The Consumer Financial Protection Bureau (CFPB) has published a Final Rule amending Subpart B of Regulation B, which implements the Equal Credit Opportunity Act (ECOA). The rule requires financial institutions to collect and report data on applications for credit from small businesses, women-owned businesses, and minority-owned businesses.
The Final Rule takes effect June 30, 2026, with a single compliance date of Jan. 1, 2028, for all covered financial institutions. The rule increases the origination threshold from 100 to 1,000 covered credit transactions for small businesses in each of the two preceding calendar years.
According to the report, the revised rule will still cover approximately 92 to 93% of the number of small business loans originated by depository institutions, compared with 94 to 95% under the previous rule. The Bureau notes that while as many as 1,570 depository institutions that would have been covered under the previous rule are no longer covered under the Final Rule, the majority of small business loan volume by depository institutions remains within scope.
The 2026 Final Rule adds an explicit exclusion for Farm Credit System (FCS) lenders from the definition of “covered financial institution,” regardless of loan volume. They concluded that FCS lenders’ unique cooperative structure and existing reporting obligations render their loan data difficult to compare with data from commercial lenders.
The rule also excludes transactions to fund crop, fruit, vegetable, and livestock production, or to fund the purchase or refinancing of capital assets such as farmland, agricultural machinery and equipment, breeder livestock, and farm real estate improvements. It found that agricultural loans’ distinctive underwriting characteristics make such data difficult to compare with commercial lending data.
Related: What Are the Benefits of Hiring a Medical Malpractice Attorney?
The Final Rule eliminates five of the discretionary data points added by the previous rule, including LGBTQI+-owned business status. The Bureau found that its value-to-burden analysis in the previous rule had overweighted the analytic value of these points and underweighted the operational complexity of collecting them.
The rule retains the core obligation that covered institutions must maintain procedures to collect applicant-provided data at a time and in a manner that are reasonably designed to obtain a response. The CFPB also added practical flexibility for indirect lenders, allowing them to make their initial request for applicant-provided data after notifying the applicant of the final credit decision.
The statutory firewall requirement, prohibiting employees and officers involved in making credit decisions from accessing applicant demographic information collected under Section 1071, is retained without modification. The Final Rule provides enhanced clarity on two aspects of the firewall, including the scope of the feasibility exception and the content and timing of the required disclosure to applicants when the exception is invoked.
The 2026 Final Rule retains the enforcement framework of the previous rule, including the bona fide error safe harbor and the four enumerated safe harbors for census tract geocoding, North American Industry Classification System code reporting, incorrect small business/covered transaction status determinations, and errors within specified numerical tolerances.
The Final Rule replaces the tiered compliance date structure of the previous rule with a single compliance date of Jan. 1, 2028, for all covered financial institutions. A covered institution must begin collecting data on Jan. 1, 2028, and must file its first small business lending application register with the CFPB by June 1, 2029.
Related: 4 Most Common Types of Car Accidents in Atlanta
The CFPB reaffirms a 12-month grace period for data collected during the first calendar year of compliance, during which the Bureau will not assess penalties for unintentional, good-faith errors. However, the grace period does not protect intentional non-compliance, deliberate discouragement of applicants, or bad-faith errors.
The 2026 Final Rule does not resolve issues regarding how and when the CFPB will publish application-level Section 1071 data or what privacy modifications and deletions it will make prior to publication. The Bureau acknowledges that the previous rule’s preliminary privacy analysis was not a final, binding decision and commits to issuing a notice of proposed rulemaking with specific proposed modification and deletion decisions for individual data points.
According to officials, the 2026 Final Rule represents a recalibration of the Section 1071 data collection regime that reduces near-term compliance burden, particularly for community banks, credit unions, and smaller non-depository lenders. The Bureau has framed 1071 compliance as beginning a multi-decade data collection program akin to the Home Mortgage Disclosure Act (HMDA), with the stated intention to expand coverage, products, and data points over time as the agency and industry accumulate experience.
Lenders should consider building systems with this continual evolution in mind and use the time between now and Jan. 1, 2028, to confirm coverage status, redesign data collection workflows, update forms, assess vendor readiness, and engage with the ongoing litigation landscape and the forthcoming data publication rulemaking. This process may involve land use ordinances and other regulatory requirements.
The U.S. Small Business Administration (SBA) has approved the alternative size standard used in the Final Rule, which defines a small business as one with $1 million or less in gross annual revenue. The rule also includes a minimum loan size threshold of $1,000, which is subject to CPI-U inflation adjustment every five years beginning in 2030.
