The Consumer Financial Protection Bureau (CFPB or Bureau) has issued a new proposed rule that would substantially revise the 2023 small business lending data collection and reporting rule under the Equal Credit Opportunity Act (ECOA) and Regulation B, which implements Section 1071 of the Dodd-Frank Act. The proposal re-centers Section 1071 on “core” providers, products, and data, with a single compliance date and material carve-outs to reduce complexity and improve data quality. The proposal is open for comment for 30 days after publication in the Federal Register. However, just this week the CFPB filed a notice with the D.C. Circuit attaching a Department of Justice (DOJ) Office of Legal Counsel (OLC) opinion which concluded that the Bureau will only be legally funded through December 31, potentially affecting rulemaking and operations timelines.

What the proposed rule would change

The Bureau proposes to focus the initial Section 1071 implementation on mainstream business loans, lines of credit, and credit cards, and on higher‑volume lenders. It would exclude revenue‑based financing, agricultural lending, and loans under $1,000 (inflation‑adjusted). It would also raise the coverage threshold from 100 to 1,000 originations in each of the two preceding calendar years, using only small‑business originations (not small farm), and set a single compliance date — January 1, 2028 — for institutions above the threshold in both 2026 and 2027. Institutions can begin collecting limited demographic data 12 months before their compliance date to test systems. The Bureau positions this “start small” approach as akin to HMDA’s gradual build-out, emphasizing data quality and reduced market disturbance.

Small business definition and covered institutions

The proposal would tighten the “small business” definition from gross annual revenue of $5 million or less to $1 million or less, with future inflation adjustments in $100,000 increments every five years starting in 2035. The Bureau is seeking Small Business Administration approval for the alternative size standard and highlights alignment with Regulation B subpart A (adverse action notice rules) and the Community Reinvestment Act’s longstanding “smaller business” revenue metric.

Data points

The proposal would confine initial data to statutory fields and a small set of discretionary items needed to make those statutory fields useful (e.g., NAICS code, time in business, number of principal owners). The Bureau proposes to remove several discretionary fields, including application method, application recipient, denial reasons, pricing components (including interest rate and fees), and number of workers. The Bureau’s rationale centers on implementation complexity, error rates, and the risk of misinterpretation of pricing data in public analyses.

Demographic collection would change in two ways. First, consistent with Executive Order 14168, the proposed rule would remove LGBTQI+‑owned business status and require collection of principal owners’ sex using a static male/female choice, replacing free‑form text asking the applicant to state their “sex/gender.” Second, while the rule would still require race/ethnicity for principal owners, the Bureau seeks comment on whether to move from disaggregated subcategories to only aggregate categories in the initial build to reduce complexity. The right for applicants to refuse to provide demographic information would be more prominent in the rule text and sample forms, and the firewall notice remains — applicants must be informed if underwriting staff will access the demographic responses.

Time and manner of collection

The 2023 final rule’s “anti‑discouragement” language specific to 1071 collection would be pared back. Institutions would still have to maintain procedures “reasonably designed to obtain a response,” but prescriptive expectations (e.g., monitoring low response rates as “indicia of discouragement) would be removed or recast as guidance. Privacy publication decisions remain deferred, with the Bureau reiterating its plan to publish aggregate data first and conduct a privacy analysis before any application-level release.

Revenue‑based financing and agricultural lending

The proposal would exclude revenue‑based financing — labeled “merchant cash advance” in the draft — from Section 1071’s covered transactions list, citing product heterogeneity, data comparability concerns, and evolving state regimes. The Bureau explicitly analogizes to how it treated leases in 2023. Agricultural lending is likewise excluded, reflecting unique collateral, underwriting, and overlapping regulatory data submission requirements.

What stays the same

Institutions must still collect and maintain statutory fields, keep demographic responses separate from application files, and provide firewall notices when applicable. The applicant’s right to refuse demographic questions is unchanged (and emphasized), and subpart A adverse action obligations remain intact. Even if denial reasons drop as a Section 1071 data field, lenders still must meet the business‑credit adverse action notice requirements for businesses under the revenue threshold in subpart A.

DOJ OLC opinion and potential 2026 funding lapse

As discussed here, on November 11, the DOJ notified federal courts that the CFPB anticipates exhausting available funds in early 2026, based on an OLC opinion concluding that there are no “combined earnings of the Federal Reserve System” from which to transfer under 12 U.S.C. § 5497 while the Fed operates at a loss. The DOJ indicated that the Bureau expects to continue normal operations at least through December 31, 2025, but a lapse would trigger Antideficiency Act constraints — pausing most rulemaking, examinations, and enforcement except for narrow “emergency” functions. If a funding lapse occurs, rulemakings like Section 1071 could slow or pause, timelines could slip, and federal oversight gaps might spur more state Attorney General and regulator activity.

Practical Implications

If you are above the 1,000 small‑business originations threshold in both 2026 and 2027, plan for a January 1, 2028 start date under this proposal’s framework and consider beginning limited demographic collection 12 months prior to this start date in order to test processes. In addition, you should inventory your current Section 1071 build and gap‑assess against the proposed changes — especially removal of pricing components and denial reasons, revised demographic formats, and narrowing to core products. If you are below the 1,000 originations threshold, this proposal would move you out of Section 1071 coverage.

For all institutions, we recommend updating demographic collection forms and scripts to reflect the proposed male/female sex field and the removal of LGBTQI+‑owned business status, and preparing to emphasize the applicant’s right to refuse. Even with subpart B streamlining, procedures must still be reasonably designed to obtain a response, and firewall obligations apply when underwriting staff will access demographic responses.