New 1071 Data Rules: Costs & Deadlines

In June 2025, the Consumer Financial Protection Bureau (CFPB) issued an interim final rule that extends the compliance deadlines for the Small Business Lending Rule (section 1071 of the Dodd-Frank Act) by approximately one year for all covered financial institutions. This move comes amid ongoing litigation and previous court-ordered stays affecting some lenders, and is aimed at ensuring consistent compliance across all market participants.

Background

Section 1071 of the Dodd-Frank Act mandates that financial institutions collect, maintain, and report data regarding small business credit applications, particularly those from women-owned, minority-owned, and small businesses. The goal is to facilitate fair lending enforcement and help identify business and community development needs.

Extended Compliance Deadlines

The new compliance dates establish a tiered approach based on lender size (by number of small business loan originations):

• Compliance Date: The date covered institutions must start collecting small business credit applicant data.

• First Filing Deadline: The date by which collected data must be submitted to the CFPB for the previous calendar year.

Additional Key Details

• Grace Period: Financial institutions get a 12-month grace period after their compliance date. During this period, CFPB won’t assess penalties for errors made as part of good-faith compliance efforts and will focus examinations on diagnosing compliance weaknesses.

• Early Data Collection: Lenders may begin collecting demographic data up to 12 months before their compliance date to test their procedures.

• Applicability: Some institutions remain protected by ongoing court stays, but for others, these revised deadlines now apply uniformly to facilitate consistent implementation.

• Comment Period: The interim final rule became effective June 18, 2025, and comments on the rule are due by July 18, 2025.

The CFPB's Section 1071 Small Business Lending Rule is coming whether we like it or not. If you're an alternative business lender, this regulation will impact your operations, and understanding what's required is critical for staying compliant and managing risk.

What Section 1071 Actually Does

Section 1071 of the Dodd-Frank Act amended the Equal Credit Opportunity Act (ECOA) to require collection and reporting of small business lending data. The rule has three main purposes:

• Fair Lending Enforcement: Regulators want data to identify and enforce against discriminatory lending practices and ensure equitable access to credit for all small businesses, particularly those traditionally underserved.

• Community Development: The data will help communities, government entities, and creditors understand the credit landscape and identify areas needing economic development support.

• Market Transparency: Similar to how HMDA data impacted residential lending, Section 1071 aims to increase lending to traditionally underserved borrowers and communities by revealing lending patterns by demographic characteristics.

The 2023 Final Rule: What Data You Need to Collect

The CFPB's 2023 final rule requires companies issuing commercial credit products to small businesses to collect extensive data.

Demographic Data Collection: You must compile and report information about the demographics of a small business applicant's ownership. This includes whether the business is minority-, women-, or LGBTQI+-owned, as well as the ethnicity, race, and sex of the applicant's principal owners.

Application-Level Information: Beyond demographics, you need other critical application data including the type of credit product offered, credit pricing (interest rates, fees, prepayment penalties), types of guarantees, loan term, credit purpose, the amount of money applied for, and the action taken on the application.

Who's Covered: Covered financial institutions include both depository and non-depository entities that engaged in at least 100 covered originations in each of the two preceding calendar years. Covered transactions include loans, lines of credit, credit cards, merchant cash advances, and credit products for agricultural purposes, all extended to small businesses or farms with gross annual revenues of $5 million or less in the preceding year.

Compliance Dates: The Moving Target

Section 1071's implementation has been extended multiple times due to ongoing litigation. The latest interim final rule, published on June 18, 2025, extended dates by approximately twelve months.

Three-Tiered Structure:

• Tier 1 (Highest Volume): Financial institutions with at least 2,500 covered transactions in the preceding two years must comply by July 1, 2026. First filing is due June 1, 2027.

• Tier 2 (Moderate Volume): Those with at least 500 covered transactions annually must comply by January 1, 2027. First filing is due June 1, 2028.

• Tier 3 (Smallest Volume): Lenders with at least 100 covered transactions annually must comply by October 1, 2027. First filing is due June 1, 2028.

Testing and Grace Periods: You can begin collecting demographic data up to 12 months before your compliance date for testing purposes. The CFPB will implement a 12-month grace period from the compliance date, during which it won't assess penalties for data reporting errors if you're engaged in good faith compliance efforts. However, errors not resulting from good faith efforts will be subject to supervisory and enforcement authority.

The Legal Battle and What It Means

The rule faces significant legal challenges. The U.S. Court of Appeals for the Fifth Circuit has stayed compliance with the rule for many financial institutions. America's Credit Unions members are covered by a 2023 district court decision that stayed the rule, which is now on appeal.

CFPB's Current Stance: The CFPB announced it will not enforce its small business lending data collection rule for entities outside of the stay. The CFPB also stated its intent to initiate a new Section 1071 rulemaking, anticipating a Notice of Proposed Rulemaking as expeditiously as possible, presumably proposing a more limited rule.

Industry Opposition: The SBA's Advocacy office raised concerns that the CFPB's approach may be unnecessarily burdensome to small entities, impact the cost of credit, and potentially decrease lending to small, minority, and women-owned businesses. Advocacy encourages the CFPB to either rescind the 2023 final rule or modify it. The American Bankers Association also supports rescinding or modifying the rule, calling it "unduly burdensome" and likely to "increase costs for small businesses seeking credit".

Support for Implementation: The National Community Reinvestment Coalition strongly opposes the extension of compliance dates and urges the CFPB to implement the 2023 Final Rule immediately. They argue that two federal courts have ruled in the CFPB's favor, affirming that the benefits of data disclosure maximize while minimizing costs, and that costs would comprise "a small portion of the total cost of the average loan".

What This Costs and System Requirements

While specific dollar figures aren't available, the discussion around costs reveals important insights:

Cost Impact: Advocacy estimates the compliance date extension could save affected small entities roughly $48.5 million over ten years. The CFPB expects the magnitude of any cost pass-through to be a small portion of the total cost of the average loan and would not meaningfully impact affordability. However, industry groups still perceive the costs as substantial despite regulatory assurances.

System Requirements: The extensive data requirements mean your loan management system must be capable of accurately recording these new fields at the point of application and throughout the lending lifecycle. The requirement to shield demographic data from underwriters requires sophisticated access controls and internal firewalls within your system. You're also responsible for recordkeeping requirements and ensuring compliance with enforcement provisions, which means your system must support comprehensive audit trails and data integrity checks.

Third-Party Solutions: Software tools like Small Biz Wiz are available to assist with Section 1071 data collection, reporting, and analysis. This means you might not need a complete custom overhaul, as specialized vendor solutions can integrate with or augment existing systems. Advisory services are also available to support data collection, reporting, and analytics compliance.

Collecting Demographic Data Without Killing Your Process

For lenders dealing with rapid-fire products like merchant cash advances, collecting sensitive demographic data without disrupting approval processes is a real challenge.

Data Firewalls Are Critical: The rule explicitly mandates shielding demographic data from underwriters and other persons involved in credit decisions. This firewall is your primary mechanism to ensure that collecting sensitive data doesn't impede or bias the underwriting process. Your underwriters won't see the ethnicity, race, or sex information, allowing them to focus solely on creditworthiness criteria.

Staff Training Matters: Your loan officers and staff must be trained to ensure that all data points are collected at application, including applicant/owner race and sex/gender information. Training should equip staff with clear explanations for why this data is being collected, emphasizing the statutory purpose of facilitating fair lending and identifying community credit needs.

No Waiting: Despite the extensions and re-evaluation, you cannot remain in a "wait and see" mode. Even with a new proposal anticipated, you must prepare for some form of data collection and reporting.

What You Need to Do Now

Determine Your Coverage: Assess whether your institution falls under the "covered financial institution" definition and identify all "covered transactions". Review your origination volumes against the 100-transaction threshold and understand that the rule applies to small businesses with gross annual revenues of $5 million or less.

Use Your HMDA Experience: If you're familiar with HMDA data reporting, apply those best practices to Section 1071 compliance. Your existing compliance management system can serve as a framework.

Assess System Needs: Work with core systems to understand how data is currently collected and stored, and develop a process guide that lists the mandated field names and corresponding source materials. Consider whether you need third-party software or can modify existing systems.

Prepare for Fair Lending Impact: Since Section 1071 is an amendment to ECOA, ensure your underwriting and pricing practices comply with fair treatment and equity standards. Conduct a full risk assessment of all small business and small farm loan products.

The regulatory uncertainty creates a dynamic environment, making flexible, scalable solutions and close monitoring of rulemaking developments critical to avoid wasted investment. But ignoring the rule due to litigation is a high-risk strategy that could leave you scrambling when compliance dates arrive.

_{Sources:
advocacy.sba.gov
federalregister.gov
consumerfinance.gov
consumerfinancemonitor.com
American Bankers Association
National Community Reinvestment Coalition}

1-Minute Video: Headcount-to-Portfolio Growth Ratio is a Real Problem for Lenders

Break that linear relationship.

John Mizzi, CEO of Vero Technologies, discuss how mart lenders scale their books without turning their offices into overcrowded processing centers filled with people doing mind-numbing manual work that computers should handle.

Listen to full podcast

Headlines You Don’t Want to Miss

Carlyle hires Goldman exec to lead direct lending unit

Carlyle Group has hired Alex Chi, former co-head of Americas private credit at Goldman Sachs Asset Management, to lead its direct lending arm as part of an effort to expand its private credit business. Chi will join Carlyle in early 2026 as a partner, sit on the firm’s leadership committee, and also serve as co-deputy investment chief for the firm’s $199 billion credit unit.

JP Morgan Explores Lending Against Crypto Holdings

JPMorgan Chase is reportedly considering offering loans backed directly by clients’ cryptocurrency holdings, including Bitcoin and Ethereum, with a launch possible as early as next year. This marks a notable shift in strategy under CEO Jamie Dimon and reflects growing institutional acceptance of crypto assets in traditional banking.

NAV finance provider 17Capital concludes lending fund at $5.5bn

17Capital, the world's largest dedicated NAV finance provider, has closed its sixth Strategic Lending Fund at $5.5 billion, marking one of the largest private credit raises in 2025. The fund garnered strong global investor support and has already committed $2.5 billion across ten investments in both the US and Europe.