Does the CFPB regulate merchant cash advances?

Partially and indirectly. The CFPB has authority over consumer financial products and certain small-business lending data under Dodd-Frank Section 1071. MCA itself isn't directly licensed or rate-regulated by the CFPB — it's regulated at the state level. But the Section 1071 rule (now live for the largest financial institutions and phasing in for smaller ones) requires reporting on small-business credit applications including MCA-like products, and the CFPB has issued guidance and bulletins flagging MCA practices.

What is Section 1071 and how does it affect me as a merchant?

Section 1071 of Dodd-Frank requires financial institutions making small-business credit decisions to collect and report data on applications: demographic info on the applicant, loan amount, decision, pricing. It's the small-business analog to HMDA mortgage reporting. As a merchant, you'll see new optional demographic questions on applications. The data is reported to the CFPB and published — eventually enabling fair-lending analysis of small-business credit, including MCA pricing patterns by borrower demographics. Compliance went live in stages starting October 2024, with full coverage by 2026.

Does the CFPB have authority over my personal guarantee on a business loan?

Indirectly, yes. If you signed a personal guarantee and the lender is a covered consumer-facing entity, certain consumer protections can attach to the personal guarantee even though the underlying obligation is commercial. ECOA (Equal Credit Opportunity Act, CFPB-enforced) prohibits requiring a spouse's guarantee solely because of marital status — that's been the basis for multiple CFPB enforcement actions against small-business lenders.

What's the practical difference between CFPB oversight and state regulation for an MCA merchant?

State regulation (CA SB 1235, NY DFS 803, VA HB 1027, UT HB 456, GA Commercial Financing Broker Act, etc.) is where MCA-specific consumer-style protections actually live in 2026 — APR disclosure, broker fee disclosure, licensing requirements, confession-of-judgment limits. CFPB jurisdiction is broader but lighter-touch on MCA specifically. If you have a complaint about an MCA, the state regulator is almost always the more responsive forum.

Will federal MCA regulation actually happen?

Possible but uncertain. There have been multiple congressional proposals (Small Business Lending Disclosure Act and others) that would extend TILA-style disclosure to commercial financing federally. None have passed. The CFPB's current posture is to use existing authorities (UDAAP, Section 1071, ECOA) to address the worst practices and let states continue building MCA-specific regimes. A unified federal regime is unlikely before 2028.

Business funding and CFPB jurisdiction 2026 — what the federal regulator actually touches, what it doesn't, and what changed this year

The Consumer Financial Protection Bureau has limited but expanding jurisdiction over small-business financing. Section 1071 data collection is now live. Here's the honest 2026 map: what the CFPB actually regulates, what's still state-only, and what this means for merchants getting an MCA, term loan, LOC, or SBA loan.

The 60-second answer

The CFPB's jurisdiction over small-business financing in 2026 is real but bounded. The agency directly enforces:

Section 1071 of Dodd-Frank — small-business credit application data collection (now live, phasing in for smaller institutions through 2026)
The Equal Credit Opportunity Act (ECOA) — anti-discrimination in credit decisions, including business credit and personal guarantees
Unfair, Deceptive, or Abusive Acts and Practices (UDAAP) authority — broad enforcement tool used against deceptive small-business lending practices
Consumer reporting overlap — Fair Credit Reporting Act issues that touch business credit when personal credit is involved

What the CFPB does not directly regulate: MCA factor rates, MCA broker fees, MCA disclosure standards, MCA licensing. That remains state-level. Federal action on MCA-specific disclosure has been proposed multiple times but not enacted. The 2026 regulatory landscape for an MCA merchant is therefore: state law sets the MCA-specific rules, CFPB sets the umbrella anti-discrimination and data-collection regime, and federal small-business credit disclosure remains unfinished.

The big shift: Section 1071 is now live

Section 1071 of the Dodd-Frank Act, enacted in 2010, sat dormant for over a decade. The CFPB issued the final implementing rule in March 2023, and compliance went live in phases starting October 1, 2024:

Tier 1 (covered financial institutions with 2,500+ small-business originations/year): Compliance live October 1, 2024.
Tier 2 (500–2,499 originations/year): Live April 1, 2025.
Tier 3 (100–499 originations/year): Live January 1, 2026.

What this means in practice: when you apply for business credit at a covered institution — and most MCA shops, SBA lenders, online lenders, and banks above small thresholds are covered — the application now includes optional demographic questions: ethnicity, race, sex of principal owners, ownership status (minority-owned, women-owned, LGBTQ-owned, veteran-owned). You can decline to answer; the funder must report the application either way, including the decision, the pricing, and the structural data.

Why this matters for merchants

Three practical effects:

Pricing analysis becomes possible. For the first time, fair-lending analysts (and the CFPB) have the data to identify whether specific funders price differently to similarly-situated minority-owned vs. non-minority-owned businesses, women-owned vs. men-owned businesses, etc. Several large funders have publicly tightened their underwriting documentation in anticipation of this scrutiny.
Application processes have lengthened slightly. Covered institutions now ask 4–8 additional demographic questions. Most funders integrated these cleanly, but some shops are adding 1–2 minutes to the application flow.
Pricing transparency at the market level will improve. Once 1071 data is publicly available (expected aggregate publication starting late 2026), merchants will be able to benchmark whether their offered MCA factor rate is in line with similarly-situated merchants. This is a significant long-term shift toward market transparency.

What the CFPB has actually enforced against MCA shops

The CFPB has used its UDAAP authority and ECOA authority — not MCA-specific rules — to take action against MCA-adjacent practices. Notable patterns:

Deceptive marketing of APR-equivalent. Funders that quoted a factor without mentioning APR-equivalent have been pursued under UDAAP in jurisdictions where APR disclosure is required (state) or where the marketing was federally misleading.
Spousal-guarantee requirements. ECOA prohibits requiring a spouse's personal guarantee solely because of marital status. Several small-business lenders have settled enforcement actions on this. Critical for merchants in community-property states who were pressured into spousal guarantees.
Furnishing inaccurate data to consumer reporting agencies. When business funding gets reported to personal credit bureaus inaccurately, FCRA obligations attach — and the CFPB has enforced.
Abusive collection practices that crossed into FDCPA territory. Several MCA-adjacent collection operations have faced UDAAP enforcement for harassment and misrepresentation to merchants.

What the CFPB has not done: capped MCA factor rates, defined a federal MCA disclosure standard, licensed MCA brokers. Those rule-making initiatives haven't moved past the proposal stage.

The jurisdictional map — what's federal vs. state

What's federal (CFPB)

Section 1071 data collection on small-business credit applications.
ECOA enforcement — anti-discrimination in business credit decisions and personal guarantees.
UDAAP enforcement — deceptive marketing, abusive practices.
Truth in Lending Act — applies to personal loans and personal credit, including when business owners borrow personally to fund a business.
Fair Credit Reporting Act — accuracy of credit reporting that touches personal credit.
Fair Debt Collection Practices Act — applies to consumer debts, but increasingly relevant when MCA collection crosses into harassment territory.

What's federal (other agencies)

FTC. Concurrent UDAP authority over non-bank small-business lenders. FTC has brought multiple enforcement actions against MCA collection operations.
SBA. Regulates SBA loan programs (7(a), 504, Express, EIDL, microloans) including rate caps, underwriting standards, lender approval.
OCC/FDIC/Federal Reserve. Bank prudential supervision; touches MCA indirectly when banks own or partner with MCA shops.
State AGs working with federal agencies. Cross-jurisdictional enforcement actions are increasingly common.

What's state-only

MCA APR disclosure (CA, NY, VA, UT, TX, NJ, CT, MO, OH, FL).
MCA broker licensing and fee caps (CA, NY, GA, VA, UT, FL).
Confession of judgment availability — varies state-by-state; NY banned for out-of-state merchants 2019.
Usury laws — generally don't apply to MCA because of receivables-sale framing, but state-by-state variation matters.
UCC filings and lien priority.
General consumer protection statutes applied to small-business financing.

The Small Business Lending Disclosure Act and other federal proposals

Multiple federal bills have been introduced over the last six years aiming to extend TILA-style disclosure to commercial financing including MCAs. The most prominent is the Small Business Lending Disclosure Act (variations introduced in multiple Congresses), which would require federally standardized APR disclosure on small-business financing under defined thresholds. None has passed.

The political dynamic is well-understood: the small-business advocacy community generally favors federal disclosure (to harmonize the patchwork), but the financial services industry resists federal preemption that would impose more constraints than existing state regimes. The most likely 2026–2028 trajectory is continued state-by-state expansion (NCSL model bill being adopted in additional states) with no federal preemption.

The practical takeaway for merchants

If you're applying for an MCA

Your state's disclosure law is your primary protection. Know whether your state requires APR disclosure (most of the large-economy states do in 2026) and insist on it.
Section 1071 demographic questions are optional. Answer or decline as you prefer; the funder must process the application either way.
ECOA protects you from spousal-guarantee shakedowns. A lender cannot require your spouse to sign solely because you're married. If you're a sole owner with qualifying credit and revenue, demand to know the legal basis if a spouse signature is requested.
UDAAP applies to deceptive sales practices. If a broker materially misrepresented your factor, your APR-equivalent, or the prepayment terms — and you have it in writing — you have grounds for both state and federal complaint.

If you're applying for SBA, term loan, or LOC

SBA programs are heavily federally regulated — APR cap is set by SBA, disclosure is standardized, fees are bounded.
Bank LOC and term loans are subject to TILA only if personal credit is extended; commercial credit is generally exempt from TILA but covered by ECOA.
Online lenders (OnDeck, Bluevine, Funding Circle, etc.) are typically covered by Section 1071 and increasingly by state disclosure regimes too.

If you have a complaint

Discrimination, fair lending issue, abusive practice: File with the CFPB at consumerfinance.gov/complaint. Also consider the state AG.
MCA-specific issue (factor, disclosure, broker fees): Your state regulator is the right forum — CA DFPI, NY DFS, VA SCC-BFI, UT DFI, GA SOS, FL OFR.
Material dollar amount in dispute: Consult a commercial litigation attorney. State disclosure-law violations have produced merchant recoveries.

The 2026–2028 forecast

Three trends to watch:

1071 data goes public. Aggregate 1071 data is expected to start publication in late 2026 and 2027. This will surface fair-lending patterns in small-business credit that have never been visible before — almost certainly leading to additional CFPB enforcement actions.
State disclosure regimes proliferate. Expect 4–8 additional states to adopt commercial financing disclosure laws by end of 2027. The de facto national standard is converging.
Federal disclosure legislation remains stalled but possible. The Small Business Lending Disclosure Act and successor bills will continue to be introduced. Passage requires a specific political alignment that hasn't materialized in multiple Congresses.

Frequently asked questions

Does the CFPB regulate merchant cash advances?: Partially and indirectly. The CFPB has authority over consumer financial products and certain small-business lending data under Dodd-Frank Section 1071. MCA itself isn't directly licensed or rate-regulated by the CFPB — it's regulated at the state level. But the Section 1071 rule (now live for the largest financial institutions and phasing in for smaller ones) requires reporting on small-business credit applications including MCA-like products, and the CFPB has issued guidance and bulletins flagging MCA practices.
What is Section 1071 and how does it affect me as a merchant?: Section 1071 of Dodd-Frank requires financial institutions making small-business credit decisions to collect and report data on applications: demographic info on the applicant, loan amount, decision, pricing. It's the small-business analog to HMDA mortgage reporting. As a merchant, you'll see new optional demographic questions on applications. The data is reported to the CFPB and published — eventually enabling fair-lending analysis of small-business credit, including MCA pricing patterns by borrower demographics. Compliance went live in stages starting October 2024, with full coverage by 2026.
Does the CFPB have authority over my personal guarantee on a business loan?: Indirectly, yes. If you signed a personal guarantee and the lender is a covered consumer-facing entity, certain consumer protections can attach to the personal guarantee even though the underlying obligation is commercial. ECOA (Equal Credit Opportunity Act, CFPB-enforced) prohibits requiring a spouse's guarantee solely because of marital status — that's been the basis for multiple CFPB enforcement actions against small-business lenders.
What's the practical difference between CFPB oversight and state regulation for an MCA merchant?: State regulation (CA SB 1235, NY DFS 803, VA HB 1027, UT HB 456, GA Commercial Financing Broker Act, etc.) is where MCA-specific consumer-style protections actually live in 2026 — APR disclosure, broker fee disclosure, licensing requirements, confession-of-judgment limits. CFPB jurisdiction is broader but lighter-touch on MCA specifically. If you have a complaint about an MCA, the state regulator is almost always the more responsive forum.
Will federal MCA regulation actually happen?: Possible but uncertain. There have been multiple congressional proposals (Small Business Lending Disclosure Act and others) that would extend TILA-style disclosure to commercial financing federally. None have passed. The CFPB's current posture is to use existing authorities (UDAAP, Section 1071, ECOA) to address the worst practices and let states continue building MCA-specific regimes. A unified federal regime is unlikely before 2028.