Understanding the CFPB’s Small Business Lending Rule
A practical guide to the CFPB’s small business lending rule, data collection duties, and what they mean for lenders and entrepreneurs.
The Consumer Financial Protection Bureau (CFPB) has developed a small business lending rule that requires many lenders to collect and report detailed information about credit applications from small businesses. This rule, issued under Section 1071 of the Dodd–Frank Act and implemented in Regulation B under the Equal Credit Opportunity Act (ECOA), is intended to shed light on how credit flows to small firms, including those owned by women and minorities.
Understanding this rule is critical for both financial institutions that must comply and small business owners who may be asked for new types of information when they seek credit.
Why Small Business Lending Data Matters
Small businesses are a major driver of job creation and local economic growth, yet historically there has been limited, standardized data on who receives small business credit and on what terms. The small business lending rule seeks to address several policy and market goals:
- Increase transparency in small business lending markets by creating a consistent, nationwide dataset.
- Identify potential discrimination and unequal access to credit for women-owned, minority-owned, and other underserved businesses.
- Support fair lending enforcement by giving regulators and courts more detailed information about lending patterns under ECOA.
- Help policymakers design targeted programs and monitor the effectiveness of federal and state initiatives that support small firms.
- Enable research and innovation by giving researchers and market participants anonymized, aggregate data to study gaps and opportunities.
This data-collection framework is similar in concept to the long-standing Home Mortgage Disclosure Act (HMDA) data for mortgages, but tailored to the small business context.
Legal Foundation: Section 1071 and Regulation B
The rule is rooted in Section 1071 of the Dodd–Frank Wall Street Reform and Consumer Protection Act, which amended the Equal Credit Opportunity Act to require certain lenders to gather and report data on credit applications from small businesses.
The CFPB implements ECOA through Regulation B. The small business lending rule creates a specialized subpart of Regulation B that describes:
- Which institutions must collect data.
- Which credit transactions are covered.
- How “small business” is defined.
- What data points must be collected and reported.
- When data must be filed and how it will be published.
The Future of AI: Preventing a Big Tech Monopoly >
As of late 2025, the Bureau has also issued rules extending compliance dates and has proposed revisions that would narrow coverage and modify several key aspects of the 2023 final rule.
Who Must Comply: Covered Financial Institutions and Tiers
The rule applies to covered financial institutions that originate a minimum number of covered small business credit transactions in each of two consecutive calendar years. Covered institutions can include:
- Banks and savings associations.
- Credit unions.
- Online lenders and nonbank finance companies.
- Certain other entities that extend business credit, depending on the final scope.
The CFPB uses a tiered approach based on the volume of small business originations. Institutions with higher origination volumes must comply earlier than smaller lenders.
| Compliance Tier | Relative Size | General Description |
|---|---|---|
| Tier 1 | Highest-volume lenders | Institutions with the largest number of small business credit originations, subject to the earliest compliance date. |
| Tier 2 | Moderate-volume lenders | Lenders with a significant but smaller volume of small business originations than Tier 1. |
| Tier 3 | Small-volume lenders | Institutions at or just above the threshold for coverage, subject to the latest compliance date. |
To determine their tier, lenders may generally use originations from a consecutive two-year period within a specified range of years (for example, 2022–2023, 2023–2024, or 2024–2025), giving them flexibility to account for changing business volumes.
Covered Transactions and the Small Business Definition
The rule does not apply to every type of financial product. Instead, it focuses on covered credit transactions to small businesses as defined under Regulation B.
Types of credit typically in scope
Covered transactions may include, for eligible small businesses:
- Term loans and lines of credit used for business purposes.
- Business credit cards.
- Equipment finance or working capital loans.
- Certain refinancings or renewals of existing small business credit.
Some transactions are excluded by rule, and the CFPB has sought feedback on whether to adjust coverage for specific products such as merchant cash advances and particular agricultural credit arrangements.
How “small business” is defined
The rule relies on a standardized small business definition based largely on gross annual revenue up to a specified ceiling, aligning with widely used thresholds to create consistency across institutions. The CFPB has proposed revisions to refine this definition for simplicity and to better reflect current market conditions.
What Data Lenders Must Collect
At the heart of the small business lending rule is a detailed list of data points that covered lenders must collect for each covered application and report annually to the CFPB.
Core application and loan information
- Date of application and action taken (approved, denied, withdrawn, etc.).
- Type and purpose of the credit product (e.g., new loan, line of credit, refinance; working capital, equipment, real estate).
- Amount applied for and originated.
- Pricing information, such as interest rate or other cost indicators, when applicable.
Business characteristics
- Business legal structure (e.g., corporation, partnership, sole proprietorship).
- Industry classification (such as NAICS code).
- Number of employees and gross annual revenue.
- Location information, including census tract, to enable geographic analysis.
Ownership and demographic information
Lenders must ask applicants for certain demographic data about ownership, including whether the business is:
- Minority-owned.
- Women-owned.
- Owned by members of other protected or historically underserved groups, as specified in the rule.
Importantly, applicants may decline to provide demographic information, and institutions must follow safeguards so that underwriters do not have access to the responses where the rule requires a “firewall” between demographic data and credit decision-makers.
Key Compliance Dates and Recent Extensions
The CFPB’s original 2023 final rule set phased compliance dates that were later affected by litigation and court orders in several jurisdictions. To promote consistent implementation, the CFPB issued an interim final rule in June 2025 and then a final rule on October 2, 2025, extending the compliance deadlines for all covered institutions by approximately one year.
Under the extended dates:
- Tier 1 (highest-volume lenders) must begin collecting data by July 1, 2026, with their first data submission due by June 1, 2027.
- Tier 2 (moderate-volume lenders) must start collecting data by January 1, 2027, with the first filing due by June 1, 2028.
- Tier 3 (small-volume lenders) must comply by October 1, 2027, with the first filing also due by June 1, 2028.
The CFPB has also stated that covered institutions may begin collecting the required demographic data up to twelve months before their compliance date so they can test systems and procedures in advance.
Ongoing Revisions: The 2025 Proposal to Streamline the Rule
On November 13, 2025, the CFPB issued a proposed rule that would revise several major aspects of the small business lending rule, including coverage, the small business definition, data points, and the compliance timeline.
The proposal would, among other changes:
- Raise the origination threshold for coverage, thereby reducing the number of lenders required to report.
- Reconsider whether certain transactions, such as merchant cash advances and agricultural credit, should be fully included or treated differently.
- Modify the small business definition and streamline which data points are collected and how they are reported.
- Adjust the compliance date structure in light of implementation experience, litigation, and executive directives focused on regulatory burden.
Comments on the proposal are invited through the federal rulemaking process, and further changes to the rule are expected before all institutions reach their final compliance deadlines.
Implications for Lenders
For covered financial institutions, the small business lending rule is a significant data governance and compliance project. Key implications include:
- System changes: Lenders must adjust application platforms, core banking systems, and data warehouses to capture and store new data fields.
- Policies and procedures: Institutions need formal written policies on when and how data is collected, how applicants are informed, and how information is protected.
- Training: Front-line staff, underwriters, and compliance teams must understand new requirements, including how to present demographic questions and respect applicant choices.
- Data quality controls: Robust checks are needed to ensure accuracy and completeness of reported data, as errors can create compliance risk.
- Fair lending analytics: Institutions can use the collected data to proactively monitor their own performance across demographic groups and geographies.
The CFPB has reaffirmed a 12-month grace period policy to provide some flexibility as institutions transition, emphasizing good-faith efforts at compliance over immediate enforcement for technical errors in early reporting.
What It Means for Small Business Owners
From the perspective of entrepreneurs, the rule does not change their substantive right to apply for and receive credit, but it does affect the application experience and the information they may be asked to provide.
New questions during the application process
Small business applicants at covered institutions can expect to see optional questions about:
- Whether the business is women-owned, minority-owned, or both.
- The ethnicity, race, and sex of principal owners, as applicable.
- Business revenue, industry, and number of employees, if not already collected.
Applicants are not required to answer demographic questions, and lenders must explain that responses are used for monitoring and reporting under federal law, not for determining creditworthiness.
Potential benefits for small firms
- Better visibility: The resulting dataset can highlight where small businesses face difficulty accessing credit, especially in rural areas, low-income neighborhoods, and underserved communities.
- More targeted programs: Policymakers and development organizations can design more precise interventions, such as loan guarantees or technical assistance for specific groups.
- Greater accountability: Publicly available, anonymized data can encourage lenders to compete more actively for underserved markets.
Preparing for Compliance: Practical Steps
Although the rule continues to evolve, both lenders and small businesses can take steps now to prepare.
For financial institutions
- Determine whether you will be a covered financial institution by reviewing small business origination volumes for recent years.
- Identify your compliance tier and corresponding deadlines, considering the extended dates.
- Map existing data flows and identify where additional fields must be added or integrated.
- Develop internal training and clear scripts for presenting demographic questions to applicants.
- Monitor CFPB rulemaking updates, including final action on the 2025 proposal.
For small business owners
- Be aware that you may be asked optional demographic questions as part of the application process.
- Keep core business information—such as revenue, number of employees, and industry classification—up to date and well documented.
- Ask your lender how your information will be used and protected under federal law.
- Watch for new data releases and programs that use small business lending data to expand access to finance.
Frequently Asked Questions (FAQs)
Q1: Does the small business lending rule change how my loan is underwritten?
No. The rule focuses on data collection and reporting; it does not dictate underwriting criteria, pricing, or approval standards. However, the collected data may influence how regulators and institutions evaluate their lending patterns over time.
Q2: Are small business owners required to answer demographic questions?
No. Applicants may choose not to provide demographic information. Lenders must offer these questions and record responses (including any refusal) but cannot require answers as a condition of applying for credit.
Q3: How will the CFPB use the reported data?
The CFPB will aggregate and publish much of the data, subject to privacy protections, to support fair lending enforcement, policymaking, research, and public transparency regarding small business credit access.
Q4: When do most lenders have to start reporting?
Large-volume lenders must begin collecting data in 2026, with first filings in 2027, while moderate and smaller covered institutions generally start between 2027 and late 2027, with first filings in 2028, following the CFPB’s extended compliance dates.
Q5: Could the requirements change again?
Yes. The CFPB’s November 2025 proposal would revise coverage thresholds, data points, and compliance timing. Final requirements may shift based on public comments, litigation outcomes, and additional rulemaking.
References
- Small Business Lending Rulemaking — Consumer Financial Protection Bureau. 2025-11-13 (updated). https://www.consumerfinance.gov/1071-rule/
- Small Business Lending Under the Equal Credit Opportunity Act (Regulation B); Extension of Compliance Dates — Federal Register / CFPB. 2025-10-02. https://www.federalregister.gov/documents/2025/10/02/2025-19370/small-business-lending-under-the-equal-credit-opportunity-act-regulation-b-extension-of-compliance
- CFPB Finalizes Extended Compliance Dates for Small Business Lending Data Rule — America’s Credit Unions. 2025-10-02. https://www.americascreditunions.org/news-media/news/cfpb-finalizes-extended-compliance-dates-small-business-lending-data-rule
- CFPB Extends Compliance Deadlines for Section 1071 Small Business Lending Rule — Consumer Finance and Fintech Blog (Goodwin). 2025-10-08. https://www.consumerfinanceandfintechblog.com/2025/10/cfpb-extends-compliance-deadlines-for-section-1071-small-business-lending-rule/
- CFPB Proposed Rule to Revise Provisions of Section 1071 Small Business Lending Rule — U.S. Small Business Administration, Office of Advocacy. 2025-11-13. https://advocacy.sba.gov/2025/11/13/cfpb-proposed-rule-to-revise-provisions-of-section-1071-small-business-lending-rule/
- Small Business Lending Under the Equal Credit Opportunity Act (Regulation B); Extension of Compliance Dates — Consumer Financial Protection Bureau (rule summary). 2025-10-02. https://www.consumerfinance.gov/rules-policy/final-rules/small-business-lending-under-the-equal-credit-opportunity-act-regulation-b-extension-of-compliance-dates-final-rule/
- CFPB Issues Small Business Lending Data Collection Proposal — Doeren Mayhew. 2025-11-21. https://www.doeren.com/viewpoint/cfpb-issues-small-business-lending-data-collection-proposal
Similar Articles
Read full bio of Sneha Tete
