§ 1071 · Grace period
The grace period, explained honestly
It's forgiveness on errors — not a delay. Data collection still starts January 1, 2028.
Last updated:
The phrase "grace period" gets used loosely, and it's worth being precise about what the CFPB actually offers here, because it's narrower than the name suggests.
What it is
From January 1, 2028 through December 31, 2028, the CFPB has stated it generally will not assess penalties for errors in the small business lending data institutions collect and report — provided the institution made good-faith efforts to comply with the rule. It's a one-year window of enforcement forbearance on data quality issues, layered on top of the compliance date rather than replacing it.
What it is not
It is not a delay of the January 1, 2028 compliance date. Covered institutions still need to be collecting the required data fields from day one of 2028. If you wait for the grace period to end before building your collection process, you'll have already missed a full year of required data.
It also isn't blanket immunity. "Good-faith efforts" is the operative phrase — an institution that hasn't built any process to collect the data at all is in a different position than one that has a process in place and is correcting genuine data-quality errors as it identifies them.
What it means practically
Treat 2028 as a live production year with a safety net, not a dry run. Build your collection process to be accurate from the start, use the grace period to catch and fix the errors that inevitably surface in a first year of new data collection, and be ready to file a clean SBLAR by June 1, 2029 — after the grace period has already ended.
This is general information, not legal or compliance advice. Consult qualified counsel or a compliance professional for guidance specific to your institution.