The Consumer Financial Protection Bureau (CFPB) recently finalized revisions to its Section 1071 small business lending data collection rule under Regulation B (2026 Final Rule). The revised rule narrows several reporting requirements, changes which institutions are covered, and reduces the amount of data lenders must collect and report. These changes will likely affect how banks approach small business lending strategy, compliance planning, technology investments, and vendor selection.
What Are The Changes
The 2026 Final Rule makes several notable changes to the prior Section 1071 framework:
- The CFPB lowered the reporting definition of a small business from businesses with revenue of $5 million or less to businesses with revenue of $1 million or less.
- The Bureau raised the institutional coverage threshold from 100 covered originations to 1,000 covered originations in each of two consecutive years, meaning fewer institutions may be required to report.
- The CFPB excluded several categories from coverage, including Farm Credit System lenders, merchant cash advances, agricultural lending, and small-dollar business credit of $1,000 or less. However, it declined to exclude indirect lending transactions.
- The CFPB reduced the amount of information lenders must report, largely moving closer to the 13 data fields required by statute and removing many discretionary fields from the 2023 Final Rule, including application method, application recipients, denial reasons, pricing, and number of workers.
- The Bureau also removed LGBTQI+ owned business status and related references, while keeping principal-owner sex as a reportable field. The remaining discretionary fields are NAICS code, time in business, and number of principal owners
The 2026 Final Rule replaces the prior tiered compliance schedule with a single compliance date for institutions that remain covered and updates the CFPB’s grace-period policy for the first 12 months of 2028 data submissions.
What These Changes Mean for Banks
The updated rule changes how institutions may approach SMB lending strategy, compliance, and operational planning, but the impact will vary depending on how much preparation a bank had already completed under the prior rule. For banks that have already built or began building systems around the 2023 requirements, the revised rule may reduce the reporting, validation, audit, and ongoing maintenance burden rather than require a major change in lending strategy.
Smaller banks may also gain a competitive advantage because the origination threshold increased to 1,000 covered originations per year, allowing many institutions to continue SMB lending without building new Section 1071 reporting systems. The narrower definition of “small business” may reduce reporting pressure around businesses with more than $1 million in revenue, and the removal of many discretionary data points may lower compliance complexity. Larger covered banks, however, will still need to collect, track, and report required data, which means they may continue to standardize intake, underwriting, monitoring, and reporting processes. The rule is expected to take effect on January 1, 2028, although it could still expand, change, or be delayed.
What Tier 2 Banks Should Expect
Section 1071 will still apply to many Tier 2 banks, but the operational pressure may look different than it does for the largest institutions. Tier 2 banks are likely to remain active in SMB lending while focusing more heavily on efficiency, consistency, and standardization. Because the revised rule reduces some reporting burden, these banks may be less likely to pursue major transformation initiatives solely because of Section 1071. Instead, they may focus on practical improvements that help them capture required data more consistently, route applications correctly, reduce manual work for frontline staff, improve auditability, and avoid unnecessary disruption to lending operations.
With less pressure than larger institutions, Tier 2 banks may also try to compete more aggressively on service, speed, and borrower experience.
Expected Technology and Vendor Trends
The revised rule may influence buying behavior, but it is unlikely to drive broad, multi-year system replacements on its own. Banks may show increased interest in LOS enhancements or Section 1071 modules, middleware or workflow tools for data collection, compliance monitoring, data validation, audit support, reporting engines, digital applications, structured intake flows, and rule-based routing for covered versus non-covered applications. Vendor selection may also place greater emphasis on regulatory credibility, including regulatory expertise, clear audit trails, proven implementations, strong data governance support, and flexible reporting capabilities. At the same time, banks are more likely to add targeted capabilities to existing systems than replace core lending platforms
The Operational Reality for Banks
For most banks, the priority will be implementing these changes in a way that is clean, cost-effective, and minimally disruptive to lending operations. The integration needs to flow smoothly across application intake, underwriting, compliance review, reporting, and audit processes without slowing down SMB lending or creating unnecessary complexity for relationship managers and frontline teams. Rather than driving full system replacements or multi-year transformation initiatives, Section 1071 efforts will likely be grouped with related priorities such as LOS upgrades, data governance programs, compliance modernization, regulatory reporting improvements, digital application enhancements, and workflow standardization. The practical takeaway is that Section 1071 may still create meaningful operational work, but the revised rule appears more likely to drive targeted modernization than wholesale transformation.
