Section 1071 Small Business Lending Data: Which LOS Platforms Are Ready?

Section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act is one of the most significant regulatory changes to affect small business lending in decades. The rule requires covered lenders to collect, report, and make public detailed data on small business credit applications — including demographic information about business owners. For lenders, the operational and technology implications are substantial. Your loan origination system sits at the center of this compliance challenge.

This article breaks down what Section 1071 requires, where things stand with implementation, what your LOS needs to support, and which platforms are best positioned to help lenders comply.

What Section 1071 Requires

Section 1071 amends the Equal Credit Opportunity Act (ECOA) to require financial institutions to collect and report data on credit applications by small businesses, similar to how HMDA requires data collection for mortgage lending. The stated goals are to facilitate fair lending enforcement and to identify business and community development needs for small businesses.

The data collection requirements are extensive. They fall into several categories:

Applicant Demographic Data

This is the most operationally challenging element. Lenders must collect — directly from applicants — information about the race, ethnicity, and sex of principal owners. This includes disaggregated ethnicity categories (not just "Hispanic or Latino" but specific subcategories like Mexican, Puerto Rican, Cuban, etc.) and disaggregated race categories. Lenders must also collect whether the applicant is LGBTQI+ if the applicant voluntarily provides this information. Applicants have the right to decline to answer, and lenders must record that refusal without substituting visual observation or other methods.

Business Ownership Data

Lenders must report whether the business is minority-owned, women-owned, or LGBTQI+-owned based on whether more than 50% of the business is owned by individuals in those categories. They must also collect the number of principal owners and, for each principal owner with 25% or more ownership, the demographic data described above.

Business and Application Data

Beyond demographics, the rule requires extensive data about the business itself and the credit application:

• Business identifiers — legal name, trade name, TIN, DUNS number (if applicable), and state of principal office
• Industry classification — NAICS code for the business, which many lenders don't currently collect systematically
• Business characteristics — gross annual revenue, number of workers, time in business, and whether the business is a startup
• Geographic data — census tract based on the business's principal place of business, requiring geocoding capabilities
• Application details — credit type (term loan, line of credit, credit card, merchant cash advance), credit purpose, amount applied for, amount approved, and action taken
• Pricing data — interest rate, origination charges, broker fees, initial annual charges, and other pricing terms
• Denial reasons — specific, standardized reason codes when applications are denied or withdrawn

In total, the rule involves roughly 80+ distinct data fields per application. For comparison, HMDA requires approximately 50 data fields. The scope of 1071 data collection is significantly larger than what most small business lenders currently capture in their origination systems.

Who Must Comply

The rule applies to any financial institution that originated at least 100 covered small business credit transactions in each of the two preceding calendar years. "Covered credit transactions" include term loans, lines of credit, credit cards, and merchant cash advances to businesses with gross annual revenue of $5 million or less. This captures a wide range of lenders:

• Community banks and regional banks with commercial lending operations
• Credit unions offering business loans
• Online and fintech small business lenders
• CDFIs and mission-driven lenders
• Any entity originating covered small business credit — including non-bank lenders, merchant cash advance providers, and agricultural lenders

The 100-transaction threshold means that most community banks and credit unions with active small business lending programs will be covered. This is not a rule that only affects large institutions.

Current Regulatory Status

The path to 1071 implementation has been anything but straightforward. Understanding where things stand is important for planning your compliance program.

The CFPB finalized the Section 1071 rule in March 2023. The rule established a phased compliance timeline based on origination volume:

• Tier 1 — Lenders with 2,500 or more covered originations in each of the two preceding years were originally scheduled to begin data collection first
• Tier 2 — Lenders with 500 to 2,499 covered originations would follow
• Tier 3 — Lenders with 100 to 499 covered originations would have the longest lead time

However, the rule immediately faced legal challenges. Industry groups filed lawsuits in multiple courts, and several injunctions were issued. A critical turning point came in May 2024, when the U.S. Supreme Court ruled in Consumer Financial Protection Bureau v. Community Financial Services Association of America that the CFPB's funding mechanism is constitutional. This removed one of the major legal arguments that challengers had used to seek injunctions against the rule.

Despite the Supreme Court ruling, the implementation timeline has been delayed from the original schedule. The CFPB has adjusted compliance dates, and additional legal challenges have continued in lower courts. As of early 2026, lenders should assume that the rule will ultimately take effect but should monitor the CFPB's website and industry counsel for the latest compliance dates.

It is also worth noting that the current political and regulatory environment introduces additional uncertainty. Changes in CFPB leadership and enforcement priorities could affect the pace and rigor of 1071 enforcement. However, the rule is finalized and on the books — it is a statutory mandate under Dodd-Frank, not an executive order that can be simply reversed. Prudent lenders are using the extended timeline to prepare rather than assuming the requirement will disappear. Building data collection infrastructure now, while there is time, is far less risky than scrambling to comply under a compressed timeline if enforcement resumes.

What Your LOS Needs to Support

Section 1071 creates specific technical requirements for loan origination systems. The challenge goes beyond simply adding data fields — it requires changes to application workflows, data validation, reporting, and data governance. Here is what your LOS (or supplementary systems) need to handle:

Demographic Data Collection Workflows

The rule requires that demographic data be collected directly from applicants using specific forms prescribed or approved by the CFPB. This collection must happen as part of the application process but must be firewalled from credit decisioning — the loan officer and underwriter should not see demographic data during the evaluation process. Your LOS needs to support this separation, either through role-based access controls, separate data collection modules, or integration with standalone demographic collection tools. For community banks where the same person often takes the application and makes the credit decision, this firewall requirement represents a significant workflow change.

Additional Data Fields

Most small business LOS platforms were not designed with 1071 data fields in mind. Your system needs to accommodate:

• Disaggregated race and ethnicity categories with multiple-selection support
• Sex and LGBTQI+ identification fields with "applicant declined" options
• NAICS code lookup and validation (many lenders do not currently collect NAICS codes systematically)
• Census tract geocoding based on business address — this requires either integration with a geocoding service or built-in census tract lookup
• Structured pricing fields that capture interest rates, origination charges, and fees in the specific format required by the rule
• Standardized denial reason codes that map to the CFPB's prescribed categories

Data Validation and Quality Controls

Unlike internal data that only your institution uses, 1071 data will be reported to the CFPB and eventually made public. Data quality matters enormously. Your LOS needs validation rules to ensure required fields are completed, values fall within expected ranges, NAICS codes are valid, and census tracts match the reported business address. Missing or inconsistent data will create compliance headaches during examination. Think of this as analogous to HMDA data quality — institutions that invested in upfront validation avoided costly resubmissions and examiner scrutiny.

Reporting and File Generation

Covered lenders must submit data to the CFPB annually in a prescribed electronic format. Your LOS or a supplementary reporting tool needs to generate compliant submission files, similar to how HMDA-reportable institutions generate their Loan Application Register (LAR). This includes data formatting, edit checks, and the ability to correct and resubmit data. Lenders already familiar with HMDA reporting workflows will recognize the process, but the data volume and field count for 1071 are larger.

Firewall Between Demographic Data and Credit Decisions

This is a critical compliance requirement that deserves emphasis. The rule explicitly requires that demographic information collected under 1071 not be used in credit decisions. Your LOS must enforce this separation through access controls, ensuring that underwriters and credit analysts cannot view applicant demographic data during the evaluation process. This is more than a policy requirement — it needs to be enforced technically within your system architecture. Platforms that store all applicant data in a single, undifferentiated record will struggle to implement this firewall without significant rearchitecting.

Platform Readiness Assessment

The honest assessment of LOS platform readiness for Section 1071 is that the industry has made significant progress, though production-ready implementations vary. Some vendors have built comprehensive 1071 modules, others offer compliance add-ons, and a few rely on third-party integrations. Here is where key platforms stand, based on publicly available information, vendor statements, and platform architecture analysis.

nCino

nCino is built on the Salesforce platform, which gives it one of the most flexible data models in the LOS market. Adding custom fields, objects, and validation rules in Salesforce is straightforward — meaning that the underlying architecture can accommodate 1071 data fields without a major platform overhaul. nCino has a strong presence in community bank and credit union commercial lending, where 1071 compliance is most directly relevant.

nCino has publicly discussed its 1071 readiness and has indicated that it has built data collection capabilities to support the rule, including integration of required fields directly into the small business loan workflow and the ability to generate CFPB-format filing data. The Salesforce platform's role-based access controls provide a natural mechanism for firewalling demographic data from credit decisioning workflows. The main consideration for nCino clients is that customization and configuration work will likely be required — this is not a simple toggle. Budget for implementation services and testing.

Abrigo

Abrigo has been one of the more vocal vendors about 1071 readiness. Given Abrigo's focus on commercial and small business lending for community banks and credit unions, 1071 compliance is squarely in its target market. Abrigo has published educational content and webinars about the rule, and the company has built 1071 data collection and reporting capabilities directly into its platform — including borrower-facing collection forms, pre-built CFPB export reports, built-in firewall enforcement, and advisory services for implementation project management.

Abrigo's integrated approach to lending and credit risk analytics positions it well for the reporting requirements. The company already handles regulatory reporting for other compliance areas, and extending that to 1071 is a logical product evolution. The advisory services are particularly valuable for community banks that lack dedicated compliance technology staff. Abrigo clients should confirm whether the 1071 functionality is included in existing licensing or requires an additional module purchase.

Baker Hill

Baker Hill serves community banks and credit unions with commercial and small business lending solutions. Like Abrigo, Baker Hill's client base overlaps heavily with the institutions that will be covered by 1071. Baker Hill has been working directly with the CFPB and its user community to build 1071 capabilities into the NextGen platform, organized around three pillars: gathering data, processing data, and reporting.

Baker Hill's NextGen platform has a relatively modern architecture that accommodates additional data fields and workflow modifications. The company's direct engagement with the CFPB during the rulemaking process suggests a strong understanding of the compliance requirements. Clients and prospects should request a demonstration of 1071 capabilities in a test environment and confirm specific delivery timelines for any features still in development.

Numerated

Numerated is a natural fit for 1071 compliance. The platform was purpose-built for small business lending at community banks and credit unions — the exact use case that 1071 targets. Numerated's modern, cloud-native architecture and API-first design mean that adding new data fields and workflow steps is less technically burdensome than it would be for legacy platforms.

Numerated offers a digital self-service experience that automatically collects 1071 data points during the application process, with strong firewall implementation — restricted demographic fields are masked and kept behind strict access controls. Given that virtually all of Numerated's clients will be affected by 1071, the company has strong economic incentive to deliver a comprehensive solution. Numerated has indicated that implementation costs can be significantly lower than the estimates published by the CFPB and industry groups, thanks to the platform's digital-first approach that eliminates much of the manual data collection overhead.

Fiserv

Fiserv is one of the largest core banking technology providers in the U.S., and its lending products serve thousands of community banks and credit unions. Because Fiserv's lending modules are tightly integrated with its core banking platforms (DNA, Premier, Precision), 1071 compliance capabilities are delivered as part of the broader core ecosystem rather than as a standalone LOS feature.

Fiserv has taken a third-party integration approach, with compatibility for tools like RATA Associates' Comply SBL, but has not shipped a standalone native 1071 module. This means Fiserv clients may need to budget for an additional compliance tool on top of their core banking and lending platform costs. Fiserv clients should engage their relationship managers early to understand the full 1071 solution architecture and total cost of ownership.

Jack Henry

Jack Henry, like Fiserv, is a major core banking provider with integrated lending capabilities. Jack Henry serves a large base of community banks and credit unions that will be covered by 1071. The company's lending solutions — particularly LoanVantage — support 1071 through applicability business rules and digital data collection capabilities.

Jack Henry has acknowledged the 1071 requirement in client communications and has built compliance capabilities into its lending platform. However, the depth of the native implementation and whether it fully eliminates the need for supplementary tools varies by product line. Given Jack Henry's track record with other regulatory requirements (HMDA, CRA), clients can expect continued development, but should verify the current feature set against their specific compliance needs rather than assuming full coverage.

Encompass (ICE Mortgage Technology)

Encompass is the dominant LOS for mortgage origination, but its relevance to 1071 is limited. Section 1071 applies to small business credit transactions — not residential mortgage lending. For lenders that use Encompass exclusively for mortgage lending, 1071 is not directly relevant to their Encompass workflow.

However, multi-product lenders should evaluate whether their small business lending systems — which may be separate from Encompass — are 1071-ready. ICE Mortgage Technology has not publicly indicated plans to add 1071 capabilities to Encompass, which makes sense given the product's mortgage-centric focus. If you originate both mortgages and small business loans, your 1071 compliance solution will almost certainly involve a different platform than Encompass. For a broader view of how different LOS platforms serve different lending segments, see our LOS market trends analysis.

Platform Readiness Summary

What to Ask Your LOS Vendor

Regardless of which platform you use, you should be having detailed conversations with your vendor about 1071 readiness now — not when the compliance date arrives. Here is a practical checklist of questions:

• Do you have a production-ready 1071 data collection module? If not, what is the expected delivery date? Distinguish between "on the roadmap" and "in beta" and "in production at client sites." Native is better than third-party — fewer integration points and a simpler audit trail.
• How will demographic data be collected? Is it integrated into the application workflow, or does it require a separate form or tool? Does it support the CFPB's prescribed format for demographic questions?
• How is demographic data firewalled from credit decisioning? What technical controls prevent underwriters from viewing applicant race, ethnicity, and sex data? Ask for a live demonstration of how restricted fields are masked from credit decision-makers — not a slide deck.
• Does the system support NAICS code collection and validation? Is there a lookup tool integrated into the application, or must loan officers enter codes manually? Manual NAICS entry is a significant source of data quality errors.
• How does the system handle census tract geocoding? Is geocoding built in, or does it require integration with a third-party service? How is the geocoding accuracy validated?
• Can the system generate the CFPB submission file? What format is used? Does it include edit checks and validation before submission? How are corrections handled? Or will you need to export data to a separate reporting tool?
• What is the additional cost? Is 1071 compliance included in your current licensing, or does it require a separate module, additional per-loan fees, or implementation services? Get the total cost in writing.
• What training and documentation will be provided? Will your team need training on new workflows? Is documentation available for compliance officers to review the data collection and reporting process?
• Can we see a live demo? Walk through an application from intake through demographic collection to report generation in a test environment. This is the single most important step — marketing materials do not substitute for seeing the actual product.
• How will you handle changes if the CFPB narrows or adjusts the rule? Your vendor should be able to adapt field requirements and reporting formats without breaking existing workflows or requiring a costly reimplementation.

Preparing Now: A Practical Approach

Given the regulatory uncertainty, many lenders are understandably unsure how much to invest in 1071 preparation right now. Here is a balanced approach that positions you well regardless of how the timeline unfolds:

• Assess your coverage — determine whether your institution meets the 100-transaction threshold. Count covered originations for the past two calendar years. If you are close to the threshold, plan as if you will be covered.
• Inventory your current data — map the 1071 required data fields against what your LOS currently collects. Identify the gaps. Many lenders will find that they collect less than half of the required fields today.
• Engage your LOS vendor — use the checklist above. Get answers in writing. If your vendor cannot provide a clear 1071 roadmap, that is a risk factor you should weigh in your overall platform evaluation. Our How to Choose an LOS guide covers how to evaluate vendor compliance capabilities.
• Evaluate supplementary tools — if your LOS cannot natively support 1071, investigate standalone compliance tools that can handle demographic data collection and reporting alongside your existing platform. Third-party solutions from vendors like RATA Associates, Wolters Kluwer, and Ncontracts are specifically designed for this purpose and can integrate with most origination systems.
• Train your team — loan officers and branch staff will need training on how to collect demographic data, how to handle applicants who decline to respond, and how to maintain the firewall between demographic data and credit decisions. This is a cultural change as much as a technology change.
• Document your compliance program — even before the rule takes effect, build your policies and procedures. Having documented processes will streamline implementation when the compliance date is confirmed and will demonstrate good faith to examiners.

If you are considering a broader LOS transition — whether driven by 1071 requirements or other factors — our LOS migration guide walks through the full process, and our cost breakdown by lender segment can help you budget realistically.

The Bottom Line

Section 1071 represents a fundamental shift in small business lending data transparency. The data collection requirements are extensive, the technical lift for LOS platforms is significant, and the regulatory timeline remains fluid. But the rule is finalized — it is a statutory mandate under Dodd-Frank, not an executive order that can be simply reversed. Enforcement may be paused and the scope may ultimately narrow, but the direction of travel is clear.

Lenders that begin preparing now — assessing gaps, engaging vendors, and building processes — will be in a far stronger position than those who wait for a firm compliance date before acting. And the operational benefits of better small business lending data collection — improved analytics, enhanced fair lending visibility, and streamlined compliance workflows — deliver value even before formal compliance is required.

For lenders evaluating or re-evaluating their LOS, 1071 readiness should be a meaningful factor in the decision. A platform that can natively support 1071 data collection, enforce demographic data firewalls, and generate compliant reports will save your institution significant time, cost, and compliance risk compared to one that requires bolted-on workarounds.

Frequently Asked Questions

What data does Section 1071 require lenders to collect?

Section 1071 requires lenders to collect and report data on small business credit applications including applicant demographic information (race, ethnicity, sex, and LGBTQI+ status of principal owners), business ownership status (minority-owned, women-owned, LGBTQI+-owned), gross annual revenue, NAICS codes, census tract, loan amount and pricing data, application outcome, and denial reasons. In total, the rule involves roughly 80+ data fields per application.

Who must comply with the Section 1071 small business lending rule?

Lenders that originate at least 100 covered small business credit transactions per year in each of the two preceding calendar years must comply. The rule applies to banks, credit unions, online lenders, CDFIs, and any other entity that originates small business loans or lines of credit. Covered credit transactions include term loans, lines of credit, credit cards, and merchant cash advances to businesses with gross annual revenue of $5 million or less.

What are the Section 1071 compliance deadlines?

The CFPB finalized the rule in 2023, but implementation timelines have been delayed due to legal challenges. The original phased schedule set Tier 1 lenders (2,500+ originations) to comply first, followed by Tier 2 (500-2,499 originations) and Tier 3 (100-499 originations). Lenders should monitor the CFPB's website for updated compliance dates, as the current political and regulatory environment may further affect enforcement timelines.

Can my existing LOS handle Section 1071 data collection?

It depends on your platform. Most existing LOS platforms were not built with 1071 data fields natively. Platforms with flexible data models (like nCino on Salesforce or Numerated) can more easily add custom fields. Core banking vendors like Fiserv and Jack Henry offer varying levels of 1071 support. However, many lenders may need to supplement their LOS with standalone 1071 data collection tools or middleware to achieve full compliance.