A CRA is a third-party company that banks hire to review loan applications and assess credit risk

CRA stands for Credit Risk Assessment firm, though the term is sometimes used more broadly to mean any outside firm that evaluates financial risk for a bank. When you apply for a loan, mortgage, or credit card, the bank may send your application to a CRA instead of reviewing it entirely in-house. The CRA pulls your credit report, verifies your income, checks your employment history, and produces a report that tells the bank how likely you are to repay the money.

Banks use CRAs because they have specialized software and databases that can process applications faster and more consistently than a single loan officer could. A CRA's job is to reduce the bank's risk of lending to someone who will default. The bank then uses the CRA's report to make the final decision on whether to approve your loan and at what interest rate.

The CRA is not the same as a credit bureau (like Equifax or Experian), though CRAs often use credit bureau data as part of their work. A credit bureau collects and sells credit information. A CRA analyzes that information and other data to produce a risk assessment for a specific lender.

Key Takeaways

  • A CRA is a company hired by banks to review loan applications and assess how risky it is to lend to you.
  • CRAs pull credit reports, verify income, and check employment history to produce a risk assessment report.
  • The bank uses the CRA's report to decide whether to approve your loan and what interest rate to charge.
  • CRAs are different from credit bureaus—they analyze data rather than collect and sell it.
  • You have the right to know if a CRA was used to evaluate your application and to see a copy of their report if you ask.

How a CRA evaluates your application

When you submit a loan application, the bank sends your information to the CRA. The CRA then gathers data from multiple sources: your credit report from one or more credit bureaus, your bank account history, your employment records, and sometimes public records like court filings or property ownership.

The CRA runs this information through a scoring model—usually an automated system that weighs factors like your payment history, debt-to-income ratio, length of employment, and savings. The output is a risk score and a written report that explains the score. A higher score means lower risk; a lower score means higher risk.

The bank then reviews the CRA's report alongside other factors (such as the loan amount, the type of collateral, and current market conditions) to make a lending decision. The bank is not required to follow the CRA's recommendation, but most banks rely heavily on it because the CRA's assessment is standardized and defensible in court if a loan later goes bad.

Why banks outsource this work to CRAs

Banks could theoretically review every application themselves, but doing so would be slow and inconsistent. A CRA can process hundreds of applications per day using the same criteria for each one. This consistency helps banks avoid accusations of bias or discrimination in lending.

CRAs also have access to databases and verification tools that individual banks may not maintain. For example, a CRA can instantly verify your employment by connecting to payroll systems or contacting your employer. A bank's loan officer would have to make phone calls and wait for callbacks.

Another reason is liability. If a bank makes a bad lending decision, it can point to the CRA's report as part of its due diligence. This does not shield the bank from all responsibility, but it does provide a paper trail showing that the bank took reasonable steps to assess risk before lending.

What information CRAs use and where they get it

CRAs pull data from credit bureaus (Equifax, Experian, and TransUnion), which maintain records of your credit accounts, payment history, and any negative marks like late payments or collections. They also request verification of income, usually by asking you to provide recent pay stubs or tax returns, or by contacting your employer directly.

Many CRAs also check employment history through databases that track job changes and tenure. Some CRAs pull bank statements to verify savings and check for patterns of overdrafts or unusual account activity. A few also search public records for evictions, lawsuits, or bankruptcy filings.

The specific data a CRA uses depends on the type of loan. A mortgage CRA will dig deeper into employment history and assets than a credit card CRA would. A small business loan CRA may request business tax returns and personal financial statements.

How long a CRA assessment takes

Most CRA assessments are completed within one to three business days. Automated scoring can happen in minutes, but the CRA still needs time to pull your credit report, verify your income, and compile the report. If your income verification requires contacting your employer or requesting documents from you, the timeline can stretch to five to seven business days.

The bank then reviews the CRA's report, which may add another one to three business days. So from the time you submit your application to the time you hear back, you should expect one to two weeks in most cases. Some banks offer expedited reviews for an extra fee, which can cut this time in half.

Your rights when a CRA is used

Under the Fair Credit Reporting Act (FCRA), you have the right to know if a CRA was used to evaluate your application. The bank should disclose this in writing, either in the loan agreement or in a separate notice. If you are denied credit, the bank must tell you the reason and provide the name and contact information of the CRA that prepared the report.

You also have the right to request a copy of the CRA's report about you. This is different from your credit report—it is the CRA's own assessment and analysis. You can contact the CRA directly and ask for a copy, usually at no cost if you request it within 60 days of being denied credit.

If you believe the CRA made an error in their report, you can dispute it directly with the CRA. The CRA must investigate your dispute within 30 days and correct any errors. You can also file a complaint with the Consumer Financial Protection Bureau (CFPB) if you believe the CRA violated your rights.

CRAs versus credit bureaus: what is the difference

A credit bureau is a company that collects credit information from lenders and sells it to other lenders, employers, and sometimes landlords. The three major credit bureaus—Equifax, Experian, and TransUnion—maintain credit reports and credit scores that are used across the financial industry.

A CRA is a company that takes information (including data from credit bureaus) and analyzes it to produce a risk assessment for a specific lender. A CRA does not sell information to the public; it works only for the banks and lenders that hire it. Some CRAs are owned by credit bureaus, but they operate as separate divisions with different functions.

In practice, when you apply for a loan, the bank hires a CRA, the CRA pulls your credit report from a credit bureau, and the CRA uses that report (plus other data) to produce an assessment. The bank then uses that assessment to decide whether to lend to you.

Frequently Asked Questions

Does a CRA check pull hurt my credit score?

A CRA's inquiry into your credit report is a "hard pull," which can lower your credit score by a few points. However, multiple inquiries for the same type of loan within 14 to 45 days (depending on the scoring model) typically count as a single inquiry. If you are shopping for a mortgage or car loan, applying to several lenders within a short window should not significantly damage your score.

Can I see what the CRA reported about me?

Yes. You have the right to request a copy of the CRA's report. Contact the CRA directly using the information provided by the bank, or file a request with the CFPB if the CRA does not respond. You may be charged a small fee unless you were denied credit within the past 60 days.

What if the CRA made a mistake in their report?

Contact the CRA in writing and explain the error. The CRA must investigate within 30 days and correct any inaccuracies. If the CRA does not fix the error, you can file a dispute with the credit bureau (if the error is in your credit report) or file a complaint with the CFPB.

Can I request that the bank not use a CRA?

No. Banks are not required to tell you in advance that they will use a CRA, and you cannot opt out of the process. However, you can ask the bank what criteria the CRA uses and request to see the CRA's report after the decision is made.

Does every bank use a CRA?

Most large banks and mortgage lenders use CRAs for most loan applications. Smaller banks and credit unions may do more in-house review, but many still outsource to CRAs for consistency and speed. The bank should disclose whether a CRA was used when you receive your loan decision.