The Consumer Financial Protection Bureau has released a proposed rule that significantly narrows and simplifies the scope of the 2023 small business lending data collection rule under Section 1071. The new proposal shifts the initial rollout toward traditional business loans, lines of credit, and credit card products, while limiting coverage to higher volume lenders.

The Bureau plans to exclude loans under 1,000 dollars, agricultural lending, and revenue-based financing. It would also raise the coverage threshold to institutions that originate at least 1,000 small business loans in each of the previous two years. A single compliance date of January 1, 2028 would apply to institutions meeting that threshold in 2026 and 2027. Lenders can begin limited demographic testing 12 months before the compliance date to validate systems.

Updated Definition of Small Business

The proposal tightens the definition of a small business from 5 million dollars in gross annual revenue to 1 million dollars or less. This metric would be adjusted for inflation in 100,000 dollar increments every five years beginning in 2035. This revision aligns Section 1071 with the Community Reinvestment Act and broader Regulation B adverse action requirements.

Streamlined Data Requirements

The CFPB proposes collecting only the statutory data fields and a narrow set of discretionary items needed to make statutory fields meaningful. These include the North American Industry Classification System code, time in business, and number of principal owners.

Data fields proposed for removal

• Application method

• Denial reasons

• Pricing components including interest rate and fees

• Number of workers

The Bureau argues that removing these data points will reduce reporting complexity, minimize errors, and prevent misinterpretation of pricing information in published analyses.

Changes to Demographic Data Collection

The proposed rule removes the LGBTQI plus owned business status field and requires collection of principal owners’ sex through a static male or female choice. Free form text describing sex or gender would no longer be accepted.

Race and ethnicity data would still be required but the Bureau seeks comment on whether reporting should shift to aggregate categories only to reduce early stage implementation complexity. Applicants’ right to refuse demographic questions is highlighted more prominently in the new rule text. Firewall rules remain unchanged and institutions must continue to inform applicants when underwriting staff will have access to demographic information.

Adjustments to Collection Procedures and Privacy

The 2023 rule’s anti discouragement language would be narrowed. Institutions must still maintain procedures reasonably designed to obtain a response but prescriptive expectations, including treating low response rates as evidence of discouragement, would be recast as guidance.

The CFPB continues to delay decisions on releasing application level data. Its plan is to publish aggregate data first and conduct a full privacy analysis before determining whether more granular information can be safely released.

Exclusions for Revenue Based Financing and Agricultural Lending

Revenue based financing, sometimes referred to as merchant cash advances, would not be included as covered transactions due to significant product variation and challenges in creating consistent data standards. Agricultural lending is similarly excluded because of the unique nature of collateral and underwriting as well as overlapping regulatory reporting regimes.

Key Requirements That Remain

Institutions must still collect statutory data fields, separate demographic information from credit application files, provide firewall notices where required, and follow existing adverse action notice rules under Regulation B. Even if denial reasons are removed from Section 1071 reporting, lenders must continue providing them under subpart A for qualifying businesses.

Impact of the DOJ OLC Opinion on CFPB Funding

A Department of Justice Office of Legal Counsel opinion indicates that the CFPB may only be legally funded through December 31, 2025. If funding lapses in 2026, rulemaking, supervision, and enforcement could pause except for emergency functions. This could delay Section 1071 timelines and increase reliance on state level oversight.

Practical Steps for Financial Institutions

Institutions above the threshold should:

• Prepare for a January 1, 2028 compliance date

• Begin limited demographic testing 12 months before the deadline

• Review current Section 1071 builds and identify gaps created by the proposed data removals and demographic changes

All institutions should update demographic forms and scripts to reflect male or female sex selection and the removal of the LGBTQI plus question. Procedures must still support reasonable efforts to obtain a response and maintain required firewalls.