Four Things to Know About the CFPB’s Final Rule Revising Small Business Lending Data Collection Under Regulation B

On May 1, 2026, the Consumer Financial Protection Bureau (CFPB) published a final rule¹ (the Final Rule) revising the CFPB’s small business lending data collection regime under section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Section 1071). Section 1071 amended the Equal Credit Opportunity Act (ECOA) to require financial institutions to collect and report data on credit applications by small, women-owned, and minority-owned businesses. The Final Rule narrows, but does not rescind, the small business lending data collection regime established by the CFPB’s May 2023 final rule (the 2023 Final Rule),² which since its adoption has been the subject of ongoing litigation in three federal courts. In making these changes, the CFPB has sought to limit the rule as much as possible to what is strictly required by statute.

Pointing to the gradual evolution of data collection under the Home Mortgage Disclosure Act (HMDA) over the past 50 years, the CFPB concluded that long-term data collection under Section 1071 should commence with a focus on core lending products, lenders, small businesses, and data points, with future expansions reserved for subsequent notice-and-comment rulemakings. In doing so, the CFPB concluded that the 2023 Final Rule’s expansive approach to coverage was not conducive to the long-term success of the Section 1071 framework.³

The Final Rule is effective June 30, 2026, with a compliance date of January 1, 2028, and a one-year grace period running through December 31, 2028.

Below are four key points about the Final Rule for consideration by financial institutions.

1.  Fewer Institutions Will Be Required to Report Data to the CFPB

The Final Rule raises the origination threshold for being a “covered financial institution” tenfold, increasing it to 1,000 covered credit originations (rather than 100) in each of the two preceding calendar years, and separately excludes Farm Credit System (FCS) lenders from coverage altogether. These changes are expected to reduce substantially the number of community banks, credit unions, and other smaller institutions subject to the rule.

2.  Fewer Borrowers Will Qualify as “Small Businesses” That Trigger Reporting Obligations

The Final Rule lowers the gross annual revenue threshold in the definition of “small business” from $5 million or less to $1 million or less, narrowing the universe of borrowers whose applications trigger the Final Rule’s data reporting requirement.⁴ The threshold remains subject to the existing five-year inflation adjustment set forth under Regulation B.

3.  Three New Kinds of Excluded Transactions That Do Not Require Data Reporting

The Final Rule adds three new categories of transactions to the list of “excluded transactions” under 12 C.F.R. § 1002.104(b) that do not require data reporting:

• Merchant cash advances (MCAs). MCAs are agreements under which a small business receives a lump-sum payment in exchange for the right to receive a percentage of the small business’ future sales or income up to a ceiling amount.⁵ The CFPB notably declined to take a categorical position on whether MCAs constitute “credit” under ECOA, instead deferring the question pending further market analysis and case-law development.⁶
• Agricultural lending. Agricultural lending is generally defined as lending to fund the production of crops, fruits, vegetables, and livestock, or to fund the purchase or refinance of capital assets such as farmland, machinery and equipment, breeder livestock, and farm real estate improvements.⁷ The CFPB cited existing data collection by the Farm Credit Administration, the U.S. Department of Agriculture’s Farm Service Agency, and Community Reinvestment Act reporting as already providing meaningful visibility into agricultural lending.⁸
• Small dollar business credit. Small dollar business credit is defined to be credit in an amount of $1,000 or less, subject to inflation adjustment.⁹

4.  A Streamlined Set of Required Data Points

The Final Rule limits required data collection to the data points specifically enumerated in Section 1071, plus a limited subset necessary to facilitate collection of those statutory items.¹⁰ Accordingly, the Final Rule eliminates several discretionary data points that the 2023 Final Rule had required, including: (1) application method, (2) application recipient, (3) denial reasons, (4) pricing information, and (5) number of workers.¹¹ In addition, the Final Rule revises the format for collecting demographic information about principal owners and the business ownership status data point to align with Executive Order 14168.¹²

Three Practical Takeaways

First, financial institutions should reassess their status against the new institutional and small business thresholds to determine whether the CFPB’s small business lending data collection requirements still apply to them. Many institutions covered by the 2023 Final Rule — particularly community banks, credit unions, and FCS lenders — may now fall outside the rule entirely, while others may move in or out of coverage as origination volumes shift across calendar years.

Second, institutions that remain covered should continue their Section 1071 implementation work rather than scaling it back. The CFPB has signaled that the Final Rule represents the first phase of an incremental, HMDA-style framework, and future rulemakings may reintroduce some of the products, lenders, or data points removed by the Final Rule.¹³ Institutions that had begun to implement the rule but are now no longer covered should nonetheless retain the work that has been done in preparation for possible future changes.

Third, the Final Rule does not necessarily moot the pending litigation challenging the 2023 Final Rule in Texas Bankers Association v. CFPB,¹⁴ Monticello Banking Co. v. CFPB,¹⁵ and Revenue Based Finance Coalition v. CFPB.¹⁶ Institutions should continue to monitor those cases for developments that may affect the new Final Rule.

*             *             *

If you would like to discuss the Final Rule or how it may affect your institution, please contact any of the authors of this Advisory or your usual Arnold & Porter contact.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.