CFPB Issues Final Rule Amending Regulation B’s Small Business Lending Data Collection Requirements

The Consumer Financial Protection Bureau (the "CFPB") has issued a final rule governing the collection and reporting of loan application data for credit for women-owned, minority-owned, and small businesses. The final rule amends provisions added to Regulation B, subpart B in 2023 which never took effect. The final rule is the latest action to implement changes to the Equal Credit Opportunity Act ("ECOA") made by section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”).

The final rule takes effect on June 30, 2026, with a compliance date of January 1, 2028.

A. Overview

In 2010, Congress passed the Dodd-Frank Act. Section 1071 of that Act amended ECOA to require that financial institutions collect and report to the CFPB certain data regarding applications for credit for women-owned, minority-owned, and small businesses. Section 1071's statutory purposes are to (1) facilitate enforcement of fair lending laws, and (2) enable communities, governmental entities, and creditors to identify business and community development needs and opportunities of women-owned, minority-owned, and small businesses.

On May 31, 2023, the CFPB published an initial final rule implementing section 1071, which was subsequently challenged in litigation across three jurisdictions. On November 13, 2025, the CFPB published a proposed rule to amend the 2023 final rule and has now finalized those amendments. The CFPB has determined that a potentially long-term data collection regime should start with a focus on core lending products, lenders, small businesses, and data points, adopting a more incremental approach than the broad initial coverage of the 2023 final rule.

B. Key Amendments

Covered Credit Transactions

Existing section 1002.104(a) of Regulation B defines a “covered credit transaction” for purposes of small business loan reporting as “an extension of business credit that is not an excluded transaction under paragraph (b) of this section.” Section 1002.104(b)(1)-(6) enumerates six types of transactions that are excluded from covered credit extensions. Those excluded transactions include trade credit, Home Mortgage Disclosure Act reportable transactions, insurance premium financing, public utilities credit, securities credit, and incidental credit.

The final rule excludes merchant cash advances, agricultural lending, and small dollar loans (transactions of $1,000 or less) from the definition of covered credit transaction. The CFPB concluded that the initial iterations of data collection should focus on core, widely used lending products most likely to be foundational to small businesses' formation and operation, namely loans, lines of credit, and credit cards.

Covered Financial Institutions

The final rule contains two changes to the covered financial institution definition. First, Farm Credit System lenders are excluded from coverage. Second, the origination threshold is raised from 100 to 1,000 covered credit transactions for each of two consecutive years. As a result, the updated definition of “covered financial institution” is “a financial institution, other than a Farm Credit System lender, that originated at least 1,000 covered credit transactions for small businesses in each of the two preceding calendar years.”

The CFPB estimates that this final rule, at an originations threshold of 1,000, will still cover the vast majority of small business loan originations made by depository institutions (approximately 92 to 93 percent).

Small Business Definition

The final rule changes the gross annual revenue threshold in the rule's definition of “small business” from $5 million or less to $1 million or less. The CFPB concluded that the focus of the rule should be on truly small businesses, and that this more limited collection will better align with the statutory purposes of section 1071. Under the revised definition, “small business” has the same meaning as “small business concern” in the Small Business Act, and a business qualifies as a small business if its gross annual revenue for its preceding fiscal year is $1 million or less.

The final rule also changes the inflation adjustment provision in section 1002.106(b)(2) of Regulation B, to require adjustment in $100,000 increments (rather than $500,000) every five years after 2030 (rather than 2025). The CFPB believes that, given the change to a $1 million revenue threshold, inflation adjustments in $500,000 increments will not be granular enough for this provision to meaningfully track inflation.

Data Points

The final rule removes several discretionary data points from the collection and reporting requirements, including application method, application recipient, denial reasons, pricing information, number of workers, and minority-owned, women-owned, and/or LGBTQI+-owned business status. The CFPB concluded that the initial iterations of data collection should focus on core data points and be consistent with other executive agency directives concerning the collection of demographic data.

Additionally, the final rule eliminates the use of disaggregated race and ethnicity categories, requiring collection of only aggregate ethnicity and race categories. For the collection of principal owners' sex, the final rule requires financial institutions to inquire about sex rather than sex and gender, with sex to be selected from a binary response option of male or female. The final rule also adds a provision emphasizing the applicant's statutory right to refuse to provide demographic information.

Time and Manner of Data Collection

The final rule amends the provisions on the time and manner of data collection, removing certain prescriptive monitoring requirements and anti-discouragement provisions that the CFPB determined were redundant and added unnecessary regulatory complexity.

C. Compliance Date and Transition Rules

The final rule establishes a single compliance date of January 1, 2028 for all covered financial institutions that originated at least 1,000 covered credit transactions for small businesses in each of calendar years 2026 and 2027. Financial institutions that subsequently originate at least 1,000 such transactions in two consecutive calendar years shall comply no earlier than January 1, 2029.

The final rule also adopts a new special transitional rule permitting, but not requiring, financial institutions to use calendar years 2025 and 2026 (instead of 2026 and 2027) for purposes of determining whether they must comply beginning January 1, 2028. Financial institutions that reasonably anticipate being covered may voluntarily begin collecting certain demographic information 12 months prior to the compliance date.

Grace Period

The CFPB is retaining and updating the grace period, now covering January 1, 2028 through December 31, 2028. During this period, for covered financial institutions that make good faith efforts to comply, the CFPB does not intend to assess penalties for unintentional errors in initial data submissions, and examinations will be diagnostic in nature to identify compliance weaknesses.

D. Conclusion

This final rule represents a significant recalibration of the CFPB's approach to small business lending data collection under section 1071 of the Dodd-Frank Act. The narrowing of covered transactions, institutions, and data points, along with the revised small business definition, is intended to streamline the rule, reduce complexity for lenders, improve data quality, and advance the statutory purposes of section 1071 through a more incremental approach.

Covered financial institutions should evaluate whether they meet the revised 1,000-origination threshold, determine whether any of their lending products are now excluded from coverage, update their data collection systems to reflect the revised data points and demographic data requirements, and prepare for compliance by January 1, 2028.

This advisory is a general overview of the final rule and is not intended as legal advice. The final rule is very detailed and must be reviewed in its totality.

If you have any questions about the final rule, please feel free to contact Joseph D. Simon at (516) 357-3710 or via email at jsimon@cullenllp.com, Elizabeth A. Murphy at (516) 296-9154, or via email at emurphy@cullenllp.com, David Curatolo at (516) 357-3773 or via email at dcuratolo@cullenllp.com, or Gabriela Morales at (516) 357-3850 or via email at gmorales@cullenllp.com.