CFPB Revises Small Business Lending Rule Under Reg B

The Consumer Financial Protection Bureau has finalized a rule that reshapes how small business lending data is collected under the Equal Credit Opportunity Act. Published May 1, 2026 in the Federal Register, the rule revises Regulation B, subpart B, and carries an effective date that financial firms cannot afford to overlook. If your institution extends credit to small businesses, the obligations described here apply to your operation, and the clock toward implementation has already started.

This guide explains, in plain English, what the rule changes, who it covers, the dates that govern it, and how covered lenders can operationalize the work at volume. We lead with the obligation and the deadline, not with any vendor, because the law is what matters first.

Key Takeaways

• The Consumer Financial Protection Bureau finalized a rule, cited as 91 FR 23530, revising Regulation B, subpart B, under the Equal Credit Opportunity Act.

• The final rule is effective on June 30, 2026, while the compliance date for the rule is January 1, 2028, giving covered lenders a defined window to prepare.

• The rule amends coverage of certain credit transactions and financial institutions, the small business definition, the data points collected, and the compliance date itself.

• The changes implement section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act, and live under 12 CFR Part 1002.

• The Bureau states the revisions are intended to streamline the rule, reduce complexity for lenders, and improve data quality.

What This Rule Actually Does

The rule, identified by RIN 3170-AB40 and cited as 91 FR 23530, revises certain provisions of Regulation B, subpart B. That subpart implements changes the Equal Credit Opportunity Act received through section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. In practical terms, section 1071 directs that financial institutions collect and report data on credit applications made by small businesses, including those owned by women and minorities, so regulators and the public can assess fair lending and community credit needs.

According to the Bureau, this final rule amends several distinct elements of the existing framework. It adjusts the coverage of certain credit transactions and financial institutions. It revises the small business definition that determines which applicants fall within scope. It changes the inclusion of certain data points and how others are collected. And it moves the compliance date. The Bureau believes these changes will streamline the rule, reduce complexity for lenders, improve data quality, and advance the purposes of section 1071.

Each of those four levers matters for a different reason. A change to coverage can pull an institution into scope, or release one from it, depending on its lending activity. A change to the small business definition can reclassify a meaningful share of an institution's applicant pool. A change to data points alters the exact fields a lender records on each covered application. And a change to the compliance date resets the timeline every covered lender plans against. Reading the rule text closely, rather than relying on summaries, is the only reliable way to confirm where your institution lands on each lever.

Because this is a Your-Money-or-Your-Life topic touching real federal law, every figure in this article is copied verbatim from the Federal Register and eCFR. Nothing here is estimated. Where a number such as a penalty amount or a precise applicant threshold would normally appear, this guide describes the requirement qualitatively and points covered lenders to the primary source so their compliance counsel can read the operative text directly.

Who Is Affected

The rule speaks to financial institutions that engage in small business lending. That is a broad universe, because "financial institution" under section 1071 reaches well beyond traditional banks. It can include credit unions, online lenders, community development financial institutions, and other entities that regularly extend covered credit to small businesses. Whether a particular institution is covered turns on the revised coverage provisions and the revised small business definition, both of which this final rule amends.

Financial firms evaluating their exposure should focus on three questions. First, does the institution extend credit transactions that the revised rule treats as covered? Second, do the applicants meet the revised small business definition? Third, does the institution's volume of covered activity cross any applicable threshold the rule sets? The exact contours of each answer live in the rule text and the implementing sections of 12 CFR Part 1002, current text of which is available through the eCFR. Reading those provisions, rather than assuming continuity with prior guidance, is essential because this rule deliberately moves several of those lines.

A practical caution: coverage is not a one-time determination. As an institution's lending mix shifts, its status under the rule can shift with it. Covered lenders typically reassess coverage on a recurring basis rather than treating an early read as permanent. That recurring assessment is itself a process that benefits from systematic monitoring rather than ad hoc spreadsheet review.

The Dates That Govern This Rule

Two dates anchor everything. This final rule is effective on June 30, 2026. The compliance date for the rule is January 1, 2028. The distinction is not academic. An effective date establishes when the rule becomes law and when its provisions are operative as a regulatory matter. A compliance date establishes when covered entities must actually be collecting and reporting data under the revised requirements. The gap between the two is the runway covered lenders have to build, test, and validate their data-collection processes.

The rule was published May 1, 2026, which is the date it appeared in the Federal Register. Covered lenders should treat the publication date, the effective date, and the compliance date as three separate reference points, each with its own significance, and confirm them against the primary source rather than relying on secondhand calendars.

The runway between the effective date and the compliance date is finite, and it is the single most important planning input for any covered lender. Institutions that treat the compliance date as a distant abstraction risk a compressed, error-prone scramble. Those that work backward from January 1, 2028, building data-collection capability methodically, give their teams room to validate field-level accuracy before the obligation is live.

How Covered Lenders Operationalize the Work

The revised rule changes which data points are collected and how. For a lender processing a steady flow of small business credit applications, that translates into a concrete operational task: capturing the right fields, on the right applications, consistently, and retaining them for reporting. Doing this by hand across hundreds or thousands of applications invites omission and inconsistency, exactly the conditions a data-quality-focused rule is designed to discourage.

This is where workflow tooling earns its place. US Tech Automations can monitor the Federal Register feed for amendments and guidance tied to a rule like this one, then automatically flag a relevant change and route it to a named compliance reviewer for sign-off. Rather than a team member periodically checking a government website, an agent watches the source continuously and triggers an alert the moment a covered change posts. That turns a passive, easy-to-miss task into an active, auditable workflow. You can see how the AI agents are configured to watch a source and escalate to a human reviewer.

The second operational layer is the application data itself. As covered applications come in, a pipeline can extract the rule-required fields, validate them against the revised data-point definitions, and flag any record that is incomplete before it reaches the reporting stage. US Tech Automations can integrate this intake step with a lender's existing systems so the workflow runs where the work already happens, escalating only the exceptions that need a person's judgment. The goal is not to replace compliance professionals; it is to let them spend their attention on the records that genuinely need it. If you want to discuss how this maps to your institution's stack, the contact page is the place to start that conversation.

A monitoring-and-routing approach matters most precisely because the compliance date is January 1, 2028, and rules in this area can be supplemented by further guidance before then. An automated watch on the primary source means a covered lender learns about a relevant change as it happens, not weeks later, and the change lands in front of the right reviewer with a clear trail of who saw it and when.

Reading the Primary Source

No summary substitutes for the rule itself. The authoritative text of this final rule, cited as 91 FR 23530, is published in the Federal Register, and the current regulatory text it amends lives at 12 CFR Part 1002 in the eCFR. Covered lenders and their counsel should read both. The Federal Register document carries the rule's preamble, which explains the Bureau's reasoning, the changes to coverage and definitions, and the dates. The eCFR carries the operative regulatory language as it stands.

For context, this rule is one of many tracked in a point-in-time index of 128 U.S. federal rules published January 1, 2026 – June 20, 2026 by 9 agencies governing covered industries. That index is a snapshot, not a substitute for the live record; the primary sources above are always controlling. When a discrepancy appears between any summary, including this one, and the Federal Register or eCFR, the primary source wins.

Frequently Asked Questions

What rule is this, and where can I read it?

This is a Consumer Financial Protection Bureau final rule titled Small Business Lending Under the Equal Credit Opportunity Act (Regulation B). It is cited as 91 FR 23530 and carries RIN 3170-AB40. The full text is in the Federal Register, and the regulatory text it amends is at 12 CFR Part 1002 in the eCFR.

When does the rule take effect, and when must we comply?

The final rule is effective on June 30, 2026. The compliance date for the rule is January 1, 2028. The effective date is when the rule becomes operative as law; the compliance date is when covered lenders must be collecting and reporting data under the revised requirements.

What does the rule actually change?

According to the Bureau, the rule amends coverage of certain credit transactions and financial institutions, the small business definition, the inclusion of certain data points and how others are collected, and the compliance date. The Bureau states these changes are intended to streamline the rule, reduce complexity for lenders, improve data quality, and advance the purposes of section 1071.

Does this rule apply to my institution?

It depends on the revised coverage provisions and the revised small business definition. The rule reaches financial institutions that extend covered credit to small businesses, which can include banks, credit unions, online lenders, and community development financial institutions. Because the rule deliberately moves several coverage and definition lines, covered lenders should confirm their status against the rule text at 91 FR 23530 and 12 CFR Part 1002, with the help of qualified counsel.

What is section 1071?

Section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act amended the Equal Credit Opportunity Act to direct financial institutions to collect and report data on small business credit applications. Regulation B, subpart B, implements those changes, and this final rule revises that implementation.

How should we prepare before the compliance date?

Covered lenders generally work backward from January 1, 2028: confirm coverage, map the revised data points to their application intake, build and test the collection and validation process, and establish a way to monitor the Federal Register for further guidance. The goal is to reach the compliance date with validated, reportable data rather than a last-minute build.

Related guidance

For adjacent obligations financial firms are tracking this cycle, see our guides on the Holding Foreign Insiders Accountable Act disclosure rule, the Geographic Targeting Order imposing recordkeeping and reporting requirements, and the broader Equal Credit Opportunity Act compliance overview.

Disclaimer

This article is provided for informational purposes only and does not constitute legal or tax advice. Reading it does not create an attorney-client relationship. Regulatory obligations turn on facts specific to each institution, and the law can change. Before acting on anything described here, consult a qualified attorney or tax advisor who can evaluate your particular circumstances.

Every date, citation, RIN, CFR reference, and figure in this post is copied verbatim from the Federal Register and eCFR as of the snapshot date. Nothing is estimated, modeled, or extrapolated. This is not legal or tax advice.

Last reviewed: June 20, 2026.

Source: U.S. Federal Register (91 FR 23530); current text via eCFR, 12 CFR Part 1002.