The board risk committee's responsibilities for CRE concentration are to set the bank's appetite for commercial real estate and hold management to it. Under the 2006 interagency guidance the board, or a committee it designates, approves the CRE lending strategy, periodically reviews and approves exposure limits and sub-limits, makes sure management has controls to stay inside them, and reviews information on the level and nature of CRE risk, including changes in the markets where the bank lends. Stress test results come to the same table, and the board decides what they change. Management stratifies the book, runs the tests and proposes actions; the board decides. Botminds' CRE Concentration & Stress Testing is built around that division: agents calculate and draft, people propose and sign, and limits and scenarios change only with the board's approval.
Where the chain from book to board has broken before
27%
of FDIC exam reports sampled that raised concentration concerns to the bank's board
88%
of inspector general reviews of failed small and medium banks that cited CRE and construction concentrations as a primary cause
492
failed institutions to which poorly managed concentrations contributed, 2007 to 2013
What are the board's responsibilities for CRE concentration?
The 2006 guidance names four. The board "has ultimate responsibility for the level of risk assumed by the institution," and where CRE concentration risk is significant, the bank's strategic plan "should address the rationale for its CRE levels in relation to its overall growth objectives, financial targets, and capital plan" (71 FR 74580). The board or a designated committee should then:
The board's four CRE duties in the 2006 interagency guidance
| Duty | In the guidance's words | What it looks like in a committee pack |
|---|---|---|
| Set the strategy | "Establish policy guidelines and approve an overall CRE lending strategy regarding the level and nature of CRE exposures acceptable to the institution" | A written CRE strategy with target mix by property type and market, approved and dated |
| Make management comply | "Ensure that management implements procedures and controls to effectively adhere to and monitor compliance" | Exceptions to limits and policy, with who approved each |
| Read the risk | "Review information that identifies and quantifies the nature and level of risk presented by CRE concentrations, including reports that describe changes in CRE market conditions" | Stratified concentration reports, market analysis, stress results |
| Approve the limits | "Periodically review and approve CRE risk exposure limits and appropriate sublimits (for example, by nature of concentration)" | Limits and sub-limits by property type, construction and market, with headroom |
The limits are the board's own. The supervisory 100% and 300% screens are indicators that prompt an examiner to look, not ceilings, and the guidance says so: it "does not establish a CRE concentration limit that applies to all institutions." A board that adopts 300% as its limit has outsourced its appetite to a screen designed to cover every bank in the country.
Who sets concentration limits at a bank?
The board approves them; management proposes them and lives inside them. In practice, the chief credit officer or chief risk officer drafts limits from the strategy and the stress results, the risk committee reviews and recommends, and the full board or the designated committee approves. The guidance asks for review "periodically" and "to respond to changes in market conditions," so a limit set once and left alone is not what it describes.
Recent enforcement orders show what examiners expect the limits to look like. The OCC's 2025 consent order with EH National Bank requires "formal limits and sub-limits for all concentrations of credit based on a percentage of Tier 1 capital plus the allowance for credit losses, stratified by loan type, locality of the borrower and/or collateral, and other meaningful measures," and a written analysis that "confirms all concentration limits are consistent with the Board's risk tolerance based on current market conditions, the declining capital base, and results of the most recent stress test results" (OCC AA-WE-2025-20). The board had sixty days to adopt the programme.
…confirms all concentration limits are consistent with the Board's risk tolerance based on current market conditions, the declining capital base, and results of the most recent stress test results.
OCC consent order, EH National Bank, April 2025
That sentence ties the three together: limits, capital and stress results. A limit the board cannot connect to a stress result, or a stress result that never reaches a limit review, is the gap examiners write up.
Where the chain from loan book to board breaks
It usually breaks at the board pack, not in the loan book. The FDIC's inspector general reviewed how examiners handled concentration risk and found that "only 27 percent of reports sampled elevated concerns to the financial institution's board of directors" within the examination report, although "a greater number of these concerns warranted board attention" (FDIC OIG, EVAL-18-004). The same review found 15% of cases where fundamental concentration concerns had not been identified in the prior examination cycle.
The earlier record is harder. The Federal Reserve's inspector general, summarising failed state member banks in 2011, found that examiners "identified key safety and soundness risks, but did not take sufficient supervisory action in a timely manner to compel the Boards of Directors and management to mitigate those risks" (Federal Reserve OIG, 2011). Its comparison of failed banks with survivors found "lower commercial real estate and CLD concentration levels, strong capital positions, and minimal dependence on non-core funding were key differentiating characteristics."
A board cannot rely on the examiner to tell it when concentration has become a problem. It has to see the numbers itself, often enough to act, in a form that names the loans and markets behind them. What that report should contain is set out in the concentration risk report a board should get.
The people in the chain, and what each one owns
Five roles carry a CRE concentration decision from the loan tape to the minutes. The solution's fictional sample bank names one person in each; their months before and after are how the work divides.
The CRE concentration chain at a sample community bank
Today
Asks each quarter whether the bank is inside its limits and which loans would take it out; gets a ratio table without the loans.
With agents
Reads every limit against the board's line and the supervisory benchmark, with the headroom in dollars, every month.
Still theirs: Approves limits and scenarios
Today
Wants the answer to a director's what-if the same day, and rarely gets it before the next meeting.
With agents
Signs a monthly report where every number traces to its loan; nothing goes to the board unsigned.
Still theirs: Signs the report
Today
Asks to see the assumptions next to the number.
With agents
Sees the board-approved assumptions by property type beside each result and tests her own scenario loan by loan.
Still theirs: Reviews and challenges
Today
Spends weeks building the stress test and an afternoon discussing it.
With agents
Answers the board's what-if by moving a slider, with every loan re-stressed, and saves it into the write-up.
Still theirs: Prepares and proposes actions
Today
Spends half a month getting operating statements out of borrowers.
With agents
Sees exactly which statements are older than 15 months and requests them together.
Still theirs: Chases the inputs
What do examiners expect from directors on CRE?
They expect the board to understand the concentration, to have set limits it can defend, and to have acted on what the stress tests showed. CRE concentrations are written up in the "Concentrations" section of the report of examination when they "pose challenges to management or present unusual or significant risk" (OCC, Commercial Real Estate Lending), and an examiner reading board minutes looks for evidence that directors saw the stratified reports and stress results and asked questions.
The 2025 orders spell out the minimum. Patriot Bank's agreement with the OCC requires a concentration programme with "a written analysis of all concentrations of credit that identifies and assesses inherent credit, liquidity, and interest rate risks and considers the impact of concentration levels on overall growth plans, financial targets, portfolio stress tests, and capital plan objectives," submitted to the OCC for no supervisory objection (OCC AA-NE-2025-05). Read as a board agenda, that is four standing items: concentration against growth plans, against financial targets, against stress tests and against capital.
Approving the stress scenarios is a board decision
The scenarios set how bad the bank assumes things can get, which makes them an expression of risk appetite, not a technical detail. The OCC's community bank guidance expects stress testing to help management "establish and support reasonable risk appetite and tolerances, set concentration limits, adjust strategies, and appropriately plan for and maintain adequate capital levels" (OCC Bulletin 2012-33). A board that approves limits but not the scenarios behind them has approved half the decision.
CRE Concentration & Stress Testing: scenario assumptions with the board's approval on them
The sample bank's library is versioned and dated, and each shock has its reason beside it: the severe office value decline of 35% was raised from 30% in April after local office sales cleared far below their 2019 prices. A director who asks why 35% gets an answer on the page.
The contingency plan: what the board approves before it is needed
The guidance asks management to develop "a contingency plan to reduce or mitigate concentrations in the event of adverse CRE market conditions," and the board should see and approve it before the market turns. It names the tools: loan participations, whole loan sales and securitizations, which manage concentration "without curtailing new originations," and it asks management to assess periodically whether the portfolio could actually be sold.
A useful plan is specific. It names the trigger (office above 45% of capital after severe losses, say), the first actions (no new office commitments, renewals continue), the second actions (participations on the largest loans), and who decides. At the sample bank, the board report drafted in October proposed four actions for the committee: a new appraisal for the office loan driving the largest loss, an early refinance conversation with its borrower, funding the approved construction pipeline in step with payoffs, and collecting eleven stale operating statements. The committee decides.
CRE Concentration & Stress Testing: prepared, reviewed and signed before the committee meets
A board risk committee's CRE calendar
The guidance sets no frequency beyond "periodic," so the calendar is the board's to write. The one below is ours, offered as a starting point for a bank above or near the screens.
What the board risk committee does on CRE, and when
- Every meeting: concentrations against limits
Total CRE, construction and growth against the screens and the board's limits, sub-limits by property type and market, with headroom in dollars and the approved pipeline.
- Every meeting: what changed
Loans that moved below 1.0x coverage or above 100% loan to value since the last report, and market moves above the bank's threshold.
- Quarterly: stress results and actions
Losses, capital and concentrations after losses under each scenario; proposed actions and their status.
- Annually: limits, sub-limits and scenarios
Re-approved against the strategy, capital plan and the latest stress results; reasons recorded.
- Annually: the contingency plan
Triggers, actions and an honest view of whether participations or sales are available.
- Whenever asked: a what-if the same week
A director's question about office values or rates answered on the book, not deferred to next year's test.
The what-if line is the one most boards do without. It needs a stress test that can be rerun on a changed assumption in minutes; the method behind that is in loan level stress testing, and the regulators' wider expectations are in CRE stress testing guidance.
Questions people ask
What should a board risk committee charter say about CRE concentration?
It should give the committee, or the board, the four duties in the 2006 guidance: approve the CRE strategy, approve limits and sub-limits, oversee management's compliance, and review concentration and market reports. It should also name stress scenario approval and the contingency plan, and say how often each comes to the committee.
How often should the board review concentration limits?
The guidance says "periodically" and in response to changes in market conditions; it sets no interval. Where the OCC has written it into an agreement, it asks the board to re-evaluate and approve concentration limits every year, with written support for any change (OCC AA-NE-2025-05). A material market move, a stress result near a limit, or rapid pipeline growth are reasons to review sooner.
What should a board risk report on CRE include?
Concentrations against the board's limits and the supervisory screens, stratified by property type, market and other risk characteristics; stress results against earnings and capital; the loans driving any loss; and proposed actions. The 2006 guidance encourages stratifying by property type, market, tenant and developer concentrations and risk rating.
Can the board delegate CRE concentration oversight?
To a designated committee, yes: the guidance addresses "the board of directors or a designated committee thereof." It does not move the responsibility. The board retains "ultimate responsibility for the level of risk assumed by the institution," and enforcement orders address the full board.
What happens when a bank exceeds its own concentration limit?
The policy should say. Usually management reports the breach to the board, explains the cause and proposes a plan to return under the limit or a reasoned change to it. Breaching an internal limit is not a regulatory violation, but an examiner will ask whether the board knew and acted.