In 2025, the Consumer Financial Protection Bureau (CFPB) has moved to rewrite its Section 1071 small business lending data collection rule, sharply narrowing which lenders are covered, which products are in scope, and how much data must be reported. This revamped CFPB small business lending rule matters for every U.S. bank, credit union, and fintech lender that touches small business credit—and for the small business owners who want fair access to financing without overburdening their local lenders.
The new proposal focuses on “core lenders, core products, and core data points,” raising the origination threshold, trimming the original 81 data fields, and delaying effective dates to 2028 so institutions have more time to prepare. In this post, we’ll break down the 5 biggest changes in the 2025 CFPB small business lending rule, how they affect banks and alternative lenders, and what small business owners in the U.S. should realistically expect over the next few years.
CFPB’s revamped small business data rule: how 2025 changes the game for lenders and borrowers
- Why the CFPB is rewriting the small business lending data rule in 2025
- The 5 core features of the 2025 CFPB proposal under Section 1071
- How the new thresholds change which lenders are covered
- What data will still be collected — and what gets cut
- Which products and borrowers stay in scope under the new rule
- Compliance timeline, 2028 start date, and what lenders should do now
- Implications for banks, fintechs, and U.S. small business owners
- Summary
- FAQ: 2025 CFPB Small Business Lending Rule Changes
Why the CFPB is rewriting the small business lending data rule in 2025
Quick overview — this section explains the legal and political backdrop behind the 2025 proposal.
The CFPB’s small business lending rule under Section 1071 of the Equal Credit Opportunity Act was first finalized in March 2023. That earlier rule required covered financial institutions to collect and report up to 81 data points on small business credit applications, including extensive demographic, pricing, and process information. Almost immediately, the rule triggered pushback from banks, credit unions, and trade groups that argued the requirements were excessive, confusing, and legally vulnerable.
Litigation followed, compliance deadlines were delayed, and the Bureau signaled in 2025 that it would “revisit” the rule with a narrower approach. The new 2025 proposal is the concrete result of that shift: instead of trying to capture every possible data point from every type of lender and product, the CFPB is now emphasizing an incremental rollout focused on mainstream small business lending and larger-volume lenders. The goal is to improve data quality without disrupting credit flows to small firms.
At the same time, there is strong political pressure on the CFPB. Industry groups have argued that the earlier version created disproportionate burdens for community banks and smaller lenders, while consumer advocates still want meaningful transparency into who is—and isn’t—getting access to credit. The 2025 proposal is the Bureau’s attempt to strike a new balance between these competing demands.
From a lender’s perspective, this is not simply a “softening.” It is a comprehensive restructuring of who counts as a covered financial institution, which products qualify as covered credit, and how “small business” should be defined for reporting purposes.
- The original 2023 rule is still the legal baseline, but many key elements are being reconsidered.
- The 2025 proposal aims to reduce initial compliance burden while keeping the door open to future expansions.
- Lenders should see this as a phased data strategy, not a one-time rule tweak.
The 5 core features of the 2025 CFPB proposal under Section 1071
Key insight 🔍 — here’s how the new rule shifts from “maximum data” to “targeted data.”
Instead of simply editing a few lines of the 2023 rule, the Bureau has put forward a proposal built on five structural changes that reshape the entire Section 1071 framework. At a high level, the 2025 small business lending rule proposal does the following:
First, it raises the origination threshold so that only lenders with substantial small business portfolios are covered at the outset. This is explicitly designed to focus on “core small business lenders” and ease pressure on smaller institutions and niche providers.
Second, it narrows the definition of covered credit transactions by excluding products like merchant cash advances, certain agricultural loans, and small-dollar credit from the initial phase of data collection. The CFPB argues that focusing on core term loans and credit lines will improve data quality and reduce implementation complexity.
Third, it narrows the definition of “small business” by lowering the revenue threshold from $5 million or less to $1 million or less, aligning the rule more tightly with the smallest firms the statute is meant to protect. This shift will materially affect which borrowers show up in reported datasets.
- Origination threshold: higher than before, covering fewer but larger-volume lenders.
- Product scope: excludes MCAs, agricultural loans, and certain small-dollar products in the initial phase.
- Small business definition: revenue threshold lowered, narrowing the pool of reportable applicants.
Fourth, it trims the data fields to focus on core demographic and statutory data points instead of the full 81-point framework. Data such as application channel, specific pricing details, reasons for denial, number of employees, and LGBTQI+ ownership information may be removed from the mandatory list in the new version.
Finally, the proposal pushes back key compliance dates, with data collection expected to start no earlier than January 1, 2028. This long runway is meant to give banks, credit unions, and fintech lenders time to rebuild their implementation plans around the new, narrower requirements.
How the new thresholds change which lenders are covered
In short — larger banks stay squarely in scope, while many small lenders get meaningful relief.
One of the most impactful changes in the 2025 CFPB proposal is the jump in the origination threshold for covered financial institutions. Under the 2023 final rule, lenders that originated at least 100 covered small business credit transactions in each of the prior two years were subject to Section 1071 reporting. The 2025 proposal would raise that threshold to 1,000 originations per year for two consecutive years.
This tenfold increase means that many community banks, credit unions, and smaller nonbank lenders would no longer be covered—at least in the initial phase. The Bureau explicitly frames this as an attempt to focus on “core lenders,” which account for the majority of small business credit volume and have the resources to build robust data collection systems.
From a compliance standpoint, this is a major pivot. Institutions that spent time and money preparing for the 100-originations threshold may now find themselves temporarily outside the rule’s scope. Conversely, larger banks and high-volume fintech lenders will remain firmly on the hook for data collection.
| Feature | 2023 Final Rule | 2025 Proposed Rule |
|---|---|---|
| Origination threshold for coverage | 100+ covered credit originations per year (for 2 consecutive years) | 1,000+ covered credit originations per year (for 2 consecutive years) |
| Focus of supervision | Broad range of banks, credit unions, and nonbank lenders | Larger “core” small business lenders with higher volumes |
| Burden on community lenders | High—most mid-sized players expected to comply | Reduced—many community institutions initially fall outside the rule |
For compliance teams, this threshold change raises strategic questions: is it worth building full Section 1071 infrastructure if the institution hovers just below the new threshold? And how should lenders plan for the possibility that the threshold could be adjusted again in a future rulemaking once the initial phase is up and running?
On the policy side, the CFPB argues that narrowing the number of covered lenders will not dramatically reduce the total number of reported applications, because larger lenders already capture a significant share of the small business credit market.
What data will still be collected — and what gets cut
Key takeaway — the rule moves from 81+ data points toward a smaller, statute-driven core set.
The original Section 1071 rule under the prior administration required financial institutions to report up to 81 distinct data fields for each small business credit application. These included a wide mix of application details, pricing terms, denial reasons, operational metrics, and detailed demographic information about business owners.
In the 2025 proposal, the CFPB is signaling a shift to a more modest data set. The Bureau wants to prioritize data points explicitly listed in the Dodd-Frank Act and a limited number of additional items needed to interpret those statutory fields. As part of this move, several previously required data points are candidates for removal from mandatory reporting.
Analyses of the proposal note that the new rule would likely eliminate requirements to report items such as the application method, the intended recipient of the credit, detailed pricing structures, specific reasons for denial, number of employees, and certain sensitive demographic data like LGBTQI+ ownership. The emphasis moves toward information that directly supports fair lending monitoring and market transparency without overloading smaller lenders.
For banks and nonbank lenders, this reduction in data fields can significantly lower system complexity, implementation timelines, and ongoing operational costs. However, institutions that have already invested in broader data capture may still choose to collect additional fields internally for risk management and portfolio analytics, even if they are not required to report them to the CFPB.
- Statutory data remains central: key applicant demographics and basic loan characteristics stay in scope.
- Operational and channel-level details are more likely to be trimmed in the early phase.
- Lenders should reassess which data fields are “regulatory must-haves” versus “business nice-to-haves.”
Which products and borrowers stay in scope under the new rule
In brief — the focus turns to core business loans for truly small firms, not every niche product.
A second structural change in the 2025 proposal involves redefining which credit products and businesses are covered. The CFPB now proposes to exclude merchant cash advances, certain agricultural lending, and small-dollar loans from the definition of covered credit transactions in the initial rollout. The Bureau’s rationale is that starting with a narrower set of mainstream products will improve data quality and reduce the risk of distorting specialized markets.
On the borrower side, the CFPB proposes to tighten the definition of “small business” by lowering the gross annual revenue threshold from $5 million or less to $1 million or less. That means many mid-sized firms that would previously have been included will fall outside the new small business category for purposes of Section 1071 reporting.
This change is significant for lenders that serve a broad range of business sizes. Institutions will need to refine their segmentation and ensure their systems can distinguish “small businesses” as defined by the rule from larger commercial clients. For some lenders, this may align more closely with existing internal SME tiers; for others, it may require remapping customer categories.
For small business owners, the shift could cut both ways. On one hand, focusing on the very smallest firms may yield more precise insights into credit access for new and micro enterprises. On the other, companies that grow beyond the $1 million revenue line may be less visible in regulatory data, even though they still face meaningful financing challenges.
| Category | Previous Rule | 2025 Proposal |
|---|---|---|
| Small business revenue threshold | ≤ $5 million | ≤ $1 million |
| Merchant cash advances | Included as covered credit transactions | Proposed exclusion in initial phase |
| Agricultural lending | Included with some exceptions | Proposed exclusion in initial phase |
| Small-dollar loans | Generally included | Proposed exclusion in initial phase |
Compliance timeline, 2028 start date, and what lenders should do now
Guiding point — longer timelines don’t mean you can wait until the last minute.
Another headline change in the 2025 rulemaking is the extended compliance schedule. Instead of forcing lenders to pivot quickly to the original 2023 framework, the revised approach contemplates data collection starting on or after January 1, 2028. This delay is meant to give institutions more time to build systems tailored to the narrower requirements and to incorporate feedback from the ongoing comment process.
Despite the longer runway, compliance teams should resist the temptation to pause planning entirely. Because the 2025 proposal focuses on a refined set of products, lenders, and data points, institutions can start designing “right-sized” implementation roadmaps that match the new scope. Early alignment between legal, compliance, IT, and business lines will make it easier to adapt if the Bureau further adjusts the rule after public comments.
For many banks and credit unions, there is also an opportunity to coordinate their Section 1071 implementations with broader data and reporting modernization efforts. If the organization is already investing in enterprise data warehouses, digital loan origination systems, or new analytics platforms, Section 1071 can be treated as a catalyst to standardize small business credit data across departments.
From an operational risk perspective, the extended timeline may also reduce the likelihood of rushed rollouts and costly rework. Institutions can pilot data collection with limited products and gradually expand as systems stabilize, rather than trying to stand up a full-scope solution overnight.
- Use the 2028 target as a planning anchor, not an excuse to delay foundational work.
- Align Section 1071 projects with other regulatory or digital modernization initiatives.
- Monitor ongoing guidance and industry commentary, as the proposal can still evolve.
Implications for banks, fintechs, and U.S. small business owners
Perspective — this rule is about more than data; it will reshape who tracks what in small business credit.
For banks and credit unions, the 2025 CFPB proposal is both a relief and a responsibility. On the one hand, raising the origination threshold and trimming data points directly address long-standing concerns about burdens on community lenders and smaller institutions. On the other, the institutions that remain in scope will be expected to deliver high-quality, reliable data that regulators, researchers, and advocacy groups can use to assess access to credit.
Fintech lenders and nonbanks should pay particular attention to how the Bureau defines covered products and covered financial institutions. Some alternative providers may fall outside the initial scope due to product exclusions or volume thresholds, but that status is not guaranteed to last. The proposal explicitly signals that the Bureau may widen its reach in later phases once the initial data collection framework proves stable.
For small business owners—especially women-owned, minority-owned, and micro enterprises—the revised rule is designed to preserve the core promise of Section 1071: more transparency into who gets approved, who gets declined, and on what terms. However, the narrower coverage and focus on smaller firms mean that not every lender or product will be visible in the early years of data collection.
A practical takeaway for small business borrowers is this: the regulatory landscape is still evolving. Some lenders may adjust their application processes, data requests, or product offerings as the rule takes shape. Business owners should continue to shop around, compare offers, and ask lenders how they handle demographic data and fair lending obligations.
- Covered banks and fintechs must treat data quality as a core supervisory risk, not a side project.
- Smaller lenders may get breathing room, but they should still monitor the rule in case the scope expands.
- Small businesses can expect more visibility into credit access over time, but changes will be gradual.
Summary
The 2025 CFPB small business lending rule proposal represents a major recalibration of Section 1071. By raising the origination threshold to 1,000 loans per year, narrowing the definition of covered credit transactions, tightening the small business revenue threshold to $1 million, trimming data fields from the original 81-point framework, and delaying data collection to 2028, the Bureau is pivoting toward a phased, incremental approach to small business credit transparency.
For banks, credit unions, and fintech lenders, the message is clear: the rule is not going away, but its first phase will be more targeted and manageable than previously expected. Institutions that invest now in streamlined, flexible data capabilities will be better prepared not only for the 2025 proposal, but for any future expansions the Bureau may pursue. For small business owners, the updated rule is intended to protect access to credit while still shining light on potential gaps or inequities in lending markets.
See Verified source: lenders and small business owners can review the public inspection draft of the CFPB’s proposed rule in the Federal Register and summaries from industry outlets such as American Banker’s coverage of the pared-down small business data collection rule for more technical details and ongoing commentary.
FAQ: 2025 CFPB Small Business Lending Rule Changes
How does the 2025 CFPB proposal change which lenders must report small business data?
The 2025 proposal raises the origination threshold from 100 to 1,000 covered small business credit originations per year for two consecutive years. That means only higher-volume “core” small business lenders—typically larger banks, some regional institutions, and higher-volume fintech lenders—will be required to collect and report data in the initial phase. Many community banks, credit unions, and niche providers will fall outside the rule, at least at the beginning.
Which small business credit products are excluded under the new proposal?
The CFPB proposes to exclude merchant cash advances, certain agricultural loans, and small-dollar credit products from the definition of covered credit transactions in the early roll-out. The Bureau’s stated goal is to focus on mainstream small business lending products—such as term loans and lines of credit—before deciding whether and how to bring more specialized products into the reporting framework in later phases.
What does the new rule mean for the definition of a “small business”?
Under the 2023 rule, a small business was generally defined as having gross annual revenue of $5 million or less. The 2025 proposal would tighten that threshold to $1 million or less. This change shifts the focus toward truly small firms, including micro and early-stage businesses. Lenders will need to adjust their internal segmentation and ensure they can reliably distinguish businesses that meet the new revenue-based definition from larger commercial customers.
When will lenders actually have to start collecting and reporting Section 1071 data?
The proposal contemplates a delayed timeline, with the revamped rule taking effect no earlier than January 1, 2028. That said, the Bureau is still collecting comments, and timelines could shift as feedback is incorporated. Lenders should treat 2028 as a planning anchor and use the extended runway to design and test data collection systems that fit the narrower scope, rather than waiting until the last minute to start implementation work.
How will these changes impact small business owners who apply for credit?
For small business owners, especially those owning very small or minority-owned firms, the core promise of Section 1071 remains: the rule is meant to provide better visibility into how credit decisions are made across different lenders and applicant groups. In the near term, some application processes may involve fewer intrusive questions than under the original 81-data-point framework, but lenders in scope will still ask for key information related to demographics and business characteristics. Over time, the reported data should help regulators and market participants identify patterns in approvals, pricing, and denials that can inform policy and business practices.
What should banks and fintechs be doing now to prepare for the 2025 rule changes?
Lenders should begin by assessing whether they are likely to meet the new 1,000-originations threshold and which products and business segments will be in scope. From there, they can map current data capture against the proposed core data points, identify gaps, and plan system and process changes. Aligning Section 1071 implementation with broader data modernization efforts—such as upgrading loan origination platforms or building more robust data warehouses—will help institutions spread costs and improve long-term resilience. Even institutions that fall below the new threshold should monitor the rulemaking closely in case the scope expands in future revisions.