The Consumer Financial Protection Bureau has quietly reshaped one of its most contentious small-business lending rules, reversing course on data-collection mandates that had alarmed community lenders and fintech infrastructure providers alike. The final rule, effective in 2028, reduces the number of reportable data points from an earlier expansive framework down to 13—a material contraction that signals a pivotal shift in the agency's approach to market transparency and regulatory burden.
What began as an ambitious effort to illuminate small-business lending markets through granular borrower data collection has become a studied exercise in regulatory compromise. The earlier proposal had sought to capture far more granular information from lenders, creating a burdensome reporting regime that threatened to upend compliance calendars across the fintech and BaaS lending ecosystem. The narrowed scope—now 13 core data points rather than the broader matrix initially mooted—reflects political pressure, industry pushback, and the incoming regulatory climate under the Trump administration.
The rule's lending threshold has also been recalibrated upward, which has profound implications for the regulatory footprint of smaller financial institutions. By raising the origination volume at which lenders must comply, the CFPB has effectively excused most community banks, credit unions, and emerging fintech platforms from the reporting obligation. This exemption threshold is critical: it means that mid-market BaaS platforms and regional lenders will avoid the compliance infrastructure investment that a broader mandate would have necessitated. For larger players—the JPMorgan Chase tier and major online lenders—the reporting remains mandatory but at a materially reduced grain of detail.
The timing and scope of this retreat warrant scrutiny. The CFPB under Rohit Vought's influence at the Office of Management and Budget has signalled a measured deregulation posture, and this small-business rule epitomises that calculus. The agency has not abandoned transparency ambitions entirely; rather, it has calibrated them to a level that preserves core market-monitoring functions while relieving compliance costs from institutions where the burden-to-benefit ratio was most acute. This is pragmatism dressed as principle.
For the fintech lending infrastructure sector, the implications are mixed. Platforms that have already built data-collection and reporting pipelines will find their engineering investment partially stranded. Conversely, newer entrants may now face a less punitive compliance environment. Core banking systems and BaaS providers will need to audit their data schemas and reporting modules to align with the 13-point standard rather than maintaining flexibility for a hypothetical expanded regime. The reprieve, in other words, comes with administrative friction.
The rule also reflects a deeper institutional question about whether lending transparency mandates can be crafted in ways that do not impose disproportionate costs on smaller competitors. The CFPB's original impulse—to create a richer information ecosystem around small-business loan terms, pricing, and outcomes—was sound public policy. The execution, however, had overextended the agency's reach relative to the actual regulatory benefit. By narrowing the mandate and raising thresholds, the CFPB has implicitly acknowledged that transparency gains must be weighed against operational feasibility. This principle applies across all regulatory domains: compliance frameworks must be proportionate to firm size and actual market risk.
What this means for the broader regulatory landscape is clearer: the era of expansive data-collection mandates at the expense of operational coherence is receding. The Federal Reserve, Office of the Comptroller of the Currency, and FDIC are likely to take note. Compliance roadmaps for 2026–2028 should be revised downward. For fintech lenders and BaaS operators who have been hedging their reporting infrastructure against an uncertain regulatory future, this clarification offers welcome closure—though not the closure they might have hoped for two years ago.
Written by the Codego Press editor — independent banking and fintech journalism powered by Codego, European banking infrastructure provider since 2012.
Sources: Banking Dive · 1 May 2026