The compliance calendar just got complicated.
Welcome to 2026. If you're hoping for regulatory clarity, we have bad news.
The compliance calendar we'd all been planning around has turned into something closer to a weather forecast—there are dates on the books, but whether anything actually happens on those dates is anybody's guess. The CFPB announced in late April that it won't prioritize enforcement or supervision of the Section 1071 small business lending rule, and the bureau is working on an "interim final" rule for Section 1033 open banking while hinting at a funding crisis. Meanwhile, the agency is transferring litigation to DOJ and fighting multiple lawsuits over whether it can even continue operating.
So, what do you do? You can't just ignore everything with a CFPB label on it, but you also should think twice before building expensive compliance infrastructure for rules that might be rewritten, withdrawn, or never enforced. Here's what's moving forward, what's frozen in place, and where you need to hedge your bets.
Texas HB 700: This one's still happening
While federal regulators are sorting themselves out, Texas is moving ahead with its MCA registration regime. HB 700 went into effect September 1, 2025, and the rulemaking is actively progressing.
The OCCC has been clear about the timeline: pre-comment draft rules and another webinar in December 2025/January 2026, formal proposal in February, comment period in March, final rules by August (no later than September 1, 2026), and a hard registration deadline of December 31, 2026.
Three things in HB 700 will change how revenue-based finance companies operate:
Registration. Providers and brokers both need to register with the OCCC. They've signaled registration will likely run through NMLS, which means you should start thinking about what NMLS registration looks like for your business if you're not already in that system.
Disclosures. For transactions under $1 million, you need to give recipients specific disclosures: total financing, disbursement amount, finance charge, repayment amount, payment amounts, and the estimated period for payments to equal the repayment amount. This isn't optional and it's not vague—the statute lays out what goes in the disclosure.
No more confessions of judgment, and auto-debit just got much harder. Confessions of judgment are void and unenforceable. Period. And you can't automatically debit a recipient's account unless you hold a perfected first-priority security interest in that account. If your model relies on ACH authorization alone, you need a new model.
The Q1 2026 comment window is your chance to shape how this works in practice. The OCCC is expected to address unfair/misleading practices (including what counts as "devices or subterfuges" to evade requirements), recordkeeping expectations, and inspection protocols. This is not a "wait and see" situation.
What to do now: Get your internal positions ready before the February-March proposal/comment period. Start mapping how your business model works (or doesn't work) under the auto-debit restriction. If you're not already in NMLS, figure out what that registration process looks like.
Section 1071: The rule that won't die but also won't enforce itself
This is where things get weird.
The CFPB said in May 2025 it won't take enforcement or supervision action on the Section 1071 rule. The agency announced it's starting a new Section 1071 rulemaking, and the proposed changes "may moot or otherwise resolve" pending litigation. In November 2025, the CFPB issued a proposed rule to revise certain provisions, including reconsidering coverage, the small business definition, certain data points, and the compliance date.
So, the old rule is technically still on the books with staggered compliance dates (Tier 1 starting July 1, 2026), but the CFPB has told courts it's rewriting the rule and won't enforce the current version. Multiple courts have issued stays for certain plaintiffs. There's also pending legislation to repeal the statutory authority entirely, though that hasn't passed yet.
Here's the practical reality: if you're Tier 1 and July 1, 2026, is coming up, you're in a bizarre spot. The compliance date exists. The CFPB won't enforce it. You might be covered by a court stay, or you might not. The rule might get replaced, or it might not.
What to do now: Don’t completely ignore the rule! It’s statutory and – practically speaking – only an act of Congress will get it off the books. Confirm what tier you'd be in under the existing rule. Stay close to whatever trade group represents your segment—they're tracking the court stays and the rulemaking process. If you're clearly within a stay, you have breathing room. If you're not, and you're Tier 1, start thinking through what a "bare minimum viable compliance" approach would look like. You don't need to be ready for a diagnostic exam that isn't coming, but you do need to be able to pivot quickly if the landscape shifts, and you should be thinking about how a (possible) new administration in 2029 might look back at your efforts at compliance in 2026.
The safe assumption: this rule will exist in some form eventually, but it won't look like the current version, and the compliance dates will move.
Section 1033: Open banking in limbo
Section 1033 is the poster child for regulatory uncertainty right now.
The Biden-era rule was finalized in October 2024 with phased compliance dates starting April 1, 2026 for the largest institutions. A federal court in Kentucky granted a preliminary injunction in October 2025, blocking enforcement until the CFPB completes its reconsideration. The CFPB issued an Advance Notice of Proposed Rulemaking in August 2025 seeking comments on four specific issues, including who can serve as a consumer "representative" and whether banks can charge fees.
Then it got messier. In December 2025, the CFPB said it plans to issue an "interim final" rule on open banking, bypassing a full rulemaking process, citing the agency's funding crisis. A federal judge ruled in late December that the Trump administration must continue seeking funding for the CFPB, but the agency's future remains uncertain.
The April 2026 compliance dates are stayed. The rule is being rewritten, but who knows what it will look like.
What to do now: Even if 1033 compliance deadlines are frozen, the underlying issue—consumer-permissioned access to financial data—isn't going away. If you're a data provider (or you work with data aggregators), review your vendor contracts, security obligations, authorization flows, and use limitations. Those diligence and contracting conversations need to happen regardless of whether a specific rule is in effect. The "interim final" rule, whenever it comes, will likely address fees and narrow the definition of who can request data. Don't build your tech stack around the old rule, but don't assume the issue disappears entirely.
California: Still California
While the CFPB sorts itself out, California is doing what California does: moving forward with its own requirements.
Annual reporting: The CCFPL commercial financing annual report is due March 15, 2026, covering calendar year 2025. The CFL Annual Report is also due March 15, 2026 for CFL licensees. These are not optional, and DFPI doesn't pause for federal drama.
SB 362 marketing restrictions: California enacted SB 362, effective January 1, 2026, which prohibits providers from using "interest" or "rate" in a deceptive way and requires use of "annual percentage rate" or "APR" in specified circumstances for commercial financing offers of $500,000 or less. After extending a specific offer, whenever a provider states a charge, pricing metric, or financing amount during an application process, the provider must also state the annual percentage rate.
This is live. Right now. As of January 1. Your sales team needs updated scripts. Your marketing materials need to be scrubbed for misleading "rate" language. If you're quoting pricing to California recipients, you need to disclose APR every time you mention cost.
What to do now: Calendar March 15, 2026 for annual reporting. Review all California-facing marketing and sales materials for SB 362 compliance. Train your sales team on when APR disclosure is required (spoiler: basically always after the initial offer). Violations of SB 362 are violations of the CFL (if you're licensed) or the CCFPL (if you're not), so enforcement is real.
What this means for 2026 planning
You're planning in an environment where major federal rules are in flux, but state requirements keep marching forward. Here's how to think about it:
Spend money on things that are certain. Texas registration and disclosures. California SB 362 compliance. California annual reporting. These are happening regardless of what the CFPB does or doesn't do.
But don't ignore federal rules entirely. Stay informed on the rewrites. Participate in comment periods if they open (the 1071 proposed rule and any future 1033 proposal). Track the court cases. Be ready to move quickly if a final rule lands.
Plan for a split universe. Some competitors will treat the CFPB pause as "anything goes." Others will build toward compliance anyway. You need to decide where you sit on that spectrum based on your risk tolerance, your investor expectations, and your long-term strategy. There's obviously no right answer, which is why this year is going to be interesting.
Welcome to 2026.