CFPB 1071 Reporting Workspace for Smaller Lenders

Analysis

CFPB 1071 Reporting Workspace for Smaller Lenders

One-line thesis

Build a Section 1071 / Regulation B workspace for covered community lenders that turns messy small-business-loan application data into validated filing files, exception queues, audit packets, and board-ready fair-lending reports—priced below enterprise LOS/GRC suites.

Opportunity takeaway

This is a real but narrower-than-it-first-looked opportunity. The 2026 CFPB final rule materially reduced scope: the current compliance date is January 1, 2028; the covered-lender threshold is now 1,000 covered small-business credit transactions in each of calendar years 2026 and 2027; the small-business gross annual revenue threshold is now $1 million or less; merchant cash advances, agricultural lending, small-dollar loans, Farm Credit System lenders, denial reasons, pricing information, number of workers, application method, and application recipient were removed from the rule. That knocks out the smallest community banks, many CDFIs, and some of the most painful original data fields.

The remaining opportunity is not “every small lender needs 1071 software.” It is “mid-sized community banks, credit unions, CDFI banks/credit unions, fintech SMB lenders, and consultants serving lenders that still cross 1,000 transactions need a lightweight system of record around CFPB collection, validation, geocoding, demographic/firewall workflow, submission, remediation, and audit evidence.” The wedge should sit between spreadsheets/manual compliance projects and full Ncontracts/Wolters/Abrigo-style compliance suites.

ICP

Best initial ICP:

• Covered community banks and credit unions that originate at least 1,000 covered small-business credit transactions in both 2026 and 2027, especially those with commercial lending teams, branch-driven intake, and limited compliance staff.
• CDFI banks and CDFI credit unions above the threshold; non-depository CDFIs are more mixed after the higher threshold, but some fintech/CDFI lenders may still qualify.
• Loan-origination, compliance, and fair-lending consultants who must help multiple institutions run readiness assessments, data mapping, QA, and exam prep.
• Fintech SMB lenders not already deeply integrated into enterprise compliance reporting stacks.

Avoid as first ICP:

• Very small community lenders below the new 1,000-transaction threshold.
• Farm Credit System lenders, agricultural-only lenders, MCA-only funders, and small-dollar lenders excluded by the 2026 final rule.
• Institutions that already use integrated enterprise compliance suites and will simply buy a module from their incumbent vendor.

Pain evidence

• First-party implementation signal is strong: the CFPB has a dedicated 1071 hub, compliance resource page, and filing-instructions-guide area. The 2023 final rule created collection/reporting, demographic shielding/firewall, recordkeeping, privacy, and filing mechanics; the 2026 final rule revised but did not eliminate the regime.
• The 2026 Federal Register final rule says the Bureau is revising coverage, credit transactions, data points, collection method, and compliance date to “streamline the rule” and “reduce complexity,” which is itself evidence that operational complexity was substantial.
• Trade groups described the original rule as burdensome. ICBA said the rule would require community banks to burden small-business customers with invasive questions and collect data beyond what Congress mandated. America’s Credit Unions said the original rulemaking was significantly burdensome, while welcoming the 2026 revisions as burden-reducing.
• Vendor pages are already selling into the pain. Ncontracts markets N1071 around direct transmittal to CFPB, expert training content, automated geocoding and edit checks, sample policies/procedures, fair-lending/redlining analytics, and reduced manual tracking. Wolters Kluwer markets Small Biz Wiz as collecting demographic data and required loan information, sending data into a workspace to input remaining details, geocode, edit, analyze, and submit.
• Cost pain is explicit. Ncontracts cites ABA-estimated implementation and ongoing-cost ranges: policies/procedures $2,500-$4,200 vs. $4,600-$234,000; staff/third-party training $3,500-$5,300 vs. $13,000-$594,000; ongoing geocoding $139-$300 vs. $3,500-$207,000; and transferring to 1071 data-management software $0-$1,000 vs. $10,000-$260,000, varying by lender size. It also says lenders with $500M-$999M in assets may spend about $43,000 on policies/procedures, training, exam prep, geocoding, and transfer to data-management software.
• Workflow pain remains even after narrowing: covered institutions must decide coverage, identify covered applications, collect applicant-provided ownership/demographic data in a compliant way, shield protected demographic information from credit decisionmakers unless an exception/notice applies, geocode, run edit checks, remediate bad records, produce submission files, keep evidence, and explain readiness to management, board, examiners, or auditors.
• Denial-reason coding was a real original-rule pain but is no longer a current-rule wedge: the 2026 final rule removed denial reasons and pricing information. A product that leads with denial coding would look stale. However, action taken, application dates, credit type/purpose/amount, census tract, gross annual revenue, NAICS, time in business, number of principal owners, minority/women-owned status, and principal-owner demographic formatting still create data-governance work.

Why now

• The current clock is visible: the 2026 final rule is effective June 30, 2026 and sets a single compliance date of January 1, 2028 for all covered financial institutions that remain covered. The 2026/2027 lookback years determine whether a lender crosses the 1,000 covered-transaction threshold.
• The rule has shifted from “maybe stayed/litigated” to “re-scoped but still alive.” That creates a fresh planning window: institutions need threshold analysis now, vendor/LOS data mapping in 2026-2027, pilot collection/testing in 2027, and production compliance by 2028.
• Existing vendors are educating the market, which lowers category-creation risk. But quote-based enterprise modules can leave space for a focused readiness and QA layer, especially for consultants and institutions that do not want to replace or deeply reconfigure their LOS.
• The narrowing creates a sharper wedge: serve only the lenders that remain covered and help everyone else document non-coverage/readiness cheaply. A “coverage calculator + data-quality readiness audit” can generate leads long before the full workspace is needed.

MVP

Weekend-to-first-customer MVP:

1. Coverage and data-map assessor

• Import prior two years of small-business lending records from CSV/LOS export.
• Classify likely covered vs excluded transactions under the 2026 rule.
• Estimate whether the institution crosses 1,000 covered credit transactions in 2026 and 2027.
• Produce a management memo: “covered / likely not covered / needs review,” assumptions, excluded product categories, and data gaps.

2. 1071 data workspace

• Canonical record schema aligned to the current filing instructions and 2026 rule.
• CSV upload, field mapping, validation rules, missing-field queue, duplicate detection, and record-level notes.
• Geocoding queue and edit-check status.
• Protected demographic data workflow: applicant-facing collection forms or import fields, firewall/role controls, exception notice tracking, and audit log.

3. Remediation and audit packet

• Exception queues by branch, lender, product, and missing field.
• “Ready to submit” report, validation-error export, and signed-off remediation log.
• Board/audit pack: coverage threshold analysis, collection policy checklist, training completion upload, data-quality metrics, and fair-lending dashboard-lite.

4. Submission helper

• Generate CFPB-ready filing file or at minimum a validated staging export that can be loaded into the official filing process or incumbent system.

Do not build a full loan-origination system, underwriting workflow, or enterprise fair-lending analytics product first. The wedge is data collection, validation, remediation, and evidence—not replacing the LOS.

Distribution wedge

• Free “2028 Section 1071 coverage calculator” for community lenders: upload anonymized counts by product/year and get a board-ready threshold memo.
• Partner with compliance consultants, fair-lending consultants, and LOS implementation consultants who need a repeatable 1071 readiness workbench across clients.
• Publish practical implementation templates: data dictionary, firewall workflow checklist, lender training checklist, board-readiness deck, and “what changed in the 2026 final rule” cheat sheet.
• Sponsor/webinar through state banking associations, CDFI associations, credit union leagues, and compliance education channels.
• Lead with “avoid overbuying an enterprise suite before you know whether you are covered” for sub-enterprise lenders; lead with “multi-client remediation console” for consultants.

Competition / substitutes

• Ncontracts N1071: purpose-built compliance module with direct CFPB transmittal, training content, automated geocoding/edit checks, sample policies/procedures, and advanced fair-lending/redlining analytics. Pricing is not public; demo-led enterprise/GRC motion. Ncontracts’ own cost article implies 1071 data-management software transfer costs can range from $10,000 to $260,000 depending on institution size.
• Wolters Kluwer Small Biz Wiz / 1071 Small Data Interface: enterprise compliance workflow tied to ComplianceOne, ARTA Lending, and TSoftPlus integrations; collects demographic and loan information, sends to Small Biz Wiz for details/geocoding/editing, supports analysis and submission. Pricing is quote-based.
• Abrigo 1071 resources and likely compliance/lending stack: strong incumbent in community financial institutions; can bundle education, consulting, loan review, credit/fair-lending workflows, and existing relationships. Pricing not public.
• RATA Associates and fair-lending/HMDA/CRA consultants: consulting-led substitutes for readiness, geocoding, analysis, and exam prep.
• LOS/core vendor modules: many lenders will ask their current LOS/core to add fields and reports rather than buy a standalone system.
• Spreadsheet + consultant + CFPB filing tools: likely default for institutions near the threshold or trying to minimize spend.

Gap that remains:

• A focused, low-friction, upload-first 1071 readiness and remediation workspace priced below enterprise modules, especially for consultants and institutions that need data-quality control without replacing the LOS. The product must be current-rule-aware; many published checklists are now stale because they still emphasize removed 2023 data fields.

Risks

• Scope reduction shrank the market. Raising the threshold from 100 to 1,000 covered transactions and excluding several product categories removes many of the smallest community lenders and CDFIs from mandatory compliance.
• Regulatory volatility remains. The rule has already gone through litigation, stays, an interim extension, and a 2026 reconsideration. Buyers may wait until late 2027 unless they are clearly covered.
• Incumbents have distribution. Ncontracts, Wolters Kluwer, Abrigo, LOS providers, and consultants already own trust and can bundle 1071 features.
• Current filing instructions may be updated after the 2026 final rule. A product must track CFPB spec changes or it becomes compliance risk.
• Data access is messy. Small lenders may have fragmented commercial loan data across LOS, spreadsheets, branch notes, and core systems. Upload-first MVP helps, but integrations become important.
• Security and trust expectations are high because the product touches loan applications and protected demographic information. Even a lightweight product needs access controls, audit logs, encryption, retention controls, and careful vendor-risk documentation.

Recommended product positioning

“Section 1071 readiness and filing QA for community lenders. Import LOS exports, confirm coverage, find missing/invalid CFPB fields, manage protected demographic workflows, and produce audit-ready board and examiner packets before the 2028 deadline.”

Self-critique

• The biggest uncertainty is market size after the 2026 final rule. The 1,000-transaction threshold may exclude many of the community banks/CDFIs that would have been most desperate for a cheap tool.
• I found strong first-party rule evidence and vendor/trade-group evidence, but less direct buyer-language from individual compliance officers complaining in forums. The pain is inferred from regulatory complexity, trade association statements, and vendors selling modules rather than many public operator complaints.
• Competitor pricing is mostly non-public. The best hard cost evidence is Ncontracts’ article quoting ABA-estimated compliance cost ranges, not public SaaS seat pricing.
• Because the current rule removed denial reasons and pricing information, any MVP spec must avoid stale 2023-rule assumptions. The report intentionally demotes denial-reason coding from current wedge to “historical/original-rule pain.”
• Public CFPB pages were not directly extractable from this runtime due to 403 responses, so first-party details were verified through Federal Register API/text and search-index snippets pointing to CFPB hubs/resource pages. The Federal Register source is authoritative for the final rule text.

Concise sources

• CFPB 1071 hub — https://www.consumerfinance.gov/1071-rule/
• CFPB compliance resources: Small business lending collection and reporting requirements — https://www.consumerfinance.gov/compliance/compliance-resources/small-business-lending-resources/small-business-lending-collection-and-reporting-requirements/
• CFPB filing instructions guide page — https://www.consumerfinance.gov/data-research/small-business-lending/filing-instructions-guide/
• Federal Register: 2026 final rule, Small Business Lending Under ECOA / Regulation B — https://www.federalregister.gov/documents/2026/05/01/2026-08494/small-business-lending-under-the-equal-credit-opportunity-act-regulation-b
• Federal Register: 2023 final rule, Small Business Lending Under ECOA / Regulation B — https://www.federalregister.gov/documents/2023/05/31/2023-07230/small-business-lending-under-the-equal-credit-opportunity-act-regulation-b
• Ncontracts: 1071 Compliance Software for Small Business Lending — https://www.ncontracts.com/products/1071-compliance-software
• Ncontracts: Managing 1071 Costs — https://www.ncontracts.com/nsight-blog/managing-1071-costs
• Wolters Kluwer: 1071 Small Data Interface / Small Biz Wiz — https://www.wolterskluwer.com/en/solutions/wiz/small-biz-wiz/1071-small-business-data-interface
• America’s Credit Unions: CFPB issues revised 1071 rule — https://www.americascreditunions.org/news-media/news/cfpb-issues-revised-1071-rule
• ICBA: Failure to exempt community banks in final 1071 rule raises privacy concerns — https://www.icba.org/w/icba-to-cfpb-failure-to-exempt-community-banks-in-final-1071-reporting-rule-raises-significant-privacy-concerns
• Congressional Research Service: Section 1071: Small Business Lending Data Collection and Reporting — https://www.congress.gov/crs-product/R47788