Common Community Reinvestment Act (Regulation BB) Data-Related Violations in the Federal Reserve System in 2025
A review of Federal Reserve examination data indicates that violations of the small business and small farm data collection and reporting requirements of Regulation BB,1 — the Federal Reserve Board’s implementing regulation for the Community Reinvestment Act (CRA)2 applicable to the state member banks that it supervises — were among the top-cited violations in the Federal Reserve System for 2025.3 To facilitate compliance, this article reviews the violations and discusses sound practices to mitigate the root causes of the violations.4
The CRA requires the Federal Reserve Board, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency (the agencies) to assess an institution’s record of meeting the credit needs of its entire community, including low- and moderate-income neighborhoods, consistent with the safe and sound operation of the institution.5 The agencies’ CRA regulations provide different standards for evaluating the CRA performance of an insured depository institution (bank)6 depending on its asset size7 and business strategy:
- Small banks — those with assets of less than $1.649 billion as of December 31 of either of the prior two calendar years — are evaluated under a lending test.
- Intermediate small banks (ISBs) — those with assets of at least $412 million as of December 31 of both of the prior two calendar years and less than $1.649 billion as of December 31 of either of the prior two calendar years — are evaluated under the lending test for small banks and a community development test.
- Large banks — those with assets of more than $1.649 billion as of December 31 of both of the prior two calendar years — are evaluated under separate lending, investment, and service tests.
- Wholesale banks (defined as banks that are not in the business of extending home mortgage, small business, small farm, or consumer loans to retail customers, and for which a designation as a wholesale bank is in effect)8 and limited purpose banks (defined as banks offering only a narrow product line to a regional or broader market, and for which a designation as a limited purpose bank is in effect)9 are evaluated under a standalone community development test.
- Banks of any size may elect to be evaluated under a strategic plan10 that sets out measurable, annual goals for lending, investment, and service activities, and must be developed with community input and approved by the appropriate federal banking agency.
To facilitate the agencies’ analysis, the CRA regulations require large banks to annually collect, maintain, and report data points on, as applicable, their home mortgage loans, community development loans, small business loans, and small farm loans. If small banks or ISBs elect to be evaluated under the large bank lending test, they are also subject to these requirements.11 Of note: If a large bank, or a small bank or an ISB that elects to be evaluated under the large bank lending test, reports loans under the Home Mortgage Disclosure Act, it must also report the location of applications, originations, or purchases of covered loans outside the metropolitan statistical areas (MSAs) in which the bank has a home or branch office (or outside any MSA).
Regulation BB Data Collection Compliance Violations
In 2025, examiners frequently cited violations of the following small business and small farm data collection requirements:
12 C.F.R. §228.42 Requirements
Data collection, reporting, and disclosure
“(a) Loan information required to be collected and maintained. A bank, except a small bank, shall collect, and maintain in machine readable form (as prescribed by the Board) until the completion of its next CRA examination, the following data for each small business or small farm loan originated or purchased by the bank:
(1) A unique number or alpha-numeric symbol that can be used to identify the relevant loan file;
(2) The loan amount at origination;
(3) The loan location; and
(4) An indicator whether the loan was to a business or farm with gross annual revenues of $1 million or less.”
Collecting and Maintaining Data with Incorrect Loan Locations
Examiners cited several banks for reporting the incorrect location of the property securing the loan. (See 12 C.F.R. §228.42 Requirements box.) The location of a small business or small farm loan is the census tract where the main business facility or farm is located or where the loan proceeds otherwise will be applied.14 If the proceeds will be applied to more than one location, “the institution should record the loan location by either the location of the small business borrower’s headquarters or the location where the greatest portion of the proceeds are applied, as indicated by the borrower.”15
The root causes for the violations included insufficient staff training in data collection requirements, lack of formal procedures, and inadequate controls and second review processes to verify the accuracy of geocodes generated by software systems.
Collecting and Maintaining Incorrect Revenue Indicators
Errors included failing to document filing indicator code “1” when business or farm revenues were less than or equal to $1 million and code “2” when gross annual revenues were greater than $1 million. In other instances, “NA” was not included in the revenue indicator field when the bank did not collect gross annual revenue information from the business or farm. Examiners determined that the root causes of the violations were inadequate staff training and the lack of controls, such as secondary reviews, to ensure collected data reflected the information in the loan documents.
Sound Practices to Mitigate Compliance Issues
Most of the Regulation BB data collection and reporting compliance violations occurred because of inadequate software monitoring, internal controls and second reviews, and staff compliance training. Examiners also attributed primary root causes to inadequate change management oversight, with management not ensuring that banks reviewed and updated their compliance management systems to align with regulatory and filing requirements and any changes to bank strategy, structure, staff, or software systems.
The table lists sound compliance practices examiners have observed and recommended to address the CRA data collection and reporting violations discussed in this article. Financial institutions can also review the Federal Financial Institutions Examination Council’s 2015 A Guide to CRA Data Collection and Reporting, which contains helpful compliance tips.
TABLE: Sound Compliance Practices
| Senior Management Oversight |
|
| Internal Controls |
|
| Training |
|
| Monitoring and Audit |
|
| Policies and Procedures |
|
Concluding Remarks
This article describes the most common Federal Reserve System CRA examination violations relating to data collection and reporting requirements for large banks and recommends sound compliance practices to help banks address the root causes of those violations and mitigate risks. Banks with questions about CRA data collection and reporting requirements should contact their primary federal regulator.
ENDNOTES
1 See 12 C.F.R. Part 228. The CRA implementing regulations of the Federal Deposit Insurance Corporation (FDIC) (12 C.F.R. Part 345) and the Office of the Comptroller of the Currency (OCC) (12 C.F.R. Part 25) are substantially similar for the institutions they supervise. For convenience, this article refers and cites to Regulation BB. In October 2023, the Federal Reserve Board, the FDIC, and the OCC jointly issued a final rule to amend their CRA regulations. 89 FR 6574 (February 1, 2024). Although the October 2023 CRA final rule was intended to take effect on April 1, 2024, the final rule was challenged in litigation and is currently enjoined. Therefore, the agencies’ legacy CRA regulations remain in effect. The text of the Federal Reserve Board’s legacy CRA regulation may be found: (i) in the 2022, 2023, 2024, or 2025 bound versions of title 12 of the Code of Federal Regulations; and (ii) in the historical version of the Electronic Code of Federal Regulations (eCFR) as of March 29, 2024. On July 16, 2025, the agencies issued a proposed rule that would rescind the October 2023 CRA final rule and replace it with the agencies’ CRA regulations (i.e., the regulations in effect on March 29, 2024), with conforming amendments to the agencies’ definitions of small bank and intermediate small bank. 90 FR 34086 (July 18, 2025). On August 12, 2026, the OCC and FDIC issued a proposed rule to amend their CRA implementing regulations, with a comment period closing on October 13, 2026. 91 FR 52114 (August 12, 2026).
2 12 U.S.C. §2901 et seq.
3 The CRA examinations were conducted in 2025 and evaluated compliance with CRA data collection and reporting requirements since these state member banks’ last examinations. Banks’ examination cycles vary, depending on an individual bank’s asset size and ratings. Because data collection and reporting requirements apply only to large banks, the CRA examination cycle is either 24 months for large banks with a CRA rating of “Satisfactory” or “Outstanding” or 12 months for large banks with a CRA rating of “Needs to Improve” or “Substantial Noncompliance.”
4 The article includes information from the presentation slides for a 2010 Outlook Live webinar, “Tips for Reporting Accurate HMDA and CRA Data,” presented by Federal Reserve Bank of Atlanta Senior Examiner Cindy J. Anderson and Federal Reserve Bank of Minneapolis Vice President Karin Bearss (November 17, 2010).
5 12 U.S.C. §2901(b), §2903(a)(1).
6 12 U.S.C. §2902(2); 12 U.S.C. §1813(c)(2) (definition of insured depository institution). For purposes of this article, the term bank includes state member banks (and certain uninsured state branches of foreign banks), as defined in 12 C.F.R. §228.11.
7 Under their CRA regulations, the agencies annually adjust the asset-size thresholds used to define small bank and intermediate small bank. The current asset-size thresholds are effective as of January 7, 2026.
8 12 C.F.R. §228.12(x).
9 12 C.F.R. §228.12(n).
10 12 C.F.R. §228.27.
11 12 C.F.R. §228.42(f).
12 12 C.F.R. §228.42(a)(3).
13 12 C.F.R. §228.42(a)(4).
14 See A Guide to CRA Data Collection and Reporting at p. 11; 12 C.F.R. §228.12(o)(3).
15 Interagency Questions and Answers Regarding Community Reinvestment, Q&A §__.42(a)(3)—1.