CFPB Section 1071 and Your Business Line of Credit: What the New Data Rules Mean in 2026

Section 1071 of the Dodd-Frank Act is now active law — and if you applied for a business line of credit at a major lender after July 2025, your application generated data that will be reported publicly. U.S. lenders originate over $700 billion in small business loans and credit lines annually, and until Section 1071, almost none of it was tracked in a standardized, publicly accessible way (SBA Office of Advocacy, 2025).

For business owners, Section 1071 changes what questions appear on your LOC application, not whether you get approved. The demographic questions you'll see for the first time — race, sex, ethnicity of principal owners — are legally required to be collected but cannot influence the credit decision. Understanding why they exist and what your rights are removes unnecessary friction from the application process.

This briefing covers the full implementation picture: what Section 1071 is, which lenders are covered, what data is collected, how the application process changes, and what it means for your LOC application in 2026. For context on current LOC qualification requirements, see our LOC qualification requirements guide.

What Is CFPB Section 1071 and Why Does It Exist?

Section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act requires financial institutions to collect and report data on small business credit applications. It is a fair lending transparency law — its purpose is to make lending patterns visible so that discrimination can be identified and addressed.

Congress passed Dodd-Frank in 2010, but the CFPB took 13 years to finalize the implementing rules, issuing its final rule in March 2023. The delay reflected the regulatory complexity of defining "small business," "covered transactions," and demographic data collection protocols across a highly diverse lending market.

The lending gap Section 1071 targets is substantial. U.S. lenders originate more than $700 billion in small business credit annually (SBA Office of Advocacy, 2025), yet prior to Section 1071 there was no standardized federal system for tracking who received that credit and who was denied — comparable to the Home Mortgage Disclosure Act (HMDA) data that has governed mortgage lending transparency since 1975.

Approximately 32 million small businesses operate in the United States, and 43% of them sought financing in the most recent survey year (Federal Reserve SBCS, 2025). Without standardized application data, regulators had no systematic way to determine whether credit access gaps reflected business fundamentals or discriminatory lending patterns. Section 1071 closes that gap.

The CFPB estimates that covered lenders will collectively report data on approximately 1.2 million small business credit applications annually once all tiers are fully compliant (CFPB Final Rule, 2023). That data will be published publicly, creating the first comprehensive national picture of small business lending patterns.

Which Lenders Must Comply With Section 1071?

Coverage under Section 1071 is determined by transaction volume — specifically, the number of "covered credit transactions" to small businesses a lender originated in each of the two preceding calendar years. The threshold-based tier structure phases in compliance by lender size.

A "covered financial institution" is any entity — bank, credit union, online lender, fintech, non-bank lender, mortgage company — that originated 100 or more covered credit transactions to small businesses in each of the two preceding calendar years. Charter type does not determine coverage; transaction volume does.

The CFPB estimated that Tier 1 and Tier 2 lenders together cover approximately 85% of all small business credit originations by dollar volume (CFPB Final Rule, 2023). Even if your specific lender is a smaller community bank below the Tier 3 threshold, odds are high that any major or mid-size institution you interact with is already in compliance.

Approximately 620 online lenders and fintech platforms are estimated to fall within Tier 1 or Tier 2 coverage — a significant expansion of the data collection universe beyond traditional bank channels (CFPB, 2025). For a comparison of which lenders offer the strongest LOC products given your profile, see our best business lines of credit 2026 analysis.

What Data Does Section 1071 Require Lenders to Collect From LOC Applicants?

Section 1071 requires lenders to collect 20 standardized data fields for every covered application. These fields fall into two categories: application data (required, collected by the lender from the applicant or from other sources) and demographic data (applicant-provided, voluntary).

The regulation specifies 13 required data fields that lenders must collect and report, plus 7 additional fields that are either voluntarily provided by applicants or collected through lender observation. Applicant-provided demographic data — race, sex, ethnicity — is legally classified as voluntary, meaning the applicant can decline without consequence (CFPB Final Rule, 2023).

Required Application Data Fields (Lender-Collected)

Voluntary Demographic Fields (Applicant-Provided)

How Does Section 1071 Change the LOC Application Process?

For business owners applying for a LOC at a covered lender in 2026, Section 1071 adds a demographic disclosure section to the standard application form. This is the most visible operational change. The questions look unfamiliar and can cause concern — but understanding their legal context eliminates the confusion.

The demographic disclosure section will typically appear as a separate boxed section on the application, labeled something like "Government Monitoring Information" or "Small Business Lending Data Collection (Regulation B)." It asks for the race, sex, and ethnicity of each principal owner who owns 25% or more of the business.

Lenders must inform applicants that providing this information is voluntary and that it will not be used in the credit decision. Lenders are required to maintain a "firewall" — the personnel who underwrite the application cannot have access to the demographic data until after the credit decision is made (CFPB Final Rule, 2023). This is an explicit regulatory requirement, not a policy choice.

The CFPB estimates that compliance costs for Tier 1 lenders average $900,000–$1.5 million in upfront system modifications, with ongoing annual compliance costs of $200,000–$400,000 (CFPB Final Rule, 2023). These costs are borne by lenders, not borrowers — Section 1071 does not create any new fees or costs for LOC applicants.

Voluntary demographic disclosure rates in comparable HMDA mortgage data run approximately 82–88% of applicants providing at least partial demographic information. Section 1071 projections suggest similar disclosure rates for small business applications — meaning most applicants will complete the section (CFPB, 2025).

Do Online Lenders and Credit Unions Have to Comply?

Yes — Section 1071 coverage extends to any financial institution that meets the transaction volume threshold, regardless of charter type, business model, or whether the lender operates online or in a physical branch. Charter-neutral coverage is one of the most significant aspects of the rule.

Credit unions above the 100-transaction threshold are fully covered. The National Credit Union Administration (NCUA) has issued its own compliance guidance for credit union members, but the underlying Section 1071 requirements are the same as for banks. For a comparison of credit union LOC products post-1071, see our credit union LOC comparison.

Online lenders — including marketplace lenders, fintech platforms, and non-bank lenders — are covered if they meet the transaction threshold. The CFPB estimates approximately 620 online lenders and fintechs fall within Tier 1 or Tier 2 coverage (CFPB, 2025). This is a substantial portion of the online lending ecosystem and includes most major small business credit platforms.

Merchant cash advance (MCA) providers are generally not covered under Section 1071 because MCAs are structured as purchases of future receivables, not credit transactions — a legal distinction that keeps them outside the regulatory perimeter. However, if an MCA provider also originates covered credit products (LOCs, term loans) above the threshold, those products are covered even if the MCA products are not.

Some online lenders operating below 100 covered transactions per year remain exempt — typically newer platforms, niche lenders, or those focused primarily on markets above the "small business" revenue threshold defined in the rule ($5 million in gross annual revenue).

What Should Business Owners Know When Applying for a LOC in 2026?

The practical guidance for business owners applying at Section 1071-covered lenders is straightforward: the new questions do not affect your approval odds, your demographic information is firewalled from underwriting, and the denial reason disclosure requirement actually gives you more transparency than you had before.

Voluntary disclosure of demographic information is your legal right. You can complete the section fully, partially, or not at all. If you decline, note that the lender may still record observed demographics — this is required by regulation when the applicant refuses, and does not constitute discrimination or penalization.

The denial reason requirement is arguably the most useful change for applicants. Before Section 1071, lenders had inconsistent practices for communicating denial reasons. The rule now requires up to four specific denial reasons when an application is declined — giving you actionable information to improve your application for a future attempt or a different lender.

The CFPB projects that Section 1071 data will generate the first nationally comprehensive picture of small business lending patterns by mid-2027, when Tier 1 data from 2025 and 2026 will be publicly available (CFPB, 2025). That data will inform future regulatory action, advocacy, and potentially lender behavior in ways that benefit underserved business segments.

For businesses concerned about credit access and rejection patterns, our small business loan rejection statistics article covers current data on denial rates by lender type, business age, and industry. For the full picture of how Section 1071 fits into the broader regulatory landscape governing LOC applications, see the current data in our 2026 business LOC statistics briefing.

Frequently Asked Questions About CFPB Section 1071

Does Section 1071 affect my LOC approval chances?

No. Section 1071 is a data collection and transparency law, not a credit decisioning rule. Lenders are explicitly prohibited from using demographic data — race, sex, ethnicity — in their credit decisions. The firewall requirement keeps demographic information separate from underwriting personnel until after a decision is made. Your qualification is determined by the same financial criteria it always was.

Is demographic disclosure required under Section 1071?

Lenders must ask the questions, but your response is voluntary. You can decline to provide any or all demographic information. If you decline, the lender may record observed demographics based on visual observation or surname — a regulatory requirement when applicants refuse — but your refusal is documented and cannot penalize your application.

What is a "covered financial institution" under Section 1071?

Any entity that originated 100 or more covered credit transactions to small businesses in each of the two preceding calendar years. This includes banks, credit unions, online lenders, fintechs, and non-bank lenders — any institution making qualifying small business credit products above the threshold, regardless of charter type or whether they operate online or in branches.

When did Section 1071 take effect?

The final rule was issued in March 2023. Tier 1 lenders (2,500+ transactions) were required to comply by July 18, 2025. Tier 2 (500–2,499) and Tier 3 (100–499) lenders faced a January 1, 2026 deadline — though Tier 3 implementation has been delayed by ongoing litigation as of May 2026. The first Tier 1 data reporting period opened May 1, 2026.

Does my small lender have to comply?

Only if your lender originated 100 or more covered transactions in each of the two preceding years. Many community banks, small credit unions, and boutique non-bank lenders fall below this threshold and are fully exempt. If you're unsure about your lender's coverage status, they are required to inform applicants whether they are collecting Section 1071 data on the application.

What happens with the data after collection?

Covered lenders submit their data to the CFPB annually. The CFPB publishes it publicly with certain privacy protections applied. Regulators, researchers, and advocacy organizations use this data to identify potential disparities in approval rates, pricing, and credit access across demographic groups, geographies, and industries. The data becomes a permanent public record that shapes future regulatory enforcement and lending practices.