Commercial loan portfolio analysis, explained.

Looking at a whole commercial loan book at once, in plain words

One board question, from asking to an approved answer

1. Loans are made and monitoredEach credit is underwritten, booked with an industry code and rating, and reviewed every year. The files fill up with memos, statements and call notes.
2. Something changes outside the bankTariffs, a supply shock, a weak hotel market, private credit growing fast. A board member or an examiner asks what it means for the book.
3. The book is asked a new questionDefine what counts, find every borrower it touches, total the exposure at one date, stress coverage. This is where a code screen misses Northfield Solar, or a full read finds it.
4. The answer goes to the boardThe portfolio manager writes it; the chief credit officer approves it; the committee reads it with the pages behind the numbers.
5. The bank acts, and asks againRelationship managers call the borrowers below the line, annual reviews move forward, limits are set, and the question returns next quarter.

Step 3 is the subject of this guide. Ashgrove Commerce Bank, its people and its borrowers are fictional.

What an industry code hides, and other portfolio surprises

Concentration, indirect exposure, coverage, NDFI

Fourteen terms are defined in the one-page summary.

Loan system or credit file: where each portfolio question gets its answer

In shortEvery commercial loan lives in two places. The loan system holds the numbers a bank books: balance, code, rating, maturity. The credit file holds what the bank knows about the borrower: how it earns, what it buys, who it sells to, who stands behind it. Routine portfolio reports read the first. New questions almost always need the second.

The Federal Reserve's examination manual expects a credit file to let reviewers analyze a credit "before it is granted and to monitor and evaluate the credit during its life", which means documenting the borrower's business, financial condition, the purpose and sources of repayment of each loan, and the collateral and its value.5 None of that is a column in a loan system. It sits in a handful of document types, each written by a different person for a different purpose, on a different date.

Supervisors read a third source, the Call Report: the quarterly financial report every insured bank files, which sorts its loans into standard categories. Eight questions boards often ask show which of the three sources can answer what.

What one commercial book's files look like

Each of these documents answers its own set of questions. An annual review states the main inputs and where they come from; the notes to an audit may list major customers; a field exam ranks suppliers by share of purchases; a call memo catches what changed last month. Reading for a new question means knowing which document is likely to carry the answer, preferring audited figures over memos and newer over older, and saying so when two documents disagree.

The supervisory texts behind portfolio analysis, and what changed between 2025 and 2026

In shortNo single rule says how to analyze a commercial book. Supervisors expect banks to measure concentrations against capital, stress the book at least yearly, review credit independently, and tell the board in time. Between December 2025 and October 2026 the OCC rewrote both of its portfolio booklets, the model guidance was replaced, and the OCC and FDIC handed the definition of a leveraged loan back to each bank. A year earlier, lending to nonbank lenders got its own lines on the Call Report.

What supervisors watch in commercial loan concentrations

Concentration risk tests at 25%, 100% and 300%, worked through on one bank

In shortThree numeric tests anchor concentration reporting. Any group of related exposures over 25% of tier 1 capital plus the allowance is a concentration. Construction and land loans at 100% of that capital, or total CRE at 300% after 50% growth in three years, draw closer supervisory analysis. All three have used the same denominator since 2020, and none of them can see an exposure the loan system does not code.

Since March 31, 2020, the agencies calculate credit concentration ratios on tier 1 capital plus the allowance, replacing total risk-based capital in the 2006 CRE screens.8 A board report that still divides by total risk-based capital uses the old method.

What counts as CRE in the 2006 guidance is set by the source of repayment: loans "where the primary source of repayment is cash flows from the real estate collateral", which leaves owner-occupied property out.7 The agencies reminded banks of the guidance in December 2015, after seeing CRE markets grow, competition increase and underwriting standards ease, and added no new ratio.23 The guidance adds that it "does not impose lending limits", and that the screens are not a "safe harbor" if other risk signs are present.7

An illustrative bank, step by step

The margin is thin either way. About $35 million of CRE paydowns, or $12 million more tier 1 capital, would bring this bank back under 300%. A bank that meets a screen can keep lending, and examiners will expect the risk management the guidance lists: board oversight, portfolio management, management information, market analysis, underwriting standards, "portfolio stress testing and sensitivity analysis", and credit review.7

What the screens cannot see

The CRE screens are built from Call Report lines, so they count only what the Call Report codes. Three kinds of concentration fall outside them. One is industry concentration inside C&I lending. Another is a shared counterparty: a sponsor behind several property loans, a guarantor on many credits, a tenant whose lease repays several buildings. The third is exposure through a shared input or customer, across industries. The first is a loan system query. The other two live in guaranty agreements, rent rolls, supplier lists and annual reviews.

Citizens Bank in Sac City, Iowa, began lending to trucking companies in 2014. By June 30, 2023, those loans were "310 percent of Tier 1 Capital and Allowance for Credit Losses" and 43% of the portfolio. Its borrowers weakened as the industry "faced supply-chain issues and increased costs of fuel, insurance, and repairs" between 2020 and 2022, and the bank was closed on November 3, 2023, at an estimated loss of $14.8 million to the Deposit Insurance Fund, 23% of its $65 million in assets.24

A code screen would have seen that concentration. A rise in input costs turned it into losses. When the input is imported steel or solar panels, the borrowers who share it carry a dozen different codes.

Tariff exposure in a commercial loan portfolio: an indirect concentration codes cannot find

In shortTariffs reach a bank through borrowers that import part of what they sell. Lenders already price that risk: in the Fed's October 2025 survey, banks said they were less likely to approve loans to firms with high trade exposure. The legal basis for tariffs changed three times in 2026, and the bank still needs to know who in its book imports. Finding them takes a definition the files can answer and a read of every relationship.

In the Federal Reserve's October 2025 survey of 65 domestic banks and 16 foreign bank offices, banks reported being "less likely to approve C&I loan applications from firms of all sizes with high trade exposures", and more likely to approve firms with low exposure.26 A Fed staff note using loan-level supervisory data went further. Indexed to the third quarter of 2024, committed C&I loans to firms with high supply-chain exposure fell to 95.8 in the first quarter of 2025 while loans to low-exposure firms rose to 101.2, and spreads on high-exposure loans rose.27

What changed in tariffs in 2026

On February 20, 2026, the Supreme Court held that the emergency-powers statute behind many of the 2025 tariffs does not authorize tariffs. A temporary 10% global tariff under Section 122 followed on February 24, 2026. The Court of International Trade found it unauthorized on May 7, 2026, but an appeals court let it stay in force pending appeal, and it ran until its 150-day limit on July 24, 2026. New Section 301 tariffs of 10% or 12.5% on goods from 60 trading partners took effect the same day.12,13,28

Duties under Section 232 were untouched by the ruling. They were restructured on April 6, 2026, with 50% on primary steel, aluminum and copper products and closely related derivatives, 25% on certain copper articles and on some steel and aluminum derivatives, and a temporary 15% rate on specified metal-intensive equipment.13 From June 8, 2026, that 15% rate covers more machinery, farm equipment and HVAC products.29 Rates and authorities may change again. The portfolio question stays the same: which borrowers buy enough from abroad that a cost rise would push them below covenant.

Why a code screen gives the wrong list

An industry code is assigned at onboarding and describes the borrower's main activity. It does not change when a contractor starts buying panels from overseas. Screening by code answers "which of our borrowers are in industries that import?" The board asked "which of our borrowers import?" The ProSight Financial Association's guidance for lenders starts with NAICS codes and transaction activity, such as import letters of credit and overseas wires, then calls borrowers, and warns that "A borrower that looked fine a year ago may not be today."30

At the fictional bank in this guide, 412 relationships sat in trade-sensitive codes. Their files confirmed 57 as dependent on imported inputs and cleared 351 with a passage showing domestic sourcing, such as a millwork company buying Appalachian hardwood. Four files did not say. Reading every other relationship found six more: a solar installer, a flooring contractor, a pool builder, an IT reseller, a marine service yard and an event-rental firm, with $39.6 million of commitments that a code screen would have reported as zero.

Where import dependence is written down

Three documents, one borrower, one story; the reader prefers audited figures over memos and newer over older, and shows both when they differ. All three passages are from the fictional case.

Loans to nondepository financial institutions: the fastest-growing line, and the borrowers coded as something else

In shortBank lending to finance companies, funds and other nonbank lenders has grown faster than any other loan type: $1.4 trillion at the end of 2025 on the FDIC's count, and about $1.7 trillion drawn in early 2026 on the Boston Fed's own grouping. Since December 2024 larger banks report it in five categories, and clarified instructions moved about $200 billion out of C&I during 2025. The borrowers that are hardest to classify are ordinary businesses with a lending arm, and their codes do not say so.

The FDIC counts $1.4 trillion of bank loans to nondepository financial institutions at December 31, 2025, 5.6% of industry assets, up 35.2% in the year, and notes that part of the growth came from banks reclassifying loans under revised Call Report instructions. From 2010 to the end of 2025 the line grew at a 22.7% compound annual rate, against 7.4% for multifamily, the next fastest; the FDIC's February 2026 analysis, covering 2010 to 2024, put it at 21.9%.11,31

In the year to June 30, 2026, it grew another $279.1 billion, 22.4%, while total loans grew 6.8%.32

The Boston Fed's July 2026 note, which groups these borrowers its own way, puts drawn loans to nonbank financial intermediaries at $1.7 trillion in the first quarter of 2026, about 12% of total loans, up from 1% in 2010. Counting undrawn commitments, the exposure is $2.7 trillion, 64% more than drawn balances alone suggested; private equity funds and business credit intermediaries account for $1.3 trillion of it.33 Reported defaults on these loans are low.

Low reported defaults say little about the loans those lenders make, which the bank sees only through its borrower's reports. That is why the OCC's spring 2026 outlook says private credit markets "warrant ongoing monitoring", and why the December 2025 leveraged lending release names indirect exposure "via lending to business development companies and certain debt funds".22,3

How a reporting change moved loans out of C&I

Banks over $10 billion now split their nondepository lending into mortgage credit intermediaries, business credit intermediaries, consumer credit intermediaries, private equity funds and other lenders, and report past dues, nonaccruals and unfunded commitments.11,6

Fund subscription lines and mortgage warehouse lines are easy to place. The hard cases look like ordinary commercial customers: a car dealer holding the retail installment contracts it wrote, a farm-supply wholesaler carrying growers' notes until harvest, an equipment distributor that starts funding its dealers. Their codes say retail or wholesale. Their files say they lend. Whether each belongs on the NDFI line is a judgment for the bank's Call Report preparers under the FFIEC instructions, and it starts in the file.

How to stress test debt service coverage borrower by borrower, with the arithmetic

In shortA borrower-level stress takes each borrower's latest financial figures, applies the shock only to the costs it touches, nets off what the borrower can pass on, and divides what is left by annual debt service. Adding up the borrowers who fall below the covenant line gives the bank a list of names. A single loss rate on a pool gives it a number with no names.

The OCC considers "some form of stress testing or sensitivity analysis of loan portfolios on at least an annual basis" a key part of sound risk management for community banks. It describes two routes: bottom-up, which adds up the effect on each loan, and top-down, which applies a stressed loss rate to pools of similar loans. Either can be done with methods that "can range from a single spreadsheet analysis to a more sophisticated model".17 Top-down is quicker and tells the board how much. Bottom-up tells relationship managers whom to call.

A bottom-up stress starts from each borrower's spread: the bank's own standard layout of the borrower's financial statements. The formula below uses EBITDA (earnings before interest, taxes, depreciation and amortization), a common stand-in for the cash a business has left to pay its lenders.

One borrower, worked through

The borrower is Kessling Fastener & Wire, a fictional fastener maker in Dayton, Ohio, with $18.5 million committed and a $12.0 million revolver maturing March 31, 2027. Its covenant minimum is 1.20x.

Two assumptions decide the answer, and both belong on the page beside the result. The first is the share of costs the shock touches: applying a rise to every dollar of cost of goods sold, when the file says 46% is imported, more than doubles the hit. The second is pass-through. A borrower with long-term fixed-price contracts passes on nothing until they reprice; a borrower whose largest customer takes a third of its output passes on what that customer accepts. Where the file states a borrower's own pass-through, it should replace the default.

From the whole book to five calls

A severe case shows how sensitive the list is. At +20% with only a quarter passed on, the same 63 borrowers produce 44 below the line and $308.6 million outstanding, against 17 and $142.6 million in the board case. Risk ratings still move only through the bank's credit process; the stress tells the bank where to look first. ProSight's advice to lenders is the same: borrowers flagged and nearing maturity "are the ones you look at first".30

Eight ways a portfolio answer misleads a board without anyone noticing

In shortMost portfolio answers go wrong quietly. The total adds up, the chart looks clean, and the error is in who was left out, which date was used, or what was counted as cash. Nearly every one of them understates risk.

The guarantor example is fictional: a hotel guarantor whose $1.64 million of cash and securities backs $31.5 million of guaranties: the bank's $21.7 million loan and $9.8 million he guarantees elsewhere.

What failed banks and the syndicated loan review show

Material loss reviews keep returning to the same pattern. First NBC Bank, whose 2017 failure cost the Deposit Insurance Fund $996.9 million, at one point had four borrowers whose relationships each exceeded 25% of tier 1 capital.35 Citizens Bank's trucking book reached 310% of tier 1 capital plus allowance.24

Large loans shared by several banks tell the same story at scale. The 2025 Shared National Credit review, the agencies' yearly review of those syndicated loans, found non-pass loans down to 8.6% of $6.9 trillion in commitments, "primarily due to growth in new commitments rather than an underlying improvement in credit quality", with leveraged loans nearly half of commitments and 81% of non-pass loans.36

Commercial loan delinquency in 2026: calm for the industry, slipping at small banks

In shortUS commercial banks held about $2.96 trillion of commercial and industrial loans. Business loan delinquency is about half its average since 1987, but smaller banks carry much higher C&I noncurrent rates, and community banks' past-due rate has risen above its pre-pandemic average. A board comparing its own book with the industry should compare with banks its size.

At June 30, 2026, the 4,238 FDIC-insured institutions held $2,540.1 billion of C&I loans (a smaller total than the Fed's, which also counts US branches of foreign banks): 0.31% were 30 to 89 days past due, 0.96% were noncurrent, and year-to-date net charge-offs ran at 0.57%. The FDIC's group of commercial lenders had a 1.06% noncurrent rate; banks under $1 billion with no single lending specialty had 1.51%, with a past-due-and-nonaccrual rate of 2.70%.32

The FDIC's annual review shows the drift at community banks: their C&I past-due-and-nonaccrual rate "continued to rise" to 1.81% at the end of 2025, above the 1.62% pre-pandemic average, in a C&I book that grew 4.9% in the year. In a small-business survey the FDIC cites, owners "cited higher input costs and supply chain interruptions".11

What software and AI change in portfolio analysis, and what the 2026 model guidance leaves to the bank

In shortSoftware has long summed the loan system. What is new is software that reads the credit files and answers in a table, each row tied to a passage. That reading is generative AI, which SR 26-2 places outside its scope, so the bank sets its own tests. The arithmetic around it falls outside the model definition. Responsibility stays with the bank either way.

SR 26-2 "supersedes and replaces" SR 11-7, the Federal Reserve's model risk guidance since 2011. It defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories" to produce quantitative estimates, excludes "simple arithmetic calculations, such as those found within spreadsheets" and deterministic rule-based processes, and places generative AI, including AI that plans and acts on its own, outside its scope because such models are "novel and rapidly evolving".

The letter "does not set forth enforceable standards", is "expected to be most relevant" to banking organizations over $30 billion, and promises a request for information on AI.4,19

The OCC's spring 2026 outlook says banks are taking a measured approach to generative AI, in limited uses "with guardrails and human-in-the-loop accountability", and names "lack of explainability, data privacy and data poisoning issues, cybersecurity threats, and validation challenges".22

Three answers for every borrower

A portfolio question sorts every relationship, and a sort with no "unknown" pile pushes unknowns into the other two. Software that reads files can make that mistake faster than people, by inferring from a borrower's industry or a similar company what its own file does not say. The US Treasury describes generative AI's best-known failure as "confidently stated but incorrect output".42

The safeguard is structural: each borrower ends in one of three states, counted with the passage that puts it in, cleared with the passage that keeps it out, or named as "not in file". A board told "63, plus four we cannot yet confirm" has been told the true state of knowledge.

What portfolio software changes, and what analysts keep

NIST's AI Risk Management Framework, voluntary and organized into GOVERN, MAP, MEASURE and MANAGE, gives a validator a structure while the promised request for information is pending; its "valid and reliable" characteristic translates into re-performing a sample of answers from the source files.41

The Fed's Vice Chair for Supervision drew the legal line by use: AI with "more direct impact on credit decisions affecting individual customers" presents "more substantial legal compliance challenges".43 Portfolio analysis informs oversight, which places it at the lower end of that range. When an answer leads to a decision on one borrower, such as a line reduction, the decision runs through the bank's normal credit process and its notice duties.

How credit teams answer a new portfolio question today: seats, steps and the six weeks

In shortA board member asks, the chief credit officer takes the question, the portfolio manager defines it and screens the book, relationship managers fill in a spreadsheet, senior analysts re-read files, and someone totals, stresses and writes. At the fictional bank in this guide the last such question took about six weeks and still missed borrowers. In an illustrative split of those weeks, half goes to reading and a quarter to waiting.

From board committee to RMs: who answers a portfolio question

Five seats before the board reads an answer

Six weeks per question, half spent re-reading files

The waiting has a cost of its own. Every relationship manager filling in the spreadsheet does it between client calls, and the replies vary in quality. Meanwhile annual reviews wait while the analysts read, which is how stale files accumulate. The result at the fictional bank: 38 borrowers found after six weeks, against 63 when every file was read.

Spreadsheets, loan review firms or file-reading analytics

The board chair's tariff question: every credit file read, exposure totaled and stressed, and an approved summary

In shortThis is the example from the top of the page, inside the product. Owen Castellanos, director of commercial portfolio management, types the board chair's question in plain words at 8:40 a.m. Six agents plan it, screen the loan data, read every credit file, total the exposure and stress it. The answer names 63 borrowers, each with the passage that puts it there. Ruth Adebayo, the chief credit officer, approves the board summary at 9:31 a.m.

1

The question, asked as the chair asked it

Owen types: which of our commercial borrowers depend on imported inputs, how much do we have out to them, and who would fall below covenant if those costs rise 15%? The question planner turns "depend" into the bank's own setting: imports of at least 20% of cost of goods sold, or one named foreign supplier. The portfolio screener ties the September 30 book to $6.42 billion committed and passes all 1,184 relationships to the reader, including the 772 outside trade-sensitive codes.

The run in the sample took 38 minutes. The answer leads with the number, names what the codes missed, and puts the four borrowers whose files are silent in an amber box of their own.

2

Every borrower, with the passage that put it there

The evidence table lists all 63: relationship manager, committed, outstanding, rating, imported share of costs, countries, coverage now and stressed, maturity, how it was found, and the passage itself with its document and date. Filters cut it to the 17 below 1.20x, the 9 maturing within 12 months, the 6 outside the codes and the 4 not in file.

3

Kessling Fastener & Wire, worked out line by line

Three passages from three documents: the annual review of March 14, 2026, page 6 (46% of cost of goods sold is imported wire rod); the July field exam (two mills at 31.2% and 14.9% of purchases); and a September call memo (a 10% surcharge, about half passed on). The stress tester applies the 15% rise only to the imported $12.4 million, nets off half, and takes coverage from 1.38x to 1.06x, under the 1.20x covenant.

The $12.0 million revolver matures March 31, 2027, so Kessling is one of the five to call first. Two buttons sit at the top: send the borrower questionnaire through Tessa Moore, its relationship manager, or move the annual review forward.

4

The stress, borrower by borrower

At +15% with half passed on, 17 of the 63 fall below 1.20x, with $142.6 million outstanding, 33% of the answer's $438.7 million; five of them also mature within 12 months. Owen can move the cost rise, the share passed on and the coverage line, or pick the board, severe or mild case. Every result prints its assumptions, and no stress moves a risk rating.

5

The summary goes to the committee only after the CCO approves

The answer writer drafts the board summary: the question, the answer by industry, the stress, what the bank is doing and how it knows, with every number footnoted to its source. Owen edits, then sends it to Ruth at 9:24 a.m. with a note. She approves at 9:31 a.m., adding "Good, put the five maturing names first on Thursday", and it goes into the committee pack.

The solution's design targets are one hour from a board question to a cited answer, and 100% of credit files read for the question. Both are targets, to be measured on your own book. The 38 minutes and the 9:31 approval are from the fictional sample run.

The rest of the workspace: loan portfolio monitoring, proof pages, file gaps and policy settings

In shortThe board question is the story. These screens show the rest: a standing question about borrowers that lend, a hotel guarantor question answered from personal financial statements, the page behind a row, the comparison with last quarter, questions saved to re-run, a borrower found outside the codes, the severe case, the approval, the gaps in the files, and the bank's own settings.

Select any screen to open it larger. The bank, borrowers, suppliers, people and figures are fictional.

The portfolio manager owns every answer and the chief credit officer approves what reaches the board

In shortEach agent has one job and limits it does not cross. None of them changes a rating, contacts a borrower or sends anything to the board. The portfolio manager owns every answer, relationship managers confirm with borrowers, and the chief credit officer approves each board and examiner summary with her name and the time.

Six agents, from question planner to stress tester

The portfolio manager owns it; the CCO approves what leaves

Every question, plan, answer, sweep re-run and approval is on the audit trail, and settings changes are versioned. Answers show only the relationships the asker may see. Ratings change only through the bank's credit process.

The portfolio director, CCO and board chair in the screens

Credit files joined to a loan system extract at one as-of date, with nothing written back to the core

In shortIt reads the files the bank already keeps and a periodic extract from the loan system, joins them at one as-of date, and leaves behind answers with a passage on every row, stressed results, saved questions that re-run, and approved summaries. Nothing is written back to the core banking system.

Loan system extract, document store, spreads: what to connect

For each, check whether it has an API, a file feed or only screens, and who owns it.

Your loan system, document store and concentration reports stay put

Every row paged, every silent file named

What a hand-built portfolio answer costs you in analyst weeks, late warnings and missed borrowers

In shortStart from your own last question. No regulator or study publishes what an unplanned portfolio question costs a bank, so the numbers that matter are yours. A few published figures frame them: what an analyst hour costs, where C&I credit is weakening, and how far a concentration can run before anyone adds it up.

Counting files and analyst days on your last board question

Renewals approved too soon and untraceable board numbers

What reading every credit file could return on your board and examiner questions

In shortPut in your own numbers. The calculator starts from a published analyst wage and asks you for the rest: how many new questions you answer a year, how many files each one takes, the hours of your portfolio manager and relationship managers, the review time that remains, and what the tool costs. Every default marked illustrative is an assumption to replace.

Every file read, borrowers outside the codes found

Files read per board question, priced at analyst cost

At these defaults, a bank that answers half a dozen book-wide questions a year, each touching 400 files or more, covers the cost. A bank whose questions can all be answered from the loan system's data will not cover it, and has little use for a file reader.

Whether your loan book's files and definitions can carry automated analysis: a scored check

In shortPick the answer closest to your team today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

A low score starts with one saved portfolio question

Asking portfolio analysis vendors whether they read the files or only the loan system's data

In shortAsk every vendor the same questions, us included. The answers show whether a tool reads the files or only the loan system's data, what it does when a file is silent, how its totals tie to your book, whose definitions apply, and how you would test it on your own question.

We found no published independent test of any portfolio analysis vendor's file reading, as of October 2026. Re-answering a question your board already asked, against your own checked answer, is the fairest comparison.

Start with a board question you already answered by hand, then run a new one live

In shortPick a question you have already answered by hand, so you have a baseline. Check a sample by hand, run the tool over the whole book, compare, then run a new question live. Decide with four numbers. None of these steps commits you to a vendor.

1. Pick last year's hardest question and write down what it cost: hours, files, borrowers found, borrowers found later.
2. Write the definition as policy would: what counts, which documents, the coverage line, the approver.
3. Check a sample by hand: 100 relationships, half inside the screened codes and half outside, read carefully.
4. Run the whole book and compare with the sample and with last year's answer: found, missed, not in file.
5. Run one new question live through to an approved summary, and decide with the four measures below.

Borrowers found and wrongly counted, against a hand sample

Concentration tests, tariff exposure, loans to nonbank lenders and portfolio stress testing: short answers

In shortThe questions credit leaders and buyers search for most, each answered on its own.

Commercial loan portfolio analysis in brief, with the words it uses

In shortThe whole guide on one screen, and the words it uses.

Portfolio analysis terms, from concentration to tier 1 capital