The CFPB Just Narrowed a Small Business Lending Rule — Advocates Are Suing to Stop It

If you've ever suspected that some business owners get approved for loans more easily than others based on things that have nothing to do with their credit, a federal data-collection rule was supposed to help prove or disprove that. The Consumer Financial Protection Bureau just gutted most of it — and a coalition of small business and civil rights groups is now suing to stop the rollback.

On May 1, 2026, the CFPB published a revised final rule under Section 1071 of the Dodd-Frank Act, the law that was supposed to force lenders to report demographic data on small business loan applicants the same way they already do for mortgages. The new version shrinks the number of lenders required to report from roughly 20% of financial institutions down to about 2% — an estimated 2,000 fewer lenders on the hook. Here's what changed, why it matters even if you're not a lender, and who's fighting it in court.

What Section 1071 Was Supposed to Do

Section 1071 has been sitting in Dodd-Frank since 2010, but the CFPB didn't finalize rules to implement it until 2023. The idea is straightforward: lenders that make small business loans have to report data on the race, sex, and ethnicity of applicants, similar to what mortgage lenders already report under the Home Mortgage Disclosure Act. The goal is to give regulators, researchers, and advocacy groups a way to spot patterns of discrimination — for example, whether women-owned or minority-owned businesses are approved at lower rates or charged higher rates than comparable businesses, even after controlling for creditworthiness.

Before this data existed, that kind of discrimination was extremely hard to prove. Mortgage lending discrimination became measurable because HMDA data existed. Small business lending discrimination has largely stayed invisible because the data was never collected in the first place.

What the CFPB Just Changed

The May 2026 final rule, which took effect June 30, 2026, raises the threshold for which lenders have to comply. Under the new rule, only lenders that originate at least 1,000 covered small business loans hit the reporting requirement — a dramatic jump from the tiered thresholds as low as 100 originations under the original 2023 rule. The rule also narrows what counts as a covered loan, excluding merchant cash advances, agricultural lending, and small-dollar loans of $1,000 or less.

The practical effect: about 2,000 fewer banks, credit unions, and online lenders will ever have to report this data. Compliance is now set for a uniform date of January 1, 2028, giving covered lenders roughly a year and a half of runway.

For the lenders that remain covered, the CFPB's changes mean a leaner reporting regime — less data collected per loan, fewer institutions in the pool, and more time to prepare. Industry groups had pushed for these changes for years, arguing the original rule was expensive to implement and would raise the cost of small business lending across the board.

Why Advocacy Groups Are Suing

Rise Economy, the National Community Reinvestment Coalition (NCRC), the Main Street Alliance, and small business owner Reshonda Young filed a federal lawsuit against the CFPB and Acting Director Russell Vought. Their argument: the agency is unlawfully abandoning a data collection mandate that Congress wrote into law fifteen years ago, and doing so through a rule that guts the data before it was ever meaningfully collected.

NCRC has described the effect of the narrowed rule bluntly — small business credit is about to become effectively invisible to regulators and researchers, right as the industry has spent years pointing to persistent lending gaps for women- and minority-owned businesses. Their lawsuit is seeking to force the CFPB to implement the rule closer to its original scope, rather than the narrowed version now on the books.

What This Means If You're Applying for a Loan

None of this changes your eligibility for a loan today, and it doesn't change how any individual lender evaluates your application. What it changes is the paper trail. If your business is turned down for a loan and you suspect the decision wasn't purely about your numbers, the data that regulators and advocacy groups would normally use to identify systemic patterns across a lender's portfolio is going to be thinner and slower to arrive than originally planned — and it may never exist at all for the roughly 2,000 lenders now exempt.

If you're in the process of building your credit profile before approaching a lender, the fundamentals matter more than ever, precisely because there will be less external data to catch problems after the fact. That means having a clean profit and loss statement, a properly documented EIN, and a clear separation between personal and business finances through a dedicated business bank account — all things underwriters look at regardless of what demographic data does or doesn't get reported.

It's also worth knowing which lenders you're dealing with. Community development financial institutions (CDFIs) and mission-driven lenders have generally supported robust 1071 reporting and tend to already track equitable lending outcomes voluntarily. If access to capital and fair treatment in the process matter to you, it may be worth asking a prospective lender directly whether they're a covered institution under the new rule, and what data — if any — they report.

What Happens Next

The lawsuit is still working through federal court, and there's no indication of a ruling timeline yet. Meanwhile, the narrowed rule stands as written, with compliance obligations phasing in through January 1, 2028 for the lenders still covered. If you're weighing an SBA loan against a conventional bank loan, this fight over data transparency is a useful reminder to shop multiple lenders and compare terms directly rather than assuming any single lender's process is neutral by default.

Photo by Christian Dubovan on Unsplash