CFPB 1071 Final Rule: Which Rental Lenders Report in 2028?

What the May 2026 rule changed

The 2023 version of the rule was broad: every lender with 100 small-business originations, every business with $5 million of revenue. The revised version, in the CFPB's words, starts "with a narrower scope". The changes that bear on a real estate investor are these.

The CFPB gave a reason for keeping rental purchases in scope. It said the $1 million threshold and the rule that lets a lender include an applicant's affiliates' revenue filter out large developers, "preserving the collection of data on small businesses that purchase small rental properties without the help of large affiliates". Its example is a developer with well over $1 million of revenue that forms a new single-purpose entity with no revenue to buy a property: the entity can be treated as not a small business. That sentence describes who counts as a small business. It does not bring a loan that HMDA already collects back into the count, and the next section shows why that matters.

The exclusion that decides it: HMDA covered loans

12 CFR 1002.104(b)(2) says the rule does not apply to “A covered loan, or application therefor, as defined by Regulation C, 12 CFR 1003.2(e).” Regulation C, the rule behind HMDA, defines a covered loan as a closed-end mortgage loan or open-end line of credit that is not an excluded transaction under 1003.3(c), and defines a dwelling to include “a multifamily residential structure or community”. Its exclusions are the other half of the answer.

Two conditions apply every time: the borrower has to be a small business ($1 million or less of revenue, with affiliates' revenue allowed to be added), and the lender has to count 1,000 such loans in each of 2026 and 2027. A DSCR loan to an LLC that buys or refinances a rental is the first row, not the second.

35 DSCR lenders: almost every business-purpose loan is an HMDA loan

Our DSCR lenders ranked by loans made page names the 35 largest lenders of DSCR-type loans in 2025 HMDA data. For this page we pulled each lender's 2025 originations from the FFIEC Data Browser by legal entity identifier and split the business-purpose loans (the HMDA field business_or_commercial_purpose equal to 1) by the loan purpose the lender reported. Purchase, home improvement, refinance and cash-out refinance are the HMDA-covered purposes.

HMDA 2025 originations of the largest investor lenders, by loan purpose (our arithmetic)

Read the table as the opposite of a list of who will report. Each of the 35 lenders in our DSCR ranking had at least 1,354 business-purpose purchase or refinance loans in 2025, so all 35 clear 1,000 in raw volume, yet under 12 CFR 1002.104(b)(2) those loans are the ones that do not count. Kiavi's 25,528 loans are all business-purpose and all coded purchase or refinance. Lima One's 2,379 and LendingOne's 2,519 are the same. Our DSCR pages (best DSCR lender, DSCR loan for an LLC) are about exactly these loans.

Lima One, Temple View, Anchor, CoreVest, Easy Street and Rain City are not among the 35 and are not in the total. Easy Street and Rain City sit in the bottom rows because every loan they reported is coded other purpose; the data do not tell us why.

The loans that could count: business loans coded "other purpose"

Regulation C excludes a business-purpose loan unless it is a home improvement, purchase or refinance. A lender that still reports a business-purpose loan as "other purpose" is therefore reporting something the regulation does not require, and whether that loan is a "covered loan" under 12 CFR 1003.2(e) is a legal question about the loan, not about whether the lender filed it. We cannot answer it from public data. What we can do is count how many such loans there are.

Nationwide, 624,151 loans originated in 2025 were coded other purpose, and 11,968 of them were business-purpose (our arithmetic). Three lenders made 7,592 of those, 63.4%.

Business-purpose loans coded "other purpose", HMDA 2025, and the share that would have to be small-business loans to reach 1,000 (our arithmetic)

The terms help read them. Easy Street's loans run 6 to 18 months with a median of 6, the profile of short-term construction or bridge financing, which Regulation C calls "Temporary financing" and excludes from HMDA (our reading). RCN's median is 360 months, a long-term loan coded other purpose, which we cannot classify. For all three, whether a loan is a Regulation C covered loan decides whether it counts toward 1,000. Better Mortgage is shown only because it passes 1,000 in raw count; 1,060 of its 1,228 loans are open-end lines of credit, not investor loans.

Worked example (our arithmetic). Easy Street reported 2,409 such loans in 2025. If 2026 and 2027 looked the same, it would need 1,000 of them, or 41.5%, to be covered credit transactions with small-business borrowers in each year. Under the affiliate rule a single-purpose LLC owned by a larger investor group can be treated as not small, which pushes the share down. If it ends 2026 under the line, the 2028 date does not apply to it, and 12 CFR 1002.114(b)(4) moves it to two consecutive years at 1,000 or more, no earlier than January 1, 2029.

Another group is invisible to HMDA entirely: banks and nonbanks that finance non-dwelling commercial property, and lenders whose loans never reach HMDA. Public data give no count for them.

Who the CFPB expects to report

The CFPB's own estimate is narrow. It puts the number of depository institutions that will report at 172 to 181 (167 to 176 banks and savings associations and 5 credit unions), and the number covered by the 2023 rule but not this one at 1,421 to 1,570. It says a threshold of 1,000 still captures about 92 to 93 percent of depository small-business loans by number, though the share by dollars is 60.3% to 62.0%.

For nonbanks it relies on an assumption, not a count: “only online lenders and merchant cash advance providers originate more than 1,000 loans each year and the remaining nondepositories originate between 150 and 999 loans each year.” Because merchant cash advances are no longer covered, it concludes “only online lenders will still be required to report”, which it puts at about 30. The 2023 rule would have covered about 610 nondepositories, among them about 240 commercial finance companies and 140 nondepository CDFIs. For a real estate borrower the practical point is that the rule is likelier to reach a bank with a large commercial book than a private lender, and that the CFPB did not treat investor lenders as a separate group.

Dates

What the data cannot tell us

• We cannot say which lender will report. The threshold counts covered credit transactions with small-business borrowers, and no public file counts those. HMDA shows only the loans the rule excludes and the ones lenders coded other purpose.
• A covered loan is defined by the loan. Regulation C's definition (12 CFR 1003.2(e)) looks at the loan, and we did not resolve from the text we saved how it applies to a loan by an institution that is not itself required to file HMDA.
• HMDA coding is the lender's. A loan coded other purpose may be a covered loan in law, and a loan coded purchase may be misdescribed. We report what was filed.
• Borrower size is not in HMDA. The $1 million revenue test, with affiliates' revenue, is applied by the lender from information the applicant gives.
• The rule is final but not frozen. The CFPB says it may amend the rule after early data collection. We did not check for new litigation or proposals after the rule's publication.
• Our lender list is the DSCR ranking. Visio Lending does not appear under that name in the 2025 filer list we read, so it is not in the table.

What a reader can do with this

1. If you borrow to buy or refinance a rental or apartment building from a lender that files HMDA, expect no change. The loan is a Regulation C covered loan and the rule excludes it. The 2028 rule does not count that transaction.
2. If you borrow for ground-up construction, a short bridge, land or an office, retail or industrial property, ask the lender whether it expects to be a covered financial institution. The rule lets a covered lender ask for the owners' ethnicity, race and sex and whether the business is minority-owned or women-owned; the lender must say it cannot discriminate on that basis “or on whether the applicant provides this information” and that you may refuse.
3. Know your entity's revenue. The $1 million test looks at the preceding fiscal year and lets the lender add affiliates' revenue. A new LLC with no revenue that is part of a larger group can be treated as not small.
4. Do not shop for a lender on this rule. It removed the pricing data point, and it changes what a lender reports to the government, not what it can charge. To see which lenders make the loans you want, use the 2025 filings in our DSCR lender ranking, the Easy Street and Kiavi comparison for construction and flips, and hard money lenders.
5. Correct the old assumption. Pages that call this rule the biggest uncertainty for DSCR lenders predate the final rule. For purchase and refinance loans on dwellings the HMDA exclusion answers the question.

The three lenders above are the ones we compare for investor loans. In 2025 HMDA data Kiavi and Lima One each reported only business-purpose loans coded purchase or refinance, so the rule's HMDA exclusion applies to the loans in this page's table.

FAQ

Sources, read and saved on November 3, 2026: the Federal Register final rule "Small Business Lending Under the Equal Credit Opportunity Act (Regulation B)", 91 FR 23530 (May 1, 2026), document 2026-08494, docket CFPB-2025-0040; the eCFR text of 12 CFR 1002.104, 1002.105, 1002.106 and 1002.114 and of 12 CFR 1003.2 and 1003.3, current to October 30, 2026; and the FFIEC HMDA Data Browser API (2025 originated loans, by legal entity identifier and nationwide for loans coded other purpose) with the 2025 FFIEC filer list. Counts by lender and the shares are our arithmetic; the extract is in sources/hmda_2025_counts.txt. Related reading: best DSCR lender, DSCR lenders ranked by loans, RCN Capital, Lima One and LendingOne. This is analysis of public documents, not investment, legal or tax advice.