How to Choose Section 1071 Software: What to Test Before Your First Filing

Most Section 1071 software demos look the same. A clean sample file goes in, a green checkmark comes out, and nobody in the room learns what happens to your own messy small business applications. This guide is for the compliance officer or lending manager who has to pick a tool before the first collection year starts and then defend that choice to an examiner. It covers who has to file under the rule as revised in May 2026, what the software has to collect, and the tests worth running in a demo before you sign. We sell one of these products, so read the section on Comply SBL as coming from an interested party. The tests apply to every vendor, us included.

Key takeaways

• Test the import first: load a real extract from your loan origination system, with its gaps, and see what the software flags before you look at any screen it shows off.
• The firewall test is a role test: sign in as someone who makes credit decisions and confirm they cannot see an applicant's minority-owned, women-owned or principal owner demographic answers, as 12 CFR 1002.108 requires.
• Validation has to happen before submission, because the CFPB's filing guide blocks a register from being certified until every error validation passes.
• Ask how the vendor will ship the revised filing specification, since the CFPB says its current Filing Instructions Guide does not yet reflect the 2026 rule.
• If you would rather not install and maintain the software, a hosted option such as RATA Hosted Services runs the same product for you.

Comparing 1071 tools right now? Schedule your free demo today and bring your own questions about the 2026 rule.

Who has to file under Section 1071, and when does it start?

A lender is covered if it originated at least 1,000 covered credit transactions for small businesses in each of the two preceding calendar years. Farm Credit System lenders are excluded (12 CFR 1002.105(b)). Lenders that clear 1,000 in both 2026 and 2027 must comply starting January 1, 2028. A lender that crosses the line later complies no earlier than January 1, 2029 (12 CFR 1002.114(b)).

Those dates come from the CFPB's reconsideration final rule, published in the Federal Register on May 1, 2026 at 91 FR 23530 and effective June 30, 2026. It replaced the old tiered schedule with a single compliance date. It also cut the small business definition to gross annual revenue of $1 million or less for the preceding fiscal year (12 CFR 1002.106(b)) and took merchant cash advances, agricultural lending and transactions of $1,000 or less out of coverage (12 CFR 1002.104(b)).

Two transitional rules matter for a software timeline. You may count your 2025 and 2026 originations instead of 2026 and 2027 to decide whether you are covered. And a lender that expects to be covered may start collecting the ownership and demographic answers up to 12 months before its compliance date, which for a January 1, 2028 filer means January 1, 2027 (12 CFR 1002.114(c)). If you plan to use that runway, the software has to be live, tested and firewalled by then, which puts the buying decision in 2026.

Not sure you are over the line? Run your two years through the Section 1071 coverage checker, and read what actually counts as a small business loan under Section 1071 before you trust the count.

Which data points does the software have to collect and validate?

The record is set out in 12 CFR 1002.107(a). After the 2026 rule it holds a unique identifier that starts with your LEI, the application date, credit product, guarantees, loan term, credit purpose, amount applied for, amount approved or originated, action taken and its date, census tract (with which kind of address it came from), gross annual revenue, a 3-digit NAICS code, time in business, minority-owned and women-owned business status, the ethnicity, race and sex of the principal owners, and the number of principal owners.

The rule reserved paragraphs (a)(3), (4), (11), (12) and (16), which held application method, application recipient, denial reasons, pricing and number of workers. A data dictionary or field mapping built against the 2023 rule will still ask for them. That is not wrong if you choose to keep collecting them, but the software should keep them apart from what you file.

Two collection details are easy to miss. Revenue reported for an application can be reused only if it was collected in the same calendar year. Census tract, NAICS code, time in business and the ownership answers can be reused for 36 months, as long as you have no reason to think they are wrong (12 CFR 1002.107(d)). Ask a vendor to show where it records the date each value was collected, because that date is what makes reuse defensible.

To find the fields you are not capturing yet, answer one question per data point in the Section 1071 data field readiness check. It returns a gap report you can take into each demo.

Firewall and demographic data: what to test

Section 1071 asks a lender to collect ownership demographics it has never had to collect, from up to four principal owners per business, and then to keep them away from the people deciding the loan. Under 12 CFR 1002.108, an employee or officer involved in a decision on the application may not see the applicant's answers on minority-owned or women-owned status or on its principal owners' ethnicity, race and sex. The exception applies only when the lender decides that limiting access is not feasible and gives the applicant a notice saying so.

Software cannot make that feasibility call for you, but it decides how hard the firewall is to keep. In a demo, test four things:

• Sign in under a loan officer or underwriter role and try to open the demographic answers for one application. The fields should be hidden or blocked, not just left off the default screen.
• Check that the answers are stored apart from the rest of the application. 12 CFR 1002.111(b) requires that separation.
• Enter an applicant who declines to answer and confirm the refusal is recorded as a refusal, distinct from a blank the lender forgot to ask about.
• Look for names, addresses, phone numbers and emails in the register. Section 1002.111(c) keeps personally identifiable information about individuals out of it, apart from what the rule itself requires.

If a vendor answers the first test with a policy document instead of a screen, write that down.

Validation and the CFPB filing format: what a pre-submission check should catch

The register is due on or before June 1 following the calendar year of collection, and an authorized representative has to certify that it is accurate and complete (12 CFR 1002.109(a)). The CFPB's 2025 Filing Instructions Guide requires a comma-separated file in UTF-8 with a header row. It sorts its checks into errors, which every record must pass before the register can be certified and submitted, and warnings, which flag values that could be mistakes and which the filer can confirm. It also runs register-level checks, such as duplicate IDs.

That guide covers data collected in 2025. The CFPB says on the same page that it will publish a revised guide to reflect the 2026 rule. Passing today's edits tells you little about next year. Ask the vendor how quickly it shipped edit changes the last time the CFPB revised a specification, and how those changes reach your installation.

To see what a pre-submission check catches, hand the vendor a file you have broken on purpose:

• A unique identifier that does not start with your LEI, and two records with the same identifier.
• An action taken date that falls before the application date.
• An amount originated on a denied application.
• A NAICS code with the wrong number of digits.
• A record with no census tract, or an address the geocoder cannot match.
• A comma inside a free-text field, which breaks a badly built CSV.

Each one should surface before export, on a screen that points at the record and the field. Edits that only appear after upload to the CFPB platform mean you are finding problems in the week before June 1.

Geocoding deserves its own question. The rule gives a safe harbor for a wrong census tract only when the lender got it by correctly using a geocoding tool provided by the FFIEC or the CFPB (12 CFR 1002.112(c)(2)). Any other geocoder, including ours, has to stand on its accuracy. Ask how the vendor measures it, and ask to see the method written down. Ours is at how RATA measures geocoding accuracy.

Exam readiness: the audit trail and the reports an examiner asks for

An examiner reviewing 1071 data is asking whether your errors were bona fide. Under 12 CFR 1002.112(b), a lender is presumed to keep procedures that avoid errors in a field if a random sample of its submission shows fewer errors in that field than the threshold set in appendix F. Above the threshold, you have to show the procedures some other way. You also have to keep the register and other evidence of compliance for at least three years after it was due (12 CFR 1002.111(a)).

That makes three things worth testing:

• Change a value on a filed record and see whether the software keeps who changed it, when, and what it was before.
• Ask for a field-by-field edit and correction history for one filing year. That is what you would hand an examiner who asks how you caught your own errors.
• Pull last year's register as filed, after this year's edits have been applied to the system. If the software cannot reproduce what you certified, the three-year retention rule is harder to meet.

Then ask for a report you will actually need: originations by census tract and by owner demographics for one product, for one period, with the filter saved so it can be rerun next year.

How Comply SBL answers these tests

Comply SBL is our 1071 module. Here is what its product page documents, mapped to the tests above.

• The Import Wizard reads fixed-length and delimited files from your origination system, with field mapping and custom conversions applied on the way in.
• The record is laid out across SBLAR tabs for the application, the business and credit product, and up to four principal owners. The LEI and unique ID are validated on entry rather than at export.
• Minority-owned and women-owned status is recorded with the required notices, and a refusal is recorded distinctly.
• It runs the CFPB's validity and quality edits for Section 1071 and updates them as the CFPB refines the specification. Quality edits you have checked can be marked verified.
• Compliance-grade geocoding is built in. You can batch the whole file or geocode one application, and it re-geocodes when an address changes.
• The Submission Wizard checks that the data is edit-free and fully geocoded, then writes the file in the CFPB's format.
• It tracks covered originations year by year against the 1,000-transaction threshold, and the data sits in the same database you file HMDA and CRA from.

Run the firewall and audit-trail tests above against us in the demo the same way you would against anyone else.

Hosted or installed: when RATA Hosted Services makes sense

Section 1071 adds a new data set, a new access-control requirement and a filing specification that is still changing. For a compliance team without spare IT time, that argues for letting the vendor run the software. RATA Hosted Services runs every Comply module, SBL included, on Microsoft Azure. RATA installs and configures it, maintains the database with daily backups and applies updates as they ship. Your team signs in from a browser.

An installed copy still makes sense when your institution requires that loan data stays on its own servers, or when your IT group already runs Comply for HMDA and CRA and wants 1071 beside it. Either way, ask how a mid-cycle edit update reaches you, and who applies it.

A buyer's test checklist for Section 1071 software

Take this into each demo and fill in the middle column with what you saw, not what you were told.

Want to run this list against Comply SBL on screen? A specialist will take a sample file from import to a CFPB-format submission file. Book a Comply SBL demo.

Before you sign

The rule is settled for now, but the filing specification is not, and the first collection year arrives on January 1, 2028 for lenders already over the threshold. Pick the vendor whose software passed the tests you ran with your own data, and get its answer about the revised filing guide in writing. If you want to put these questions to us, the demo is the place to do it.

Schedule your free demo today

Sources

• Small Business Lending Under the Equal Credit Opportunity Act (Regulation B), final rule
  CFPB, 91 FR 23530, May 1, 2026. Effective June 30, 2026; compliance date January 1, 2028.
• 12 CFR part 1002, subpart B (Regulation B)
  eCFR, text as amended at 91 FR 23605 to 23606. Read November 10, 2026.
• Small business lending collection and reporting requirements
  CFPB compliance resources page. Read November 10, 2026.
• Filing instructions guide for small business lending data collected in 2025
  CFPB. Read November 10, 2026.

Photo by Kampus Production on Pexels.