CFPB Final Rules: Regulation B (Section 1071 and Disparate-Impact Liability)

The Consumer Financial Protection Bureau (CFPB) issued two final rules that amend Regulation B, the regulation that implements the Equal Credit Opportunity Act (ECOA or the Act):

1. Small Business Lending (Section 1071): The final rule amendments narrow the scope of the CFPB’s earlier 2023 release (see KPMG Regulatory Alert here) with an eye to “streamline the rule, reduce complexity for lenders, and improve data quality.”
2. Disparate Impact, Discouragement, Special Purpose Credit Programs: The final rule provides that ECOA does not authorize disparate-impact liability (effects test), further defines discouragement, and adds prohibitions and conditions for special purpose credit programs.  

Each of the final rules has been adopted substantially as proposed and implements Executive Orders (i.e., 14168, 14173, and 14281) relevant to the CFPB’s administration of the ECOA. The final rules become effective June 30, 2026, and July 21, 2026, respectively.

Small Business Lending (Section 1071)

The CFPB states that a “potentially long-term data collection regime should start with a focus on core lending products, lenders, small businesses and data points.” As such, it has reconsidered the approach of its 2023 rulemaking, and has narrowed the scope of data collection in several areas:

1. Defined Terms
2. Data Collection
3. Compliance Date

The final rule is substantially as proposed (see KPMG Regulatory Alert here).

Defined Terms. The final rule implements the following changes:

• “Small business”: Changes the annual gross revenue threshold from $5 million or less to $1 million or less in the previous fiscal year.
• “Covered credit transactions”: Excludes merchant cash advances (MCAs), agricultural lending, and small dollar loans (defined as transactions in an amount less than $1,000).
• “Covered financial institutions”: Is modified to:
• Exclude Farm Credit System (FCS) lenders.
• Raise the origination threshold for all covered financial institutions from 100 to 1,000 covered credit transactions in each of two consecutive calendar years.

Data Collection. The CFPB states that “the initial iterations of data collection under the rule should focus on core data points and be consistent with other executive agency directives concerning the collection of demographic data to minimize any burden accompanying new collections.” To that end, the final rule:

• Removes the “discretionary” data points for application method, application recipient, denial reasons, pricing information, and number of workers.
• Eliminates data points to conform with Executive Order 14168, including LGBTQI+-owned business status, modifies the collection of business ownership status, and the format of demographic data concerning the principal owners.
• Amends provisions on the time and manner of data collection, to remove certain requirements that are not statutorily required and appear to anticipate or presume non-compliance with the rule. It also adds a provision that emphasizes for applicants their statutory rights under the rule.
• Removes anti-discouragement provisions and related monitoring requirements.

Note: This final rule does not address privacy discussions in the 2023 final rule or its statements about the eventual publication of data.

Compliance Date and Grace Period. The final rule extends the compliance date to January 1, 2028, for all financial institutions that are covered by the final provisions. Accordingly:

• All covered financial institutions that originate at least 1,000 covered credit transactions for small businesses in each of calendar years 2026 and 2027 must begin to comply with the rule starting on January 1, 2028.
• All financial institutions that did not originate at least 1,000 covered credit transactions for small businesses in each of calendar years 2026 and 2027 but subsequently originate at least 1,000 such transactions in two consecutive calendar years must begin to comply with the rule, but no earlier than January 1, 2029.

Special transition rules provide flexibility to potentially covered financial institutions including provisions to use calendar years 2025 and 2026 as a look-back period to determine compliance, and permission for certain financial institutions to use any “reasonable method” to estimate their originations to small businesses for either or both of the calendar years 2026 and 2027.

The updated grace period is from January 1, 2028, through December 31, 2028 to align with the new single initial compliance date of January 1, 2028.

Disparate Impact, Discouragement, Special Purpose Credit Programs

The CFPB states that the “amendments to Regulation B are to ensure consistency with the letter and intent of ECOA” as well as “clarify the obligations imposed by ECOA and facilitate compliance” with it. The key amendments covered by the final rule include:

1. Disparate Impact
2. Discouragement Prohibition
3. Special Purpose Credit Programs

Disparate Impact. The CFPB has determined that its former conclusion that disparate-impact claims may be cognizable under ECOA is “not the best interpretation of ECOA” and the “statutory language does not authorize disparate-impact liability.”

Accordingly, the final rule removes language indicating that disparate-impact liability, referred to as the “effects test,” may be applicable under ECOA, and adds language stating that the Act does not recognize the “effects test” for determining whether there is discrimination in violation of the Act.

Note: Although the effects test has been removed, the final rule preserves prohibitions relating to disparate-treatment liability.

Discouragement Prohibition. The final rule amends the prohibition on discouraging applicants or prospective applications to clarify that it i) prohibits statements of intent to discriminate in violation of ECOA and ii) is not triggered merely by negative consumer impressions. The rule also clarifies that encouraging statements by creditors directed at one group of consumers is not prohibited discouragement as to applicants or prospective applicants who were not the intended recipients of the statements.

In addition, the CFPB also:

• Clarifies that “oral or written statement” is defined as spoken or written words, or visual images such as symbols, photographs, or videos; including any visual images used in advertising or marketing campaigns.
• Narrows discouragement liability by prohibiting creditors from making statements that they “know or should know” would cause a reasonable person to believe that the creditor would deny their credit application, or would grant it on less favorable terms, because of their prohibited basis characteristic(s).

Special Purpose Credit Programs. Under the final rule, special purpose credit programs (SPCPs) offered or participated in by for-profit organizations are subject to:

• New Prohibitions on using the basis of race, color, national origin, or sex, or any combination thereof, of the applicant, as characteristics in determining eligibility for the SPCP.  
• New standards that permit SPCPs' use of religion, marital status, age, or income derived from a public assistance program as eligibility criteria, subject to certain conditions. In particular, the CFPB will now require SPCP written plans to:
  • Provide evidence of the need for the SPCP and must include that the consumers involved would effectively be denied credit if in the absence of the SPCP they “would not receive” such or similar credit, irrespective of whether the consumers had actually applied for such credit or had actually been denied such credit by a creditor.
  • Explain why, under the for-profit organization's standards of creditworthiness, the class of persons would not receive such credit in the absence of the program.

Note: The new conditions for the written plan will apply irrespective of whether the SPCP requires its participants to share a common characteristic that would otherwise be a prohibited basis.

Compliance Date. The final rule goes into effect on July 21, 2026. With regard to SPCPs, the CFPB permits creditors that have extended credit prior to the effective date under existing SPCPs to comply with the SPCP rule in place at the time the SPCP was established and SPCP credit was extended. However, SPCP credit extended on or after July 21, 2026, must comply with this final rule.