Section 1071 may still be evolving, but it is not sidelined. With the Consumer Financial Protection Bureau’s (CFPB or Bureau) final reconsideration rule released on May 1, 2026, institutions should be reassessing their planning assumptions against the narrower framework the Bureau has adopted. That framework replaces the prior tiered schedule with a single January 1, 2028 compliance date for covered financial institutions, raises the origination threshold to 1,000 covered credit transactions in each of two consecutive years, lowers the small-business revenue threshold to $1 million, excludes Farm Credit System (FCS) lenders from coverage, and excludes merchant cash advances, agricultural lending, and small dollar loans from the definition of covered credit transaction.
Even with that narrower scope, Section 1071 remains consequential enough to stay firmly on the agenda for institutions’ scoping, governance, product-mapping, and readiness decisions now.
What the Reconsideration Changed
For months, the key question was whether the Bureau’s reconsideration effort would meaningfully change the rule or simply prolong uncertainty. The final rule answers that question. The Bureau has now adopted a narrower framework that focuses initial Section 1071 data collection on core lending products, larger core lenders, businesses that meet the rule’s lower revenue threshold, and a reduced set of data points. In practical terms, that means the rewrite is no longer just a proposal or a procedural signal, but rather is a finalized recalibration of the rule’s initial scope.
The rewrite narrows product coverage, excludes FCS lenders, increases coverage threshold, lowers revenue threshold for small businesses, removes several discretionary data points, and establishes a single January 1, 2028, compliance date. Whatever questions remain about implementation, the direction of travel is now much clearer than it was when the November 2025 proposal was initially published.
The Implementation Dilemma Is Not the Same for Everyone
The Section 1071 implementation dilemma still is not the same for every institution, but the dividing line has changed. Under the final rule, the key question is no longer which compliance tier applies. It is whether an institution is clearly inside the narrower coverage framework, clearly outside it, or close enough to the line that coverage still requires careful analysis.
Institutions that appear likely to originate at least 1,000 covered credit transactions for small businesses in each of calendar years 2026 and 2027 should not treat January 1, 2028, as distant enough to ignore. The final rule replaces the old, tiered schedule with a single compliance date, but the Bureau expressly recognizes that covered institutions will still need time to adjust systems, forms, customer interfaces, data processes, and governance to the revised requirements.
The picture is different for institutions nearer the threshold or less clearly in scope, but not different enough to justify inactivity. The Bureau adopted a special transition rule that permits institutions to use 2025 and 2026, rather than 2026 and 2027, to determine whether they must comply beginning January 1, 2028, specifically to provide greater clarity and certainty for lenders, particularly those close to the 1,000-transaction threshold. That may support a more staged assessment process for some institutions, but it should not be mistaken for a reason to defer foundational work. Institutions should still understand their coverage status under the final rule because scoping, product mapping, data sourcing, and governance decisions tend to become more expensive and less thoughtful when compressed.
Why Flexibility Still Looks Like the Best Response
Flexibility still looks like the best planning posture, but it now means something more specific. The question is no longer whether institutions should prepare for a narrower rule if one eventually arrives. The narrower rule has arrived.
For covered lenders, the approach now should be to build a Section 1071 compliance framework that is disciplined, scalable, and operationally realistic. Building such a framework includes investing in the parts of implementation that carry the most value across portfolios and business models – scope analysis, product mapping, governance, data sourcing, procedures, training, and reporting design – while resisting the temptation to overbuild around requirements the Bureau has now removed or relaxed.
Conclusion
Section 1071 is no longer a story about a possible rewrite. The CFPB has adopted a narrower, more incremental framework that materially changes who is covered, what is covered, what data must be collected, and when compliance begins. For covered institutions, the practical message is straightforward: revisit planning assumptions, align implementation to the final rule, and avoid both paralysis and overbuilding.
Authored by Hamza Abourifq
Contact CrossCheck to learn how we can help review your institution’s current approaches, validate critical decisions, and build 1071 programs that are well-governed, pragmatic, and sustainable.
Explore More
- Learn about CrossCheck’s Section 1071 consulting services
- Read Fair Lending Risk in AI Credit Models: A Compliance Framework for Lenders
