The CFPB Took Merchant Cash Advances Out of Its Small Business Lending Rule. It Did Not Decide They Aren't Credit, and the Enforcement Record Still Stands.

In 2023 the Consumer Financial Protection Bureau wrote merchant cash advances into its small business lending data rule, on the view that every MCA is credit under the Equal Credit Opportunity Act. On 1 May 2026 it published a final rule taking them back out. Read quickly, that looks like a federal regulator stepping away from MCAs altogether. It is narrower than that, and the reasoning the CFPB gave for it is more useful to an ISO than the exclusion itself.

This piece sets out what the amended rule does, what the CFPB actually said about whether an MCA is credit, and which obligations an ISO that refers merchants to MCA funders still sits under. It is drawn from the rule as published in the Federal Register, the FTC's and the New York Attorney General's own announcements, and is not legal advice.

What the May 2026 Rule Changed

Section 1071 of the Dodd-Frank Act amended ECOA to require lenders to collect and report data on credit applications from small businesses, including women-owned and minority-owned businesses. The CFPB's implementing rule sits in Regulation B, subpart B. The amended version, 91 FR 23530, took effect on 30 June 2026. Its main changes:

• Merchant cash advances are now an excluded transaction. New section 1002.104(b)(7) defines one as an agreement under which a small business receives a lump-sum payment in exchange for the right to receive a percentage of its future sales or income up to a ceiling amount. Agricultural lending and transactions of $1,000 or less are excluded alongside it.
• A lender is covered only if it originated at least 1,000 covered credit transactions for small businesses in each of two consecutive calendar years, up from 100.
• A small business is one with gross annual revenue of $1 million or less in its preceding fiscal year, down from $5 million.
• Several data points are gone, including denial reasons, application method, number of workers and all pricing information. The pricing fields that went include broker fees and the MCA-specific field for the difference between the amount advanced and the amount to be repaid.
• There is one compliance date: 1 January 2028, for a lender that originated at least 1,000 covered transactions in each of 2026 and 2027.

The 2023 rule never reached its compliance dates. Challenges to the rule are pending in three jurisdictions, each of which stayed the compliance deadlines for some market participants, and the CFPB pushed them back by interim final rule in 2024 and 2025. The earliest remaining date, 1 July 2026, fell after the amended rule took effect, so no MCA funder ever had to begin collecting data under it, and under the amended rule none will. The CFPB's own impact analysis says so directly: since MCAs are no longer covered credit transactions, no MCA provider will be required to report.

What the CFPB Did Not Decide

The exclusion is a decision about what data to collect first. It is not a finding that MCAs are outside ECOA, and the preamble is explicit on the point. The CFPB rejected the argument that MCAs are categorically not credit, and rejected the argument that they are simply purchases of future receivables. It said commenters had shown that in some instances MCAs in practice involve debt, confer a right to payment and are loans, and that in many instances providers seek recourse against the individual owners of a business that no longer has revenue.

It equally rejected its own 2023 position that every MCA is credit, accepting that some may resemble factoring. Its conclusion was that the record does not yet support a bright-line test separating the two, and that more analysis is needed to work out which subset of MCAs is credit for ECOA purposes. It said it will keep monitoring the market to see whether a subset should later be brought back in.

That leaves no federal bright line either way. Whether a given advance is credit turns on how the product behaves, and the features the CFPB pointed to are concrete: a debt the business owes, a right to payment the funder holds, and recourse against the owners personally when the business's revenue stops. State enforcers have added others, as the New York case below shows: fixed payments that do not move with sales, and a reconciliation right that exists on paper and not in practice.

The Enforcement That Never Depended on Section 1071

Removing MCAs from a data collection rule changes nothing about the enforcement record, none of which was brought under Section 1071. The CFPB said as much in the preamble: concerns about high costs and predatory practices in the MCA market may be addressed by federal and state enforcement agencies through their own authorities.

The Federal Trade Commission has brought MCA cases under Section 5 of the FTC Act, which prohibits deceptive and unfair practices and which the FTC has applied to practices aimed at small businesses:

• Yellowstone Capital, April 2021. The FTC alleged the funder misrepresented how much money businesses would receive, advertised no personal guarantee or collateral when its contracts required them, and kept withdrawing money after balances were repaid. The defendants agreed to surrender $9,837,000 for refunds.
• RCG Advances (Richmond Capital Group), June 2022. The company and an owner were permanently banned from the MCA and debt collection industries and ordered to pay more than $2.7 million. The FTC alleged false no-personal-guaranty and no-upfront-fee claims, confessions of judgment used to seize assets, and threats of violence.
• Jonathan Braun, October 2023. A federal court granted the FTC summary judgment against the RCG controller, finding violations of the FTC Act and the Gramm-Leach-Bliley Act, and permanently banned him from the MCA industry.

State attorneys general have gone further. In January 2025 the New York Attorney General announced a settlement with a network of 25 companies controlled by Yellowstone Capital and its officers, including a $1.065 billion judgment and the cancellation of more than $534 million owed by small businesses. The office described the transactions as loans disguised as merchant cash advances: contracts that described a purchase of future revenue with flexible payments, while the companies collected fixed amounts every day over terms that often lasted 60 or 90 days. The companies promised to reconcile payments to an agreed percentage of revenue, and the office says they used fraudulent measures so that businesses almost never qualified. By its account the transactions carried interest rates of up to 820 percent a year.

New York's toolkit has also grown. The FAIR Business Practices Act, signed on 19 December 2025 and in force since 17 February 2026, extends General Business Law section 349 to unfair and abusive practices as well as deceptive ones, in actions brought by the Attorney General, and lets the Attorney General act on behalf of businesses as well as consumers. In June 2026 the Attorney General sued Rapid Ruling, citing the Act among other New York laws, an arbitration service the office says presented itself as neutral while working with MCA companies, under rules an MCA company drafted. The office found that in 97 percent of the approximately 3,000 arbitrations Rapid Ruling administered in its first three years, no small business appeared.

Then there are the state commercial financing laws: disclosure statutes in several states and, in Virginia, Utah, Connecticut and now Texas, registration regimes, some of which reach brokers. We covered those, and the Texas broker registration deadline of 31 December 2026, in a separate piece. None of them is affected by anything the CFPB did in May.

What This Means for an ISO That Refers MCAs

Every case above was brought against funders and their principals, not brokers. Several of the practices at issue happen in the sale, though: what the merchant was told about the personal guarantee, the fees and the amount they would actually receive. That is the part an ISO's agents control.

• There is no Section 1071 reporting on an MCA placement, now or in 2028, unless the CFPB brings a subset of MCAs back in through a later rulemaking. Nothing needs building for it.
• If your agents also refer merchants to bank or online lenders for term loans or lines of credit, those lenders may be covered from 1 January 2028. The rule lets a lender that expects to be covered start collecting minority-owned, women-owned and principal-owner demographic data up to 12 months early, so requests for that information can start reaching your merchants from 1 January 2027.
• Review what agents say about MCA products against the claims the FTC called deceptive: no personal guarantee, no collateral, no upfront fees, and the amount the merchant will actually receive. Do they match the funder's contract?
• Know how each funder you place with handles reconciliation, and whether a merchant who asks for one gets one. A reconciliation clause that is never honoured is the feature the New York Attorney General built its case around.
• Keep records of what was presented to the merchant and by whom. When a funder is investigated, the broker's file is where the sales conversation lives.

The amended rule took one federal obligation off the table for MCA providers. It did not settle whether their product is credit, and it left every enforcement route open. For an ISO, the practical position is the same as it was a year ago: the risk sits in how the product behaves and how it was sold, not in whether a federal data rule happens to cover it.