HMDA penalties and what data errors really cost: an ROI model

HMDA penalties are the visible end of a longer bill. HMDA data errors cost a lender in four ways: the hours spent checking a sample of loan files before each filing, the rework when an examiner's sample of 79 records finds four errors in one field and orders that field corrected and resubmitted across the whole register, the penalties and orders that follow repeated findings, and the fair-lending conclusions drawn from data that was wrong. Only the first appears in a budget. Botminds' HMDA and 1071 Data Validation checks every reportable field on every record against the page in the loan file it came from, before filing, and leaves each correction to a named person. This page shows how to price what that changes, and which numbers should stay out of the business case.

What do HMDA data errors cost? Four lines, and the budget sees one

The visible cost of HMDA compliance is the people who prepare the loan application register (LAR); the larger cost sits in events the budget treats as unlikely. The CFPB's own cost model splits HMDA work into four primary tasks: collecting the data, reporting and resubmission, compliance and internal audits, and preparing for and assisting examiners. For a representative lender with 1,000 records, it put the yearly cost at about $35,600, or $36 an application, against $6 an application for a large lender with 50,000, before the 2015 rule added fields. Those are averages of the routine. They do not price the year an examiner's sample goes the wrong way.

The last row is the one compliance officers worry about and finance never sees. The transaction testing guidelines give their own example: a lender that coded withdrawn applications as denials so often that examiners could not reliably analyse underwriting disparities can be ordered to correct and resubmit the action taken field even below the four-error threshold. A data error does not have to be frequent to be expensive. It has to be in the wrong field.

What are the HMDA civil money penalties? $6,000 to $12 million, mostly for repeats

Most of the HMDA penalties we reviewed on the regulators' own pages followed an earlier finding against the same lender, or sample error rates far above the resubmission line. The amounts span three orders of magnitude, from $6,000 to $12 million, and the size appears to track the lender's volume and its history more than any single error.

Freedom Mortgage is the clearest case of how the costs stack. In 2019 the CFPB found it had misreported race, ethnicity and sex from 2014 to 2017 and fined it $1.75 million. Its 2020 register was then tested: the CFPB found 51 errors in an initial review of 159 files, and the company had to resubmit. In that resubmission it corrected 35 different fields, over 174,000 data entries, affecting nearly 20 percent of its applications. The CFPB sued in October 2023, and in June 2024 the court entered a judgment with a $3.95 million penalty and requirements to regularly audit, test and correct its HMDA data.

Washington Federal shows the same pattern at a smaller scale. After a $34,000 penalty in 2013, its own internal audit of the 2016 register found errors in 40 of 100 files; the CFPB's sample of the 2017 register found a 32% error rate, and 16% even after resubmission. The consent order blamed "a lack of appropriate staff, insufficient staff training, and ineffective quality control", and added a $200,000 penalty.

The occurrence of errors in many different fields, rather than concentrated in one or two fields, indicates broad CMS failures and a lack of adequate resources.

CFPB consent order against Washington Federal Bank, 2020

The climate has changed since. In 2025 the CFPB terminated or modified 22 pending orders or issued no-action letters, and both Washington Federal orders have since been terminated. Examinations did not stop: HMDA was still the fifth most frequently cited rule in FDIC consumer compliance examinations in 2025. For a business case, that means the penalty term moves with enforcement policy, while the examiner's sample, and the resubmission it can order, does not.

How are HMDA penalties calculated? Statutory tiers, then judgement

There is no formula. The HMDA statute leaves enforcement to each lender's regulator under its usual powers, including civil money penalties, and the amount is set case by case within a statutory ceiling and a list of factors. For the CFPB, the Consumer Financial Protection Act sets three tiers: up to $5,000 a day for any violation, $25,000 a day for a reckless one and $1,000,000 a day for a knowing one, before the annual inflation adjustments (12 U.S.C. 5565). The banking agencies apply similar tiers under their own statute.

Within the ceiling, the Act names the factors: the size of financial resources and good faith of the lender, the gravity of the violation, the severity of risks to or losses of the consumer, the history of previous violations, and "such other matters as justice may require". For HMDA specifically, the CFPB's 2013 bulletin added its own: the size of the register and the observed error rate, whether the lender had already been on notice of high error rates, and whether error rates since then show "substantial progress" or have "remained high or have increased" (CFPB Bulletin 2013-11). The cases in the chart above read like those factors applied: the largest amounts fell on large lenders, repeat findings and demographic data.

Does self-identifying HMDA errors reduce penalties?

It is one of the named factors. The same bulletin says the Bureau will consider "whether an institution self-identified its HMDA errors outside the context of an active examination or examination-related activity, and independently took appropriate corrective action", both in deciding whether to bring a public action and in sizing any penalty. The words that matter are "outside the context of an active examination": errors your own check finds and corrects before the examiner arrives count; errors found once the exam has begun do not earn the same credit. A record of each correction, with its date, page and signer, is how a lender shows which kind it has.

What a field-wide HMDA resubmission really takes

A resubmission order means correcting one field on every record in the register, not just the ones the examiner found. Under the FFIEC transaction testing guidelines, examiners test 35 records from a register of 501 to 100,000, extend to 79 when any field shows two errors, and direct the lender to correct and resubmit every field with four or more. They can also order a resubmission to add loans that were left off, and can direct changes to policies, procedures and audit even when no threshold is met.

We found no published figure for what a resubmission costs, so build it from your own register. The arithmetic is short: records in the register × minutes to re-verify the field against the file × loaded cost per hour, plus the refiling and the procedure changes. The minutes are the hard part. If the field's source page is not already known for each record, a reviewer has to open the loan file, find the document and read the value, record after record. That is why a field that took the examiner an afternoon to test can take a team weeks to correct.

Federal Reserve examiners describe the preventive practice as comparing the data collected "with the data in the source files" before submission, and they warn that the errors such reviews uncover can lead to "systemic reporting violations, data scrubs, and resubmission". Their own caveat is the one that matters for cost: "Depending on the volume of data an institution collects, this process may involve testing through sampling."

The same arithmetic shows what changes when every field has already been matched to its page before filing. Take a sample bank as it runs through the solution: Kestrel Valley Bank, a fictional $6.8 billion lender whose 2026 register held 5,318 records by the end of September. Every correction it made this year keeps its old value, its new value, the page it rests on and who signed it. A resubmission order on one field can then start from a filtered list rather than a project.

Every correction with its page and its signer, ready for the examiner

This is the evidence a resubmission, or an examiner's question about a procedure, asks for. Counting the hours it takes to produce today is part of the baseline.

The term most HMDA business cases leave out: the odds of a resubmission

The expected cost of a resubmission is its cost multiplied by the chance that a sample orders one, and that chance rises steeply well below the 5.1% line. Because the examiner tests only 79 records, a field with a true error rate of 3% is ordered resubmitted roughly one time in seven under both stages of the published procedure, and one time in five if all 79 are reviewed.

Two readings matter for the budget. First, a field does not have to cross 5.1% to be ordered resubmitted: at 3% the odds are already one in seven or more, because a sample of 79 easily over-draws errors. Second, a register carries many fields, and their odds compound. The solution's estimate for the sample bank, across all its fields as first entered, is 37 in 100 that one 79-record sample orders at least one field resubmitted. Our model of both stages of the procedure gives about 29 in 100 on the same data. Either way, roughly one exam in three ends in a resubmission, and the derivation is laid out in how examiners test HMDA data.

The exam odds, as the HMDA team sees them

How to calculate the ROI of HMDA and 1071 Data Validation

The return is three gains minus one cost, each in its own unit and priced by the person who owns that number. Hours are only the first gain. A case that stops there undersells checking every record, and a case that adds expected penalties oversells it.

A worked example on a sample 5,300-record HMDA register

On the sample bank, review time falls from an estimated 22 days a quarter to 3.5, the odds term adds roughly a third to a half again in an exam year, and one root-cause finding cuts next year's action-taken-date errors by 30%. Every input below is either our estimate on the fictional register or an assumption marked as one. Replace each with your own.

Term 1: review hours

The gap is 18.5 days a quarter, or 74 working days a year: about 590 hours. At an assumed loaded cost of $85 an hour, that is about $50,000 of capacity. It is capacity, not cash, unless it replaces overtime, contract scrub help or a vacancy you would otherwise fill. Where the days go today, desk by desk, is the subject of HMDA scrub season.

Term 2: resubmissions avoided

Assume re-verifying one field against the loan file takes ten minutes a record by hand. One field across 5,318 records is then about 890 hours, roughly $75,000 at the same rate, before refiling and procedure changes. The odds of an order fall from 26 to 37 in 100 as first entered to under 1 in 100 once the breaks found are corrected. That is about $19,000 to $27,000 of expected cost per examination, to be multiplied by the chance your register is tested in the year.

The "after" odds are the number a skeptic should press on, because they assume the check finds the errors. In our model of the sample register they are forgiving: if the solution caught only four errors in five, the odds of an order would stay below 1 in 400; at half, they would rise to about 4 to 6 in 100. Detection is measurable, by seeding known errors into a copy of the register, which is how model risk and internal audit should test it.

Term 3: errors stopped at source

The sample bank's error-rate counts found that one branch, Eastgate, carried 41 of the year's 127 action-taken-date errors: 32% of the errors on 16% of the records. In 38 of the 41, the register held the date the loan file was moved to Suspended, not the date of the adverse action notice. The finding went to the branch's loan operations lead with the records attached.

A root-cause finding, sent to the person who owns the step

If the branch changes the step, next year's register would carry 38 fewer action-taken-date errors at the same volume. On the same model, that field's odds as first entered fall from 12 in 100 to about 4, and the register's overall odds from 37 to about 31, before any check runs. The value is the 38 breaks nobody has to work plus that change in odds, and unlike the other two terms it compounds year on year. The whole case is told in 41 errors at one branch.

Term 4: cost to run

The 3.5 days a quarter that remain are the supervision cost, and they belong in the denominator. So do the subscription and the set-up: connecting the register extract and the loan files, and writing the bank's own HMDA procedure into the rules. Payback is the number of quarters it takes the gains to cover set-up; measure it on your first full quarter rather than on anyone's estimate.

The HMDA KPIs to report to the board each quarter

Report six numbers, each measured on every record from the first quarter: coverage, error rate by field, error age, the kept-value rate, exam odds and errors stopped at source. Together they show both that the data is accurate and that the people deciding are not simply accepting what the check says.

What not to count in an HMDA ROI

Leave out expected penalties, the headline "after" odds as a measured result, hours booked as cash, and Section 1071. Each inflates the case in a way a CFO or an auditor will find.

• Expected penalties. The largest public HMDA penalties followed earlier findings, intentional misreporting or sample error rates in double digits, and their pace now moves with enforcement policy. Multiplying a $3.95 million penalty by a probability produces a large, unfalsifiable number. What a full check does change is the defence: under Regulation C, an unintentional error is not a violation if it occurred despite procedures "reasonably adapted to avoid such an error". A corrections list with every page and signer is evidence of those procedures.
• "Under 1 in 100" as a result. It is an estimate on a fictional register that assumes the check finds the errors. Use your measured detection rate, and the odds that follow from it.
• Hours as cash. Count them as money only where they replace overtime, outside scrub help or a hire. Otherwise report them as capacity moved to root-cause work and fair-lending analysis.
• Resubmission and penalty together. They are not independent: most of the cases above began with an examination sample that failed. Counting both double-counts the same event.
• Section 1071. A practice small-business register before the 1 January 2028 compliance date is readiness, with its own costs and its own case; it is set out in Section 1071 under the 2026 rule.

The CFPB has said it will keep monitoring the rate at which lenders fail to collect and report applicants' demographic information, which has risen since 2019. That is a reason to measure the demographic fields closely, not a number to put in the spreadsheet.

Questions people ask

How much does an HMDA resubmission cost?

We found no figure published by a regulator or a survey. Estimate it as records in the register × minutes to re-verify one field against the file × loaded hourly cost, plus refiling and any procedure changes the examiner directs. The minutes depend almost entirely on whether each field's source page is already known.

How many HMDA errors trigger a resubmission?

For a register of 501 to 100,000 records, four errors in one field among the 79 sampled; three among 59 for 191 to 500 records; four among 159 above 100,000. Examiners can also order a resubmission below the threshold when errors would make fair-lending analysis unreliable, or to add omitted loans.

Does checking every record reduce HMDA penalty risk?

Indirectly. Penalties have followed repeated or systemic failures, and the cases cite weak quality control and monitoring. A documented check of every field, with each correction's evidence and signer, is the kind of procedure Regulation C's bona fide error provision describes, but it is evidence for the examiner to weigh, not a guarantee.

What are examples of HMDA violations?

Federal Reserve examiners describe fields keyed by hand and mistyped, a cash-out refinance reported as a plain refinance, income reported as the borrower stated it rather than as the lender relied on it, and business loans wrongly reported because staff misread the definition of a business or commercial purpose (Consumer Compliance Outlook, 2023). At the FDIC in 2025, 82% of HMDA violations cited were failures in the required data fields.

How long does it take to see the return?

The hours term shows in the first full quarter, the odds term at the next examination, and the errors stopped at source in the following year's error rates. How fast the first quarter arrives is covered in going live on an HMDA register.