establish or refresh business entity, EIN, bank account, and primary business credit file.
• Open Tier 1 business credit cards in sequence (Chase, then Bank of America, then American Express, then U.S. Bank, then Wells Fargo — spaced 90+ days apart).
• Build operating history (24+ months in business helps SBA 7(a) and most bank lines of credit).
• Establish a baseline relationship with at least one SBA-preferred 7(a) lender. See our SBA loan products guide.
• If applicable, structure equity injection via ROBS for an acquisition or startup.

Phase 2 — 2028 Transition Year

• Anticipate that covered lenders will present the demographic questionnaire on every covered application.
• Decide your default response posture: full answer, partial answer, or refusal. Each is equally protected.
• Keep adverse action notices from any denied applications; they remain your primary documentation source.
• If pursuing a major capital event (acquisition, manufacturing expansion, etc.), consider whether to time the application before or after the demographic questionnaire is fully operational at your lender of choice.
• Engage capital advisory (Stacking Capital or equivalent) for sequencing complex multi-lender stacks.

Phase 3 — 2029 and Beyond

• The first published LAR (covering 2028 data) appears in mid-2029. Trade press, academics, and the CFPB itself will issue analyses.
• Patterns of disparate treatment, if any, will become visible at the lender level for the first time. Expect targeted enforcement actions to follow.
• The aggregated data set will inform business-development planning, fair-lending litigation, and lender selection. Borrowers will have access to far more transparent market data than at any prior point in U.S. small business credit history.

20. Three Worked Scenarios

Three composite scenarios drawn from common Stacking Capital client profiles, walking through how the 2026 rule interacts with the actual capital architecture.

21. Open Questions and Likely 2027 Developments

Several major aspects of the 1071 framework remain unresolved as of late May 2026. The list below is what we are watching going into the voluntary-collection window.

• Public disclosure rule. The CFPB has not yet finalized how 1071 LAR data will be made public. The 2026 rule contemplated a separate rulemaking on data privacy and publication. Expect that rulemaking to be initiated in 2027.
• MCA litigation. The Revenue Based Finance Coalition case was effectively mooted by the 2026 rule's express MCA exclusion, but the underlying question (are MCAs credit under ECOA?) remains unresolved. State-level cases continue.
• Consumer-side litigation. The NCRC and other consumer advocacy groups have signaled potential litigation challenging the 2026 rule's narrowing on statutory-authority grounds. The most exposed elements: the data point removals (pricing, denial reasons, LGBTQI+ status) and the 1,000-transaction threshold.
• State 1071 analogues. California (CA-SB-869), New York (NY-SB-6716), Illinois, and several other states have considered or enacted small-business lending data collection regimes that pre-date or supplement the federal 1071 framework. Expect more state activity in 2027.
• CFPB enforcement reversal. The April 2025 enforcement de-prioritization can be reversed by a future administration or by the current administration if priorities shift. The 5-year ECOA statute of limitations means data collected in 2028 can be the basis for enforcement actions through 2033.
• Voluntary-period adoption. How many covered institutions actually begin voluntary collection on January 1, 2027 versus waiting until the mandatory date will reveal a lot about industry compliance posture. Early-adopter institutions are likely to absorb regulatory goodwill that late-adopter institutions will not.

22. Bottom Line — The Final Word on the 2026 Rule

Section 1071 of Dodd-Frank, implemented through the CFPB's 2026 Final Rule, will from January 1, 2028 onward require approximately 172 to 181 large U.S. financial institutions to collect roughly 13 data points (including demographic information) on small business credit applications from borrowers with $1M or less in gross annual revenue. The first LAR filings are due June 1, 2029. Merchant cash advances, agricultural lending, sub-$1,000 loans, factoring, and true leases are excluded from the data-collection regime; HMDA-covered mortgages are excluded to avoid duplicative reporting.

For small business borrowers, the rule's practical effect is small: a few additional minutes of demographic questionnaire per application, with strong firewall protections preventing the data from being used in credit decisions. The underlying ECOA fair-lending protections that have always applied to small business credit continue to apply — the rule does not change borrower rights, only borrower-visible regulatory infrastructure.

For covered lenders, the rule is a meaningful compliance build — data collection systems, firewall architecture, training, LAR generation infrastructure, three-year retention — but materially smaller than the 2023 rule would have required. The single uniform compliance date (January 1, 2028) and the 12-month grace period provide adequate runway for institutions that begin the build during the voluntary-collection window in 2027.

For the lenders who are not covered (community banks, smaller credit unions, CDFIs, MCA providers, factoring companies, equipment lessors), the rule imposes no new direct obligations. ECOA's general fair-lending obligations continue to apply.

For Stacking Capital and our clients, the capital architecture is unchanged. Personal credit foundation, Tier 1 business credit stacking (Chase, Bank of America, American Express, U.S. Bank, Wells Fargo), SBA 7(a) and 504 leverage under the new $10M cumulative cap, the Made in America Loan for domestic manufacturing, federal AR factoring for receivables, PO financing for production, ROBS for equity injection, and disciplined sequencing through capital advisory — these remain the architecture. The 1071 LAR adds a thin data-collection layer on top of all of that without changing any of it.

The political and regulatory environment around 1071 will continue to evolve. The rule may be challenged from both sides. Enforcement priorities may shift. State regulators may diverge. Public disclosure rules will be issued. The 5th Circuit and other federal courts may revisit the question. The 2028 compliance date may be moved again. None of that changes the underlying architectural advice: build the credit foundation, sequence the products, document the financials, and don't take MCAs when bank-grade alternatives are available.

Frequently Asked Questions

The 41 questions below cover the most common scenarios advisors field when clients are evaluating their lender options under the 2026 CFPB Section 1071 framework. If your specific situation isn't covered here, book a strategy session.

Related Guides

Continue building your fair-lending awareness and capital architecture with these companion deep-dives.

Book a Strategy Session

Tell us about your business revenue band, your industry, your current capital structure, and your growth horizon. We'll map the right stack on the call — SBA 7(a)/504 under the new $10M cap, the Made in America Loan if you're manufacturing domestically, federal AR factoring and PO finance, Tier 1 business credit sequencing, and the right lender pre-qualifications. We'll also walk through how CFPB 1071 affects (or doesn't affect) the lender selection. No pitch, just clarity.