On June 18, 2025, the Consumer Financial Protection Bureau (CFPB) published an interim final rule extending the compliance deadlines for the small business lending rule (the “Rule”). The CFPB first issued the Rule on March 30, 2023, to implement the small business lending data collection requirements in Section 1071 of the Dodd-Frank Act, which amended the Equal Credit Opportunity Act (ECOA). The Rule imposes data reporting requirements on lenders for small business credit applications, with the goal of improving fair lending and combating discrimination against small businesses when they try to access credit. The Rule has a staggered timeline for compliance, with the earliest dates applying to lenders with the highest volume of small business loans. When it was first issued, the Rule had originally set October 1, 2024, as the earliest compliance deadline.
The CFPB extended the compliance deadlines once previously to begin on July 18, 2025, after the Rule had been stayed due to pending litigation. Lawsuits challenging the Rule remain pending in Texas, Kentucky, and Florida, in which courts have issued stays of the compliance deadlines for the plaintiffs and certain intervenors. To facilitate consistency across all covered financial institutions, the CFPB is extending all compliance deadlines for a second time. With this extension, the earliest compliance date is now July 1, 2026. A chart showing the updated compliance deadlines is below.
| Compliance Tier | Original Compliance Date from March 2023 Final Rule | 2024 Extension: Revised Compliance Date | New Compliance Date | New First Filing Deadline |
| Tier 1: Financial institutions that originated at least 2,500 covered originations in each of the previous two calendar years. | October 1, 2024 | July 18, 2025 | July 1, 2026 | June 1, 2027 |
| Tier 2: Financial institutions that originated at least 500 but less than 2,500 covered originations in each of the previous two calendar years. | April 1, 2025 | January 16, 2026 | January 1, 2027 | June 1, 2028 |
| Tier 3: Financial institutions that originated at least 100 but less than 500 covered originations in each of the previous two calendar years. | January 1, 2026 | October 18, 2026 | October 1, 2027 | June 1, 2028 |
As discussed in our previous post, the Rule requires covered financial institutions, which are those that originated at least 100 covered credit transactions for small businesses in each of the two preceding calendar years, to collect and report business credit application data from small businesses. Small businesses are defined as those with a gross annual revenue of $5 million or less for the preceding fiscal year. The data that must be reported includes credit type, purpose, requested amount, application date, approval/denial date, the types and amounts of certain fees charged, whether the applicant is a minority-owned, women-owned, and/or LGBTQI+-owned business, and the ethnicity, race, and sex of the applicant’s principal owners. The Rule applies to extensions of business credit only.
The Rule has been met with strong opposition from financial industry and political stakeholders, and a multitude of lawsuits challenging the Rule have been filed in court since it was first issued in March 2023. Among the biggest concerns was the vast scope of the Rule’s coverage, which includes depository institutions, nonbank lenders, online lenders, commercial finance companies, lenders involved in equipment and vehicle financing, and nonprofit lenders, to name a few. Opponents also noted the burdensome costs for covered lenders to implement and comply with the Rule. With the reelection of President Trump and new leadership at the CFPB, which has indicated it will not prioritize enforcement or supervision actions related to the Rule, the CFPB stated that it plans to revisit the Rule and to initiate a new Section 1071 rulemaking “as expeditiously as reasonably possible.”
Along with legislation pending in Congress to repeal the small business data collection requirements in the underlying law, it is doubtful that covered financial institutions will need to comply with the Rule in its current form. For now, however, the CFPB’s compliance deadlines still apply to all covered financial institutions. We will continue to closely monitor updates by the CFPB and outcomes of the court cases and pending legislation. If you would like to discuss how these new reporting requirements may impact your institution, or other fair lending concerns, please contact the author or any member of Frost Brown Todd’s Consumer Financial Services and Consumer Protection team.
Banking On It
Delivering timely and practical commentary on the legal and regulatory challenges impacting financial institutions, our Banking On It blog covers a wide range of topics, from consumer finance and loan originations to workouts and regulatory enforcement trends. Our goal is to keep you informed and prepared for what’s ahead.