The CRA modernization rule finalized by the FDIC introduced changes to assessment methodology that go well beyond updating asset thresholds. For community banks, the practical implication is a set of new data collection obligations that most existing CRA programs were not designed to handle, combined with revised performance test frameworks that require demonstrating lending, investment, and service activity differently than before.
This post focuses specifically on the data collection requirements and how they map to existing controls, because that is where the compliance gap tends to be most concrete. We are not trying to summarize the entire rule. We are trying to answer the question that community bank compliance officers are asking: what specifically needs to change in our program?
The Assessment Area Definition Change
One of the more significant structural changes in the modernized rule is the expansion of what counts as an assessment area. Under the prior CRA framework, assessment areas were defined primarily around deposit-taking facilities. The modernized rule adds facility-based assessment areas alongside outside retail lending areas for banks that originate a significant volume of loans outside their facility-based footprint.
For community banks that have expanded their online lending presence, this creates a new category of geographic obligations. A community bank headquartered in a mid-size Midwestern city that originates mortgages in other metro areas through digital channels may now have to demonstrate CRA performance in those outside retail lending areas, not just in its facility-based assessment area. The threshold for triggering an outside retail lending area obligation is based on a percentage of total lending activity in that geography.
The data implication: you need to know where your loans are going, at a more granular geographic level than may have been tracked previously, to determine whether outside retail lending area obligations are triggered and to document performance in them if they are.
The 11 New Data Fields and What Controls They Touch
The modernized rule requires collection and reporting of data fields that were not required under the prior framework. We mapped these against the control categories community banks typically maintain for CRA compliance:
Census tract of property location for HMDA-reportable mortgages. Most banks already collect this under HMDA, so the incremental burden here is low. The control that owns this data should already have it. The question is whether the CRA program is consuming the HMDA data directly or maintaining a separate collection process that may diverge.
Census tract of business location for small business and small farm loans. This is where the new burden is most significant for community banks that do not already geo-code business loan addresses at origination. The data field is required for loans to businesses and farms meeting the small business or small farm loan definitions in the modernized rule. If your loan origination system captures address but does not geo-code to census tract, you have a data gap that needs to either be addressed in the LOS or through a post-origination batch geocoding process.
Gross annual revenues of borrowers for small business loans. Required to verify that the loan qualifies as a small business loan under the modernized rule definition. Most banks collect this at underwriting. The control question is whether this field is reliably captured in a way that can be reported, or whether it lives in unstructured underwriting notes that require manual extraction.
Origination channel (online versus in-person). New field. Required to support the assessment methodology distinctions the rule makes between in-person and digital lending activity. A bank using both channels needs a reliable flag on each loan record. If your LOS does not capture origination channel as a structured field, this requires a system configuration or process change before the data collection obligations take effect.
The remaining fields in the new set relate to community development loan and investment data, performance context documentation, and assessment area boundary reporting. These are less likely to create data infrastructure gaps but require process documentation updates to ensure the CRA program is capturing the right information in a retrievable format.
The Performance Test Changes
Beyond data collection, the modernized rule changes the performance tests that determine CRA ratings. The retail lending test replaces the prior lending test with a methodology that includes benchmarks. Performance is evaluated against both a geographic distribution benchmark and a borrower distribution benchmark, using data on actual lending in the assessment area as the comparison set.
For community banks, this means a CRA program that previously relied on examiner judgment and qualitative context will now produce quantitative performance metrics that are compared to benchmarks. The controls that feed this analysis need to ensure that the loan data used for benchmark comparison is complete and accurate. Missing data skews the performance calculation.
We are not saying the benchmark approach is unfavorable to community banks. The rule does include performance context provisions that allow examiners to consider factors affecting a bank's ability to meet benchmarks, including local market conditions and the bank's capacity and constraints. But the performance context documentation requires its own controls. Collecting and maintaining the data that supports a performance context argument is not automatic.
The Community Development Finance Test
The community development finance test in the modernized rule evaluates community development loans and investments differently than the prior framework, using impact and responsiveness criteria alongside the traditional volume metrics. This requires that banks document the community development purpose of each qualifying activity in a way that maps to the rule's qualifying activity categories.
A community bank that has been tracking community development activity in a spreadsheet with informal purpose codes needs to revisit whether those codes align with the modernized rule's qualifying activity framework. The risk is not that the underlying activity fails to qualify. It is that the documentation does not demonstrate qualification in the way the rule and examination procedures expect to see it.
Control Update Priorities
Mapping the obligations above to the control areas most commonly cited in CRA-related exam findings, the highest-priority control updates are: the data collection process for census tract geo-coding on business loans, the origination channel field capture, and the community development documentation framework.
The assessment area boundary documentation requirement is less likely to be a gap at most community banks, but it is worth reviewing whether the current process for defining and documenting assessment areas explicitly covers the outside retail lending area determination logic the modernized rule requires.
For banks whose CRA program was designed around the prior rule framework, a systematic gap assessment against each of the new performance test data requirements, before the applicable compliance dates, avoids the situation where the first examination under the modernized rule reveals data gaps that have been accumulating since implementation.
The implementation timelines in the modernized rule are tiered by asset size. Reviewing where your bank falls in the tier schedule determines how much runway exists for control updates before data collection obligations become binding. The tiering schedule is in Part 345 of the FDIC regulations as modified by the final rule.