What Is Bank Regulatory Reporting? The Main Report Families

9/6/2026

Ask a new compliance analyst what "regulatory reporting" means and you will usually get one of two answers. Someone who came from finance says the Call Report. Someone who came from the BSA side says CTRs and SARs. Both are right, and both are describing a small part of the picture.

Bank regulatory reporting is the full set of recurring and event-driven filings a bank sends to government agencies about its condition, its lending, its customers' transactions and its tax-reportable payments. The filings go to different agencies, run on different clocks, are owned by different departments, and fail in different ways. What ties them together is that every one is a statement the bank makes to a regulator under its own name, and every one can be wrong.

This guide is an orientation, not a deadline table. It walks through the main report families, which agency receives each, what triggers it, and who inside the bank typically owns it. The exact filing set for any one institution depends on its charter, asset size, holding company structure and business lines, so treat this as a map and confirm your own filing list with your primary federal regulator.

Why the Reporting Picture Is Hard to See

Most banks never draw the whole map, because no single person needs it day to day. The controller owns the Call Report. The mortgage operations manager owns HMDA. The BSA officer owns CTRs and SARs. Deposit operations owns 1099s and B-notices. Each owner knows their own calendar well and has only a rough idea of everyone else's.

That works until something changes. A bank crosses an asset threshold and suddenly owes a report it has never filed. A holding company is formed, or an acquisition closes, and a new set of Federal Reserve reports appears. An analyst who handled OFAC reports leaves, and nobody else knows the blocked-property annual report exists until a reminder arrives from a peer bank. The gaps are almost always at the edges between owners.

A compliance management system is supposed to catch exactly this. The reporting inventory, meaning a list of every report, its trigger, its owner, its backup and its source data, is one of the most useful single documents a compliance department can maintain, and it is the first thing worth building if you are new to the function.

The Six Report Families

It helps to sort the filings into families by purpose. Each family has a different audience and a different idea of what "accurate" means.

Family	Main filings	Who receives it	Rhythm
Financial condition	Call Report; holding company reports	FFIEC / primary federal regulator; Federal Reserve	Quarterly
Mortgage lending data	HMDA loan/application register	CFPB (for the bank's agency)	Annual, quarterly for the largest
Community reinvestment	CRA loan data, for banks subject to reporting	Primary federal regulator	Annual
Financial crimes	CTRs, SARs and related BSA filings	FinCEN	Event-driven
Sanctions	Blocked property, rejected transaction and annual reports	OFAC	Event-driven plus annual
Tax information	Forms 1099, backup withholding returns	IRS (and recipients)	Annual, with notice cycles

The table is deliberately short. Banks also file a range of smaller recurring reports, and which of them apply genuinely varies from one institution to the next. The six families above are the ones nearly every compliance and finance team will touch.

Financial Condition Reports

The Call Report

The Consolidated Reports of Condition and Income, universally called the Call Report, is the quarterly financial statement every insured bank files. It is the foundation document for supervision: examiners use it to scope exams, analysts use it to compare peers, and the deposit insurance assessment draws on it.

There are three versions. The FFIEC 051 is an optional streamlined form for banks with domestic offices only and total consolidated assets under $5 billion. The FFIEC 041 is for banks with domestic offices only that do not use the 051. The FFIEC 031 is for banks with foreign offices. Under the form instructions, the Call Report must be received no more than 30 calendar days after the report date, with a limited extra period (35 days) for banks that have more than one foreign office.

The submission is the easy part. The work is the reconciliation between the general ledger and the schedules, the classification decisions that sit behind loan and deposit categories, and keeping up with instruction changes that arrive almost every year. Our Call Report preparation guide walks through the preparation timeline and the edits in detail, and the Call Report training page lists the related courses.

Who owns it: the finance or accounting function, usually the controller, with compliance reviewing the schedules that touch regulatory definitions.

Holding company reports

A bank owned by a holding company adds a second layer. The Federal Reserve supervises holding companies and collects its own reports. The consolidated financial statement, the FR Y-9C, is generally filed by bank holding companies with total consolidated assets of $3 billion or more, and the very largest firms also file the FR Y-14 stress-testing reports, including the quarterly FR Y-14Q. Most community banks will never touch the Y-14 series, but staff who move between institutions will hear the names, and it helps to know where they sit.

Smaller holding companies file shorter parent-only reports on their own schedules. Which ones apply depends on size and structure, and that is exactly the kind of question to settle with the Federal Reserve rather than infer from a peer.

Who owns it: finance, coordinated with whoever owns the bank-level Call Report so that the numbers tie.

Mortgage Lending Data: HMDA

The Home Mortgage Disclosure Act requires covered institutions to collect data on applications for, and originations and purchases of, covered mortgage loans, and to submit it as a loan/application register (LAR). Under Regulation C, the annual LAR is due by March 1 of the year after the data was collected, and an authorized representative must certify its accuracy and completeness. Institutions that reported at least 60,000 covered loans and applications (excluding purchases) in the preceding year also file quarterly, within 60 days after each of the first three quarters.

Whether a bank is a HMDA reporter at all turns on an asset-size threshold that is adjusted every year, a location test, a federally related loan test and loan-volume thresholds. Smaller depositories may also qualify for partial exemptions that remove some data points. These tests need to be reapplied every year, which is why we keep a separate post on HMDA reporting thresholds. For what goes on the register, see HMDA reporting requirements.

HMDA data is public in aggregate and is one of the first data sets examiners use in a fair lending review, which is why accuracy matters well beyond the filing itself.

Who owns it: mortgage operations or a HMDA coordinator, with compliance running the scrub and the pre-submission review.

Community Reinvestment Data: CRA

Larger banks subject to CRA data reporting collect and report small business and small farm loan data and certain community development data each year, and every bank maintains a CRA public file. The CRA rule has been in flux: the agencies' 2023 rewrite never took effect, the agencies proposed in 2025 to rescind it and return to the long-standing framework, and further rulemaking has followed. Banks continue to operate under the existing framework while that plays out, so check your regulator's current guidance before you rely on any summary of the data requirements, including this one.

Separately, the CFPB's small business lending data rule under Section 1071 of the Dodd-Frank Act creates a distinct data collection for covered lenders. A 2026 amendment narrowed its coverage and pushed compliance out to 2028. It is not a CRA report, but the two get confused because both involve small business loan data.

Who owns it: compliance, usually with the CRA officer, drawing data from the lending systems.

Financial Crimes Reports: The BSA Filings

Bank Secrecy Act reports go to FinCEN through the BSA E-Filing System. Unlike the condition reports, most of them are triggered by events rather than dates, which makes them harder to manage with a calendar.

Currency Transaction Reports. Required for cash transactions of more than $10,000 in one business day by or on behalf of the same person, aggregated where the bank knows the transactions are related. Filed within 15 calendar days. Bills to raise the threshold have been introduced in Congress, but the $10,000 figure is still the law. See our guide to currency transaction reports.
Suspicious Activity Reports. Filed within 30 calendar days of initial detection of facts that may constitute a basis for filing, extendable in limited circumstances when no suspect has been identified. The detection date is the clock, not the date the investigation wraps up. The mechanics are covered in how to file a SAR.
Designation of Exempt Person filings for CTR exemptions, with their own review cycle.

The BSA family also includes recordkeeping that feeds the reports: funds transfer records, monetary instrument records and customer identification records. These are not filings, but an examiner testing a SAR decision will pull them, so they belong in the same inventory.

Who owns it: the BSA officer, with tellers, deposit operations and investigators feeding the process.

Sanctions Reports: OFAC

OFAC reporting is often bundled with BSA, but it sits under a different agency and a different regulation (31 CFR Part 501). A bank that blocks property must report it to OFAC within 10 business days; a bank that rejects a prohibited transaction must report the rejection within 10 business days; and every holder of blocked property files an annual report of blocked property held as of June 30, due by September 30. Initial blocking reports, rejected transaction reports and the annual report are filed through the OFAC Reporting System.

OFAC obligations are strict liability, and the reporting clocks run whether or not the operations team realizes a block was made. The broader screening program is covered in our OFAC compliance guide.

Who owns it: usually the BSA officer or a dedicated sanctions officer, with wire and payments staff making the first call.

Tax Information Reports: The IRS Family

Banks are large filers of information returns. Interest on deposit accounts goes on Form 1099-INT; banks also file forms covering mortgage interest received, retirement account distributions and payments to vendors, among others. Recipient statements and IRS filings run on an annual cycle anchored at year end, with recipient copies generally due early in the year and IRS filing deadlines shortly after.

The tax family has a second rhythm that catches banks off guard: the IRS notice cycle. When names and taxpayer identification numbers on filed returns do not match IRS records, the IRS sends the bank a CP2100 or CP2100A notice, which starts a fixed sequence of B-notices, solicitations and possible backup withholding with its own business-day clocks. Backup withholding collected is then reported on Form 945. Our post on 1099 reporting for banks covers the forms, and the Current Issues in TIN Validation and B-Notices webinar addresses the notice cycle.

Who owns it: deposit operations or finance, depending on the bank, often with a vendor running the print and file process.

How Regulators Use What You File

It is worth understanding what happens to each report after submission, because it changes how much care each one deserves.

Condition reports are compared. Call Report data feeds peer analysis and off-site monitoring. An unusual ratio invites a question before the next exam, and an amendment is a visible event.

Lending data is analyzed for patterns. HMDA and CRA data are screened for fair lending outliers and redlining risk. A field miscoded consistently can create a pattern that looks like disparate treatment.

Crimes and sanctions reports are searched. BSA filings are used by law enforcement, often years later. Their value depends on a clear narrative and accurate identifiers, and examiners judge quality, not just timeliness.

Tax reports are matched. Information returns are matched against taxpayer records. Mismatches flow back to the bank as notices, and repeated mismatches can bring penalties.

That difference explains why the same bank can be excellent at one family and weak at another. The skills involved, from reconciling a balance sheet to writing a SAR narrative to tracking a B-notice clock, are genuinely different.

Building a Reporting Inventory

If you are new to the function, or inheriting it, the most useful thing you can do in your first month is build an inventory. It does not need software. A spreadsheet works, provided it has the right columns.

Report name and form number. Use the agency's exact name, not an internal nickname.
Legal citation. The rule that requires the report, so the next person can check whether it still applies.
A calendar date, a quarter end, or an event such as a block, a rejection or an IRS notice.
Deadline logic. Expressed as the rule states it, such as "10 business days from the date of blocking", rather than as a date.
Owner and backup. Named people, not departments.
Source data. The systems and reports the filing draws on.
Review step. Who checks it before it goes, and what they check.
Applicability test. For threshold-based reports, when the bank last confirmed it was in or out, and the evidence.

The applicability column is the one most often missing, and it is the one that prevents the worst surprises. A bank that crosses the HMDA loan-volume threshold, grows past a holding company reporting threshold, or opens a foreign office changes its filing set, and nobody gets a letter about it.

Where Reporting Programs Break

The failures are consistent enough to list.

Event-driven clocks managed on a calendar. A wall calendar cannot know that an alert was raised on Tuesday or a wire was blocked on Friday. Event clocks need to start in the system where the event is recorded.
Single points of failure. One person knows how the annual blocked-property report works, or how to load the CP2100 file. They go on leave in September or October.
Unreconciled source data. A HMDA field that does not tie to the loan file, a Call Report line that does not tie to the general ledger. The filing passes edits and is still wrong.
Rule changes absorbed late. Instruction changes, threshold adjustments and new reporting systems arrive steadily. Someone has to own regulatory change for each family.
No evidence of review. The report was right, but nothing shows anyone checked it. Examiners treat undocumented review as no review.

Each of these is a compliance management problem more than a technical one, which is why the compliance management systems discipline, with its oversight, procedures, monitoring and audit, is the right frame for owning regulatory reporting as a whole.

Training the People Behind the Reports

Reporting quality comes down to the people preparing the data. A few patterns help.

Train report owners on the rule itself, not just the software. Someone who only knows which screen to fill in cannot tell when a new fact pattern falls outside it. Train the upstream staff, such as tellers for CTRs, loan officers for HMDA fields and new-accounts staff for TINs, because most reporting errors are created at the point of capture, long before the report is assembled. And train the compliance generalist who maintains the inventory to understand every family well enough to ask the right question, even if they will never prepare the report.

For staff responsible for the program as a whole, the Certificate in Compliance Management System (CMS) is the natural starting point, since owning the reporting inventory is a CMS function. Topic courses then go deeper on specific families, such as HMDA compliance training and Bank Secrecy Act training.

Next Step

If you own compliance, or are about to, start with the inventory and the CMS view of it. The Certificate in Compliance Management System (CMS) gives you the framework for oversight, monitoring and accountability that every report family sits inside. From there, pick the families where your bank's risk is highest and train their owners in depth.

Frequently Asked Questions

What is bank regulatory reporting?

Bank regulatory reporting is the set of reports a bank must submit to government agencies about its financial condition, lending activity, suspicious and large cash transactions, sanctions matches and tax-reportable payments. The main families are the Call Report and holding company reports, HMDA and CRA lending data, BSA filings to FinCEN, OFAC reports, and IRS information returns. Some run on fixed dates, such as the quarterly Call Report, while others are triggered by events, such as a cash transaction over the CTR threshold or a blocked wire. Each family goes to a different agency and is usually owned by a different department.

Which agency receives the Call Report?

Banks submit the Call Report through the FFIEC's Central Data Repository, and the data is used by the bank's primary federal regulator (the OCC, Federal Reserve or FDIC) along with the other agencies. It is due no more than 30 calendar days after each quarter-end report date, with a limited extension to 35 days for banks with more than one foreign office. Holding companies file separate reports with the Federal Reserve. Which Call Report form a bank files, the 031, 041 or streamlined 051, depends on whether it has foreign offices and on its asset size.

Is FR Y-14Q something a community bank has to file?

No. The FR Y-14 series, including the quarterly FR Y-14Q, supports the Federal Reserve's stress testing of the very largest bank holding companies. Community banks and most regional banks never file it. The FR Y-9C consolidated statement is filed by larger holding companies, generally those with $3 billion or more in total consolidated assets, and smaller holding companies file shorter reports. If you are unsure which holding company reports apply to your organization, confirm with your Federal Reserve Bank rather than relying on a peer's filing list.

When is the HMDA LAR due?

Under Regulation C, the annual loan/application register is due by March 1 of the year after the data was collected, and an authorized representative must certify its accuracy and completeness. Institutions that reported at least 60,000 covered loans and applications in the prior year also submit quarterly data within 60 days after the end of each of the first three quarters. If the deadline falls on a weekend, submission on the next Monday is timely. Whether a bank must report at all depends on annual coverage tests, so reconfirm coverage every year.

Are BSA reports part of regulatory reporting?

Yes. CTRs, SARs and related Bank Secrecy Act filings are regulatory reports filed with FinCEN, but they work differently from condition reports. They are triggered by events rather than dates: a CTR is due within 15 calendar days of a reportable cash transaction, and a SAR within 30 calendar days of initial detection of facts that may support a filing. Because there is no fixed calendar date to remind anyone, BSA reporting needs its clocks tracked inside the systems where alerts and transactions are recorded.

Who should own regulatory reporting at a bank?

Each report family needs a named owner with deep knowledge of its rules: finance for the Call Report, mortgage operations or a HMDA coordinator for HMDA, the BSA officer for FinCEN and OFAC filings, and deposit operations or finance for information returns. Above them, someone in compliance should own the inventory of every report, its trigger, its owner and backup, and the evidence that each was reviewed. That oversight role is a compliance management system function, and it is where gaps between departments get caught.