Regulators abandoned the 2023 CRA modernization rule, but the preparation exposed longstanding governance, data, and oversight weaknesses that remain subject to examiner scrutiny. Institutions and their internal audit functions should revisit CRA now to confirm that two years of uncertainty did not create blind spots in an ongoing program.
Executive Summary
The federal banking agencies’ decision to abandon the 2023 Community Reinvestment Act modernization effort brought welcome clarity to an industry that had spent years preparing for sweeping regulatory change. Institutions invested significant resources in evaluating data requirements, governance structures, assessment-area methodologies, and compliance processes designed around a future framework that never took effect. Yet the most important consequence of the modernization effort may not have been regulatory at all.
The preparation process forced institutions to reexamine longstanding assumptions about how CRA programs were governed, monitored, measured, and audited. In many cases, those reviews revealed weaknesses that had little to do with proposed regulations and everything to do with existing program oversight. As regulators return to the longstanding CRA framework that has governed examinations for decades, compliance leaders face a different challenge: determining whether two years of uncertainty created blind spots in programs that remain subject to examiner scrutiny today. [1][2]
Key Takeaways
• CRA modernization may have been suspended, but examiner expectations regarding governance, monitoring, documentation, and board oversight remain unchanged under the longstanding CRA framework. [2][4]
• Prolonged regulatory uncertainty can lead to institutional drift as projects are paused, priorities shift, and independent assurance activities are deferred.
• Many modernization initiatives revealed weaknesses in data governance, community development tracking, management reporting, and compliance oversight that predated the proposed rule changes.
• Internal Audit functions should reassess CRA coverage to determine whether uncertainty created gaps in assurance for key program components. [5]
• Institutions that strengthen governance and independent oversight now will be better positioned, regardless of the future direction of CRA reform. [6]
CRA Modernization Was Rescinded. The Audit Gap It Exposed Was Not.
Few regulatory initiatives have drawn as much attention from Compliance departments in recent years as the effort to modernize the Community Reinvestment Act. When federal banking agencies finalized a substantially revised CRA framework in 2023, institutions nationwide began preparing for what many viewed as the most significant change to CRA implementation since the performance-based reforms of the 1990s. Compliance teams launched readiness programs. Technology groups assessed data infrastructure. Boards received updates on implementation timelines and emerging requirements. Internal auditors began considering how assurance activities would evolve under a dramatically different examination approach. [3]
The story ultimately took a different turn. Litigation prevented the rule from taking effect, and in 2025 federal regulators announced their intent to rescind the framework and revert to the longstanding CRA regulations that continue to govern examinations today. The industry’s immediate reaction was understandable. Institutions that had devoted considerable resources to modernization suddenly found themselves operating under familiar rules again. For many compliance executives, the announcement appeared to remove a significant regulatory burden. [1][2]
Yet regulatory developments often have second-order effects that prove more consequential than the rules themselves. The most important question emerging from the CRA modernization effort is not whether the 2023 framework survived, but what happened inside institutions as they prepared for it.
The answer varies from one financial institution to another, but a common theme has emerged across the industry. During periods of prolonged uncertainty, organizations naturally redirect attention to anticipated future requirements. Existing controls are reassessed in light of upcoming change. Investments are evaluated against future-state needs. Audit plans begin to accommodate pending regulatory developments. None of these decisions are inherently problematic, and many represent prudent management. The challenge arises when uncertainty persists long enough to shift organizational priorities without providing clear direction on what comes next.
The Regulatory Debate Distracted From a More Important Risk
The regulatory conversation about CRA modernization has understandably focused on rulemaking, litigation, implementation dates, and examination frameworks. Those issues matter. They shape compliance obligations, influence resource allocation, and affect strategic planning across the financial services sector. Yet they can also obscure a more practical operational reality.
Most weaknesses identified during modernization efforts were not caused by the proposed rule. Institutions evaluating expanded reporting requirements frequently encountered challenges with data quality, data lineage, and reporting consistency. Financial institutions reviewing potential assessment area changes often found documentation practices that relied heavily on institutional knowledge rather than formal governance processes. Community development reviews sometimes revealed inconsistencies in how activities were identified, documented, tracked, or presented to leadership. These were not modernization problems. They were existing governance issues exposed by modernization exercises.
This distinction helps explain why some organizations emerged from the modernization process stronger than others, despite facing the same regulatory uncertainty. The strongest institutions treated modernization not merely as a compliance project but as a diagnostic exercise. Preparation efforts provided visibility into operational weaknesses that might otherwise have remained undiscovered until an examination, audit, or regulatory inquiry brought them to light. That perspective becomes increasingly important as regulators return to the established CRA framework. Examinations continue to be conducted under longstanding procedures, and expectations regarding governance, lending performance, assessment areas, community development activities, and data integrity remain firmly in place. [4][5] The institutions that derive the greatest long-term value from modernization investments may ultimately be those that used the process to strengthen governance rather than simply prepare for a new rule.
How Regulatory Uncertainty May Create Institutional Drift
The greater risk associated with prolonged uncertainty is not noncompliance but institutional drift.
Institutional drift rarely occurs when an organization consciously lowers its standards. It develops gradually as attention shifts, assumptions evolve, and priorities change. Projects that once seemed urgent are deferred pending further clarity. Program reviews are postponed until future requirements are clearer. Risk assessments remain technically accurate but increasingly disconnected from evolving operational realities.
Institutional drift rarely occurs when an organization consciously lowers its standards. It develops gradually as attention shifts, assumptions evolve, and priorities change.
CRA programs are particularly vulnerable to this phenomenon because they sit at the intersection of lending, compliance, community development, governance, and strategic planning. When the program’s future is uncertain, management decisions naturally become more cautious. Resources are preserved, investments are reconsidered, and long-term initiatives are placed on hold. Over time, however, those individual decisions can produce cumulative effects that are difficult to recognize from within the organization.
The consequences are often subtle. Board reporting becomes increasingly routine rather than analytical. Monitoring focuses on historical performance rather than emerging risks. Community development activities continue, but documentation standards become inconsistent. Policies remain technically compliant yet fail to reflect evolving operational practices. None of these developments necessarily constitutes an examination finding. Collectively, however, they can weaken management’s ability to understand the program’s actual condition.
Perhaps most importantly, prolonged uncertainty affects the independent assurance environment surrounding CRA. Audit plans developed during periods of anticipated change often incorporate assumptions about future regulatory expectations. Reviews may be rescheduled, redesigned, or deferred as organizations await clarity. What begins as a reasonable planning response can eventually lead to periods when critical components of the program receive less attention than they otherwise would under more stable conditions.
Why Internal Audit Should Revisit CRA Now
The Internal Audit opportunity created by this moment extends beyond traditional compliance testing. The more pressing question for boards and executive management is whether the program in place today reflects the same level of oversight, challenge, and assurance that existed before uncertainty became a defining feature of the regulatory environment.
For Internal Audit functions, that inquiry begins with governance rather than technical requirements. Which modernization projects changed existing processes? Which initiatives were suspended but never formally closed? Which assumptions guided program decisions over the past two years? Have risk assessments been revisited since regulators signaled a return to the longstanding framework? Does the board receive information that accurately reflects current program performance rather than implementation activities that are no longer relevant?
These questions closely align with the principles underlying the Institute of Internal Auditors’ Three Lines Model, which emphasizes independent assurance of governance, risk management, and control effectiveness. [6] Internal audit’s responsibility is not merely to determine whether controls operate as designed. It is to provide objective insight into whether management understands the risks associated with the programs it oversees.
That distinction is especially important in the current environment. The largest CRA risks facing many institutions today are unlikely to stem from misunderstanding a recently rescinded rule. They are more likely to arise from assumptions adopted during a period of uncertainty and never revisited after circumstances changed.
At some point, regulators will revisit CRA modernization. Whether the next effort resembles the 2023 framework is less important than many institutions assume. Organizations with strong governance structures, reliable data, effective oversight mechanisms, and credible independent assurance functions will adapt successfully, regardless of the specific regulatory model that emerges.
That may be the lasting lesson from the past several years. The modernization effort was intended to reshape how CRA programs would be evaluated. Instead, it exposed how many institutions evaluate themselves.
The rule may never take effect, but the insight it produced should not be wasted.
About the Author
Celeste Burton is Compliance Practice Director at AuditOne, with more than 30 years of experience in banking, internal audit, and regulatory compliance. A Certified Internal Auditor and graduate of the ABA National Compliance School, she has held senior Internal Audit and Compliance roles at Bank of America, Countrywide, and American Express. She holds a dual major B.A. in Accounting and Finance from the University of California, Berkeley.
References
[1] Federal Deposit Insurance Corporation, Federal Reserve Board, and Office of the Comptroller of the Currency, Agencies Issue Joint Proposal to Rescind 2023 Community Reinvestment Act Final Rule, 2025.
[2] Office of the Comptroller of the Currency, Community Reinvestment Act: Rescinding the 2023 CRA Final Rule, OCC Bulletin 2025-5, 2025.
[3] Federal Reserve Board, Community Reinvestment Act 2023 Final Rule and Subsequent Rulemaking Notices, 2023 to 2025.
[4] Federal Financial Institutions Examination Council (FFIEC), CRA Examination Procedures for Small, Intermediate Small, and Large Institutions.
[5] Federal Deposit Insurance Corporation, Consumer Compliance Examination Manual, Community Reinvestment Act Section and Interagency Questions and Answers Regarding Community Reinvestment.
[6] Institute of Internal Auditors, The IIA’s Three Lines Model: An Update of the Three Lines of Defense.
