A fair lending risk assessment is conducted in four steps: scope the product lines and channels in view, score each FFIEC risk factor category against the institution’s own lending, test the scores that data can check, and record the basis for every conclusion.
This article covers what the assessment includes, how the categories are scored across product lines, which conclusions require testing, what the finished document records, and how the work is implemented.
See our webinar about Ask Kaia’s Fair Lending Compliance Testing Agent for more on this topic.
What the Assessment Covers and Who Owns It
Scope decides what a fair lending compliance program can see. Every credit product the institution originates or purchases falls in, along with each channel it originates through and the market geography it serves. Three product families carry most work:
- Residential mortgage
- Consumer and indirect
- Small business
The CFPB’s revised Section 1071 rule took effect on 30 June 2026 with a compliance date of 1 January 2028, covering institutions that originate 1,000 or more covered transactions in each of two consecutive years. Until collection begins, small business risk has to be scored without that data.
This document is kept accountable by two boundaries:
- Institutional compliance risk assessment
- File-level review is a separate exercise
Ownership sits with the compliance function, with board or committee approval recorded.
Scoring the FFIEC Risk Factor Categories
The Interagency Fair Lending Examination Procedures published by the FFIEC define six categories:
- Overt indicators
- Underwriting
- Pricing
- Steering
- Redlining
- Marketing
For each, the question is where the institution’s structure creates exposure. A fair lending risk assessment scores those categories product line by product line.
| Product line | Where inherent risk concentrates | Data that tests it | Review cadence |
|---|---|---|---|
| Residential mortgage | Pricing discretion and assessment area coverage | HMDA register, rate spread and fee fields, geocoded applications | Annual, with quarterly monitoring |
| Consumer and indirect | Dealer or broker discretion and product steering | Approval and denial rates by channel, product mix at origination | Annual |
| Small business | Underwriting judgment and thin documentation | Internal application and pricing records until Section 1071 collection begins | Annual, first data-driven cycle after 1 January 2028 |
| Marketing and outreach | Media selection and geographic distribution | Campaign records, branch and advertising footprint against tract demographics | Each campaign cycle |
Testing the Scores That Data Can Check
A score is a hypothesis, and the assessment has to say which hypotheses were checked and how, because examiners read the scoring and then look for the work behind it.
Disparate treatment is the claim that similarly situated applicants were handled differently, and it is tested by comparative file review on marginal transactions. Comparative disparate treatment applies that method against a control group drawn from the institution’s own file. Disparate impact is the claim that a neutral policy produces a disproportionate outcome, and it is tested statistically against the business justification the institution states for that policy.
The examiners’ own method is comparative, so an institution that has never run the comparison hands over an untested file at the start of the examination.
What the Finished Document Records
Four things belong in the record for every scored factor:
- The score with the reasoning behind it
- The test performed or an explicit statement that none was
- The mitigating controls credited and the evidence they operate
- The date with the owner’s name
The part most often missing is the trigger list, which sets out what would change the answer (such as a new product, a branch closure, a change in incentive compensation, a merger that redraws the assessment area).
The adverse action notice preserves underwriting reasoning for individual decisions, and an examiner goes there to test whether stated reasons match what the data shows. A denial coded to debt-to-income that the file does not support is a finding on that loan and a scoring problem for the assessment.
Assessment and Testing in Ask Kaia
Ask Kaia’s Fair Lending Compliance Testing Agent helps compliance teams identify potential disparities across a lending portfolio and prepare the supporting analysis for examinations, audits, and management review.
Benefits include:
- Faster testing
- Earlier risk detection
- Better prioritization
- Stronger exam readiness
- More defensible analysis
- Greater consistency
- Lower resource demands
Frequently Asked Questions
How often should a fair lending risk assessment be updated?
Most institutions refresh the full assessment annually and monitor between cycles. The trigger list should be a main driver: a new product, a branch closure, a change in incentive compensation or a merger that redraws the assessment area all warrant a refresh before the annual date arrives.
What is steering in fair lending?
Steering is directing an applicant toward a particular credit product on a prohibited basis when another product was available and would have served them. It is scored wherever an institution offers more than one product for the same need, and it is tested by comparing product mix at origination across groups and channels.
Do fair lending laws apply to business loans?
Yes. The Equal Credit Opportunity Act and Regulation B cover credit extended for business purposes, so underwriting and pricing decisions on small business credit sit inside fair lending scope. From the 1 January 2028 compliance date, Section 1071 data will give covered institutions a dataset for testing small business lending in the way HMDA data supports mortgage testing.
Learn how Ask Kaia can assist your organization’s compliance team in gaining clarity on regulatory changes.
Request Demo- Policy Drafting
- Audit Trails
- Compliance Automation
- Regulatory Intelligence