This post was updated to reflect new compliance deadlines finalized by the CFPB on Oct. 2, 2025.
New timelines for small business loan data collection and reporting
The Consumer Financial Protection Bureau (CFPB) 1071 rule was originally effective in 2023, but section 1071 compliance dates have been extended. The 1071 compliance dates are for collecting and reporting data on small business loan activities.
You might also like this one-page summary of key dates and deadlines for complying with the 1071 rule.
Takeaway 1
The effective date of the CFPB's new rule based on Section 1071 of the Dodd-Frank Act was August, 29, 2023. But compliance dates and deadlines are tiered and start in 2026.
Takeaway 2
The reporting tiers and compliance deadlines for CFPB 1071 are based on the number of covered transactions a lender originated in 2022 and 2023, in 2023 and 2024, or in 2024 and 2025.
Takeaway 3
As modified by the CFPB in October 2025, the earliest deadline to begin collecting data is July 1, 2026. The earliest for reporting initial data is June 1, 2027.
Final rule
Effective dates & compliance dates for rule 1071
As they do with any new requirement, financial institutions want to know when the CFPB 1071 rule is effective and when they must begin collecting and reporting data on their small business lending activities.
The effective date of the Consumer Financial Protection Bureau’s (CFPB) new rule was August 29, 2023. However, compliance deadlines and related deadlines for reporting the data collected about small business loan applications are tiered. This staggering of compliance deadlines requires the small business lenders originating the most transactions to begin reporting data earlier than less active small business lenders.
In addition, court cases and changes to the rule have delayed compliance dates, in much the same way compliance with the current expected credit loss (CECL) model was delayed by several actions.
In the case of 1071, a Texas judge originally stayed compliance deadlines pending a Supreme Court ruling over the constitutionality of CFPB funding. Following the Supreme Court's decision in favor of the CFPB on that issue, however, the agency extended the 1071 rule’s compliance deadlines. The CFPB issued a final rule outlining the new 1071 compliance dates and filing deadlines as follows:
| Compliance Tier | Original Date (2023 Final Rule) | 2024 Interim Rule | New Date (2025 Interim Rule) | First Filing Deadline |
|---|---|---|---|---|
| Tier 1 (highest-volume) | October 1, 2024 | July 18, 2025 | July 1, 2026 | June 1, 2027 |
| Tier 2 (moderate-volume) | April 1, 2025 | January 16, 2026 | January 1, 2027 | June 1, 2028 |
| Tier 3 (smallest-volume) | January 1, 2026 | October 18, 2026 | October 1, 2027 | June 1, 2028 |
Source: CFPB
How to stay ahead of compliance
Despite the seemingly long runway to prepare, it's not too early to get a handle on the new requirements and how they will affect a bank or credit union. With the changes, many financial institutions face the most significant data collection and reporting effort in nearly 50 years. Given this scope, lenders need to begin assessing now how and when they will comply.
Abrigo has helped hundreds of bank and credit union staff members learn more about 1071 and how to prepare for it. Webinars, podcasts, and whitepapers provide tips for capturing small business loan data, storing it, and reporting it to the CFPB to comply with the required timelines. In addition, Abrigo's small business loan origination software can automate 1071 data collection and reporting.
Below are details on important dates for 1071 compliance, which financial institutions must comply, and what the changes involve.
Which FIs must comply
What are the goals of 1071?
Before discussing 1071 compliance dates, it’s helpful to understand the rule’s goals and which financial institutions it affects.
The final rule implements section 1071 of the Dodd-Frank Act by amending the Equal Credit Opportunity Act (ECOA), or Regulation B (Reg B). The CFPB small business lending data collection regulations are being included as subpart B of Reg B and aim to support and enforce the fair lending requirements. CFPB intends the data collected by lenders on each small business credit application to shed light on potential disparate treatment in loan terms, especially related to minority-owned small business applicants, including women-owned small businesses. Reporting on the data is also expected to help identify small business owners’ needs and credit opportunities. A CFPB compliance aid lists 81 data fields for information lenders must collect and report.
Which lenders are counted as “covered financial institutions” in the 1071 rule?
The rule outlines that any company or organization engaged in lending activities is covered.
Each reporting tier and its associated deadline is determined by the number of covered transactions to small businesses that a lender originated in each of two years, whether it's 2022 and 2023, or 2023 and 2024, or 2024 and 2025.
In fact, to be subject to the rule’s requirements at all (i.e., be considered a “covered financial institution”), a company or organization must have originated at least 100 covered credit transactions in each of the two years it selects.
What is a covered transaction
The CFPB generally describes it as a request for any of the following:
- Loans
- Lines of credit
- Credit cards
- Merchant cash advances
- Credit products used for agricultural purposes
Requests for additional credit on an existing loan are not counted as originations for the purpose of determining a covered financial institution.
Defining "application" for a covered transaction
For data collection and reporting, financial institutions must track applications they receive for covered transactions, as opposed to solely tracking originations. What is an application under the CFPB 1071 rule? It is an oral or written request for a covered credit transaction that is made following the procedures used by a financial institution for the type of credit requested. This means that lenders must track data not only related to approved and booked credit but also applications that are any of the following:
- Withdrawn
- Incomplete
- Denied
- Approved by the lender but not accepted by the applicant
A re-evaluation, extension, or renewal request on an existing business account is excluded from the definition of covered applications as long as the request seeks no additional credit. Inquiries and prequalification requests are also excluded.
How a lender defines an application as incomplete or withdrawn can vary from financial institution to institution, noted Abrigo Senior Advisor Paula King, CPA, who is already working with financial institutions to plan for and prepare 1071 reporting.
The CFPB “has left it up to financial institutions as to where you feel the cutoff is for an incomplete application” or a withdrawn application, she said. Regardless of how the bank or credit union defines these application resolutions, the lender should spell it out in the loan policy, King added. Loan policies should also clarify how a counteroffer by the lender will be treated.
Which credit transactions are excluded from 1071?
Several types of transactions are excluded from the CFPB’s requirements to report on applications. Among those considered excluded transactions:
- Letters of credit
- Trade credit (i.e., financing arrangements such as accounts receivable with a business providing goods or services)
- Public utilities credit
- Securities credit
- Incidental credit defined in Regulation B as exempt (e.g., not payable in more than four installments; not subject to finance charge)
- Factoring
- Leases
- Consumer-designated credit used for business/ag purposes, such as taking out a home equity line of credit or charging business expenses on their personal credit cards
- Purchases of originated covered credit transactions
- Applications with potential HMDA and section 1071 overlap: CFPB does not require reporting under section 1071 (transactions would only be reportable under HMDA)
A final component of the rule that is useful in understanding the various deadlines for 1071 reporting is the CFPB’s description of what constitutes a small business. An applicant or borrower is considered a small business if it is a business (including agricultural) that had $5 million or less in gross annual revenue for its preceding fiscal year before applying.
Would you like to stay up to date on CFPB 1071 implementation?
This means that in addition to banks and credit unions, other lenders subject to the rule’s mandates are finance companies, online lenders, Community Development Financial Institutions (CDFIs), government lenders, and nonprofit lenders.
Three deadlines for tracking, reporting data
Tiers determined by transaction volume
The earliest reporters are those that have originated at least 2,500 small business loans. These financial institutions must begin data collection in July 2026 and continue through the end of the year, based on the CFPB's timeline. The data collected needs to be reported by June 1, 2027. For following years, lenders must collect data for the full year and report it by the following June 1.
The second tier of deadlines covers financial institutions with at least 500 covered originations during the relevant two-year period. This group of small business lenders must begin collecting data on Jan. 1, 2027, and they must report data collected for the entire year by June 1, 2028.
The last group of lenders required to collect and report data on small business loan applications is financial institutions with at least 100 covered originations. These banks, credit unions, and other lenders have to begin collecting data on Oct. 1, 2027, and they are required to report the data by June 1, 2028.
The CFPB produced an info sheet with more details and examples of how financial institutions collect data and comply with the small business lending rule.
In this document, the bureau notes that if an institution determines it’s not required to comply with the rule initially, it must nevertheless determine in subsequent years whether it must, based on whether it originates at least 100 covered originations in each of the two calendar years immediately preceding the year in question. The document was written before the Supreme Court ruling that prompted the extension of the compliance dates for 1071, so it's likely to include outdated deadlines.
Abrigo can help you navigate 1071 deadlines and compliance. In addition to our 1071 resource page for lenders, which has updated information to help prepare for the new requirements, Abrigo’s Loan Origination Software already has all required data fields in a borrower-facing collection form, access to pre-built reports, and the ability to export for CFPB reporting. Your financial institution can comply with 1071 while streamlining the origination process and ongoing customer management while working with a trusted partner of 2,400 institutions. Talk to a specialist to learn more.
CFPB small business data collection
Read practical tips for banks and credit unions to manage their 1071 rule data collection processes efficiently so they can stay ahead of deadlines and avoid compliance problems.
Takeaway 1
Under the CFPB small business data collection rule, any lender is required to collect and report demographic data during the application process.
Takeaway 2
The small business lending data regulations require data points covering details related to the credit transaction, the business’s attributes, and demographic data..
Takeaway 3
Reviewing existing data collection and assessing lending processes are among steps for banks and credit unions to organize the data collection process.
This article was updated to reflect the Oct. 2, 2025, final rule published by the Consumer Financial Protection Bureau to extend the original deadlines to those set out in its June 18, 2025, interim final rule.
Banks and credit unions prepare
CFPB 1071 rule has significant requirements
The Consumer Financial Protection Bureau’s (CFPB) small business data collection rule, often referred to as the 1071 rule, is set to be the most significant effort of data collection and reporting for financial institutions in nearly 50 years. Banks and credit unions must prepare to meet the rule’s requirements by understanding what data must be collected, when it needs to be collected, and how to streamline the process to ensure compliance.
This article describes the scope of the CFPB small business lending data regulations and offers practical tips for banks and credit unions to manage their data collection processes efficiently. Understanding the rule and preparing adequately will help your financial institution stay ahead of deadlines and avoid compliance problems.
Rule covers all lenders
The scope of small business data collection
The CFPB’s small business data collection rule implements Section 1071 of the Dodd-Frank Act, which directs the bureau to collect certain demographic data from small business lenders. The primary goal of the federal rule is to facilitate fair lending enforcement and identify the credit needs of women- and minority-owned businesses.
Under this rule, any entity engaged in lending activities is required to collect and report demographic data during the application process. This includes not just banks and credit unions but also finance companies, online lenders, Community Development Financial Institutions (CDFIs), government lenders and nonprofit lenders. The only lenders excluded from these requirements are those that originated fewer than 100 covered credit transactions in each of the two calendar years preceding their compliance date. Requests for additional credit tied to an existing loan do not count as originations when determining whether an institution is covered.
The rule requires that lenders collect and report data for all small business credit applications from any business with $5 million or less in gross annual revenue its preceding fiscal year. Credit transactions covered by the rule include applications or requests for:
- Loans
- Lines of credit
- Credit cards
- Merchant cash advances
- Credit products used for agricultural purposes
- Refinancings where existing debt is satisfied and replaced by a new obligation for the same borrower
Who must file when
Compliance deadlines for 1071 small business lending data regulations
Lender deadlines for 1071 compliance are initally determined by the volume of small business loans originated in each of the calendar years 2022 and 2023 or in 2023 and 2024 or in 2024 and 2025. Abrigo has a one-pager summarizing the 1071 data collection and reporting deadlines. Here’s a general overview of when different types of lenders must begin data collection, based upon their origination thresholds and the final rule published Oct. 2, 2025:
- Lenders that originate at least 2,500 small business loans in each of the years must start collecting data on covered applications by July 1, 2026.
- Lenders that originate at least 500 covered loans in each of the years must begin data collection by Jan. 1, 2027.
- Lenders that originate at least 100 small business loans in each of the years must collect application data starting Oct. 1, 2027.
Stay up to date with CFPB small business lending data collection requirements.
To prepare for these deadlines, lenders may begin gathering the otherwise protected demographic information one year before their official collection deadline. This head start can help institutions ensure timely compliance and address any challenges in advance.
20+ pieces of data
Key data points under 1071 small business lending data regulations
Banks, credit unions, and other creditors will need to collect more than 20 pieces of data for each application and report this data to the CFPB each year. The data points cover a wide range of details related to the credit transaction, the business’s attributes, and demographic data.
Some of the key 1071 data points required include:
- Application date and method (in person, telephone, online, mail)
- Credit type, including the product type (term loan, line, credit card, etc.), guarantee type (personal, SBA, USDA, etc.), and loan term (in months)
- Purpose of the credit (e.g., purchase, working capital, construction, etc.)
- Amount applied for
- Action taken on the application (originated, denied, withdrawn, etc.) and date of action
- Amount approved or originated
- Denial reasons (e.g., business characteristics, cash flow, collateral)
- Pricing details (interest rate, origination charges, broker fees, initial annual charges, additional cost for merchant cash advances, and prepayment penalties)
- Census tract number. This information should represent the address where loan proceeds will be applied, the address of the applicant’s headquarters or main office, or another address associated with the applicant
- Gross annual revenue. Financial institutions may reuse previously collected gross annual revenue figures when the data was collected within the same calendar years as the covered application
- NAICS code
- Number of workers and time in business
- Business ownership status (such as minority, women, LGBTQI+)
- Number of principal owners and ethnicity, race, and sex/gender of principal owners 1-4. This data must be reported based only on information provided by the applicant (i.e., no reporting based on visual observation)
Importantly, the CFPB mandates that lender data collection processes shouldn’t discourage applicants from providing their demographic information. Financial institutions will want to make data collection processes as easy as possible for applicants to encourage participation.
The first filing dates for reporting the small business lending data under the final rule published Oct. 2, 2025, are as follows:
- Highest volume lenders (Tier 1): June 1, 2027
- Moderate volume lenders (Tier 2): June 1, 2028
- Smallest volume lenders (Tier 3): June 1, 2028
Existing data and processes
Tips for organizing and streamlining data collection processes
Given the scope of effort needed to collect and report data by the CFPB deadlines, some financial institutions are already taking action. In fact, if you are a tier 1 lender and have to comply beginning July 1, 2026, we recommend beginning your testing now to give you at least nine months of testing.
For those who may feel overwhelmed by the tasks ahead, the following steps can help organize and streamline the data collection process:
- Understand the rule and related requirements. Make sure others involved in lending are familiar with the 1071 small business lending data regulations and the specific requirements for CFPB small business data collection.
- Review existing data collection practices. Identify what data is already being collected and where gaps exist. Some data may be available within the financial institution’s systems, while other data points will need to be obtained from applicants.
- Assess current systems currently used for data collection and reporting. Determine whether these can be leveraged for 1071 data collection and whether new or updated systems are needed.
- Assess the current lending process (i.e., how information is gathered). This assessment likely will require reviewing the institution’s credit culture if certain required data points are missing from the current application process.
Technological solutions for efficient 1071 data collection
Automation can play a critical role in streamlining CFPB small business data collection. Software solutions designed for data collection and analysis can help lenders focus on the borrowers and winning deals while ensuring compliance with the 1071 small business lending data regulations. These tools can also make it easier to review and submit the information to the CFPB efficiently. Abrigo’s product team worked with the CFPB throughout the rulemaking process and has built 1071 compliance into its loan origination platform and its small business loan origination software.
While ease of data access is important, in general, if the institution doesn't employ the firewall exception, CFPB prohibits underwriters or any employee responsible for the disposition or “making a determination” on an application from accessing certain demographic data. Abrigo’s software integrates 1071 compliance features such as built-in firewalls and user permission controls to help maintain non-biased lending and compliant reporting.
Streamline 1071 data collection. See how Abrigo can help.
Get a demoPreparing for regulatory changes
While organizing the data collection process is crucial, it’s also important for financial institutions to take broader steps to prepare for these regulatory changes. These include educating staff, revising policies and procedures, and considering more standardized pricing and fee structures to align with the 1071 small business lending data regulations.
Department coordination
1071 Data risk management & compliance strategies
Preparing for regulatory changes
While organizing the data collection process is crucial, it’s also important for financial institutions to take broader steps to prepare for these regulatory changes. These include educating staff, revising policies and procedures, and considering more standardized pricing and fee structures to align with the 1071 small business lending data regulations.
Compliance with the 1071 small business lending data regulations will require coordination across multiple departments. To mitigate risks associated with non-compliance, financial institutions should:
- Create a formal project plan and timeline for compliance efforts.
- Plan for the training of all relevant staff involved in data collectors, reporting, and underwriting.
- Establish consistent lending processes to promote data accuracy and compliance.
- Consider the formality of the current borrower application process and identify any culture changes needed.
- Automate processes to reduce manual errors and speed processes.
- Develop internal controls, including those that validate and test the data collected.
- Track and report exceptions, particularly those related to pricing, fees, and loan structures.
Some financial institutions will need to formalize their small business loan application process. Others may decide to balance small business relationship lending with a risk-based pricing model to mitigate unintended disparate treatment among lenders and branches.
For institutions facing challenges or staff resource constraints, engaging experienced consultants can help. CFPB 1071 consultants can establish reporting and monitoring processes and recommend any needed policy changes.
The CFPB’s 1071 small business lending data regulations represent a momentous change in how financial institutions must collect and report data. By understanding the requirements, preparing in advance, and leveraging technology, banks and credit unions can navigate the changes with compliance. Start planning now to make sure your institution is ready for a smooth data collection process under the 1071 rule.
See how Abrigo's small business origination software and its 1071 readiness advisory engagement helps lenders meet the CFPB 1071 requirements.
Learn more
Marijuana safe banking in 2025: Will rescheduling bring relief for financial institutions?
Financial institutions have monitored the progress of federal marijuana legislation for years, yet meaningful change has remained out of reach. While speculation around marijuana legislation continues to grow, financial institutions remain in the challenging position of navigating the gap between expanding state-level legalization and ongoing federal prohibition. This regulatory gray area presents heightened AML/CFT, reputational, and operational risk. With a decision on federal rescheduling expected soon, financial institutions are asking: Will it bring marijuana safe banking?
Rescheduling marijuana: Progress, but not a green light
In May 2024, after a review by the U.S. Department of Health and Human Services, the Drug Enforcement Agency issued a proposed rule that would reclassify marijuana from a Schedule I narcotic to Schedule III under the Controlled Substances Act (CSA). This historic shift would recognize its medical use and remove its classification alongside drugs like heroin and LSD.
In August 2025, the Trump administration confirmed reviewing the rescheduling proposal, with a final decision expected soon. President Trump acknowledged conflicting perspectives, stating, “I’ve heard great things having to do with medical [use]... and bad things having to do with just about everything else.”
But even if marijuana is rescheduled, it will remain federally regulated. For financial institutions, this means the 2014 FinCEN guidance remains in effect. Rescheduling may reduce stigma, but it does not equate to legalization and doesn’t resolve the core banking challenges.
What this means for financial institutions and their clients
The conflict between state legalization and federal prohibition puts banks and credit unions in a difficult position. Many serve communities with growing marijuana-related businesses (MRBs) that need access to basic financial services. Yet without federal protection, offering those services remains risky and complex.
The compliance burden is significant for institutions choosing to bank MRBs or exposed indirectly through ancillary clients, like landlords, vendors, or service providers. Enhanced due diligence and robust ongoing monitoring remain critical components of a sound marijuana safe banking program.
Clients, meanwhile, face limited access to financial services. The result is often increased reliance on cash, which raises fraud, theft, and money laundering risks. To stay compliant and prepared, institutions must take a risk-based approach that addresses marijuana exposure through policies, staffing, and controls tailored to current and emerging threats.
Has the SAFE Banking Act passed?
Amid these challenges, the Secure and Fair Enforcement (SAFE) Banking Act continues to generate attention and bipartisan support but remains stalled, primarily due to a packed Congressional schedule. Intended to give banks and credit unions safe harbor when serving state-legal MRBs, the Act has passed the U.S. House seven times but has never cleared the Senate.
With its most recent iteration, the SAFER Banking Act (S.2860) remains pending in the Senate. In July 2025, a majority of state attorneys general sent a letter to Congressional leaders in support of passing federal protections for banks that do business with marijuana companies. “We write today in support of the SAFER Banking Act of 2025,” the letter read. “It is increasingly critical to move cannabis commerce into the regulated banking system.”
What the Act would mean for financial institutions
The SAFE Banking Act does not legalize marijuana or remove it from Schedule I. However, it would change the operational risk landscape by protecting financial institutions that serve compliant MRBs from federal penalties, asset forfeiture, or loss of deposit insurance.
The Act would also support AML/CFT efforts by reducing cash-only business models and enabling better transaction monitoring. Senator Jeff Merkley (D-Oregon) described the issue clearly in his Senate Committee testimony: “There is nothing like a cash economy to facilitate money laundering.”
Cash-heavy operations are more vulnerable to violent crime and harder for law enforcement to monitor. Without auditable financial records, marijuana-related activity remains in the shadows. Allowing electronic transactions would enable institutions to detect suspicious patterns better, file more accurate SARs, and bring marijuana-related funds into the oversight of the financial system.
Marijuana safe banking today
Despite legalization in most states, the vast majority of MRBs still lack access to traditional financial services. FinCEN SAR data shows that only about 830 U.S. banks and credit unions currently serve this market.
This forces many MRBs to operate in cash, limiting their ability to secure loans, build credit, or expand. For financial institutions, even those not intentionally serving the marijuana industry, this gap increases the risk of unknowingly onboarding or servicing indirectly connected customers.
Supporters of the SAFE Banking Act emphasize that the issue isn’t just about access but also about public safety. The Act would not only help institutions manage risk but also enhance community safety by integrating more marijuana funds into transparent, monitored systems. It would also protect the ecosystem of businesses that support MRBs, like landlords, law firms, and payroll providers.
Staying on top of fraud is a full-time job. Let our Advisory Services team help when you need it.
Connect with an expertA regulatory turning point
The Act remains a pivotal opportunity to bring federal alignment to a rapidly growing state-legal market. While past efforts have failed, increasing public support and the burden placed on financial institutions may eventually force action.
Still, banks and credit unions cannot afford to wait. Whether an institution chooses to serve MRBs or not, updating AML/CFT programs to reflect marijuana-related risks is a regulatory expectation—not a future suggestion. That includes documenting board-approved positions on MRBs in risk appetite statements.
Marijuana exposure
Even institutions not actively banking marijuana businesses may have exposure through third-party relationships. Property managers, security firms, consultants, and others may be closely tied to MRBs—making strong customer due diligence (CDD) and ongoing monitoring critical.
Recommended next steps:
- Perform a staffing assessment to ensure your teams can meet marijuana-related compliance demands.
- Update CDD and enhanced due diligence (EDD) processes to identify high-risk accounts.
- Revisit your BSA/AML risk assessment to include scenarios related to rescheduling, legalization, and continued regulatory ambiguity.
Prepare for what’s next
Despite growing support, marijuana legislation remains uncertain. Financial institutions can’t afford to wait for clarity. Instead, they must take a proactive, risk-based approach to marijuana-related compliance today.
Whether your institution plans to bank MRBs, avoid them entirely, or prepare for future opportunities, strong internal controls, updated policies, and a mature AML/CFT program are essential. Regulators expect institutions to identify and mitigate marijuana-related risk—regardless of what happens on Capitol Hill.
The marijuana industry isn’t waiting for Congress to act, and neither should your institution. By planning and documenting your approach, you can stay compliant, protect your reputation, and remain ready for whatever comes next.
Find out how Abrigo Fraud Detection stops check fraud in its tracks.
fraud detection software
Discounted cash flow or WARM for the allowance?
Two commonly deployed approaches for the allowance for credit losses under CECL are the discounted cash flow model and the remaining life methodology, also called WARM. How do you know when to select which?
CECL's flexibility is both a strength and a responsibility
Since its adoption in ASU 2016-13, the current expected credit loss (CECL) model has introduced a forward-looking approach to estimating credit losses. The guidance intentionally avoids prescriptive formulas, empowering financial institutions to choose from a variety of acceptable methodologies for calculating the allowance for credit losses:
- Discounted cash flow (DCF)
- Remaining life (also known as the weighted average remaining life methodology, WARM, or WARL)
- Roll-rate
- Probability of default/loss given default (PD/LGD)
- Vintage analysis
Work with advisors who have helped hundreds of financial institutions implement and manage CECL.
Connect with an expertHowever, with this flexibility comes the responsibility for financial institutions to align their chosen methodology with portfolio characteristics, data capabilities, and risk management practices.
Two of the most commonly deployed approaches to CECL are the discounted cash flow model and the remaining life methodology. This guide unpacks the strengths and challenges of both. It offers a practical decision framework to help community financial institutions make defensible, scalable choices as they select, or transition to, an approach that aligns with their unique situation and supports defensibility and operational efficiency.
What is the discounted cash flow method?
The DCF method estimates credit losses by projecting future contractual cash flows, applying assumptions for prepayments, defaults, and recoveries, and discounting those expected loan-level cash flows back to present value using the effective interest rate (EIR) as defined by the FASB.
As ASC 326-20-30-4 says, “The allowance for credit losses shall reflect the difference between the amortized cost basis and the present value of expected cash flows.”
How it works
The discounted cash flow methodology, in essence, uses contractual schedules adjusted for prepayments to estimate future balances by month. This is extraordinarily helpful when adhering to ASC 326-20-30-6, which instructs institutions to model “expected credit losses over the contractual term of the financial asset(s).”
ASC 326-20-30-6 also says “ An entity shall consider prepayments as a separate input in the method or prepayments may be embedded in the credit loss information.” Speaking from experience, it’s neither an easy nor fun task to defend changing expected lives due to changes in prepayment speeds in varying rate environments when prepayments are “embedded in the credit loss.”
This approach, whether discounted or undiscounted, offers the opportunity to eliminate a life assumption, which is the most difficult and material assumption to support in a remaining life model (described below).
In fact, in order to support the remaining life input, one must run cash flows adjusted for prepayments, which begs the question – why not just stop there? As an added opportunity, forward-looking amortization schedules, interest income, and periodic expected loss all provide a strong foundation from which to manage. After all, it is the language of banking.
Armed with this kind of output, estimating future balances is accurate, which can allow for production budgeting. Loan-level detail on interest income that considers the default probability is also helpful in its own right. Lastly, timing-specific loss estimates make backtesting, monitoring, and scenario analysis feasible.
When to use DCF for CECL
Financial institutions have a number of considerations when selecting a CECL methodology. If using the discounted cash flow model is a possibility, remember that the methodology is best suited for specific situations.
These include the following:
- While the discounted cash flow method works for nearly all loan types, it’s best for loan portfolios with contractual obligations extending beyond a year.
- When an institution wants to quantify the impact of an economic forecast
- When an institution wants to quantify the impact of a prepayment speed input
- When an institution has loan-level fair market value adjustments resulting from an acquisition or whole loan purchase
- When an institution prefers loan-level modeling and/or loan-level auditability
- When industry or peer data is necessary or helpful
Pros
Some advantages of calculating the allowance using the discounted cash flow methodology include that it:
- Is highly flexible, granular, and precise
- Accurately reflects timing of losses, recoveries, and prepayments
- Natively integrates reasonable and supportable forecasts
- Supports layering of external or peer-derived inputs where internal data is sparse
Cons
Banks and credit unions have found that some of the challenges tied to using DCF are that it:
- Requires detailed loan-level data (e.g., cash flow schedules, EIR, risk ratings)
- Involves a heavier computing power burden
What is the remaining life method?
The remaining life method estimates losses using historical annualized loss rates and then applies those losses to balances using some form of life-of-loan assumption. Adjustments for prepayment speed changes, current conditions, and reasonable and supportable forecasts are usually estimated and applied through qualitative overlays or adjusting a life-of-loan input.
When to use it
Some of the reasons a financial institution might select WARM for the allowance for credit losses include:
- When an institution is seeking an expedient
- Comfortable with qualitative factors for forecasting and prepayment changes
- Limited access to loan-level data or modeling capacity
- As a transitional methodology
Pros
The remaining life method has the following qualities that might cause a bank or credit union to choose this methodology:
- Easy to implement and maintain
- No need for extensive historical or loan-level data
- Easily understandable and auditable
- Widely used and regulator-accepted for community institutions
Cons
Some of the feedback we’ve gotten about why financial institutions might not want to select WARM includes:
- Difficult to support in changing rate environments (prepayment speed changes)
- Loss timing is not explicitly modeled
- Limited flexibility for dynamic economic forecasts
- Assumes flat distribution of risk across remaining life
- May misstate risk for longer-duration or prepayment-sensitive assets
Choosing the right method: A practical decision framework
Making a choice of CECL methodology involves many factors. Below is a simplified framework to help guide your selection.
Both methods are fully compliant with CECL, but DCF offers better alignment with forward-looking credit risk modeling. The remaining life method offers an alternative for institutions prioritizing ease of implementation over support and defensibility.
Documentation and validation best practices
Regardless of the method used, institutions should:
- Document method selection rationale, tying it to portfolio characteristics
- Clearly define all inputs, assumptions, and external data sources
- Perform annual CECL model validations or revalidations whenever portfolios materially change
- Monitor and backtest model performance
- Retain version control for model updates and assumption changes
- Align CECL methodology with internal ALM, stress testing, and strategic planning frameworks where possible
Aligning methodology with institutional maturity
There is no universally “right” method for CECL compliance—only the method best aligned with your institution’s size, systems, staffing, and risk complexity.
- Start with WARM if you're prioritizing ease of implementation and are comfortable re-implementing later as you grow or experience changes in rates or economy.
- Evolve toward DCF as your institution builds stronger data pipelines, economic forecasting capabilities, and strategic modeling needs.
- DCF provides not only more refined allowance estimates but also enhanced insight into credit risk behavior. These can enable better pricing, strategy, and capital planning.
Abrigo has guided hundreds of financial institutions through CECL implementation, tailoring the process to their unique goals and operational realities. Whether adopting a simplified model like remaining life, or ready to unlock the full potential of loan-level DCF modeling, Abrigo's allowance solutions and CECL advisors can help you navigate every step—from methodology selection and model validation to reporting and examiner readiness.
Listen to an on-demand webinar about CECL model governance to be ready for your next audit.
Listen now
Understanding the WARM method
Learn how the WARM method supports CECL compliance with step-by-step guidance, example calculations, and comparisons to other methodologies like SCALE and discounted cash flow models.
The WARM method, short for Weighted Average Remaining Maturity, is one approach to estimating credit losses under the current expected credit loss accounting standard (CECL).
The allowance for credit losses (ACL) is one of the most significant estimates in an institution’s financial statements and regulatory reports. Understanding the basics of WARM, how financial institutions implement it, and how the methodology compares to alternative allowance methodologies under CECL can guide more informed discussions.
Unlike models that calculate the allowance under CECL using loan-level data encompassing the entire life of the loan, the WARM methodology estimates lifetime credit losses without requiring such granular information. Instead, it leverages an institution’s top-down historical annual charge-off rates along with information about the remaining life of a loan pool. This is why WARM is also known as the remaining life method.
Since limited data has been one of the biggest challenges for institutions transitioning to CECL, WARM has been an attractive option to some financial institutions, especially after regulators recognized it as an acceptable CECL methodology.
Other reasons financial institutions consider using the WARM method include that it is forward-looking (similar to the discounted cash-flow method) and offers a transparent and repeatable process.
Abrigo has helped hundreds of institutions with CECL implementation and ongoing compliance.
Read their storiesHow the WARM method estimates credit losses
Under CECL, an allowance must cover losses expected over the entire life of the loan. Previously, losses weren’t recognized until they were both probable and estimable. In other words, credit losses under CECL are calculated by assuming that all loans are originated with some measurable risk of default.
Estimating lifetime losses is difficult without the historical, life-of-loan or life-of-cycle data detailed at the loan level. Data gaps may stem from operational issues (such as a small portfolio acquisition or a system conversion) or numerical limitations (such as a new line of business or a de novo institution without sufficient history).
The WARM calculation helps address the data gap by combining three key inputs:
- Average annual charge-off rate, typically derived from historical loan-level or portfolio-level losses, institution call report data or peer group data.
- Amortization-adjusted remaining life, reflecting expected paydowns or prepayments and curtailments. Remaining life is derived by calculating the average life of the segment using an attrition model or other methods.
- Qualitative adjustments, which account for factors not captured in the historical data that are quantitative in nature.
As FASB has explained, “The average annual charge-off rate is applied to the contractual term, further adjusted for estimated prepayments to determine the unadjusted historical charge-off rate for the remaining balance of the financial assets.” To comply with CECL’s requirement for adjustments to historical loss information for current conditions and a “reasonable and supportable forecast period,” the qualitative components are layered in.
For example, in a widely cited interagency illustration, a $13.98 million loan pool with a 0.36% charge-off rate and a 2.52-year remaining life yields an unadjusted lifetime loss rate of 0.90%. Adding a 0.25% qualitative adjustment raises the final allowance for credit losses (ACL) to 1.15%, or $161,000.
The math for WARM is relatively simple, but examiners have cautioned that supporting these inputs and layering on qualitative factors to account for forward-looking information is important to establish CECL model credibility.
How to implement the WARM method
Step-by-step implementation process
Institutions implementing WARM typically follow this process:
- Segment the loan portfolio by similar risk characteristics, such as type, term, and credit quality.
- Determine remaining life using contractual terms adjusted for expected prepayments. One approach is to use a quarterly attrition analysis that tracks exit events and develops an annual percentage of how often loans exit the portfolio via payoffs, renewals, maturity, or charge-offs. Call Report data (yours or peer data) may also be used for this.
- Calculate the historical loss rates at the pool level using available charge-off data, Call Report data, or peer data.
- Apply forecast model to capture the forward-looking impact on the reserve. This can be done through an expedient method or through application or regression models.
- Apply the WARM formula to generate the lifetime historical charge-off rate for the remaining balance of the financial assets.
- Incorporate qualitative overlays to adjust for reasonable and supportable forecasts.
Banks are expected to reflect forward-looking risks, not just replicate historical patterns. That’s where adjusting credit loss estimates with so-called qualitative factors comes in.
Adjusting for qualitative factors (Q factors)
What are Q factors, and why do they matter?
Qualitative factors, or Q factors, are adjustments to credit loss estimates that help account for risks that quantitative models and historical loss data can’t fully capture. Q factor adjustments to the allowance developed with the remaining life method will ensure reserve levels reflect what’s expected in the future, based on reasonable and supportable forecasts, rather than capturing past performance alone.
Under CECL, these adjustments are especially important because institutions must incorporate a reasonable and supportable forecast period. In this context, the forecast period is a near-term horizon over which management can credibly link economic forecasts (such as unemployment, interest rates, or local market conditions) to expected credit performance.
However, CECL also requires institutions to address what happens after that forecast horizon. Since forward-looking forecasts cannot be projected indefinitely with reliability, the guidance requires a reversion period. The reversion period is the point at which loss rates transition back to long-term historical averages.
In practice, this means:
- Reasonable and supportable forecast period: The near-term horizon (often 1–3 years) where economic forecasts are applied directly to adjust expected losses.
- Reversion period: The time after which forecasts become unreliable, during which modeled loss rates revert to long-term historical loss experience, either immediately or gradually (e.g., linear reversion).
For WARM specifically, the average annual charge-off rate is extended across the pool’s remaining life, but it must be adjusted first, for near-term forecasts (via Q factors) and second, for how losses revert beyond that period.
For example, an institution may adjust loss rates upward for the first two years due to a projected economic slowdown but then revert to historical charge-off levels for the rest of the pool’s life.
Documenting how management determined both the forecast horizon and the reversion approach is essential. Examiners have emphasized that unsupported overlays or vague explanations of forecast and reversion assumptions are among the most common CECL exam findings.
Documenting qualitative overlays for examiners
According to recent Fed findings, another common CECL-related exam issues was unsupported Q factors. Some institutions either neglected to apply qualitative overlays or failed to document them adequately, despite experiencing known risk shifts, such as entering new markets or launching new loan types.
Even though the adjustments are labeled “qualitative,” they can and often do have a quantitative basis.
Examples of qualitative adjustments in WARM
Examples of well-supported Q factors that could be incorporated into the WARM method include:
- Local unemployment rate changes
- Loosened underwriting standards compared to historical periods
- New or inherently riskier product types, such as commercial real estate lending expansions
One way to determine what economic factors may apply is to talk with internal credit and Treasury teams to identify which economic factors are already being used internally, for example, for stress testing. Regardless of which factors are selected, they need to be tied to measurable indicators, and financial institutions should document their rationale as part of overall model governance. They should also define when the institution will revisit the factors as part of sound model governance.
Model governance and documentation
CECL internal controls
Speaking of model governance, CECL auditors and experts have noted that recent exams and audits have focused on this important aspect of calculating the allowance. Good CECL model governance, regardless of whether the institution uses a more simplistic model like WARM or something else, should include documentation, validation, and back testing. Regulators have cited inadequate documentation as another common issue in CECL exams.
Governance best practices and examiner expectations
To meet examiner expectations regarding other aspects of model governance, institutions using WARM should also:
- Maintain a clear allowance policy that aligns with CECL
- Explain why WARM was chosen to calculate the allowance and where it applies
- Detail the assumptions specific to using WARM, lookback periods, segmentation logic, and forecast policies
- Review and update assumptions periodically
Sound governance, including documenting assumptions, is essential when using the remaining life methodology or other options for CECL calculations.
Save time estimating the allowance with a compliant model that scales to your level of complexity.
Allowance softwareComparing the WARM method to other CECL approaches
WARM method vs. SCALE
Both WARM and the Federal Reserve’s SCALE tool (Scaled CECL Allowance for Losses Estimator) are intended to help estimate the ACL for less complex entities or those with less complex financial asset pools. As a result, both methods appeal to community banks and credit unions. However, they serve different needs and have some important differences.
- SCALE leverages peer data, which may ease data requirements for banks with limited internal loss history. The regulators and auditors still expect institutions to adjust for their own experience, which can be challenging and hard to support.
- WARM can also use peer data, but it allows for greater use of internal data and portfolio-specific risk segmentation. It also offers more customization, which requires documentation.
Other considerations when it comes to comparing SCALE and the remaining life method:
- SCALE relies on proxy expected lifetime loss rates of peers, which are already adjusted for reasonable and supportable forecasts. Management should consider whether a qualitative adjustment should be applied to account for local economic conditions expected to perform better or worse than industry economic conditions.
- The peer data used for SCALE would typically be based on information from the previous reporting period. Management should consider the timing issue and determine the impact of any changes in business or economic conditions as between when proxy loss rates were calculated and the reporting date.
- Regulators have said the SCALE tool is not appropriate for institutions with assets greater than $1 billion that are required to submit data into Schedule RI-C since that would result in an institution both submitting data and using data derived from Schedule RI-C.
WARM vs. discounted cash flow and static pool models
WARM, discounted cash flow (DCF), and static pool methods all comply with CECL, but they vary greatly in data requirements, forecasting precision, and operational complexity.
- Discounted cash flow models simulate individual loan cash flows using assumptions for prepayments, default timing, recovery rates, and discount rates. They provide high granularity and allow institutions to align economic forecasts with precise time periods, which can be a key advantage when forecasting near-term economic volatility or credit deterioration.
- Static pool or cohort-based models track over time a defined group of loans originated during a given period, measuring cumulative loss behavior. Static pool methods conceptually align with CECL’s lifetime loss perspective, but they require longitudinal, loan-level data and robust cohort tracking practices.
By comparison, WARM estimates credit losses using historical loss averages applied across the remaining life of the pool. It does not account for the timing of losses and treats the portfolio as a single amortizing asset. As a result, WARM is easier to govern and document but sacrifices modeling precision.
Considerations for use cases of each model type
WARM may be best for institutions with relatively simple, amortizing portfolios and limited access to life-of-loan data, or for less complex portfolios/segments, new lines of business, or immaterial acquired portfolios. It may be appropriate for specific types of loan portfolios, such as segments without losses or segments lacking loan-level data because they are serviced by a third party. A credit card portfolio is an example.
DCF and static pool models may be better suited for institutions with complex portfolios, short-term credit volatility, or regulatory pressure to align forecasts more tightly with exposure timing.
Trade-offs and limitations of the WARM method
As noted above, the WARM method is designed for clarity and feasibility. But that simplicity comes with trade-offs. Institutions using this approach should recognize its potential limitations and actively mitigate them through documentation and governance.
Challenges with data granularity and outliers
Because WARM is a top-down method relying on aggregated portfolio data, it lacks visibility into loan-level performance patterns. This can mask significant outliers or emerging risks within a pool. For smaller institutions or smaller segments, one or two charge-offs can skew the average charge-off rate, especially when loss histories are shallow or inconsistent.
Institutions should consider the statistical volatility of smaller pools and whether supplemental analysis or exclusion of outlier periods is needed to avoid distortions.
Situations where WARM may introduce oversimplification
WARM assumes straight-line balance reduction across the remaining life of the pool. While this simplifies exposure modeling, it often does not reflect actual amortization behavior. Products with balloon structures, revolving credit, or seasonal paydown patterns may not fit the straight-line assumption well.
Institutions using WARM should document how they determined remaining life and consider qualitative adjustments if actual repayment patterns materially diverge from the model assumption.
Balancing ease of use with accuracy
CECL requires incorporating reasonable and supportable forecasts, and WARM supports this through qualitative overlays and near-term forecast layering. However, because the method applies charge-off rates evenly over the remaining life, WARM lacks the ability to time forecasted risk precisely.
For example, if an institution anticipates elevated losses within the next 12–18 months due to deteriorating market conditions, the WARM method can’t easily front-load those losses. More granular methods like DCF or PD/LGD modeling are better suited to simulate time-based loss expectations.
When WARM may not be the best fit
The WARM method may not be appropriate for all loan types or portfolios. Institutions should reassess their methodology if they have:
- Newly introduced or unseasoned loan products without reliable loss history
- Complex structures (e.g., interest-only periods, variable-rate resets, or off-balance sheet exposures)
- Significant concentration risk in high-volatility asset classes
- Rapid growth into new markets with limited historical performance data
In these cases, WARM may oversimplify the credit risk profile, potentially leading to under- or over-reserving. If the institution cannot clearly tie the model assumptions to observed portfolio behavior, examiners may challenge the methodology’s adequacy.
Is WARM the right fit for your institution?
The WARM method remains a viable, widely accepted CECL methodology, especially for community institutions seeking a manageable and auditable approach. Still, institutions should ask:
- Have we documented why WARM is appropriate for our portfolio?
- Are we using recent, relevant historical loss data?
- Have we applied and supported Q factors tied to observable risks?
- Have we backtested the remaining life model to ensure results truly reflect the institution risk profile? Even though WARM is considered one of the more straightforward CECL methodologies, regulators expect every institution regardless of model complexity to validate and backtest their allowance methodology. This is not optional.
- Do our policies reflect CECL’s expectations, not just our legacy allowance process?
If the answer to any of these is “no,” it may be time to revisit model inputs, documentation, or governance structure.
Practical tips for financial institutions
An automated CECL solution that supports WARM and other methodologies can help institutions remain compliant without unnecessary complexity. Moreover, it allows institutions to fine-tune the CECL process as the institution grows and changes and as best practices evolve.
Abrigo supports institutions using WARM and other methodologies through CECL software, CECL advisory services, and CECL allowance training programs. Abrigo’s allowance software contains an attrition calculator and examiner-ready documentation tools.
Revisiting CECL methodologies
CECL was one of the most significant changes to financial institution accounting in decades.
For many financial institutions, the remaining life or WARM method offered a practical on-ramp to CECL. Now that community financial institutions have navigated their first year of compliance with CECL, some are revisiting their allowance methodologies. For those using WARM, reviewing model selection and assumptions regularly can demonstrate “ownership” and make for a smoother review by auditors and examiners.
This blog was developed with the assistance of ChatGPT, an AI large language model. It was reviewed and extensively revised by Abrigo's subject-matter expert for accuracy and additional insight.
What is reputational risk: How it fits into business strategy
As banks and credit unions navigate evolving regulatory expectations, reputational risk remains important, especially for community financial institutions that prioritize strong, trusted relationships. While regulatory agencies have clarified they will not examine reputational risk in isolation, many institutions continue to consider it part of a broader, community-centric strategy. Understanding reputational risk and its impact can help financial institutions stay aligned with their mission, protect stakeholder trust, and make informed business decisions.
Regulatory guidance on reputational risk
In a recent shift in examination expectations, the three federal banking regulators—the Federal Reserve Board, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation—have confirmed that they will no longer consider reputational risk as a stand-alone factor during bank examinations. The National Credit Union Administration is being called upon by America’s Credit Unions to follow suit. The change is part of a broader effort to clarify expectations and reduce the likelihood of institutions feeling pressure to exit entire industries based solely on perceived reputational concerns.
This shift provides more certainty around how regulators approach client risk for banks and credit unions. However, it raises important questions about how financial institutions define and manage reputation within their risk frameworks, primarily when serving diverse or high-profile client groups. While regulators have stepped back, reputational considerations remain, especially regarding community trust and long-term strategy.
Need short-term fraud or AML staffing relief? Abrigo Advisory Services can help.
Connect with an expertWhat is reputational risk and why it matters
Reputational risk is the potential for negative public perception to affect a financial institution's credibility, client trust, or financial performance. It often stems from how an institution is viewed by its community, clients, regulators, or media, and it may arise even when no compliance violations or operational failures have occurred.
Today, reputational risk can be influenced by various factors, including the types of clients an institution chooses to serve or decline, partnerships with third-party vendors, lending or investment decisions, or how it handles emerging social or political issues. Even lawful and risk-based decisions may draw public scrutiny if they appear inconsistent with the institution's stated values or community expectations.
These factors make reputational risk more dynamic than ever. For example, exiting a relationship with a high-profile business might be entirely appropriate from a risk management perspective. Still, without clear communication or documentation, the public can misinterpret the decision as unfair or discriminatory. Likewise, continuing to serve a controversial client segment may prompt questions from community members, advocacy groups, or employees.
New regulatory changes
The decision to remove reputational risk as a factor in formal bank examinations was mainly in response to concerns about derisking—when financial institutions end relationships with entire categories of clients or industries based on perceived reputational harm rather than individual risk assessments. In previous years, some banks chose to exit entire sectors, such as money services businesses, cannabis-related businesses, or international remittance providers, not because of direct regulatory violations, but because of uncertainty around supervisory expectations. This derisking trend created unintended consequences. Legitimate businesses, especially those serving underserved or international communities, were sometimes left without access to essential financial services. In response, regulatory agencies clarified that while banks can make risk-based decisions, supervisors would no longer use reputational risk alone as a basis for exam criticism. The goal is to promote financial inclusion while ensuring client decisions are grounded in individual risk, not generalized assumptions.
Reputational risk is connected to other areas of risk
Reputational risk rarely stands alone. In fact, it often overlaps with other key risk categories, which means it can surface in situations where it may not be immediately obvious. Understanding these connections helps financial institutions see the full picture before making decisions that could have lasting effects.
- Strategic risk can rise when an institution chooses to enter or exit industries that are considered sensitive or controversial. Expanding into a new market segment may create growth opportunities, but it can also bring heightened public attention. Likewise, stepping away from a line of business for sound risk reasons may be interpreted by some as a value statement.
- Compliance risk can occur when actions do not align with written policies or when those policies are applied inconsistently. Even if a decision is legal and defensible, failing to follow established processes can create reputational questions about fairness, transparency, or governance.
- Credit risk can be complicated when the financial strength of a borrower becomes secondary to how the relationship is perceived. A strong-performing borrower in a controversial industry may pose minimal credit risk, but the reputational implications could still influence the institution’s decision-making.
For example, an institution might decide to end a relationship with a client whose lawful business activity does not align with the bank’s mission or community priorities. While the decision could be supported by credit analysis, operational considerations, or policy requirements, it may also reflect reputational concerns.
The key is to evaluate the full risk picture and anticipate how a decision will be perceived by customers, staff, and community stakeholders. By doing so, banks and credit unions can minimize surprises, ensure decisions are consistent with their stated values, and preserve the trust that often takes years to build.
Reputation as part of governance conversations
Even though examiners will no longer evaluate reputation as a stand-alone risk, institutions benefit from including it in board and leadership discussions. In fact, the regulatory agencies expect banks and credit unions to engage in sound risk management practices, operate in a safe and sound manner. For many community financial institutions, reputation remains an important aspect of risk management. Common governance examples of include:
- Reviewing client onboarding and exit policies for reputational considerations: Customer acceptance and closure policies should account for reputational implications and be applied consistently. Clear criteria and documentation help staff explain decisions to customers, community members, or regulators.
- Evaluating new products or services through a community impact lens: Before launching new offerings, consider how they will be received by the community and whether they align with the institution’s mission. This helps prevent missteps that could harm trust or brand perception.
- Discussing high-profile vendor relationships that may attract stakeholder attention: Vendors with public visibility can influence how the institution is perceived. Leadership discussions should weigh the benefits against potential reputational costs and ensure there is a plan to address questions if they arise.
When reputation is discussed at the board or committee level, it helps ensure that the institution's decisions align with its stated values and risk appetite.
A simple framework for assessing reputational exposure
Adding structure to reputational risk management does not require new systems. Institutions can adapt existing tools to include questions such as:
- Does the client or activity align with our institution's mission and values?
- Could this relationship or decision attract public or media attention?
- Have we documented how and why we reached a decision?
- Would this decision be viewed as fair and consistent by clients and regulators?
These questions help bring consistency to decisions that often involve subjective judgment. They also help front-line and risk staff feel confident in their approach when handling complex or sensitive situations.
Prioritizing reputation
For many banks and credit unions, reputational risk is not just about regulatory expectations but about living out the values they promote within their communities. These institutions are not managing their reputation to meet a rule. They are doing it because they believe it is the right thing to do.
Local financial institutions often have deep relationships with their clients. Their reputations are built over years, sometimes decades. Once trust is lost, it is not easily regained. Institutions that include reputational considerations in their risk and business decisions are often better positioned to preserve that trust during times of change.
Reputational risk may no longer be central to regulatory examinations, but remains a valuable part of business strategy. Financial institutions that proactively consider reputation in their governance, client policies, and community engagement are taking steps to ensure long-term strength and stakeholder trust.
Powerful financial crime fighting
Get features and functionality you need from AML compliance software.
Transaction monitoring software
Elder sextortion: The emotional and financial toll
Financial exploitation of older adults continues to evolve as fraudsters shift their tactics to digital platforms. According to the FBI's Internet Crime Complaint Center (IC3) 2024 data, more than 147,000 Americans aged 60 and older reported falling victim to online fraud, with total losses approaching $4.9 billion. This represents a 43 percent increase in reported losses compared to 2023.
Among these crimes, elder sextortion stands out as one of the most emotionally and financially damaging. Elder sextortion is a form of blackmail that combines romance scams, impersonation, and manipulation to target older adults online. A 2024 study published in Computers in Human Behavior estimated that one in seven adults globally has experienced someone threatening to share intimate images.
The FBI reports that extortion, including sextortion, among older adults increased by 134 percent year over year. These are not isolated incidents. They are part of a growing trend in digital crime affecting some of the most vulnerable members of our communities.
For community banks and credit unions, responding to this threat is not simply a matter of fraud detection. It is about protecting customers, preserving trust, and reinforcing the financial institution's role as a safe, trusted partner.
What is elder sextortion
Elder sextortion occurs when scammers deceive older adults into sharing explicit photos, videos, or engaging in private online interactions. The fraudster then uses that content, or the threat of having it, to extort money. In many cases, the scammer never actually possesses any images. Instead, they rely on fear, shame, and the victim's concern for their family, social circle, or religious community to force compliance.
These cons often begin as online romance scams. Fraudsters are patient and calculated, gradually building emotional trust before introducing explicit content or requests. The scammer starts making demands once the relationship feels real to the victim.
While financial loss is significant, the emotional toll can be devastating. Many victims do not report the crime due to embarrassment. The resulting shame may lead to social withdrawal, depression, or, in some cases, even premature death.
Download this checklist to spot red flags for elder financial exploitation
Get the checklistHow scammers target older adults
Criminals executing sextortion scams use sophisticated tactics that take advantage of the emotional, digital, and social vulnerabilities of older adults. These include:
- Preying on loneliness or grief: Scammers identify recent widows or widowers by scanning online obituaries or public posts. They initiate contact under the guise of companionship.
- Romance scams on digital platforms: Many scams begin on dating apps, social media, or text messaging. Initial messages may seem innocent or friendly, but quickly turn flirtatious.
- The "wrong number" trick: A scammer pretends to text the wrong number. If the recipient responds, the conversation escalates into a manufactured romantic interest.
- Fake profiles and video calls: Scammers use images of attractive individuals, often stolen or computer-generated, and may encourage victims to engage in private chats. Some use deepfake technology or screen recordings to fabricate compromising content.
- Phishing links and malware: Clicking on suspicious links can give scammers access to the victim's device, camera, or personal files. Older adults with limited cybersecurity protections are particularly vulnerable.
These methods exploit both emotional trust and gaps in digital literacy. Increasingly, these scams are not random acts. Many are carried out by transnational organized crime groups that share victim information and target retirement communities or individuals identified through data breaches.
Find out how Abrigo Fraud Detection stops check fraud in its tracks.
Fraud detection softwareWhen sextortion escalates
A recent case reported to the AARP Fraud Watch Network Helpline involved a 70-year-old man from Missouri. He was targeted through what he believed was a romantic relationship. After sending nude photos, he was quickly threatened with exposure unless he paid $2,500.
Soon after, another person contacted him, pretending to be a law enforcement officer. This impersonator accused him of criminal behavior related to the images and warned that his employer would be contacted if he did not send more money. The scammer knew where the man worked, intensifying the pressure.
This case demonstrates how sextortion can quickly evolve from emotional manipulation to impersonation and coercion. It also highlights the importance of financial institutions being prepared to spot signs of distress, especially when older customers make unusual transactions or appear anxious.
Protecting clients from fraud: Steps to stay safe
Fraud can happen to anyone, but the FBI advises there are practical steps financial institutions can coach their clients on to help protect them and their personal information:
- Verify before trust: If a client is contacted by someone they do not know, they should take time to research the contact’s name, phone number, email address, or the offer they are presenting. A quick online search can often reveal warnings from others who may have been targeted by similar scams.
- Avoid being rushed: Scammers often try to create urgency to pressure victims into making quick decisions. They may appeal to their emotions or promise financial gain or companionship. Advise clients to take a step back and give themselves time to evaluate the situation.
- Never share sensitive information: Clients should never give out personal or financial information, including social security number, bank details, or wire instructions, unless they have verified the legitimacy of the request.
- Take immediate action if an account is compromised: If your client suspects someone has gained access to their personal devices or financial information, they should notify their bank or credit union right away. Advise them about placing additional safeguards on their accounts and remind them to monitor their activity closely for unauthorized transactions.
How financial institutions can protect their customers from elder sextortion
Banks and credit unions serve as critical touchpoints for many older adults. When staff are trained to recognize potential fraud, they can help stop scams before more harm occurs. Proactive steps include:
- Educate frontline employees: Tellers and customer service teams should be trained to spot red flags such as abrupt wire transfers, large cash withdrawals, or changes in financial behavior. Empower staff to ask respectful, nonjudgmental questions when something seems unusual.
- Use fraud detection tools: Implement systems that monitor behavior outside a customer's typical transaction pattern. Real-time wire fraud monitoring combined with behavioral analytics helps stop fraud losses before they occur. Banks and credit unions should combine technology with transparent internal escalation processes.
- Provide targeted client education: Offer ongoing education through brochures, in-branch events, webinars, or one-on-one consultations. Topics include safe online practices, how to identify scams, and how to respond to suspicious messages.
- Partner with external agencies: Establish relationships with local law enforcement, elder protection agencies, and fraud reporting centers. Coordination can lead to faster, more effective responses when fraud is suspected.
- Foster a safe, supportive environment: Many older adults fear being judged or losing independence if they disclose being scammed. Creating a culture of support and privacy encourages disclosure and early intervention.
Why action matters
As more older adults embrace digital communication, the threat of elder sextortion will continue to grow. Financial institutions are in a strong position to detect early warning signs and respond with compassion and professionalism.
Preventing financial loss is essential, but helping clients preserve their dignity, feel supported, and recover from emotional harm is just as important. Addressing elder sextortion goes beyond risk mitigation. It reflects the core mission of community financial institutions to serve and protect. With strong fraud detection tools, well-trained teams, and a commitment to client care, banks and credit unions can be a first line of defense against this increasingly personal exploitation.
FinCEN Investment Advisor Rule delay: A shift in regulatory priorities
On Aug. 5, 2025, the Financial Crimes Enforcement Network (FinCEN) issued an Exemptive Relief Order delaying the effective date of the Investment Adviser Rule. The delayed effective date gives some breathing room to affected advisers and their banking partners for adjusting systems, training staff, and coordinating with technology vendors. However, financial institutions would be wise to nevertheless begin planning for implementation, given the importance of the rule’s ultimate goal of protecting the U.S. banking system.
Once implemented, the rule will require certain investment advisers to establish formal anti-money laundering/countering the financing of terrorism (AML/CFT) programs, maintain detailed records, and file suspicious activity reports (SARs). Finalized on Sept. 4, 2024, the rule extends long-standing Bank Secrecy Act (BSA) obligations, already applied to banks, credit unions, and broker-dealers, to segments of the investment industry that have not been covered.
It was originally set to take effect Jan. 1, 2026, but now the Treasury Department has exempted covered investment advisors from all rule requirements until Jan. 1, 2028. FinCEN intends to issue a notice of proposed rulemaking (NPRM) to propose a new effective date for the rule no earlier than Jan. 1, 2028.
Why FinCEN issued the delay
FinCEN said it issued the relief order to ensure the regulation is “efficient” and “appropriately balances costs and benefits” following industry feedback. According to the relief order, the extension is intended to:
- Allow investment advisers to design and implement effective AML/CFT programs without creating undue operational risk;
- Provide time for FinCEN to develop additional guidance and respond to industry feedback on rule interpretation;
- Support coordination between investment advisers and financial institutions to ensure consistent application of due diligence standards;
- Avoid compliance bottlenecks that could arise if thousands of newly covered entities rushed to meet the same deadline.
These statements are a significant shift from FinCEN’s stance when the rule was finalized in 2024. FinCEN issued the rule after carefully considering public comment and extensive consultations with staff and various government and industry advisors. At that time, FinCEN determined that the rule would:
- Help prevent criminals from laundering money through the U.S. financial system
- Improve the U.S. financial system’s transparency and integrity
- Provide beneficial information to law enforcement authorities
- Bring the U.S. into greater compliance with international AML/CFT standards and address a significant gap identified by the Financial Action Task Force (FATF)
The delay reflects a broader regulatory approach under the federal government’s current administration, which has emphasized deregulation to reduce perceived compliance burdens across multiple sectors. Even so, the underlying need to protect the U.S. financial system from illicit actors remains, and any delay in implementation should be balanced with measures that preserve the integrity and security of our banking system.
Staying on top of fraud is a full-time job. Let our Advisory Services team help when you need it.
Connect with an expertWhy the delay matters to financial institutions
Even though the delay offers breathing room, it is still recommended that financial institutions begin preparing. Once implemented, the rule will influence how they work with investment adviser clients and bring greater alignment in compliance expectations across the industry. While banks and credit unions are not the primary targets of the rule, it will likely impact their compliance priorities, especially in customer due diligence (CDD) and coordinated financial crime prevention, assuming an effective date is eventually set.
This pause is a chance to get ahead of the ripple effects. Institutions should be ready for:
- Requests for closer collaboration from adviser clients
- More consistent application of CDD standards
- Heightened regulatory scrutiny once the rule takes effect
Acting now can help avoid last-minute disruptions, prevent operational bottlenecks, reduce compliance risk, and position banks and credit unions for smoother coordination with investment adviser clients when deadlines return.
We recommend that banks and credit unions prioritize the following actions for eventual compliance:
- Update policies and procedures: Review and revise AML/CFT policies to address the specific risks and compliance expectations tied to investment adviser relationships. Document procedures for onboarding these clients, including when to apply enhanced due diligence, how to verify beneficial ownership information, and escalation steps when unusual or suspicious activity is detected. Ensure these policies are consistent across business lines so retail and commercial teams follow the same standards.
- Evaluate technology readiness: Work with your AML software provider and core system vendor to confirm that existing platforms can handle expanded monitoring rules, higher volumes of alerts, and any additional data points associated with investment adviser accounts. Consider testing automated scenarios now to identify gaps in detection logic or reporting capabilities. Build in time for any needed upgrades, integrations, or workflow adjustments before the rule’s compliance date.
- Train compliance and frontline staff: Develop targeted training for employees on how investment adviser business models operate and the unique risks they may present. Include case studies on common red flags such as layered transactions, unexplained transfers between client accounts, or the use of complex corporate structures. Reinforce escalation and SAR filing procedures, especially as the FinCEN Investment Advisor Rule delay concludes and expectations increase.
- Refresh AML/CFT risk assessments: Update your institution’s AML/CFT risk assessment to reflect the potential impact of serving investment adviser clients. Consider how these relationships might influence customer risk ratings, monitoring thresholds, and the allocation of compliance resources. Document any changes in risk mitigation strategies so they can be communicated to regulators during examinations.
Next steps
The delay in the FinCEN Investment Advisor Rule is a limited opportunity for banks and credit unions to get ahead of future compliance demands. While the deadline has shifted, the expectation to maintain strong AML/CFT programs has not. Institutions that use this time to enhance monitoring processes, test technology, update risk assessments, and strengthen staff expertise will be well-positioned to adapt quickly when the rule takes effect. Early preparation reduces operational and regulatory risk and reinforces an institution’s role in safeguarding the U.S. financial system from illicit activity.
Find out how Abrigo Fraud Detection stops check fraud in its tracks.
fraud detection software
Day 2 accounting work can get tricky
Following a deal, financial institutions need to recognize the accretion or amortization of purchase accounting marks in an auditable and transparent way. Don't overlook income recognition.
Deal activity is heating up; be accounting-ready
With deal activity heating up again, bank and credit union leaders can’t afford to be caught flat-footed when it comes to the accounting side of a merger.
Piper Sandler Chairman and CEO Chad Abraham said recently that conditions “have continued to improve for depository M&A,” according to a transcript of the firm’s recent earnings call.
“Credit’s been pretty good. There’s capital available if that needs to be part of transactions,” he said. “We’re definitely seeing proof of regulatory approvals being quicker. And I would say our pace of announcements has increased kind of across the spectrum—the small deals, a few of the larger deals.”
Improved conditions for mergers and acquisitions are good news for institutions looking to grow, but they’re also a reminder that critical financial reporting follows a deal.
Income recognition, in particular, is one of those areas that can get overlooked until it’s too late. Now’s the time to line up a merger accounting playbook that’s audit-ready and built to scale.
Abrigo's experts handle Day 1 and Day 2 accounting, exit pricing, and other quarterly services.
See available servicesIncome recognition accounting can’t be an afterthought
Closing a bank acquisition is a big milestone, but it’s really just the start of the hard work. Day 2 accounting—particularly income recognition—is where things can get tricky fast. These purchase marks can be material to earnings, and if financial institutions aren’t paying attention to how they flow through their systems, they might set themselves up for issues with auditors and regulators. Abrigo Advisory has seen this firsthand. A lot of institutions get focused on valuation and CECL planning tied to a deal, and they treat income recognition almost like an afterthought. That can be a costly mistake.
What drives the complexity is the materiality of purchase marks (fair value adjustments). Deferred fees and costs, which are accounted for under the same accounting standard, aren’t significant enough for expedients to generate material differences.
Fair value adjustments, especially in dynamic rate environments, are significant, and it is the responsibility of management to understand how these amounts find their way into the income statement.
The core and income recognition: A recipe for auditor questions
A lot of institutions figure they’ll run the accretion through the core system or track it in a spreadsheet. The problem is, that only gets you so far. ASC 310-20 is the accounting standard that describes the treatment for recognizing fees, costs, fair value adjustments, etc., over the life of the loan as an adjustment to yield. As such, management should be able to recalculate yields, reconcile beginning and ending marks between reporting periods, accelerate and decelerate accretion in order to maintain yield, and provide loan-level positions. If not, something is missing.
To make matters more challenging, we've seen numerous cases where the valuation was calculated at a pool level with purchase marks subsequently being allocated to each underlying loan. This approach results in irrational yields and subsequent problems with loan-level accretion.
Time and time again, we've seen the inability of management to get any information or clarity from core-calculated accretion. When a parallel calculation is performed accurately, the results are significantly different. That’s why we always push for loan-level granularity from the beginning. It gives you control and defensibility.
CECL and income recognition
Some folks ask, “Well, can’t we handle all of this with our CECL model?”
If you’re talking about how marks flow into your allowance or how expected credit losses for acquired loans need to be calculated on Day 1 and for each subsequent reporting period, then yes, there’s overlap. But the allowance isn’t income recognition. They touch, but they’re not the same. As its name implies, the current expected credit loss (CECL) model is about expected credit losses. Income recognition is about amortizing or accreting a known mark into earnings over time. Different accounting standards and different processes.
Documentation matters here more than people think. If you can’t explain why income is rising or falling as those marks burn off, someone’s going to start asking questions. What you don’t want to happen is to get caught flat-footed by assuming the core system was handling it, or by the person who built the spreadsheet leaving without someone else knowing how it worked. That’s not a position you want to be in.
Abrigo built income recognition software with all of this in mind. It takes in the purchase marks, handles both base and accelerated accretion, and ties back to CECL where needed. Everything is transparent and auditable at the loan level.
But regardless of what system you’re using, the point is this: don’t wing it. You need a process that scales and holds up when someone comes asking to see the details.
Who really owns the income recognition process?
We’d also encourage banks not to treat income recognition as a bolt-on task. If you’ve got one firm doing the valuation and another firm helping with CECL, and no one really owning income recognition, you’re going to have gaps. Those gaps usually show up in audits. What you want is someone who can help you stitch the full process together, someone who’s been on calls with examiners and knows what they’re going to ask.
Income recognition isn’t the flashiest part of a deal, but it’s one of the most important parts when it comes to the integrity of your financials. It’s where the marks you put on at close start hitting your earnings every month. A problem isn’t simply a technicality; it’s visible. So get ahead of it. Build the right foundation. And make sure your process isn’t merely working—make sure it’s defendable.
See how your loan fair value estimates compare to market-based benchmarks.
See Quarterly Insights
Fraud victim support: How financial institutions can respond and restore trust
As fraud schemes evolve in complexity and scope, financial institutions are called upon to do more than just detect and prevent illicit activity. Banks and credit unions often also serve as first responders when individuals or businesses fall victim to financial fraud.
Institutions that respond with urgency and empathy to support victims of fraud can rebuild trust, restore confidence, and reinforce long-term relationships with clients. But fraud victim support is about more than recouping financial loss. Understanding the common fraud schemes clients may encounter and taking an intentional approach to assist in the aftermath demonstrates an institution’s values, dedication to client care, and role as a trusted advisor within the community.
The growing cost of fraud
Reported fraud losses exceeded $12.5 billion in 2024, according to the Federal Trade Commission (FTC). The FBI documented an even higher total loss of over $16.6 billion across 859,000 complaints. These figures speak not only to the scale of financial harm but to the emotional toll these crimes leave behind.
The volume and impact of fraud are increasing across all channels. In 2024, investment scams topped the list in financial damage, with $5.7 billion in reported losses. Imposter scams followed closely at nearly $3 billion. Criminals prey on trusting and vulnerable people, and they continue to leverage digital platforms to initiate contact via email, phone, or text, and move funds through cryptocurrency, bank transfers, or wire services.
According to the FBI, phishing scams were the most frequently reported. However, business email compromise and investment fraud caused the most significant monetary damage. These trends highlight the urgent need for comprehensive fraud victim support programs that go beyond the basics of account recovery.
Staying on top of fraud is a full-time job. Let our Advisory Services team help when you need it.
Connect with an expertUnderstanding the scope of fraud
Financial institutions must first understand the various forms of fraud affecting their clients to deliver meaningful assistance. Some of the most prevalent methods include:
- Cybercrime attacks: Cybercrime attacks occur approximately every 11 seconds, costing organizations an average of $13 million per incident. Small businesses are especially vulnerable due to limited cybersecurity infrastructure.
- Consumer fraud: Consumer fraud takes many forms, including synthetic identity theft, spoofing, romance scams, and grandparent scams. These often target the elderly and financially inexperienced.
- Business and investment fraud schemes: Scams such as Ponzi operations, business email compromise, and wire fraud continue to result in significant losses for commercial clients.
- “Pig butchering”: A particularly alarming emerging scam is known among criminals as “pig butchering” because victims are deceived over time through emotional manipulation before being persuaded to make large financial transfers.
Each scheme can leave a trail of emotional distress and financial disruption. A thoughtful, informed approach to fraud victim support is essential to help affected individuals navigate the aftermath.
A layered approach to fraud victim support
1. Prevention through education and technology
Preventing fraud begins with awareness. Banks and credit unions can help clients identify red flags by offering regular educational materials across digital and in-person channels. Topics include the creation of secure passwords, the identification of phishing attempts, and safe usage of peer-to-peer payment apps.
Technology also plays a pivotal role in prevention. Sophisticated fraud detection tools incorporating artificial intelligence and behavioral analytics can monitor suspicious activity in real time. Institutions can also empower their clients with biometric login, multi-factor authentication, and real-time fraud alerts.
- Helping clients create a response plan
Helping clients prepare a response plan before fraud occurs can reduce confusion and stress if the worst happens. Encourage clients to keep a written checklist that includes how to report fraud to their financial institutions, contact information for the FTC and FBI, and steps for freezing credit with the major bureaus. The plan should also cover resetting login credentials and enabling fraud alerts. Reviewing this plan regularly gives clients confidence that they know what to do and who to call. It is a simple way to support a long-term client relationship.
- Responding with clarity and compassion
A fast and empathetic response is critical following a fraud incident. Banks and credit unions should have clear procedures in place to support victim response plans, including measures around:
- Freezing or closing affected accounts
- Reissuing account credentials and payment cards
- Assisting with dispute processes and documentation
- Communicating directly with law enforcement when appropriate
Empowering front-line employees to handle these cases with care can help ease client anxiety and reestablish trust during a particularly vulnerable time.
- Supporting financial recovery
While banks and credit unions often must reimburse clients for unauthorized transactions, many fraud cases involve victims being tricked into authorizing payments. In these situations, reimbursement is not always guaranteed. Still, financial institutions can support victims with the following meaningful actions:
- Assist with regulatory reporting: Help victims file official complaints with the FTC, the FBI, or Consumer Financial Protection Bureau (CFPB). These reports establish a record of the incident and contribute to broader fraud tracking efforts.
- Work with law enforcement and other financial institutions: Cooperate with authorities and peer institutions to trace stolen funds and flag suspicious accounts. Swift action can help contain damage and may lead to partial recovery.
- Provide recovery resources: Refer victims to identity theft protection services, legal aid, or nonprofit support organizations. These resources can help clients manage credit impacts and protect against future fraud.
Even when full financial recovery is impossible, these steps demonstrate a commitment to care and accountability. Institutions prioritizing fraud victim support during recovery reinforce trust and deepen client relationships.
Sustained support beyond the incident
Helping a client through the immediate fallout of fraud is the first step. Ongoing protection is key to rebuilding confidence. Financial institutions can offer continued support through:
- Identity theft monitoring
- Credit and account activity alerts
- Help with placing credit freezes
- Referrals to advocacy groups for seniors or other vulnerable individuals
Staying engaged after the crisis helps banks and credit unions show they are not just financial service providers but also long-term partners in their clients’ security and peace of mind.
Making victim support a shared responsibility
An effective response to fraud must involve collaboration across internal teams. Anti-money laundering (AML), information technology, fraud prevention, and client service departments should operate under a unified plan to ensure quick and coordinated action. Regular training and updates on emerging fraud trends are essential.
Equally important is leadership support. Institutions that invest in fraud prevention tools, adequate staffing, and client education signal that fraud victim support is not a side function but a core priority.
Turning crisis into opportunity
Fraud response efforts should be viewed as risk mitigation and opportunities to lead with purpose. Financial institutions can demonstrate their commitment to ethical banking and social responsibility by standing with victims and guiding them through recovery. Banks and credit unions that take fraud victim support seriously will be better positioned to retain loyal clients, enhance their brand reputation, and serve as trusted pillars in their communities.
