Under the CFPB’s 2026 final rule, Section 1071 applies from 1 January 2028 to a lender that originated at least 1,000 covered credit transactions for small businesses in each of 2026 and 2027, and a small business is one with gross annual revenue of $1 million or less. The first full year of data is due to the CFPB by 1 June 2029. The rule is far narrower than the 2023 version it amends, but it still asks a covered lender to file an application-level register it has never filed before, with no prior year to compare against and no examiner feedback to learn from.
That gap is why Botminds built HMDA and 1071 Data Validation: agents that read each register record and the file behind it, draw every reportable field to the page it came from, and put only the disagreements in front of a person who corrects and signs. The same check that runs on a mortgage lender’s HMDA register runs on a small-business register. This page sets out what the 2026 rule says, in its own words, and how a lender can use 2027 to find out whether its data will hold.
The Section 1071 rule, 2023 against 2026
2023 final rule: Three tiers by volume. After court stays and extensions: 1 July 2026, 1 January 2027 or 1 October 2027.
2026 final rule: One date for every covered lender: 1 January 2028. Rule effective 30 June 2026.
2023 final rule: 100 or more covered originations to small businesses in each of two years.
2026 final rule: 1,000 or more in each of 2026 and 2027 (or 2025 and 2026). Farm Credit System lenders excluded.
2023 final rule: Gross annual revenue of $5 million or less.
2026 final rule: Gross annual revenue of $1 million or less for the preceding fiscal year.
2023 final rule: Merchant cash advances, farm loans and very small loans covered.
2026 final rule: Merchant cash advances, agricultural lending and credit of $1,000 or less excluded.
2023 final rule: 20 in §1002.107(a), eight of them discretionary.
2026 final rule: 15. Application method, application recipient, denial reasons, pricing and number of workers removed.
2023 final rule: Minority-, women- and LGBTQI+-owned status; aggregate and disaggregated race and ethnicity; sex or gender as free text.
2026 final rule: Minority- and women-owned status; aggregate race and ethnicity only; sex as male or female.
2023 final rule: Anti-discouragement provisions and monitoring of response rates.
2026 final rule: Monitoring deleted. Procedures must still be “reasonably designed to obtain a response”.
2023 final rule: §1002.108: underwriters may not see demographic answers unless a notice is given.
2026 final rule: Retained without change.
2023 final rule: First 12 months after each tier’s date.
2026 final rule: 1 January to 31 December 2028, for good-faith compliance.
The CFPB’s own compliance page puts the change in one sentence: on 1 May 2026 it “published a final rule to reconsider portions of the small business lending rule … and extend its compliance date to January 1, 2028.” It adds that it “will update its regulatory and implementation materials to reflect the final rule at a later date”, so the filing instructions a register must match are still to come.
What the 2026 Section 1071 final rule changed, and why
The 2026 rule cuts Section 1071 back to core lenders, core products, the smallest businesses and the data points the statute names. The Bureau says so directly in the preamble:
“A potentially long-term data collection regime should start with a focus on core lending products, lenders, small businesses, and data points.”
CFPB, Small Business Lending final rule, 91 FR 23530
Four definitions move. Coverage rises from 100 to 1,000 originations “for each of two consecutive years”. The revenue line falls from $5 million to $1 million. Merchant cash advances, agricultural lending and “small dollar business credit”, defined as “a transaction in an amount of $1,000 or less”, leave the definition of a covered credit transaction. And five of the eight discretionary data points go, while NAICS code, time in business and number of principal owners stay because they are “integral to collection and understanding of statutorily required data points.”
Two things do not move, and both shape a lender’s operations more than the headline numbers. The firewall in §1002.108 is kept “without modification”, and the Bureau declined to replace it with an HMDA-style disclosure because the firewall “is an explicit statutory requirement.” And the rule’s error tolerances in Appendix F still judge each field on a random sample, which is where the parallel with HMDA becomes exact.
Who is covered by the Section 1071 final rule? The 1,000-origination test, in order
A lender is covered on 1 January 2028 if it originated at least 1,000 covered credit transactions for small businesses in each of calendar years 2026 and 2027; it may instead use 2025 and 2026. The regulation text is plain: a lender that meets the test “shall comply with the requirements of this subpart beginning January 1, 2028.” A lender that crosses the line later complies under §1002.105(b), “but in any case no earlier than January 1, 2029.”
The catch is that the count uses the new definitions. Only transactions that are not excluded, made to businesses at or under $1 million, count toward the 1,000. A lender that has never recorded applicants’ revenue cannot know its own number, so the rule lets it use “any reasonable method to estimate”. The first example in the commentary is live as this is written: ask every applicant, before closing, whether its revenue for the preceding fiscal year was $1 million or less, “during the period October 1 through December 31, 2026”, then quadruple that quarter’s originations and apply the result to both years.
Who the 1,000 line leaves in, and who it lets go
≈170
banks, savings associations and credit unions the CFPB expects to report
≈1,530
depository institutions covered by the 2023 rule that will not report
≈92%
of depository small-business originations still covered (92–93%), against 94–95% at 100
≈240
commercial finance companies that would have been covered in 2023 and are not now
So the 2026 rule moves Section 1071 from a regime about 1,700 banks, savings associations and credit unions would have joined to one that about 170 will. Those 170 make most of the loans, which is the Bureau’s argument for the threshold. For each of them, though, the register is just as new as it was going to be in 2023.
Is this application on the 1071 register? Three questions, in order
1 · The lender
1,000 or more covered originations to small businesses in each of 2026 and 2027?
Or 2025 and 2026, at the lender’s option. Farm Credit System lenders are out.
No → not covered from 1 January 2028
2 · The transaction
Business credit, but not a merchant cash advance, agricultural lending or credit of $1,000 or less?
These exclusions also shrink the count in question 1.
No → excluded transaction, not reported
3 · The applicant
Gross annual revenue of $1 million or less for its preceding fiscal year?
The applicant’s figure, or the verified one if the lender verified it.
No → not a small business, not reported
On the small business lending register
Collect the data points, keep the firewall, file by 1 June of the following year.
Who is a small business now: $1 million, stated or verified
A business is small under the 2026 rule if “its gross annual revenue for its preceding fiscal year is $1 million or less”, and the figure that decides it is the applicant’s, unless the lender has a better one. The commentary allows a lender to rely on what the applicant says and does not require verification. But it is explicit about what happens when a lender does check: “if the applicant provides updated gross annual revenue information or the financial institution verifies the gross annual revenue information …, the financial institution must use the updated or verified information in determining small business status.” For reporting, comment 107(b)-1 adds that where a lender verifies revenue for its own business purposes, “the financial institution reports the verified information”, and gives a tax return as an example source.
Commercial credit verifies revenue all the time, from returns, financial statements and bank statements, and the stated figure is often the owner’s round estimate. At $5 million that gap rarely mattered. At $1 million it decides whether an application is on the register at all, and it works in both directions. The rule’s own example is a business that states $1.1 million and turns out, in underwriting, to have $950,000: it was not reportable, and now it is, and the lender must “take reasonable steps upon discovery” to collect the data it skipped.
Take a sample lender’s third-quarter practice register as it runs through the solution. Kestrel Valley Bank, a fictional $6.8 billion lender, took 412 small-business applications from July to September 2026. One of them is Halvorsen Provisions LLC, a $150,000 working-capital line approved on 22 July. The application states revenue of $980,000, the owner’s estimate. The commercial credit analyst verified revenue from line 1a of the 2025 business tax return: $1,214,300.
The revenue line breaks: stated on the application, verified from the return
Verified revenue is the one that counts. Above $1 million, the business is not small under the 2026 rule, and the application leaves the register.
The register held the stated figure because that is what the origination system captured at intake. The return says otherwise, the lender verified it, so the verified figure is reported, and at $1,214,300 the business is not small. The solution does not remove the application on its own. It writes the break with both values, the document and the rule, and the data manager corrects revenue and removes the application with a signed reason.
Correct, remove and sign: the reason goes on the record
Halvorsen was not alone. Nine of the 412 sample applications stated revenue at or under $1 million and verified above it: $950,000 that verified at $1,388,000, $900,000 at $1,046,500 from financial statements, $990,000 at $1,018,200 from bank statements, $975,000 at $2,140,000. From 2028 that judgment is made on every application near the line, and a practice year is the cheapest place to learn how often it happens, which documents decide it, and whether the loan system keeps the verified figure anywhere a register can read it.
Nine applications stated under $1 million and verified over it
The data points that remain, and the document each comes from
Fifteen data points remain in §1002.107(a), and each has a document in the credit file where its true value lives. The 2023 rule listed twenty. The 2026 rule removes application method, application recipient, denial reasons, pricing information and number of workers, and drops LGBTQI+-owned status from the ownership question. What is left is mostly what a commercial loan system already holds, plus the demographic answers, which it usually does not.
Fifteen Section 1071 data points, each with the document behind it
| Data point | What is reported | Where it comes from |
|---|---|---|
| Unique identifier | Assigned by the lender | Commercial loan system |
| Application date | Date the application was received | Credit application |
| Credit type | Product, guarantees, loan term | Credit application, note |
| Credit purpose | The purpose or purposes | Credit application |
| Amount applied for | As requested | Credit application |
| Amount approved or originated | As decided or closed | Credit decision, note |
| Action taken | Originated, denied, withdrawn … | Credit decision |
| Action taken date | The date of that action | Credit decision, notice |
| Census tract | Of the business or the loan | Geocoded from an address |
| Gross annual revenue | Preceding fiscal year | Application or tax return |
| NAICS code | 3 digits | Application or third party |
| Time in business | As the lender collects it | Application or credit memo |
| Minority- and women-owned status | Applicant’s answer | Demographic data form |
| Principal owners’ ethnicity, race, sex | Aggregate categories; sex male/female | Demographic data form |
| Number of principal owners | As the applicant states it | Application or form |
Three of them are where a new register is most likely to go wrong. Gross annual revenue, for the reasons above. Action taken date, because a commercial system’s status dates are not decision dates, the same trap behind the action-taken-date errors at one branch of a sample HMDA register. And census tract, which the 2023 rule let lenders take from the best address they have through a “waterfall” that one trade association called “confusing and burdensome”; the Bureau kept it, finding that it “strikes the appropriate balance”.
The firewall and the demographic questions
The firewall is unchanged: employees and officers involved in deciding a covered application may not see the applicant’s answers about minority- and women-owned status or the principal owners’ ethnicity, race and sex, unless the lender determines one of them “should have access” and gives the applicant a notice. Commenters asked the Bureau to drop it or exempt banks under $10 billion in assets. The Bureau declined: it had not proposed a change, and the firewall is in the statute.
The demographic questions themselves are simpler than in 2023. Race and ethnicity are collected in the aggregate categories only, sex is a male or female choice “rather than a free-form text field”, and the LGBTQI+ question is gone. One HMDA habit does not transfer: the Bureau again declined to require visual observation or surname review when an applicant declines, because those methods, “while perhaps suited to the HMDA context, may not be appropriate for small businesses where the persons interacting with the financial institution may not be the actual owners of the business.”
For the register, the firewall means the demographic data form sits in a different place from the credit file, often in a different system, and the people who check the register against the file have to reach both while the underwriter reaches only one. A check that reads the form and the register, and shows its findings only to the compliance team, fits that line; one that runs inside the credit workflow may not.
A practice register: run 2027 as if it counted
The 2026 rule gives a covered lender a full year to rehearse, and lets it rehearse the hardest part. Under the transitional rule in §1002.114(c)(1), a lender that “reasonably anticipates” coverage “is permitted, but not required, to collect” the minority- and women-owned answers and the principal owners’ demographics “beginning 12 months prior to the compliance date”, which is 1 January 2027. Nothing in 2027 is reported. Everything in 2027 can be measured.
From the final rule to the first 1071 filing, month by month
- Final rule30 Jun 2026
- In force, not yet requiredJul 2026 – Dec 2027
- Compliancefrom 1 Jan 2028
- 2026 originations1,000+
- 2027 originations1,000+
- Build and estimate2026
- Practice year2027
- First year · grace period2028
- Fileby 1 Jun 2029
The grace period in 2028 is not a reason to wait. The Bureau says that for covered lenders “that make good faith efforts to comply”, it intends for the first 12 months not to assess penalties for errors in data reporting and to examine only “to diagnose compliance weaknesses.” A diagnosis made in 2028 is a list of findings to fix before 2029. Made in 2027 by the lender itself, it is the same list with a year to fix it.
What a practice register tests is not the rule; it is the lender’s data. Run the same field-against-file check on the 2027 applications that the solution runs on an HMDA register, and the questions answer themselves: which fields the loan system never captured, which offices key status dates instead of decision dates, how often verified revenue moves an application across the line, and whether demographic answers collected on a form ever reach the register. On the sample lender’s third quarter, the check ran 23 fields on 412 applications, 9,476 field checks, and found 63 breaks; 41 were resolved by the end of the run and 22 were still open. Those are sample figures from a fictional bank. The method is the point: find the breaks a year before they count.
Nine checks for a 2027 Section 1071 practice register
- Run the 1,000 test both ways
Count 2026 and 2027, and 2025 and 2026, without the excluded products. If revenue is not readily accessible, document the estimate: the rule’s example asks every applicant in Q4 2026 and multiplies by four.
- Build the register from the systems of record
One row per covered application, refreshed nightly, in the filing format, from 1 January 2027.
- Name a source document for every field
Write down which document is the authority for each of the fifteen data points, so a disagreement has a rule to settle it.
- Decide where verified revenue lives
If credit verifies revenue, the register must carry the verified figure. Find out whether the loan system stores it at all.
- Check status dates against decisions
Action taken date is the decision, not the day a file changed status. Compare them for every record.
- Collect demographic answers in 2027
The transitional rule permits it from 1 January 2027. Measure the response rate and whether answers reach the register.
- Test the firewall with real access lists
List who can see the demographic form, and issue the notice wherever a decision-maker should have access.
- Sample it the way an examiner will
Draw 79 records and count errors by field against Appendix F’s threshold of four.
- Fix the step, not only the record
Count errors by office and officer, and send each pattern to the person who owns the step that makes it.
What HMDA teams already know that 1071 teams can reuse
For a lender that also files HMDA, the discipline transfers almost unchanged. Appendix F of the 1071 rule judges errors on a random sample of 79 applications for a register of 1,000 to 100,000, with a threshold of four errors in a field. That is the same 79 and the same four that the FFIEC’s HMDA transaction testing guidelines use for a register of 501 to 100,000 records, where four errors in a field order that field corrected and resubmitted. The consequence differs: under 1071, errors below the threshold are presumed bona fide and are not violations. The arithmetic is the same, and so are the odds a sample turns up four.
HMDA and Section 1071: the same discipline on two registers
HMDA (Regulation C): 1 March of the following year.
Section 1071 (Regulation B, subpart B): 1 June of the following year; the first by 1 June 2029.
HMDA (Regulation C): Up to 79 records for 501–100,000; four errors in a field orders it resubmitted.
Section 1071 (Regulation B, subpart B): 79 applications for 1,000–100,000; four errors in a field ends bona fide error protection.
HMDA (Regulation C): Gross annual income relied on in the credit decision.
Section 1071 (Regulation B, subpart B): Gross annual revenue of the business; the verified figure where the lender verified it.
HMDA (Regulation C): Income is one input to pricing and fair-lending analysis.
Section 1071 (Regulation B, subpart B): Revenue also decides whether the application is reported at all.
HMDA (Regulation C): Collected from the applicant; visual observation or surname in some cases.
Section 1071 (Regulation B, subpart B): Collected from the applicant only; no visual observation or surname review.
HMDA (Regulation C): No firewall.
Section 1071 (Regulation B, subpart B): Firewall: decision-makers may not see the answers unless a notice is given.
HMDA (Regulation C): Each field drawn to its page in the loan file, with the tolerance applied.
Section 1071 (Regulation B, subpart B): The same, against the commercial credit file, the tax return and the demographic form.
That is why the solution treats Section 1071 as a second register, not a second product. The same agents read the register and the file, find the page for each field, match and apply the tolerance, and queue the breaks; the same people correct and sign; the same corrections list exports for the examiner. What changes is the documents the loan file reader opens and the rules the matcher applies, both of which come from the lender’s written procedure. The setting for revenue, for instance, reads “verified figure when the analyst verified it” and can be switched to match a different policy.
The rule also lowers the stakes of a rehearsal in one specific way. The Bureau notes that it “needs a full year’s worth of reported data” before deciding how to modify or delete application-level data for privacy, and will set that out in a separate rulemaking “likely after the collection of the first year’s worth of data.” Publication is undecided; accuracy is not.
Key Section 1071 dates to 1 June 2029
- 13 November 2025. The CFPB proposes reconsidering coverage, the small business definition, data points and the compliance date; comments close 15 December 2025.
- 1 May 2026. Final rule published at 91 FR 23530.
- 30 June 2026. The rule takes effect.
- 1 October to 31 December 2026. The window in the commentary’s example for asking every applicant whether its revenue was $1 million or less, to estimate the count.
- 1 January 2027. Earliest date a lender expecting coverage may collect the demographic answers to test its procedures.
- 1 January 2028. Compliance date for every lender with 1,000 or more covered originations to small businesses in each of 2026 and 2027 (or 2025 and 2026). The grace period runs to 31 December 2028.
- 1 January 2029. Earliest compliance date for a lender that crosses the threshold later.
- 1 June 2029. The first full year of data is due to the CFPB.
For a lender on the list, 2027 is the only year in which the register can be wrong without consequence. Teams planning that year can set it out as a separate track in a go-live plan, or start by comparing ways to validate a register before choosing one for both.
Questions people ask
Is the Section 1071 compliance date still 1 January 2028?
Yes. The 2026 final rule sets one compliance date, 1 January 2028, for every covered lender and replaces the three tiered dates that the 2023 rule and its extensions had set. The CFPB’s compliance page gives the same date.
Does a lender have to verify an applicant’s gross annual revenue?
No. The commentary says a lender “need not independently verify gross annual revenue” and may rely on the applicant. If it does verify, for its own business purposes, it must use and report the verified figure, including to decide whether the business is small.
Does Section 1071 still cover merchant cash advances and farm loans?
No. The 2026 rule adds merchant cash advances, agricultural lending and small dollar business credit of $1,000 or less to the excluded transactions in §1002.104(b). The $1,000 figure adjusts for inflation every five years after 1 January 2030.
Which demographic data does the 2026 rule still require?
Whether the business is minority-owned or women-owned, the number of principal owners, and each principal owner’s ethnicity, race and sex, in aggregate categories with sex as male or female. The LGBTQI+-owned question and the disaggregated race and ethnicity subcategories are removed, and the firewall still applies.
What is the status of the Section 1071 rule now?
The 2026 final rule took effect on 30 June 2026, and its compliance date is 1 January 2028. The court stays that began in 2023 were aimed at the 2023 rule and its dates; we found no reported challenge to the 2026 rule as of October 2026. The CFPB has said it will update its implementation materials, such as the filing instructions, at a later date, so a practice register should be built on the rule text itself.