CFPB’s Section 1071 Reset Leaves MCAs Outside Reporting. Underwriters Still Need an Evidence Trail
The CFPB finalized a narrower Section 1071 rule that excludes merchant cash advances from covered-credit reporting. MCA operators still need clean file evidence for underwriting, broker oversight, servicing, diligence, and future scrutiny.
The CFPB has finalized a narrower version of its small-business lending data rule, and merchant cash advances are now outside the Section 1071 reporting perimeter. For MCA funders, ISOs, and embedded-finance teams, that removes a major federal data-collection obligation for now. It does not remove the need to prove how a file was marketed, priced, underwritten, and collected. The practical question is no longer only, “Do we have to report this to the CFPB?” It is, “If a regulator, bank partner, capital provider, or plaintiff asks how this deal was originated and serviced, can we show the record without rebuilding it by hand?” “This final rule therefore excludes merchant cash advances (MCAs), agricultural lending, and small dollar loans from the definition of covered credit transaction.” Consumer Financial Protection Bureau final rule, Small Business Lending Under ECOA/Regulation B What changed in the final rule The CFPB’s final rule, scheduled for Federal Register publication on May 1, 2026, revises the small-business lending data rule under ECOA and Dodd-Frank Section 1071. The agency says the changes are meant to narrow the first version of the collection around core products, larger reporters, and fewer data fields. For the MCA market, the headline is direct: the final rule adds MCAs to the list of excluded transactions. The CFPB defines the excluded product as an agreement where a small business receives a lump-sum payment in exchange for the right to receive a percentage of future sales or income up to a ceiling amount. Industry trade publication deBanked summarized the effect plainly: MCAs are excluded from the final small-business loan data collection requirements, and the prior CFPB proposal to exclude them is now final. “Since MCAs are not covered credit transactions under this final rule, no MCA providers will be required to report.” Consumer Financial Protection Bureau final rule, impact analysis for nondepository institutions What did not change: scrutiny of the operating record The exclusion is important, but it should not be read as a full compliance holiday. State sales-based-financing disclosures, unfair or deceptive acts and practices theories, bank-partner oversight, capital-provider diligence, servicing controls, and recharacterization disputes still turn on evidence. The evidence usually lives in the same places: broker submissions, bank-connect data, offers, contracts, renewal history, debit behavior, hardship notes, and collection communications. The CFPB also did not promise that product coverage is frozen forever. The final rule says the Bureau “may revisit the scope of its coverage of credit products in future rulemakings.” That matters for operators building systems today. A clean audit trail is cheaper to keep as part of normal workflow than to reconstruct after policy changes, litigation, portfolio sale diligence, or a bank review. Opinion Treat the exclusion as a reporting change, not a controls strategy The stronger operating model is to keep the file-level discipline even when a specific federal reporting field drops away. MCA providers that can show source-of-lead, consent, business-purpose evidence, revenue basis, payment history, modification logic, and collection notes will be better positioned with banks, investors, auditors, and counterparties than providers that simply stop collecting structured records. Operator impact by team The rule change affects teams differently. Compliance teams may have less immediate federal reporting work for MCAs. Underwriting and servicing teams still need consistent file evidence. Broker-channel teams need a clearer record of how deals entered the funnel and what the merchant was told. Team What the final rule changes What should stay controlled Compliance MCA files are outside Section 1071 covered-credit reporting under the final rule. Maintain state disclosure evidence, complaint records, consent history, and policy exceptions. Underwriting Pricing and denial reason fields removed from the federal collection do not need to be mapped for MCA reporting. Keep consistent cash-flow inputs, revenue assumptions, offer versions, renewal logic, and adverse-file notes. Broker / ISO operations The reporting burden may not sit on MCA originations, but channel quality remains visible through disputes and portfolio performance. Track source, submission package, merchant communications, stacked positions, and post-funding complaints. Capital markets Investors may not receive a CFPB 1071 data trail for MCA portfolios. Expect diligence requests for standardized tapes, vintage performance, concentration, returns, modifications, and collections behavior. A file checklist for MCA operators after the 1071 reset A practical MCA control file should answer five questions without a Slack search, spreadsheet hunt, or broker-email archaeology: Where did the application come from? Capture ISO, sub-ISO, campaign, referral, consent, and the submission package received. What business activity supported the offer? Preserve bank-connect results, statements, processor data, revenue normalization, seasonality notes, and negative-balance logic. What was presented to the merchant? Version contracts, disclosures, renewal offers, payoff estimates, and any broker-facing term sheets. What changed after funding? Track debits, holds, split changes, modifications, reversals, hardship requests, and renewal decisions. How was the account serviced or collected? Keep contact logs, call notes, notice history, complaint handling, UCC activity, and settlement authority. Why Plutus readers should care Plutus readers live where underwriting, broker intake, fraud checks, and portfolio controls meet. The CFPB’s final rule reduces one expected reporting path for MCAs, but it also makes internal data quality more important. When there is no single federal dataset to lean on, funders and partners need their own normalized operating record. That record is useful beyond compliance. It helps underwriters compare files consistently, helps funders spot broker-channel drift, helps servicing teams explain outcomes, and helps capital providers diligence portfolios without turning every review into a manual reconstruction project. Bottom line The Section 1071 final rule is a real regulatory reset for MCAs. No MCA provider is required to report under the final rule because MCAs are not covered credit transactions. The better response is not to relax file discipline. It is to use the breathing room to make the evidence trail cleaner, easier to review, and ready for the next diligence or policy cycle.