Financial & Corporate Compliance June 24, 2026

From risk to recalibration: Insights on Section 1071 from industry leaders

Key Takeaways

  • Financial institutions should reassess scope, reuse prior implementation work, and start optional early data collection ahead of the 2028 deadline to test processes and systems.
  • Strong governance models, cross-functional alignment, and investment in modern data and lending infrastructure are key to successful Section 1071 implementation.
  • Even with fewer required data fields, fair lending risks remain, so institutions must maintain robust analytics, monitoring, and flexible systems for future regulatory changes.
How leading institutions are staying ahead of the compressed timeline

The CFPB’s final Section 1071 rule may have reduced reporting requirements, but it continues to raise important concerns for financial institutions on implementation efforts, technology readiness, fair lending monitoring, and regulatory uncertainty.

In a recent moderated panel discussion, Unlocking the new Section 1071 rules: Impact, risks, and action plans, Wolters Kluwer gathered industry experts to discuss how their organizations are adapting to the final rule. 

Moderated by Jason Keller, Director of Market Strategy for Compliance Analytics at Wolters Kluwer,

  • Elena Babinecz, former CFPB Section 1071 manager and current Shareholder at Baker Donelson
  • Chelsea Shenton, Senior Vice President, Compliance Director for CRA Oversight/1071Implementation at KeyBank
  • Melinda Lawrence, Senior Vice President, Head of Consumer and Small Business Compliance at First Citizens Bank
  • Vivek Saraswat, Senior Vice President, Compliance Director, Truist

Their discussion surfaced four common themes: recalibrating scope, strengthening governance, maintaining visibility into risk, and building programs designed to adapt to future change.

“Don’t wait,” said Babinecz. “This rule may very likely go into effect, so you just want to be ready.”

Strategy and recalibration: Redefining scope and priorities

The final rule presents a new challenge: determining what work should be retained, adjusted, or shelved.

Melinda Lawrence of First Citizens Bank encouraged institutions to take inventory of what has already been completed and what remains relevant under the revised requirements.

“It’s important from an institutional perspective to make sure that you’re taking stock in what you currently have, where you’re at,” Lawrence said. “Are the business units that were in scope before, are they currently in scope now?”

 

At First Citizens Bank, discussions have centered on a November 2027 target date to avoid year-end IT freezes and implementation constraints.

Institutions are encouraged not to view January 1, 2028 as an operational go-live date but instead take advantage of optional early data collection. This period can be used to validate processes, assess training effectiveness, perform QA/QC reviews, and make necessary adjustments before mandatory compliance begins.

Removed reporting fields may still provide value as well. While pricing information and denial reasons are no longer required reporting elements, these fields may may still support fair lending analysis, adverse action notice requirements, and future regulatory flexibility.

Rather than starting from scratch, institutions may focus on:

  • Determining which business units remain subject to reporting requirements
  • Revisiting previously paused implementation initiatives
  • Reassessing vendor, technology, and resource plans
  • Evaluating how changes to gross annual revenue thresholds affect scope

Execution and modernization: Building governance models that support execution

According to Chelsea Shenton of KeyBank, the conversation has shifted from implementing Section 1071 to governance.

Governance structures developed under the previous rule may need to be revisited. However, Shenton cautioned against spending too much time searching for a perfect model. “I don’t think there’s a one-size-fits-all model for governance. You have to think about your organization and your existing governance processes — your risk committees, change management processes, and regulatory processes.”

Organizations may benefit from evaluating whether existing governance structures still align with the revised scope of the rule while maintaining clear ownership and accountability. Institutions that were already considering investments in online applications, origination platforms, data governance, or infrastructure may find that regulatory implementation provides additional momentum for those initiatives.

Section 1071 implementation creates opportunities for:

  • Modernizing lending operations
  • Re-engaging governance committees and executive sponsors
  • Aligning compliance, legal, business, and technology teams
  • Revisiting governance models established under the prior rule
  • Establishing clear ownership and accountability

Analytics and risk management: Looking beyond reporting requirements

Fewer data points for collection do not mean a respite from regulatory or fair lending risk.

“This has resulted in a collective sigh of relief from many, including myself,” says Vivek Saraswat of Truist. “But this is also leading to this dangerous assumption that this somehow reduces the compliance risk.”

Underlying risks associated with underwriting exceptions, discretionary pricing, and steering have not disappeared simply because they are no longer included in required reporting. The Equal Credit Opportunity Act (ECOA) remains unchanged, and institutions may still need to understand and defend their lending practices beyond what appears in Section 1071 submissions.

At Truist, the focus has shifted from reporting requirements to portfolio risk management. The institution plans to augment collected 1071 data with proxy data and additional internal analysis to strengthen fair lending risk oversight.

Saraswat also highlighted the close relationship between CRA and Section 1071 data, noting that institutions may benefit from ensuring their data quality, governance, and analytical capabilities support both obligations.

Several areas that institutions may want to continue monitoring or maintaining include:

  • Underwriting and approval disparities
  • Fair lending analytics
  • Section 1071 and CRA data strategies
  • Robust firewall controls

Designing for durability: Building for future regulatory change

Although institutions are focused on today’s implementation requirements, panelists repeatedly emphasized the importance of preparing for tomorrow’s regulatory environment.

Rather than viewing the final rule as the finish line, industry leaders discussed the importance of building programs that can evolve alongside future regulatory, supervisory, or state-level changes.

Areas of focus may include:

  • Building scalable data architectures
  • Maintaining flexibility to add future data fields
  • Preserving implementation documentation and decision rationale

Saraswat encouraged institutions to keep future adaptability in mind as they design their programs. “Design your solution with that flexibility in mind that’ll allow you to scale up as the rule scope changes in the future.”

Successful Section 1071 programs may require more than compliance with today’s requirements. Reassessing scope, strengthening governance, maintaining visibility into fair lending risk, and building adaptable processes may help institutions navigate the 2028 implementation timeline — and whatever comes next.

This material is provided for informational purposes only and does not constitute, and is not intended to substitute for, legal, compliance, or other professional advice.

Frequently asked questions

  • How should financial institutions recalibrate their Section 1071 readiness plans?
    Institutions should reassess their data collection processes, reporting workflows, governance frameworks, staff training, technology capabilities, and quality-control procedures to ensure they can support ongoing Section 1071 compliance. A successful readiness strategy includes clear ownership of data, automated validation controls, documented procedures, and continuous monitoring of reporting quality and regulatory risk.
  • What changed in Section 1071 requirements?
    Section 1071 introduced small business lending data collection and reporting requirements designed to increase transparency and support fair lending oversight. Covered financial institutions must collect, maintain, and report standardized data about small business credit applications, lending decisions, applicant demographics, and business characteristics. These requirements have expanded compliance, operational, data management, and governance responsibilities for many lenders.
  • How does Section 1071 affect fair lending monitoring?
    Section 1071 provides regulators and financial institutions with greater visibility into small business lending activity and applicant demographics. The reported data can be used to identify potential lending disparities, evaluate access to credit, support fair lending reviews, and detect patterns that may warrant further analysis or investigation.
  • What are the biggest Section 1071 compliance risks?
    Common Section 1071 compliance risks include incomplete data collection, inconsistent reporting practices, poor data quality, inadequate governance controls, insufficient employee training, ineffective exception management, and limited visibility into lending patterns. Institutions that proactively address these risks can improve reporting accuracy and strengthen regulatory readiness.
  • How can financial institutions improve regulatory reporting readiness?
    Regulatory reporting readiness improves when institutions maintain accurate data, document compliance procedures, implement validation controls, monitor exceptions, and establish repeatable review processes. Strong governance and reporting practices help organizations respond more effectively to regulatory inquiries, examinations, and audits.
  • Why is data quality critical for Section 1071 compliance?
    Data quality is essential because regulators rely on reported information to evaluate lending activity, assess fair lending risk, and monitor market access for small businesses. Inaccurate or incomplete data can lead to reporting errors, examination findings, operational inefficiencies, and elevated compliance risk. Robust validation and quality-control processes help ensure reliable reporting outcomes.
  • How can analytics help identify Section 1071 reporting and fair lending risks?
    Analytics can help identify reporting anomalies, data-quality issues, demographic trends, approval-rate disparities, and geographic lending patterns that may indicate potential compliance concerns. By providing early visibility into potential issues, analytics enable institutions to investigate exceptions, prioritize remediation efforts, and strengthen risk management programs.________________________________________
  • What data must be collected under Section 1071?
    Covered institutions must collect information related to small business credit applications, including application information, action taken, pricing data, credit purpose, business characteristics, and demographic information required under the rule. Accurate collection, validation, and reporting of these data elements are critical for compliance.
Solutions

Small Biz Wiz

Simplify Section 1071 data collection, reporting, and analysis with an integrated solution.
Learn More

Speak to a subject matter expert

Related Insights

  • Webinar
    Financial & Corporate Compliance
    Updated August 20, 2026

    Reduce collateral risk and accelerate agricultural loan decisions

    Learn how agricultural lenders can streamline borrower onboarding, improve collateral risk management, and accelerate lending decisions with AI.
    Learn More
  • Article
    Financial & Corporate Compliance
    July 02, 2026

    From spreadsheets to smart workflows: How CRA teams are using automation to do more with less

    For CRA compliance teams, the pressure is constant: more data, more documentation, and higher expectations from regulators, often without additional resources.
    Learn More
  • Article
    Financial & Corporate Compliance
    April 03, 2026

    The decline of the bank exam: How continuous data feeds can rewrite US supervision by 2028

    By 2028, continuous supervisory data feeds will displace the traditional 12–18‑month safety‑and‑soundness exam for large US banks, turning regulatory oversight into an always‑on, data‑engineering audit rather than a backward‑looking file review.
    Learn More
  • Article
    Financial & Corporate Compliance
    February 04, 2026

    Wolters Kluwer Q1 2026 banking compliance AI trend report

    Wolters Kluwer shares insights from a survey of 148 financial institutions on AI adoption, data readiness, and regulatory challenges in banking. Download the Q1 2026 Banking Compliance AI Trend Report for analysis and recommendations.
    Learn More
Back To Top