Section 1071: Small Business Lending Data Collection Requirements
Last updated: September 8, 2026
Section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act creates the most significant new lending data collection requirement since HMDA was expanded in 2018. Covered financial institutions must collect, maintain, and report data on credit applications from small businesses, including demographic information about principal owners.
The rule aims to:
- Facilitate fair lending enforcement by providing regulators with data to identify potential discrimination in small business lending
- Enable communities to identify business and community development needs for small businesses, including women-owned and minority-owned businesses
- Promote transparency in the small business credit market
Who Must Comply?
These figures were revised by the CFPB's reconsideration final rule published May 1, 2026 (Federal Register document 2026-08494, effective June 30, 2026). Guidance published before that date, including compliance calendars built on the old tiered schedule, is out of date. Use the Section 1071 coverage checker to test where you stand.
Financial institutions that originated at least 1,000 covered credit transactions to small businesses in each of the two preceding calendar years must comply, per § 1002.105(b). This includes banks, credit unions, online lenders, CDFIs, and other non-depository lenders. The threshold was raised from 100 by the 2026 rule, a tenfold increase that takes many institutions out of scope entirely. Note what the count is of: the same section counts originations for small businesses, not applications received, and transactions that extend, renew or otherwise amend an existing transaction are not counted as originations.
A small business now means one with gross annual revenue of $1 million or less for its preceding fiscal year, down from $5 million — the definition is in § 1002.106(b)(1). That change cuts both ways: it shrinks the population of applications you would report, and because the origination threshold counts transactions to small businesses, it also shrinks the number you count when testing coverage.
There is now a single compliance date:
- January 1, 2028 for every institution that remains covered. The rule extends the compliance date "for all financial institutions that remain covered by the rule."
- The former Tier 1, Tier 2 and Tier 3 dates, and the intermediate extensions issued during 2025, no longer describe the rule.
Which fiscal year’s revenue decides whether an applicant is a small business
Two different counting rules sit next to each other here, and running them together is the most common way a Section 1071 programme gets the small business test wrong. The institution-level threshold in § 1002.105(b) counts originations across two preceding calendar years. The applicant-level test in § 1002.106(b)(1) counts revenue for one fiscal year: a business is small if “its gross annual revenue, as defined in § 1002.107(a)(14), for its preceding fiscal year is $1 million or less.”
So the small business determination does not need several years of revenue history. It needs one figure, for the fiscal year before you collected the information. Official interpretation 107(a)(14)-1 states it plainly: a financial institution “reports the applicant’s gross annual revenue, expressed in dollars, for its fiscal year preceding when the information was collected.”
If your origination system is pulling multiple years of revenue to satisfy this test, it is answering a question the rule did not ask, and every applicant without that much history will look incomplete when the file is in fact reportable.
Incomplete revenue history and newly formed businesses
A business that has not traded long enough to have revenue in the preceding fiscal year is not a case the rule left open. Official interpretation 107(a)(14)-4 answers it: “In a typical startup business situation where the applicant has no gross annual revenue for its fiscal year preceding when the information is collected, the financial institution reports that the applicant’s gross annual revenue in the preceding fiscal year is ‘zero.’”
Zero is a reported value, not a blank. An applicant reported at zero is below $1 million, so it satisfies the revenue element of the small business definition rather than dropping out of scope for want of history.
Missing years, and when the revenue figure cannot be pulled at all
Where the figure is genuinely unavailable the rule supplies both a reported value and a condition on reaching for it. Official interpretation 107(a)(14)-2: “Pursuant to § 1002.107(c), a financial institution shall maintain procedures reasonably designed to collect applicant-provided data, which includes the gross annual revenue of the applicant. However, if a financial institution is nonetheless unable to collect or determine the gross annual revenue of the applicant, the financial institution reports that the gross annual revenue is ‘not provided by applicant and otherwise undetermined.’”
The order of those two sentences is the whole point. That fallback value becomes available after the § 1002.107(c) procedures have run and failed, not instead of them. What the file needs to evidence is therefore the attempt rather than the empty field: which reported outcome applied to this application — a dollar figure, zero, or “not provided by applicant and otherwise undetermined” — and, for the third, that the collection procedure actually ran.
Two related points come up in the same conversation. You may rely on what the applicant tells you: interpretation 106(b)(1)-3 permits a financial institution to rely on an applicant’s representations about gross annual revenue, and 107(a)(14)-1 allows a figure the applicant estimated, though verified or updated information has to be used once you hold it. And affiliate revenue is optional: interpretation 107(a)(14)-3 permits, but does not require, reporting revenue that includes an affiliate’s.
Whether a given origination is a covered credit transaction at all is a separate question from the revenue test above, and it is the one that decides what you count toward the 1,000. We work through it in what actually counts as a small business loan under Section 1071.
What Data Must Be Collected?
Section 1071 requires a substantially larger collection per application than HMDA. The 2026 rule removed the discretionary data points for application method, application recipient, denial reasons, pricing information and number of workers, so any field mapping built against the earlier data dictionary needs re-checking. The categories that remain:
Application Information
- Unique identifier and application date
- Application method (online, in-person, telephone, mail)
- Application recipient (direct to institution or via broker/agent)
- Credit type (term loan, line of credit, credit card, merchant cash advance, etc.)
- Credit purpose (working capital, equipment, real estate, refinancing, etc.)
Credit Details
- Amount applied for and amount approved
- Action taken (originated, approved but not accepted, denied, withdrawn, incomplete)
- Action taken date and denial reasons (up to 4)
- Pricing information (interest rate, fees, charges)
Business Information
- Census tract of principal place of business (requires geocoding)
- Gross annual revenue of the business
- NAICS code — a 3-digit North American Industry Classification System code. Holding a 6-digit code is fine as a source, but 3 digits is what § 1002.107(a)(15) asks you to report, using the subsector codes in effect on 1 January of the reporting year.
- Time in business (number of workers was removed by the 2026 rule — § 1002.107(a)(16) now reads Reserved, while time in business remains at (a)(17))
- Minority-owned and women-owned business statuses, with the notices the rule requires and a refusal recorded distinctly
To check these against what your own origination system captures today, work through our Section 1071 data field readiness check — one question per data point, and it returns the fields you are not collecting alongside the ones you are collecting in a form that will not survive validation. It runs in your browser and nothing is uploaded.
Principal Owner Demographics
- Ethnicity of each principal owner (Hispanic/Latino origin with subcategories)
- Race of each principal owner (detailed categories including Asian and Pacific Islander subcategories)
- Sex of each principal owner
How Is Section 1071 Different from HMDA?
While compliance officers familiar with HMDA will recognize some concepts, Section 1071 introduces significant new challenges:
| Aspect | HMDA Reporting | Section 1071 |
|---|---|---|
| Scope | Residential mortgages only | All small business credit types |
| Demographics | Can use BISG proxy if not reported | Must collect directly from applicants |
| Data Points | ~48 data fields | Substantially more, revised in 2026 |
| Business Info | Not applicable | NAICS code, revenue, employees, ownership |
| Pricing Data | Rate spread vs APOR | Actual interest rate, fees, and charges |
| Credit Types | Closed-end mortgages, HELOCs | Term loans, lines of credit, cards, MCA, etc. |
How Can RATA Associates Help?
RATA has been preparing for Section 1071 since the rule was proposed, building on our 39 years of HMDA/CRA compliance expertise. Comply SBL (1071) provides:
- Complete data collection for every field the rule requires
- Compliance-grade geocoding (98%+ accuracy) for business addresses
- NAICS code lookup and validation
- Built-in edit checking aligned with CFPB validation rules
- Demographic data collection forms that meet regulatory requirements
- Integration with existing Comply HMDA/CRA for institutions already using our software
Section 1071 Compliance Software
Ready to prepare for Section 1071? Comply SBL (1071) tracks every required data point, handles geocoding and NAICS coding, and generates submission-ready files.
Tracking Every Data Point by Hand, or Not
Whatever your compliance date, the collection work is the same size. This is what changes about doing it.
Frequently Asked Questions
What is Section 1071 of the Dodd-Frank Act?
Section 1071 requires covered financial institutions to collect and report data on small business credit applications to the CFPB. It aims to facilitate enforcement of fair lending laws and identify business and community development needs for small businesses, including those owned by women and minorities.
Who must comply with Section 1071 requirements?
Financial institutions that originated at least 1,000 covered credit transactions to small businesses in each of two consecutive years must comply. A small business is one with gross annual revenue of $1 million or less. Both figures were changed by the CFPB's reconsideration final rule of May 1, 2026, which raised the origination threshold from 100 and lowered the revenue ceiling from $5 million. There is a single compliance date of January 1, 2028 for every institution that remains covered. The tiered phase-in that set separate dates for lenders above 2,500, above 500 and above 100 originations was replaced by the CFPB's reconsideration final rule of May 1, 2026.
What data must be collected under Section 1071?
Section 1071 requires application and credit details, census tract of the principal place of business, gross annual revenue, NAICS code, time in business, and principal owner demographics (ethnicity, race and sex) collected directly from the applicant. The May 2026 reconsideration rule removed the discretionary data points for application method, application recipient, denial reasons, pricing information and number of workers.
How is Section 1071 different from HMDA reporting?
While both require geographic and demographic data collection, Section 1071 applies to small business credit (not residential mortgages), requires collecting owner demographics directly from applicants (not using proxies), includes business-specific fields like NAICS codes and revenue, and covers more credit products including lines of credit, credit cards, and merchant cash advances.
