For years, Section 1071 of the Dodd-Frank Act lived in the category of "coming eventually." That era is over. The CFPB's small-business lending data-collection rule is now in force for the highest-volume lenders, and the compliance dates for mid-size and smaller institutions are close enough that "we'll deal with it later" is no longer a plan.
For community banks and credit unions, 1071 is less a technology problem than a process-and-training problem. The institutions struggling most in early 2026 aren't the ones with the smallest budgets — they're the ones that treated it as a last-minute reporting exercise instead of a change to how loan officers actually work.
What Section 1071 actually requires
At its core, 1071 requires covered lenders to collect and report data about applications for credit from small businesses — generally those with $5 million or less in gross annual revenue. Think of it as HMDA for small-business lending. For every covered application, you capture details about the request, the decision, the pricing, and the demographics of the business's ownership.
The regulator's goal is transparency: making it possible to see whether small businesses — particularly women-owned and minority-owned firms — have fair access to credit. Whatever you think of the policy, the operational reality is the same: a lot of new fields, collected consistently, across a lot of applications.
The compliance timeline that matters in 2026
The rule uses a tiered, volume-based rollout. The largest originators went first, moderate-volume lenders follow, and the smallest covered institutions get the latest start. The practical takeaway for a community institution is simple: find your tier, count backward from your date, and start your dry run at least two quarters early. The data itself isn't the hard part — building the muscle memory to collect it cleanly is.
The data points that trip people up
Most teams handle the straightforward fields — amount applied for, action taken, key dates — without trouble. The friction shows up in a handful of places:
- Pricing data. Interest rate, origination charges, and other costs have to be captured accurately and consistently, which forces alignment between origination and reporting systems that often don't talk to each other.
- Application logic. Knowing exactly when an inquiry becomes a "covered application" — and when it doesn't — is a judgment call your front line has to make the same way every time.
- Demographic information. It must be requested, but applicants can decline to answer, and how you ask genuinely matters for both compliance and data quality.
Firewall the demographic data
One requirement deserves special attention: in many cases, underwriters and decision-makers should not have access to the demographic information you collect. That means either a technical firewall or a clean separation of roles — and it's exactly the kind of control examiners will look for. Building it in from day one is far easier than retrofitting it after your first exam.
The institutions that do well under 1071 won't be the ones with the biggest compliance teams. They'll be the ones that made data collection a natural part of the loan officer's workflow instead of a bolt-on.
Building a process you can defend
The winning approach treats 1071 as an operational program, not a filing. That means updating your loan origination system to capture the fields at the point of application, training front-line staff on the "covered application" definition until it's second nature, running quarterly data-quality checks well before your deadline, and documenting your decisions so you can explain them later. Small-business lending is a relationship business; the goal is to layer compliance on top of that relationship without making the borrower feel like they're filling out a census.
