Section 1071 Starts January 1, 2028: What Every DSCR Loan Application You Sign Will Now Send to Washington

On May 1, 2026, the Consumer Financial Protection Bureau published a final rule in the Federal Register that quietly redrew the data footprint of every small business loan in the United States. The rule implements Section 1071 of the Dodd-Frank Act, a 2010 statute that has been sitting on the CFPB's rulemaking docket for fifteen years. The rule's compliance date, after two prior delays, is now January 1, 2028. Lenders meeting the threshold must begin collecting demographic, financial, and underwriting data on every credit application from a small business, including the single-member LLC owned by an independent landlord who is applying for a DSCR loan on a fourplex. The first filing is due to the CFPB by June 1, 2029. The Bureau deferred aggregate-data publication timing to a future rulemaking — no definite publication date has been set.

Most small owners have not mapped this rule. The mortgage broker who calls in January 2027 to take a DSCR application has. The bank underwriting the loan is already updating its intake forms. The independent landlord who signs the application is the data subject, not the data collector, and is the one who absorbs the disclosure.

Section 1: Today's Lens — Section 1071 in Plain English for the Independent Landlord

Section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act amended the Equal Credit Opportunity Act in 2010 to require financial institutions to compile, maintain, and submit to the CFPB certain data on applications for credit for women-owned, minority-owned, and small businesses. The congressional purpose, as the CFPB restated in the May 1, 2026 final rule's general statement of policy, was to facilitate enforcement of fair lending laws and to enable communities, governmental entities, and creditors to identify business and community development needs and opportunities for women-owned, minority-owned, and small businesses. The Bureau's authority is the ECOA, which has been on the books since 1974 and already prohibits discrimination on the basis of race, color, religion, national origin, sex or marital status, age, or the fact that an applicant's income derives partly from public assistance.

The CFPB issued the original Section 1071 rule in March 2023. That rule defined a "covered financial institution" as a bank or nonbank lender that originated at least 100 small business loans in each of the two preceding calendar years. The compliance dates were originally tiered by lender size (verify the historical timeline in CFPB rulemaking documents before citing specific dates). Both original dates were extended more than once. The November 2025 proposed rule and the May 1, 2026 final reconsideration rule did three things that change the picture for the small landlord.

First, the rule raised the threshold for a "covered financial institution" from 100 to 1,000 covered credit transactions in each of two consecutive calendar years. The higher threshold narrows coverage modestly (the specific Mayer Brown coverage percentages could not be verified). For most community banks and credit unions the change is academic — they originate well under 100 covered small business loans annually. For DSCR-heavy nonbank lenders, the threshold change matters enormously, and the change is a deliberate narrowing of the rule's reach.

Second, the rule set a single compliance date for all covered financial institutions. Every lender meeting the threshold must begin collecting data on January 1, 2028. The first Small Business Lending Application Register is due June 1, 2029. There is no tiered rollout by lender size. The 1,000-loan-or-more bank, the 1,000-loan-or-more nonbank, the Farm Credit System institution, and the credit union above the threshold all begin on the same day. The grace period for technical compliance runs through December 31, 2028.

Third, the rule trimmed the data points the lender must collect on each application. The 2023 rule required race, ethnicity, sex, and several other demographic fields via a "live" interview. The 2026 final rule allows those demographic questions to be answered by the applicant on a voluntary basis using aggregated categories, removing the in-person interview requirement and eliminating several data points the 2023 rule had collected on the basis of "discretionary" collection. The 2026 rule is shorter, simpler, and easier to administer. It is also less granular, which means the discrimination-detection purpose of the statute is now achieved on a coarser dataset than the 2023 rule would have produced.

What the lender collects on a DSCR loan application from an independent landlord, starting January 1, 2028, is roughly the following. The lender records the application date, the loan type, the loan amount requested and approved, the interest rate, the term, the collateral, the loan purpose (acquisition, refinance, line of credit, other), and the census tract of the business or collateral property. The lender records the applicant's business structure (sole proprietor, partnership, LLC, corporation), the applicant's revenue bracket, the number of employees, and the "time in business." The lender asks the applicant to voluntarily provide race, ethnicity, and sex using aggregated categories — Asian, Black or African American, Hispanic or Latino, Middle Eastern or North African, Native Hawaiian or Other Pacific Islander, White, or "I do not wish to provide this information" — and the applicant's response is preserved as collected, even if the response is the refusal box. The lender does not ask immigration status. The lender does not ask the applicant to identify as a "minority-owned" business in a definitional sense; the applicant self-identifies or does not.

The data goes to the CFPB in a flat file twice a year after the first June 1, 2029 filing. The Bureau publishes the data in aggregate form, with census-tract-level aggregation that obscures individual loans but preserves enough demographic and geographic resolution for fair-lending analysis. The final rule deferred publication details to a future NPRM — no definite publication timeline has been set.

Section 2: One Market, One Metric — Charlotte, North Carolina, and the DSCR Lenders the New Threshold Leaves In

Charlotte, North Carolina is the second-largest financial center in the United States by assets after New York, and the headquarters or major operating hub for several of the largest DSCR rental lenders in the country. According to the CFPB's institutional coverage analysis in the May 2026 final rule, roughly 92 to 93 percent of small business loan originations are made by lenders that originate 1,000 or more covered credit transactions per year. Charlotte-based and Charlotte-area DSCR lenders — the firms that originate the bulk of the rental acquisition and refinance loans on small multifamily and single-family rental portfolios held by independent owners — are squarely inside the 1,000-loan threshold.

What that means in practice is that an independent landlord with a single LLC who applies for a DSCR loan in Charlotte in 2028 will have the application data submitted to the CFPB, aggregated into the published dataset, and made available to fair-lending researchers, community development organizations, journalists, and the lenders themselves once the Bureau finalizes publication timing. The landlord's identity is not published. The landlord's name, EIN, and personal identifiers are stripped before submission. The loan-level data the landlord is part of is aggregated with hundreds or thousands of other loans in the same census tract and reporting year.

The exposure the rule creates for the independent landlord is not at the loan level. The exposure is at the demographic and geographic level. If the published aggregate data shows that lenders in the landlord's census tract approved DSCR loans at one rate for applicants in one demographic category and a different rate for applicants in another, the dataset makes that pattern visible — and gives community groups, regulators, and reporters the same baseline the 2010 statute was designed to create. For most independent landlords the published dataset is benign and invisible. For the small minority of landlords applying at lenders who do discriminate, intentionally or unintentionally, the published dataset is the evidence the discrimination-detection purpose of the statute was designed to surface.

The Charlotte market is also the market where the rule's narrowing matters most for the lender side. Several nonbank DSCR lenders operating in Charlotte originate well over 1,000 covered credit transactions per year and will remain in the rule's coverage. Several mid-sized community banks that originate between 100 and 1,000 are now out. The compliance cost — building the data submission pipeline, training the loan officers, redesigning the application intake, filing the biannual register — falls on the larger nonbank lenders. The smaller banks keep their existing application flow. The independent landlord who shops between the two markets in Charlotte will see a different application form at a large DSCR lender than at a community bank, and that difference is the rule's only visible footprint on the borrower side.

Today's 5-Minute Action

Before your next DSCR or portfolio loan application, request the lender's current Section 1071 compliance status in writing. The question to ask the loan officer: "Is your institution a covered financial institution under Regulation B, subpart B, and what is your projected 2026 originations number?" A lender above the 1,000-origination threshold must begin collecting data January 1, 2028, and will update their intake forms and disclosures before then. A lender below the threshold has no federal data submission obligation, but the lender may still voluntarily collect and disclose the demographic data, in which case the question is whether the landlord wants to provide it. The five minutes it takes to email the loan officer and get a written answer is the five minutes that turns a federal compliance rule into a credit decision you actually understand.