Section 1071 Small Business Lending Data: Which LOS Platforms Are Ready?

Updated September 30, 2026 to reflect the CFPB's May 2026 final rule. The rule described here is the one published at 91 FR 23530 and codified in 12 CFR part 1002, subpart B. For a vendor-by-vendor view, see our Section 1071 readiness by LOS platform guide.

Section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act is one of the most significant regulatory changes to affect small business lending in decades. The rule requires covered lenders to collect, report, and make public detailed data on small business credit applications — including demographic information about business owners. For lenders, the operational and technology implications are substantial. Your loan origination system sits at the center of this compliance challenge.

This article breaks down what Section 1071 requires, where things stand with implementation, what your LOS needs to support, and which platforms are best positioned to help lenders comply.

What Section 1071 Requires

Section 1071 amends the Equal Credit Opportunity Act (ECOA) to require financial institutions to collect and report data on credit applications by small businesses, similar to how HMDA requires data collection for mortgage lending. The stated goals are to facilitate fair lending enforcement and to identify business and community development needs for small businesses.

The data collection requirements are extensive. They fall into several categories:

Applicant Demographic Data

This is the most operationally challenging element. Lenders must ask applicants for the ethnicity, race, and sex of principal owners (§ 1002.107(a)(19)). The May 2026 final rule eliminated the disaggregated ethnicity and race subcategories that the 2023 rule required, so collection now uses the aggregate categories only. It also removed the LGBTQI+ ownership inquiry and revised how principal owners' sex is collected. The lender must tell the applicant that it cannot discriminate on the basis of this information and that the applicant has the right to refuse to provide it.

Business Ownership Data

Lenders must report whether the business is minority-owned, women-owned, or both (§ 1002.107(a)(18)). The May 2026 final rule removed LGBTQI+-owned business status. Lenders must also report the number of principal owners and the demographic data described above for those owners.

Business and Application Data

Beyond demographics, the rule requires extensive data about the business itself and the credit application:

• Application identifiers: a unique identifier for each covered application and the application date
• Industry classification: a 3-digit NAICS code for the business, which many lenders do not collect systematically today
• Business characteristics: gross annual revenue for the preceding fiscal year and time in business
• Geographic data: the census tract where the credit proceeds will principally be used, or the applicant's main office if that is unknown, which requires geocoding
• Application details: credit product, guarantees, loan term, credit purpose, amount applied for, amount approved or originated, action taken, and action taken date

The amended § 1002.107(a) lists 15 data points. The May 2026 final rule removed five that the 2023 rule required: pricing information, denial reasons, application method, application recipient, and number of workers. The remaining set still asks for fields that many small business lenders do not capture in their origination systems today, such as NAICS codes, census tracts, and principal-owner demographics.

Who Must Comply

The May 2026 final rule applies to a financial institution, other than a Farm Credit System lender, that originated at least 1,000 covered credit transactions for small businesses in each of the two preceding calendar years (§ 1002.105(b)). The 2023 rule set that threshold at 100. A small business is one with gross annual revenue of $1 million or less, down from $5 million in the 2023 rule. Covered credit includes loans, lines of credit, and credit cards. Merchant cash advances, agricultural lending, and transactions of $1,000 or less are excluded. The rule can reach several types of lender, and only those above the threshold:

• Banks that originate small business credit at that volume
• Credit unions that originate business credit at that volume
• Online and fintech small business lenders
• CDFIs and mission-driven lenders
• Any other entity that originates covered small business credit at that volume, including non-bank lenders

The CFPB estimates that between approximately 172 and 181 depository institutions will be required to report under the final rule: 167 to 176 banks and savings associations and five credit unions. Most community banks and credit unions with small business lending programs fall below the threshold and are not covered.

Current Regulatory Status

The path to 1071 implementation has been anything but straightforward. Understanding where things stand is important for planning your compliance program.

The CFPB finalized the original Section 1071 rule on March 30, 2023. That rule set a phased compliance timeline based on origination volume, with three tiers that the 2026 rule has since eliminated:

• Tier 1 — Lenders with 2,500 or more covered originations in each of the two preceding years were originally scheduled to begin data collection first
• Tier 2 — Lenders with 500 to 2,499 covered originations would follow
• Tier 3 — Lenders with 100 to 499 covered originations would have the longest lead time

However, the rule immediately faced legal challenges. Industry groups filed lawsuits in multiple courts, and several injunctions were issued. A critical turning point came in May 2024, when the U.S. Supreme Court ruled in Consumer Financial Protection Bureau v. Community Financial Services Association of America that the CFPB's funding mechanism is constitutional. This removed one of the major legal arguments that challengers had used to seek injunctions against the rule.

Litigation continued in the lower courts, and the CFPB extended the compliance dates in 2024 and again in 2025. On November 13, 2025 the Bureau proposed to revise the rule, and on May 1, 2026 it published the final rule (91 FR 23530), which took effect June 30, 2026. The final rule eliminated the tiers and set a single compliance date of January 1, 2028 for lenders that originate at least 1,000 covered credit transactions for small businesses in each of calendar years 2026 and 2027. A lender that crosses the threshold later must comply no earlier than January 1, 2029. The CFPB reports that challenges to the 2023 rule remain pending in three jurisdictions.

Section 1071 is a statutory mandate under Dodd-Frank, so the data collection requirement remains in place after the CFPB narrowed the rule. In the 2026 rule the Bureau wrote that the initial iterations of the data collection should focus on core lending products and larger lenders, which leaves room for a later expansion. Lenders above the 1,000-origination threshold should use the time before January 1, 2028 to build collection and reporting. Lenders near the threshold should track their covered origination counts each year.

What Your LOS Needs to Support

Section 1071 creates specific technical requirements for loan origination systems. The challenge goes beyond simply adding data fields — it requires changes to application workflows, data validation, reporting, and data governance. Here is what your LOS (or supplementary systems) need to handle:

Demographic Data Collection Workflows

The rule requires that demographic data be collected directly from applicants using specific forms prescribed or approved by the CFPB. This collection must happen as part of the application process but must be firewalled from credit decisioning — the loan officer and underwriter should not see demographic data during the evaluation process. Your LOS needs to support this separation, either through role-based access controls, separate data collection modules, or integration with standalone demographic collection tools. For a covered lender where the same person takes the application and makes the credit decision, this firewall requirement is a significant workflow change.

Additional Data Fields

Most small business LOS platforms were not designed with 1071 data fields in mind. Your system needs to accommodate:

• Aggregate ethnicity and race categories for principal owners (the 2026 rule eliminated the disaggregated subcategories)
• Sex of principal owners, collected in the format the 2026 rule specifies, with a way to record that the applicant declined to answer
• NAICS code lookup and validation (many lenders do not currently collect NAICS codes systematically)
• Census tract geocoding for the address where the credit proceeds will principally be used, with the applicant's main office as the fallback, through a geocoding service or built-in census tract lookup
• Gross annual revenue for the preceding fiscal year, captured so the system can apply the $1 million small business definition
• Flags for excluded transactions (merchant cash advances, agricultural lending, and transactions of $1,000 or less) so they stay out of the 1071 data set

Data Validation and Quality Controls

Unlike internal data that only your institution uses, 1071 data will be reported to the CFPB and eventually made public. Data quality matters enormously. Your LOS needs validation rules to ensure required fields are completed, values fall within expected ranges, NAICS codes are valid, and census tracts match the reported business address. Missing or inconsistent data will create compliance headaches during examination. Think of this as analogous to HMDA data quality — institutions that invested in upfront validation avoided costly resubmissions and examiner scrutiny.

Reporting and File Generation

Covered lenders must submit data to the CFPB annually in a prescribed electronic format. Your LOS or a supplementary reporting tool needs to generate compliant submission files, similar to how HMDA-reportable institutions generate their Loan Application Register (LAR). This includes data formatting, edit checks, and the ability to correct and resubmit data. Lenders already familiar with HMDA reporting workflows will recognize the process.

Firewall Between Demographic Data and Credit Decisions

This is a critical compliance requirement that deserves emphasis. The rule explicitly requires that demographic information collected under 1071 not be used in credit decisions. Your LOS must enforce this separation through access controls, ensuring that underwriters and credit analysts cannot view applicant demographic data during the evaluation process. This is more than a policy requirement — it needs to be enforced technically within your system architecture. Platforms that store all applicant data in a single, undifferentiated record will struggle to implement this firewall without significant rearchitecting.

Platform Readiness Assessment

The honest assessment of LOS platform readiness for Section 1071 is that the industry has made significant progress, though production-ready implementations vary. Some vendors have built comprehensive 1071 modules, others offer compliance add-ons, and a few rely on third-party integrations. Here is where key platforms stand, based on publicly available information, vendor statements, and platform architecture analysis. Under the May 2026 final rule most community banks and credit unions fall below the coverage threshold, so these capabilities matter mainly to institutions that originate 1,000 or more covered small business credits a year or expect to reach that volume.

nCino

nCino is built on the Salesforce platform, which gives it one of the most flexible data models in the LOS market. Adding custom fields, objects, and validation rules in Salesforce is straightforward — meaning that the underlying architecture can accommodate 1071 data fields without a major platform overhaul. nCino has a strong presence in community bank and credit union commercial lending.

nCino has publicly discussed its 1071 readiness and has indicated that it has built data collection capabilities to support the rule, including integration of required fields directly into the small business loan workflow and the ability to generate CFPB-format filing data. The Salesforce platform's role-based access controls provide a natural mechanism for firewalling demographic data from credit decisioning workflows. The main consideration for nCino clients is that customization and configuration work will likely be required — this is not a simple toggle. Budget for implementation services and testing.

Abrigo

Abrigo has been one of the more vocal vendors about 1071 readiness. Abrigo focuses on commercial and small business lending for community banks and credit unions. Abrigo has published educational content and webinars about the rule, and the company has built 1071 data collection and reporting capabilities directly into its platform — including borrower-facing collection forms, pre-built CFPB export reports, built-in firewall enforcement, and advisory services for implementation project management.

Abrigo's integrated approach to lending and credit risk analytics positions it well for the reporting requirements. The company already handles regulatory reporting for other compliance areas, and extending that to 1071 is a logical product evolution. The advisory services are particularly valuable for community banks that lack dedicated compliance technology staff. Abrigo clients should confirm whether the 1071 functionality is included in existing licensing or requires an additional module purchase.

Baker Hill

Baker Hill serves community banks and credit unions with commercial and small business lending solutions. Baker Hill has been working directly with the CFPB and its user community to build 1071 capabilities into the NextGen platform, organized around three pillars: gathering data, processing data, and reporting.

Baker Hill's NextGen platform has a relatively modern architecture that accommodates additional data fields and workflow modifications. The company's direct engagement with the CFPB during the rulemaking process suggests a strong understanding of the compliance requirements. Clients and prospects should request a demonstration of 1071 capabilities in a test environment and confirm specific delivery timelines for any features still in development.

Numerated

Numerated is a natural fit for 1071 compliance. The platform was purpose-built for small business lending at community banks and credit unions — the exact use case that 1071 targets. Numerated's modern, cloud-native architecture and API-first design mean that adding new data fields and workflow steps is less technically burdensome than it would be for legacy platforms.

Numerated offers a digital self-service experience that automatically collects 1071 data points during the application process, with strong firewall implementation — restricted demographic fields are masked and kept behind strict access controls. Numerated has indicated that implementation costs can be significantly lower than the estimates published by the CFPB and industry groups, thanks to the platform's digital-first approach that eliminates much of the manual data collection overhead.

Fiserv

Fiserv is one of the largest core banking technology providers in the U.S., and its lending products serve thousands of community banks and credit unions. Because Fiserv's lending modules are tightly integrated with its core banking platforms (DNA, Premier, Precision), 1071 compliance capabilities are delivered as part of the broader core ecosystem rather than as a standalone LOS feature.

Fiserv has taken a third-party integration approach, with compatibility for tools like RATA Associates' Comply SBL, but has not shipped a standalone native 1071 module. This means Fiserv clients may need to budget for an additional compliance tool on top of their core banking and lending platform costs. Fiserv clients should engage their relationship managers early to understand the full 1071 solution architecture and total cost of ownership.

Jack Henry

Jack Henry, like Fiserv, is a major core banking provider with integrated lending capabilities. Jack Henry serves a large base of community banks and credit unions. The company's lending solutions — particularly LoanVantage — support 1071 through applicability business rules and digital data collection capabilities.

Jack Henry has acknowledged the 1071 requirement in client communications and has built compliance capabilities into its lending platform. However, the depth of the native implementation and whether it fully eliminates the need for supplementary tools varies by product line. Given Jack Henry's track record with other regulatory requirements (HMDA, CRA), clients can expect continued development, but should verify the current feature set against their specific compliance needs rather than assuming full coverage.

Encompass (ICE Mortgage Technology)

Encompass is the dominant LOS for mortgage origination, but its relevance to 1071 is limited. Section 1071 applies to small business credit transactions — not residential mortgage lending. For lenders that use Encompass exclusively for mortgage lending, 1071 is not directly relevant to their Encompass workflow.

However, multi-product lenders should evaluate whether their small business lending systems — which may be separate from Encompass — are 1071-ready. ICE Mortgage Technology has not publicly indicated plans to add 1071 capabilities to Encompass, which makes sense given the product's mortgage-centric focus. If you originate both mortgages and small business loans, your 1071 compliance solution will almost certainly involve a different platform than Encompass. For a broader view of how different LOS platforms serve different lending segments, see our LOS market trends analysis.

Platform Readiness Summary

What to Ask Your LOS Vendor

Regardless of which platform you use, a lender that is covered or close to the 1,000-origination threshold should have detailed conversations with its vendor about 1071 readiness well before the January 1, 2028 compliance date. A practical checklist of questions:

• Do you have a production-ready 1071 data collection module? If not, what is the expected delivery date? Distinguish between "on the roadmap" and "in beta" and "in production at client sites." Native is better than third-party — fewer integration points and a simpler audit trail.
• How will demographic data be collected? Is it integrated into the application workflow, or does it require a separate form or tool? Does it support the CFPB's prescribed format for demographic questions?
• How is demographic data firewalled from credit decisioning? What technical controls prevent underwriters from viewing applicant race, ethnicity, and sex data? Ask for a live demonstration of how restricted fields are masked from credit decision-makers — not a slide deck.
• Does the system support NAICS code collection and validation? Is there a lookup tool integrated into the application, or must loan officers enter codes manually? Manual NAICS entry is a significant source of data quality errors.
• How does the system handle census tract geocoding? Is geocoding built in, or does it require integration with a third-party service? How is the geocoding accuracy validated?
• Can the system generate the CFPB submission file? What format is used? Does it include edit checks and validation before submission? How are corrections handled? Or will you need to export data to a separate reporting tool?
• What is the additional cost? Is 1071 compliance included in your current licensing, or does it require a separate module, additional per-loan fees, or implementation services? Get the total cost in writing.
• What training and documentation will be provided? Will your team need training on new workflows? Is documentation available for compliance officers to review the data collection and reporting process?
• Can we see a live demo? Walk through an application from intake through demographic collection to report generation in a test environment. This is the single most important step — marketing materials do not substitute for seeing the actual product.
• How did you handle the May 2026 changes? The CFPB removed five data points, LGBTQI+-owned business status, and the disaggregated ethnicity and race categories. Your vendor should be able to show those fields retired from the workflow and the reporting output, and explain how it will adapt to later amendments without a costly reimplementation.

Preparing Now: A Practical Approach

With the 2026 rule in place, the first step for most lenders is to confirm whether they are covered. The steps below start there:

• Assess your coverage: count your covered originations for calendar years 2026 and 2027, meaning loans, lines of credit, and credit cards to businesses with $1 million or less in gross annual revenue, leaving out merchant cash advances, agricultural lending, and transactions of $1,000 or less. A lender that originates at least 1,000 in each year must comply starting January 1, 2028. If you are close to the threshold, plan as if you will be covered.
• Inventory your current data: map the 15 data points in the amended rule against what your LOS currently collects. Identify the gaps, starting with NAICS codes, census tracts, and principal-owner demographics.
• Engage your LOS vendor: use the checklist above. Get answers in writing. If your vendor cannot provide a clear 1071 roadmap, that is a risk factor you should weigh in your overall platform evaluation. Our How to Choose an LOS guide covers how to evaluate vendor compliance capabilities.
• Evaluate supplementary tools: if your LOS cannot natively support 1071, investigate standalone compliance tools that can handle demographic data collection and reporting alongside your existing platform. Third-party solutions from vendors like RATA Associates, Wolters Kluwer, and Ncontracts are specifically designed for this purpose and can integrate with most origination systems.
• Train your team: loan officers and branch staff will need training on how to collect demographic data, how to handle applicants who decline to respond, and how to maintain the firewall between demographic data and credit decisions. This is a cultural change as much as a technology change.
• Document your compliance program: the rule took effect June 30, 2026 and compliance begins January 1, 2028, so a covered lender has 2026 and 2027 to write policies and procedures and test them before data collection starts. The rule permits, but does not require, a lender that expects to be covered to begin collecting the demographic data points 12 months before the compliance date.
• If you are under the threshold: you have no Section 1071 collection or reporting duty under the current rule. Recheck your covered origination counts each year, because coverage turns on the two preceding calendar years.

If you are considering a broader LOS transition — whether driven by 1071 requirements or other factors — our LOS migration guide walks through the full process, and our cost breakdown by lender segment can help you budget realistically.

The Bottom Line

The May 2026 final rule changed Section 1071 from a rule that reached most small business lenders into one that starts with the highest-volume lenders. The CFPB estimates 172 to 181 covered depository institutions, and the compliance date is January 1, 2028. Section 1071 remains a statutory mandate under Dodd-Frank, and the Bureau wrote that the initial iterations of the data collection should focus on core lending products and larger lenders, so a later expansion is possible.

Covered lenders that start assessing gaps, engaging vendors, and building processes in 2026 will be in a stronger position than those that wait until late 2027. Lenders below the threshold can still use better small business lending data for analytics and fair lending review, whether or not they report it.

For a covered lender evaluating or re-evaluating its LOS, 1071 readiness should be a meaningful factor in the decision. A platform that can natively support 1071 data collection, enforce demographic data firewalls, and generate compliant reports will save your institution significant time, cost, and compliance risk compared to one that requires bolted-on workarounds. For a lender under the threshold, it is one consideration among several.

Frequently Asked Questions

What data does Section 1071 require lenders to collect?

Under the CFPB's May 1, 2026 final rule, covered lenders compile 15 data points on each covered small business credit application: a unique identifier, application date, credit type, credit purpose, amount applied for, amount approved or originated, action taken and its date, census tract, gross annual revenue, a 3-digit NAICS code, time in business, minority-owned and women-owned business status, the ethnicity, race, and sex of principal owners, and the number of principal owners. The 2026 rule removed LGBTQI+-owned business status, the disaggregated ethnicity and race categories, and five data points from the 2023 rule: pricing, denial reasons, application method, application recipient, and number of workers.

Who must comply with the Section 1071 small business lending rule?

Under the CFPB's May 1, 2026 final rule, a financial institution is covered only if it originated at least 1,000 covered credit transactions for small businesses in each of the two preceding calendar years. Farm Credit System lenders are exempt. The CFPB estimates that between approximately 172 and 181 depository institutions will be required to report, so most community banks and credit unions are not covered. A small business is one with $1 million or less in gross annual revenue. Covered credit includes loans, lines of credit, and credit cards. Merchant cash advances, agricultural lending, and transactions of $1,000 or less are excluded.

What are the Section 1071 compliance deadlines?

The compliance date is January 1, 2028 for a lender that originated at least 1,000 covered credit transactions for small businesses in each of calendar years 2026 and 2027. The May 1, 2026 final rule eliminated the three-tier schedule in the 2023 rule and took effect June 30, 2026. A lender that crosses the threshold later must comply under the two-preceding-years test, and no earlier than January 1, 2029. The CFPB reports that challenges to the 2023 rule remain pending in three jurisdictions, so check the CFPB's small business lending page for changes.

Can my existing LOS handle Section 1071 data collection?

It depends on your platform. Most existing LOS platforms were not built with 1071 data fields natively. Platforms with flexible data models (like nCino on Salesforce or Numerated) can more easily add custom fields. Core banking vendors like Fiserv and Jack Henry offer varying levels of 1071 support. However, many lenders may need to supplement their LOS with standalone 1071 data collection tools or middleware to achieve full compliance.