Market Signals

    CFPB's Regulation B Rewrite Puts Underwriting Controls Back in Focus

    The CFPB's April 2026 Regulation B final rule narrows parts of the federal fair lending framework, but funders, ISOs, and specialty finance operators still need documented underwriting logic and explainable exceptions.

    8 min readRegulation BUnderwriting controlsFair lendingSpecialty finance
    Editorial fintech desk with regulatory binder, underwriting checklist, financial statements, and compliance review materials

    The CFPB published a final rule on April 22, 2026 that changes core parts of Regulation B, the rule that implements the Equal Credit Opportunity Act. For banks and fintech lenders, the headlines are obvious: the Bureau says ECOA does not authorize disparate impact liability, narrows the discouragement standard, and changes the conditions for special purpose credit programs.

    For MCA funders, ISOs, brokers, and specialty finance operators, the practical lesson is narrower and more operational: do not read a deregulatory headline as permission to loosen underwriting discipline.

    Even if federal fair lending exposure changes, counterparties still care about documented decision logic. Bank partners care. Capital providers care. State regulators care. Buyers of portfolios care. So do merchants when a decision is challenged.

    This is not legal advice. The rule may be challenged, and the final operating answer will depend on product type, jurisdiction, partner model, and counsel review.

    What happened

    On April 22, 2026, the CFPB published a final rule amending Regulation B under ECOA. The Federal Register notice lists an effective date of July 21, 2026.

    “The Act does not provide that the “effects test” applies for determining whether there is discrimination in violation of the Act.”
    Federal Register, final rule
    AreaWhat changedWhy operators should notice
    Disparate impactThe CFPB states that ECOA does not provide for the effects test when determining discrimination under the Act.Lenders may see less federal pressure around outcomes-only claims, but this does not remove the need to monitor decision patterns.
    DiscouragementThe rule narrows prohibited discouragement to statements or images directed at applicants that would cause a reasonable person to believe credit would be denied or offered on worse terms because of a prohibited-basis characteristic.Marketing, broker scripts, intake forms, and decline explanations still need review.
    Special purpose credit programsThe rule adds tighter conditions for for-profit SPCPs and limits use of certain protected characteristics as eligibility criteria.Lenders with targeted programs need counsel-led review before assuming current plans remain compliant.

    A Baker Donelson analysis published April 23 noted that the CFPB finalized the proposal without material changes and that litigation is expected. That same analysis advised lenders to generally stay the course on fair lending compliance while reviewing special purpose credit programs.

    “The CFPB finalized its proposal without any material changes and has made the final rule effective on July 21, 2026.”
    Baker Donelson analysis

    The CFPB's separate Section 1071 small business lending rulemaking also remains in motion. That matters because underwriting, pricing, and application data remain part of the regulatory conversation even if Regulation B enforcement posture shifts.

    Why operators should care

    MCA and specialty finance operators do not live in one regulatory box. A funder may describe a product as a purchase of future receivables. A bank partner may treat a related program as credit. A broker may handle documents across both categories. A capital provider may diligence the entire workflow before renewing a facility.

    That means a change to federal Regulation B still touches day-to-day operations.

    Exceptions remain the risk center

    Most underwriting problems do not start with the written policy. They start with exceptions: one broker gets repeated approvals outside normal exposure limits, a merchant is declined for cash flow without a clear debt load calculation, or stips are waived for one channel but required for another.

    If a file later gets questioned, the operator needs more than a final offer. The operator needs the reasoning path.

    Broker conduct still matters

    The revised discouragement standard focuses on statements directed at applicants or prospective applicants. That makes broker and ISO communication more important, not less. Intake language, merchant-facing templates, website eligibility language, sales scripts, and decline explanations still deserve review.

    “A creditor shall not make any oral or written statement, in advertising or otherwise, directed at applicants or prospective applicants that the creditor knows or should know would cause a reasonable person to believe that the creditor would deny, or would grant on less favorable terms, a credit application by the applicant or prospective applicant because of the applicant or prospective applicant's prohibited basis characteristic(s).”
    Federal Register, revised discouragement standard

    Data discipline is becoming a market requirement

    The Section 1071 process is a reminder that small business finance is becoming more data-visible over time. Even where an operator is not currently covered, investors and bank partners may still ask for application timestamps, approval and decline reason codes, pricing fields, broker source, exception reason, and approver.

    “Section 1071 requires certain financial institutions to compile, maintain, and submit data to the CFPB about applications for credit by small businesses, women-owned businesses, and minority-owned businesses.”
    CFPB Section 1071 rulemaking page

    Practical implications for funders, ISOs, and brokers

    The near-term question is not whether to overhaul every policy. The question is whether your files can support the decisions your team is already making.

    Operating areaWhat to check this weekWhat good looks like
    Decision reasonsAre decline, approval, pricing, and routing reasons standardized?A reviewer can compare files without translating free-text notes.
    Bank statement analysisAre deposit adjustments, NSFs, negative days, and existing payments captured consistently?The cash flow story matches the offer and repayment burden.
    ExceptionsAre policy exceptions tagged with approver, reason, and supporting facts?Exceptions are visible in reporting, not buried in comments.
    Broker channelAre broker scripts and merchant-facing templates reviewed?Communications do not discourage applicants on prohibited bases and do not overpromise approvals.
    Partner diligenceCan a bank, warehouse lender, or buyer review a sample file cleanly?The file tells a coherent story without a live employee narrating it.

    Operator checklist

    • Confirm every no-offer or decline has a clear reason code.
    • Separate low revenue, unstable deposits, excessive existing debt, restricted industry, missing documents, and fraud concerns.
    • Record when an underwriter overrides system output or broker-provided assumptions.
    • Track who approved exceptions to exposure, term, frequency, position, or documentation requirements.
    • Review merchant-facing language for discouragement risk.
    • Keep broker notes separate from verified underwriting facts.
    • Do not let MCA proceeds, owner transfers, or one-time wires inflate operating revenue.
    • Save the version of the offer that the merchant actually received.
    • Review special programs with counsel before relying on protected-basis eligibility criteria.
    • Monitor outcomes by channel, product, industry, and geography even when not expressly required.

    What Plutus looks for in a stronger underwriting record

    A clean operating record connects the source document to the decision. An MCA file should be able to show the statement months reviewed, gross deposits by month, removed adjustments, negative days, NSFs, existing MCA or debt payments, requested amount, approved amount, payment estimate, term, factor rate, policy flags, human changes, exception reason, approver, and final merchant-facing outcome.

    This does not make a file risk-free. It makes the decision reviewable.

    Sources

    Final thought

    The CFPB's Regulation B rewrite may reduce certain federal fair lending theories, but it does not reduce the commercial value of disciplined underwriting records. Specialty finance operators win when they can move quickly without losing the thread of the decision. Fast files are useful. Fast files with clean data, clear exceptions, and reviewable reasoning are better.

    View all articles

    Market Signals

    Morgan Stanley maps $1.5 trillion AI data-center financing gap

    Morgan Stanley says AI data-center spending needs about $1.5 trillion of outside capital. The underwriting lesson is lease cash flow, power access and refinancing evidence, not AI demand alone.

    3 min readBy Plutus Editorialprivate creditAI infrastructuredata centersasset-based financesecuritizationmarket signals
    Abstract data-center financing desk with lease schedules, power card, private-credit folder and securitization folder.

    Morgan Stanley estimates that global data-center spending will reach $2.9 trillion through 2028. According to the bank's July research and an August 6 podcast, roughly $1.5 trillion of that total must come from outside capital. Private credit and asset-based finance could provide $800 billion of this gap. Another $150 billion could come via data-center asset-backed securities (ABS) and commercial mortgage-backed securities (CMBS).

    The data-center financing surge involves a complex credit structure. Morgan Stanley projects that $1.5 trillion in outside financing will be required by 2028. This shifts the focus from general growth to specific collateral, lease terms, power contracts, refinancing windows, and underwritable cash flows.

    Porter Stansberry noted these financing questions in an August 11 thread. Additional details appear in Morgan Stanley Research, Morgan Stanley's published podcast transcript, Moody's data-center credit-risk page, and L&G's securitized-credit analysis.

    Morgan Stanley breaks down the capital stack as follows: $1.4 trillion of hyperscaler capital expenditure will come from cash flow, $200 billion from investment-grade tech debt, $800 billion from private credit or asset-based financing, $150 billion from securitized credit, and $350 billion from other sources. In the podcast, Vishwas Patkar stated the $1.5 trillion gap exceeds the size of both the high-yield and leveraged-loan markets.

    Financing is moving into several different underwriting channels. Corporate bonds rely on a single large issuer. Private credit and asset-based finance rely on project cash flows, leases, collateral, construction progress, and specific lender protections. Securitization typically occurs after an asset is built, leased, and generating income.

    L&G noted this sequence in a February report on data-center securitization. The firm stated that most securitized issuance refinances existing income-generating assets instead of funding new construction. Data-center ABS and CMBS issuance exceeded $25 billion in 2025. L&G also identified a refinancing risk: many deals have a five-year repayment target. This makes the period between 2028 and 2030 a critical test if refinancing markets decline.

    Moody's analyzes this market through credit risk. Its data-center page states that developers and landlords will use equity, bank loans, corporate bonds, securitized bonds, and project-finance vehicles. Leverage will likely increase for developers building hyperscale facilities between 2026 and 2028. Moody's also notes that power, water, and development approvals act as constraints.

    For operators in merchant cash advance (MCA), revenue-based financing (RBF), or equipment finance, the parallel is found in repayment logic. Rapid demand can mask poor repayment structures. A lender might see a merchant with high revenue but miss that the cash flow relies on a single processor, a seasonal buyer, an expiring contract, a second-position lender, or a landlord dispute. Similarly, a data-center lender might see AI demand but overlook risks regarding power delivery, tenant renewals, lease increases, obsolescence, construction timing, or the exit market.

    The underwriting process requires identifying the revenue source, the constraints, hidden debt-like obligations, and the exit strategy. If a deal relies on refinancing, lenders must identify the specific future buyer and the evidence required to secure them.

    Crowding is also a factor. If private credit absorbs hundreds of billions in data-center finance, lenders will remain selective elsewhere. The insurance, pension, and private-credit buyers funding infrastructure also fund warehouse lines and asset-backed facilities. If these buyers concentrate on one theme, specialty-finance originators should expect more scrutiny regarding concentration, liquidity, documentation, and performance history.

    AI infrastructure is not inherently bad credit. If leases are durable, power is secured, the tenant mix is stable, and a refinance path exists, the assets may be attractive. However, AI demand is not collateral. Collateral consists of the contract, the operating asset, power access, tenant payments, and the market capable of refinancing the structure.

    Opinion

    The collateral test is more than just the building

    AI infrastructure credit depends on leases, power access, tenant concentration, and takeout markets, not just rising compute demand. Smaller finance desks face the same reality: high demand in a sector does not fix a weak credit file. It only increases the number of lenders asking for proof of cash flow.

    Plutus tracks how capital-market pressure reaches the underwriting file at plutusai.net.