CFPB 1071 Compliance: How Entity Verification API Supports Small Business Reporting

The Consumer Financial Protection Bureau's Section 1071 rule — formally amending the Equal Credit Opportunity Act (ECOA) — is one of the most consequential regulatory mandates facing U.S. lenders since Dodd-Frank. Financial institutions that originate covered credit products to small businesses must now collect, validate, and report a substantial set of data fields for every application. Among the most operationally demanding requirements is confirming that each applicant is a legitimate, active business entity. That is where CFPB 1071 small business entity verification becomes mission-critical.

This guide explains what Section 1071 demands, how it intersects with existing KYB, FinCEN BOI, and BSA obligations, and how automated Secretary of State lookups via the OpenSOSData API help compliance teams scale efficiently without sacrificing accuracy.

What Section 1071 Actually Requires

Section 1071 of Dodd-Frank directed the CFPB to collect data about small business credit applications to expose potential discrimination and facilitate fair-lending enforcement. The final rule (effective March 2023, with phased compliance dates) requires covered financial institutions to gather more than 20 data points per application, including:

• Business legal name and Tax Identification Number (TIN)
• Business address and state of organization
• Entity type (LLC, corporation, partnership, sole proprietorship)
• Time in business and number of employees
• Gross annual revenue
• Demographic information about principal owners

Critically, lenders cannot simply accept what an applicant self-reports. Regulators and examiners expect institutions to demonstrate that the business data on file is verified. Unverified or stale records expose lenders to fair-lending scrutiny, examination findings, and potential civil money penalties.

The KYB and BOI Overlay

Section 1071 does not exist in isolation. Lenders must simultaneously satisfy:

• KYB (Know Your Business): Confirming business identity, active status, and legal structure before origination.
• FinCEN Beneficial Ownership Information (BOI): Under the Corporate Transparency Act, most U.S. entities must report beneficial owners to FinCEN. Lenders must confirm applicant entities are compliant where required and align their own customer due diligence (CDD) rule obligations.
• Bank Secrecy Act (BSA) / AML: Verifying that applicant entities are not shell structures or OFAC-listed parties requires knowing the entity's legal status and registered agent of record.

All three frameworks converge on a single operational need: a reliable, machine-readable source of truth for business entity data. Secretary of State (SOS) records are that source. They are the authoritative government database for entity formation, status, and registered agent information in all 50 states.

Why Manual SOS Lookups Break Down at Scale

Many compliance teams still rely on analysts manually checking individual state SOS portals. That approach has serious deficiencies in a Section 1071 world:

• Each of the 50 states plus D.C., Puerto Rico, and USVI maintains a separate portal with different search conventions.
• Manual lookups are not auditable in a structured way — screenshot PDFs are not adequate evidence for examiners.
• Throughput is limited. High-volume lenders may process hundreds or thousands of small business applications per day.
• Data entry errors introduce verification gaps that become findings during regulatory review.

API-driven entity verification solves all of these problems simultaneously.

How OpenSOSData Supports CFPB 1071 Compliance

OpenSOSData provides a REST API that queries official Secretary of State records across all 50 U.S. states, Washington D.C., Puerto Rico, and the U.S. Virgin Islands — covering more than 34 million business entities. A single POST request returns structured JSON with the fields your compliance workflow needs:

• Legal entity name
• Entity type (LLC, corporation, LP, etc.)
• State entity ID
• Current status (active, dissolved, revoked, etc.)
• Formation date
• Registered agent name and address

These fields map directly to Section 1071 data collection requirements and support the KYB risk scoring that BSA/AML programs require.

Pricing That Scales With Your Volume

OpenSOSData uses a pay-as-you-go model with no monthly minimums:

For Section 1071 purposes, live lookups are recommended at the point of application decisioning to ensure the entity status is current. Cached lookups are cost-effective for bulk portfolio reviews or preliminary screening.

Practical Code Example: Verifying a Small Business Applicant

The following Python example shows how a lending operations team can verify a small business applicant's entity status at the point of application intake. The cache_preference parameter is set to live_only to ensure real-time SOS data for regulatory documentation.

import requests
import json

# OpenSOSData API endpoint
API_URL = "https://api.opensosdata.com/v1/lookup"

# Your API key from https://app.opensosdata.com
API_KEY = "your_api_key_here"

# Small business applicant details from the 1071 application form
applicant = {
    "entity_name": "Sunrise Bakery LLC",
    "state": "TX"  # State of formation reported by the applicant
}

# Build the request payload
# Use cache_preference: live_only for regulatory-grade verification
payload = {
    "entity_name": applicant["entity_name"],
    "state": applicant["state"],
    "cache_preference": "live_only"  # Ensures real-time Secretary of State data
}

headers = {
    "x-api-key": API_KEY,
    "Content-Type": "application/json"
}

# Send verification request to OpenSOSData
response = requests.post(API_URL, headers=headers, json=payload)

if response.status_code == 200:
    data = response.json()

    # Extract key fields for 1071 data collection and KYB record
    entity_name   = data.get("entity_name")
    entity_type   = data.get("entity_type")       # e.g., "Limited Liability Company"
    entity_status = data.get("status")            # e.g., "Active"
    formation_date = data.get("formation_date")   # Supports "time in business" field
    state_id      = data.get("entity_id")         # State-issued entity number
    reg_agent     = data.get("registered_agent")  # Registered agent name
    reg_address   = data.get("registered_address")

    print(f"Entity Name:      {entity_name}")
    print(f"Type:             {entity_type}")
    print(f"Status:           {entity_status}")
    print(f"Formation Date:   {formation_date}")
    print(f"State Entity ID:  {state_id}")
    print(f"Registered Agent: {reg_agent}")
    print(f"Agent Address:    {reg_address}")

    # Flag non-active entities for compliance review before proceeding
    if entity_status and entity_status.lower() != "active":
        print(f"WARNING: Entity status is '{entity_status}' — flag for compliance review.")

else:
    print(f"API Error {response.status_code}: {response.text}")

This pattern can be embedded directly into your loan origination system (LOS) or compliance middleware. Every response should be logged with a timestamp and the raw JSON stored in the application file — providing the auditable evidence trail that examiners look for.

Mapping API Response Fields to Section 1071 Data Points

Integration Best Practices for Compliance Teams

1. Verify at Application Intake, Not Just Onboarding

Section 1071 data collection begins when the application is received. Triggering an entity verification call at intake — before any credit decision — ensures your data set is accurate from day one and prevents costly retroactive corrections.

2. Store the Raw API Response

Do not just store parsed fields. Retain the full JSON response with the timestamp. This constitutes your verification record and demonstrates to examiners that the data came from an authoritative, real-time source rather than applicant self-certification.

3. Use Live Lookups for Decisioning, Cached for Batch Screening

Set cache_preference: live_only for individual applications at the point of decision. Use cache_preference: cache_first for periodic portfolio reviews where speed and cost matter more than real-time precision. See the full parameter reference at opensosdata.com/docs.

4. Build Automated Flags for Non-Active Entities

Any entity with a status other than "Active" should automatically route to a compliance analyst queue. Dissolved, revoked, or administratively suspended entities represent elevated BSA and fraud risk and should not proceed through normal origination without senior review.

Frequently Asked Questions

Getting Started

Section 1071 compliance is no longer a future obligation — phased compliance deadlines are active, and examination cycles are beginning. Institutions that automate entity verification now will be better positioned for both regulatory review and operational efficiency as small business lending volumes grow.

To explore the full API capability, review the OpenSOSData documentation or create a free account and run your first lookup today. With pay-as-you-go pricing starting at $0.10 per live query and no monthly fees, there is no barrier to getting started.

Visit opensosdata.com to learn more about how the platform supports KYB, BSA, and CFPB 1071 compliance workflows across all 50 states.