The CFPB Excluded Merchant Cash Advances From Its New Rule

The CFPB Just Excluded Merchant Cash Advances From Its New Rule. Here Is What That Means for Small Business Owners.

On April 30, 2026, the Consumer Financial Protection Bureau finalized a new small business lending data rule. The rule requires lenders to collect and report data on the loans they make to small businesses: who received funding, on what terms, at what cost.

Merchant cash advances were explicitly excluded.

Not overlooked. Not forgotten. Excluded by name, at the request of the industry.

If you run a small business and you take an MCA, the federal government is not collecting data on that transaction. The CFPB cannot see what you were charged. It cannot identify patterns of predatory pricing. It cannot flag funders who target distressed businesses with triple-digit APRs. None of that information goes anywhere.

Here is what actually changed, why it matters, and what protects you now that the federal watchdog has stepped back.

What the New CFPB Rule Does

The rule implements Section 1071 of the Dodd-Frank Act, a provision passed in 2010 that required the CFPB to collect data on small business lending. The original Biden-era version of the rule, finalized in 2023, covered roughly 2,500 lenders and required collection of 81 data points, including loan pricing, denial reasons, and demographic information about business owners.

The 2026 version covers 280 lenders. It collects 13 data points. It does not take effect until January 1, 2028.

And it excludes merchant cash advances entirely.

The CFPB's own summary of the final rule lists the excluded products: merchant cash advances, agricultural lending, and small dollar loans. The exclusion was requested by the industry and granted.

The practical result: the only federal data collection mechanism that could have shed light on MCA pricing and practices will not apply to MCA at all.

Why MCA Was Excluded

The industry argued that MCA is a purchase of future receivables, not a loan, and therefore falls outside the lending data requirements. This is the same legal argument MCA funders use to avoid usury laws and interest rate caps: by calling the transaction a receivables purchase rather than a loan, the product escapes most of the regulatory framework that applies to conventional lending.

That argument has been contested in courts and by regulators for years. Several state courts have found that the economic substance of an MCA is functionally equivalent to a loan regardless of how it is labeled. But the CFPB accepted the industry's framing and wrote the exclusion into the final rule.

The result is a category of small business financing that is growing rapidly, costs more than almost any other form of capital, and is now explicitly outside the federal data collection net.

What This Means in Plain Numbers

The CFPB data rule, even in its narrowed form, will tell regulators and researchers something about the 280 largest conventional small business lenders in the country. They will know how many loans were made, to whom, at what rates, and who was turned down.

For MCA, none of that exists at the federal level.

The MCA market does approximately $20 billion in originations annually. The average real APR on the contracts Gradino has analyzed to date is above 100%. The highest was 415%: two contracts on one business, signed six days apart.

None of that data flows anywhere. No regulator sees it. No researcher can analyze it. No journalist can request it through FOIA. It exists only in the funder's records and, if the merchant uploads their contract, in tools like Gradino.

What Still Protects You at the State Level

The CFPB stepping back does not leave merchants with nothing. Several states have passed their own commercial finance disclosure laws, and these do apply to MCA.

New York requires MCA funders to disclose an estimated APR, the total repayment amount, and all fees before a merchant signs. The disclosure must be in a standardized format. Violations are enforceable by the New York Department of Financial Services.

California requires similar disclosures under the California Financing Law. Florida, Virginia, Utah, Connecticut, Georgia, Kansas, and Missouri have all passed or are passing their own versions of commercial finance disclosure requirements.

These laws are meaningful. They force funders to put a number on paper before you sign. But they have limits.

The disclosed APR is an estimate based on the funder's revenue projections. If your business earns less than projected, the term extends and your real APR drops. If you earn more, the term shortens and your real APR rises. The disclosure tells you what the funder expects. It does not tell you what you will actually pay.

The disclosure laws also do not address contract clauses. A funder can disclose a 95% APR in full compliance with state law and still include a confession of judgment, an irrevocable ACH authorization, and a blank fee field in the same contract. The disclosure requirement and the predatory clause can coexist on the same page.

The Gap This Creates

Here is the gap that now exists in small business financial protection:

Federal oversight: does not apply to MCA. State disclosure laws: apply to pricing but not to contract terms, and only in states that have passed them. CFPB data collection: explicitly excludes MCA. Federal usury limits: do not apply to commercial lending. State usury limits: largely inapplicable due to the receivables-purchase framing.

What remains is state-level disclosure in about eight states, state AG enforcement actions which are sporadic and resource-constrained, and private litigation which requires a merchant to already be in trouble and have money to fight.

The merchant who takes an MCA in Texas, Florida, or Ohio today has no federal protection and no state disclosure law. They have whatever is in the contract they signed and whatever they can find out on their own.

Why This Makes Independent Information More Important

When the regulatory framework has gaps, the information asymmetry widens. Funders know exactly what they are charging. Merchants increasingly do not. That gap is where most of the damage happens.

The CFPB's rollback does not create the MCA information problem. That problem existed long before 2026. But it does confirm that the federal government is not closing it. The market correction, if it comes, will come from somewhere else.

It will come from merchants who know their real APR before they sign. From business owners who can read a confession of judgment clause and understand what it means. From a public dataset showing which funders charge the most, default the most, and use the most aggressive collection clauses, built not from federal reporting requirements but from real contracts uploaded by real merchants.

That dataset does not exist yet. It is being built one contract at a time.

What to Do Right Now

If you have an MCA contract, run it through a free contract grader before you sign anything else. Know your real APR. Know what clauses you agreed to. Know whether your state's disclosure laws apply to your deal and what they actually require.

If you are shopping for funding, compare APR across products: not factor rates, not marketing language, not what the broker told you on the phone. The real annualized cost of an MCA versus an SBA loan versus a bank line of credit is a comparison any business owner can make with the right tools. Make it before you sign.

The CFPB is not collecting this data. Someone needs to.

Upload your MCA contract at Gradino and see your real APR, every clause graded, A through F, free, 90 seconds, no signup.