Peter Haug, Senior Corporate Strategist, LTi Technology Solutions
For more than a decade, Section 1071 of the Dodd-Frank Act has hung over commercial lenders. The rule kept being delayed, challenged in court, and revised, so many equipment finance companies stopped planning for it. That was understandable. This spring the picture finally settled, and the updated rule contains one detail that makes waiting risky.
How we got here
Section 1071 amended the Equal Credit Opportunity Act to require lenders to collect and report data on credit applications from small businesses, including women-owned and minority-owned businesses. The CFPB’s first rule, finalized in 2023, took a broad approach to lenders, products, and data points. In 2025 the Bureau proposed narrowing the rule, and the revised final rule, issued May 1, 2026, took effect June 30, 2026, with a compliance date of January 1, 2028.
What changed
Who is covered. The origination threshold rose from 100 to 1,000 covered credit transactions in each of two consecutive calendar years. That excludes many community banks and specialty lenders, but high-volume small-ticket and vendor finance programs can reach 1,000 small business originations quickly.
What counts as a small business. The gross annual revenue threshold dropped from $5 million to $1 million.
Which products are covered. The rule focuses on loans, lines of credit, and credit cards. True leases, factoring, and purchases of credit transactions remain excluded, and merchant cash advances, agricultural lending, and loans of $1,000 or less are now excluded as well. Equipment finance agreements and loans remain in scope, so for many portfolios the true lease versus financing distinction now determines what is reportable.
Indirect and vendor programs. If the last institution with authority to set material terms is not a covered institution, the application is not reported. Captives, vendor programs, and funders should work out now which party sets the terms.
What data you collect. Discretionary data points such as pricing, denial reasons, and number of workers are gone, along with the anti-discouragement monitoring provisions. The statutory core remains, including demographic information on principal owners.
The detail that makes waiting risky
Coverage is based on origination history. Lenders that meet the 1,000-origination threshold in 2026 and 2027 (optionally, 2025 and 2026) must begin collecting data on January 1, 2028, and file their first Small Business Lending Application Register by June 1, 2029.
You can’t count small business originations if you don’t capture gross annual revenue consistently, and many application-only programs have never required it. The rule offers transition provisions for institutions in that position, but they are no substitute for a clear view of your own volume. There is a grace period through 2028 for good-faith data errors, but good faith requires a working process on day one.
Will it change again?
Possibly. Community groups are challenging the 2026 rule in federal court, and the Small LENDER Act cleared a House committee in April 2026 without becoming law. The CFPB has also compared 1071 to HMDA, indicating coverage, products, and data points could expand over time. The safe assumption is that today’s scaled-back rule is a starting point.
What to do now
The lenders in the best shape are treating 1071 as a customer experience and process problem, not purely a data and reporting problem. A few principles apply regardless of what systems you run.
Design and document your process. As with any regulatory or audit concern, the process playbook should be developed with your compliance and legal teams to ensure you have a decision basis that demonstrates you are making reasonable efforts to comply with the rule. Include your origination partners so there is a firm understanding of who is responsible for each compliance aspect, leading to a clearer customer experience. Collaborate with your technology and service providers to ensure the best possible support for your compliance needs.
Build the firewall into your permissions design. Section 1071 demographic data should be inaccessible to anyone involved in credit and pricing decisions wherever feasible. Set up those access controls before go-live, when they’re far easier to implement. If a full firewall isn’t practical, for example because the same people handle underwriting and data collection, consider how you will notify applicants that those parties will see the data.
Keep the evidence. Log when information was requested, whether the applicant declined, and every change made afterward. A good-faith grace period rewards lenders who can show their process.
Rehearse in 2027. Produce a test register, validate it against the CFPB’s filing specifications, and fix issues while under less pressure.
Lenders who prepare now will treat 2028 as routine. Those who wait risk regulatory scrutiny, and, worse, losing customer trust.