CRA Community Reinvestment Act Audit Overview

The Community Reinvestment Act audit is a specialized compliance review that evaluates whether a depository institution is meeting its obligations to serve the credit needs of low- and moderate-income communities in its assessment area. This page covers the regulatory framework governing CRA examinations, how the audit process unfolds, the scenarios that typically trigger intensified scrutiny, and the decision boundaries that separate satisfactory from deficient performance ratings. Understanding this process is essential for any bank, thrift, or credit union subject to federal oversight.

Definition and scope

The Community Reinvestment Act, enacted in 1977 (12 U.S.C. § 2901 et seq.), was established to prevent redlining and ensure that federally insured depository institutions affirmatively meet the credit needs of all segments of their communities, including low- and moderate-income (LMI) neighborhoods. Three federal agencies share examination authority: the Federal Reserve Board (FRB) supervises state-chartered Federal Reserve member banks, the Office of the Comptroller of the Currency (OCC) oversees national banks, and the Federal Deposit Insurance Corporation (FDIC) examines state-chartered nonmember banks and savings institutions.

CRA obligations apply to all FDIC-insured commercial banks and savings associations. Credit unions, mortgage companies that do not hold FDIC-insured deposits, and non-bank fintechs are generally outside the CRA's direct scope — though the CFPB and state regulators may impose analogous fair lending requirements on such entities. For institutions within scope, CRA performance is evaluated at periodic intervals linked to the institution's examination schedule, asset size, and prior performance rating. Institutions with assets above $1.564 billion (2023 threshold indexed by the FDIC) are classified as large institutions and face the most comprehensive multi-test examination framework.

A CRA audit, as distinct from the regulatory examination itself, is an internal or third-party review conducted by the institution to assess its own compliance posture before — or in preparation for — an official examination. For background on how this fits within broader bank compliance reviews, see FDIC Audit Requirements for Banks and Compliance Audit vs Financial Audit.

How it works

A CRA audit follows a structured sequence that mirrors the methodology federal examiners use under 12 C.F.R. Part 25 (OCC), 12 C.F.R. Part 228 (FRB), and 12 C.F.R. Part 345 (FDIC), as amended effective February 27, 2026.

  1. Institution size classification — The first step identifies which examination test applies. Large institutions face the Lending Test, Investment Test, and Service Test. Intermediate small institutions (assets between $390 million and $1.564 billion, per 2023 FDIC thresholds) are subject to the Lending Test and a Community Development Test. Small institutions (below $390 million) are evaluated primarily on lending performance.

  2. Assessment area delineation — Auditors verify that the institution has correctly drawn its Community Reinvestment Act assessment area(s) to include the geographies where it accepts deposits and has branches, without arbitrarily excluding LMI census tracts.

  3. Lending performance analysis — Under the Lending Test, examiners and internal auditors analyze the geographic distribution and borrower profile of home mortgage loans (using HMDA data filed under 12 C.F.R. Part 1003), small business loans, small farm loans, and community development loans. Peer comparisons and demographic benchmarks from the U.S. Census Bureau are applied to measure proportionality.

  4. Investment Test review — Qualified investments — equity investments, grants, and deposits in community development financial institutions (CDFIs) or similar vehicles — are catalogued and evaluated for their responsiveness and innovativeness relative to the institution's capacity.

  5. Service Test analysis — Branch distribution, alternative delivery systems, and community development services (e.g., financial literacy programs, technical assistance to nonprofits) are mapped against LMI census tract boundaries.

  6. Ratings determination — Each test receives a component rating: Outstanding, Satisfactory, Needs to Improve, or Substantial Noncompliance. The composite CRA rating is derived from the component ratings.

For context on how examiners and internal auditors interact within this framework, see Bank Examination vs Financial Audit.

Common scenarios

Three recurring situations characterize CRA audit engagements:

Pre-examination preparation reviews — An institution schedules an internal CRA audit 12–18 months before its anticipated regulatory examination to identify gaps in lending distribution, investment gaps, or service delivery shortfalls. This is the most common audit scenario.

Merger and acquisition due diligence — Federal regulators condition approval of bank mergers on satisfactory CRA ratings. Institutions with a rating of Needs to Improve or Substantial Noncompliance face heightened scrutiny, potential denial, or required remediation commitments under 12 U.S.C. § 2903. Acquirers routinely commission third-party CRA audits to assess the target institution's exposure.

Post-examination remediation — Following an official examination that identifies weaknesses, institutions undertake a targeted audit to evaluate the effectiveness of corrective measures before the next examination cycle. This often involves re-analyzing HMDA loan application registers and re-mapping qualified investment portfolios.

For institutions navigating concurrent fair lending obligations, the Fair Lending Audit Requirements page addresses how CRA performance data intersects with ECOA and Fair Housing Act compliance reviews.

Decision boundaries

The line between a Satisfactory and a Needs to Improve CRA rating turns on several measurable factors that auditors must understand in concrete terms.

Large vs. intermediate small institution standards — A large institution that receives a Needs to Improve on the Lending Test cannot achieve a Satisfactory composite rating, regardless of strong Investment or Service Test scores. The Lending Test carries a dispositive weight under the large institution examination framework (12 C.F.R. § 25.21(b)).

HMDA data integrity — CRA examiners rely heavily on HMDA Loan Application Register data. Institutions with error rates above 5% of reported records in their HMDA data face credibility impairment on the Lending Test, because examiners may question whether the loan universe analyzed accurately reflects actual origination patterns.

Qualified investment definition boundaries — Not all community-facing expenditures qualify as CRA investments. Investments must benefit the assessment area and meet the definition in agency guidance (Interagency Questions and Answers Regarding Community Reinvestment, 81 Fed. Reg. 48506 (2016)). Corporate philanthropy not tied to LMI benefit, general advertising, and non-mission-related bank services do not count.

Strategic plan alternative — An institution may elect to be evaluated under a Board-approved strategic plan rather than the standard test framework, but this path requires advance regulatory approval. Strategic plans set performance targets that the institution must meet to achieve a given rating, creating a different — and more predictable — audit boundary structure.

For additional context on how ratings translate into consequences and how audit findings are documented, see Audit Findings and Management Response and the broader Financial Audit Types Explained overview.

References

📜 13 regulatory citations referenced  ·  🔍 Monitored by ANA Regulatory Watch  ·  View update log

Explore This Site

Regulations & Safety Regulatory References Tools & Calculators Compound Interest Calculator