Concentration limits for banks are the ceilings a board sets on how much of the bank's capital may sit behind one industry, one region, one kind of collateral or one type of borrower, expressed as a percentage of tier 1 capital plus the allowance for credit losses. Setting one is harder than it looks because almost nothing about the number is prescribed: the agencies publish thresholds at which they start writing in a report of examination, but no maximum, so the number has to be justified by the bank rather than copied from a rule. Botminds' Credit Concentration Risk Monitoring holds the whole schedule as settings rather than as a policy document nobody can test, and re-tests every limit in it each time a loan funds.
The sample bank below — Ellsmere Bank & Trust, an $18.4B commercial bank, its borrowers and its people — is fictional data inside the product. The rules, benchmarks and the bank failure are the agencies' own, linked where they appear.
How do banks set concentration limits, and what makes one hold
The OCC describes what concentration policies and procedures typically do, and the list is a useful specification: communicate the bank's risk appetite for various exposures, establish methods and responsibilities for identifying concentrations, establish limits for concentration levels and other risk metrics, and set out how concentrations are monitored and controlled. Everything else is the bank's judgement.
In practice a limit that survives its first contact with a deal has three things behind it. A reason: the loss experience, stress result or strategic decision that produced this number rather than a rounder one, written down at the time. A benchmark: some external evidence about the pool, so that the limit is not purely an artefact of the bank's own history. And a consequence: who is told, how quickly, and what has to happen next when the limit is crossed. A limit missing the third is a target, and the first deal that needs more room will find that out.
The regulator's test of a limit: approached, but not routinely exceeded
"In general, limits should be reasonable (e.g., not so high that they will likely never be approached nor so rigid that they are routinely exceeded)."
OCC, Comptroller's Handbook, Concentrations of Credit, version 3.0, September 2026
The sentence describes a band, and both edges are real failures a reviewer sees. A limit set so far above the book that no deal could ever reach it is decorative: it communicates nothing about risk appetite, and it leaves the bank with no mechanism for noticing growth. A limit crossed every other quarter and waived each time is worse, because it trains everyone — relationship managers, committee, board — to read a breach as paperwork. The same passage sets the test examiners apply around it: whether the limits "are effective in controlling the bank's concentration risk and reflective of the bank's risk appetite."
A useful self-check is the distribution. On a well-calibrated schedule, most limits sit well inside, a few sit in the top tenth, and crossings are rare but not unknown. At the sample bank, of 31 limits, four are at 90% or more and none is over before the 10:14 funding — a shape that says the limits are near enough the book to bind.
Calibrating an industry limit from loss experience and stress results
Two inputs do most of the calibration. The first is the bank's own loss experience in that pool, or in the nearest pool it has history for. The second is stress testing, which the OCC describes as a direct input: it can be used to quantify loss potential and the effect on earnings and capital, to assess whether exposures remain within risk appetite, and it "can be used to inform calibration of concentration limits." A limit derived from a stress result has an answer to the obvious board question — what happens if this pool turns — that a limit derived from last year's balance does not.
The booklet also describes a structure worth copying, in which the size limit is not the only trigger. Some banks pair a percentage of capital with a credit risk benchmark, so that pools above a certain share of capital — 10%, 15% or 20% are the examples given — get heightened monitoring once their special mention or classified share passes a level. Others add a dynamic version: the same size test, triggered by criticised exposure growing above a specified rate, which fires earlier. The benchmarks the booklet lists as common are special mention and classified levels, net loss rates, nonaccrual rates, delinquency and roll rates, growth rates in commitments and utilisation, the risk rating distribution, weighted-average risk ratings or credit scores, probability of default, loss given default, and required capital allocation.
A limit-setting worksheet: the eight entries that make a number defensible
| Entry | What goes in it | Why a reviewer asks for it |
|---|---|---|
| The pool | How the exposures are identified — NAICS codes, a geography, a collateral type, a repayment source | Two banks with "trucking" limits can be measuring different books. The definition is the limit. |
| Measurement basis | Commitments or outstanding balances, and which for this pool | It changes the number materially, and it has to match how the limit was calibrated. |
| The limit | A percentage of tier 1 capital plus the allowance, and the dollars it equals this quarter | A limit in dollars alone loosens as capital grows; a percentage re-prices itself. |
| Sublimits | Segments inside the pool that carry their own ceilings | Expected where the pool is broad, and particularly where the limit exceeds 100% of capital. |
| Warning level | The share of the limit at which the pool is reported as near | Without it, the first signal is the breach. The sample bank warns from 90%. |
| Consequence | Who is notified, in what time, and what must happen | This is what distinguishes a limit from a target, and it is the first thing read after a crossing. |
| Review date | When the number is re-examined, and against what | Benchmarks move. A limit calibrated on a four-year-old loss rate is calibrated on a different industry. |
| Owner | The named seat accountable for the pool | A limit with no owner is nobody’s to defend when a deal needs room. |
How do you benchmark an industry concentration limit against public data?
The agencies publish an industry ranking of criticised credit every January, free, and most banks do not use it. The Shared National Credit report's industry appendix was widened for the 2025 reviews: "Appendix C has been modified to include a more granular industry breakdown of twenty-one sub-sectors from the prior seven sector grouping" (Federal Reserve, FDIC and OCC, 2025 Shared National Credit Program report, 12 January 2026). Twenty-one sub-sectors, each with commitments, special mention and classified amounts and percentages, for five years — which is an ordering of industry risk by the three agencies that will examine your book.
The agencies' own ranking: special mention plus classified, as a share of each sub-sector's commitments
Two caveats, both important enough to put in the board paper beside the chart. The SNC population is syndicated credit: aggregate commitments of $100 million or more shared by three or more unaffiliated supervised institutions — 6,857 borrowers and $6.9 trillion of commitments in the 2025 review. That is not a community bank's book, and the ownership split explains why the percentages read the way they do: US banks hold about 45% of all SNC commitments but only about 22% of the loans rated below pass (agencies' press release, 12 January 2026) — a split the guide to credit risk rating models reads for what it says about grading. The criticised credit sits disproportionately with non-bank investors.
The second caveat is the one that should change how often a limit is reviewed. Transportation services in that table was 30.2% classified in 2021 and 3.5% in 2025, on commitments that grew from $114.8 billion to $144.0 billion. An industry benchmark moved by a factor of almost nine inside four years. Any limit calibrated against a point in that series needs a review date attached to it, because the thing it was calibrated against has not stood still.
Broad pools and sublimits: why a limit above 100% of capital needs them
The OCC is explicit that broad pools need structure underneath: "When a bank sets higher concentration limits for broadly defined pools—especially when those limits are more than 100 percent of capital—sound concentration risk management typically includes setting appropriate sublimits for material groups of segmented exposures." The logic is that the broader the pool, the less the headline limit constrains: a 150% limit on a category covering five different businesses permits any one of them to grow to 150%.
The sample bank's largest limit is exactly that case. All lending to non-bank lenders is capped at 150% of capital, and stands at 147.7%. Underneath it sit five sublimits following the Call Report categories: 50% for mortgage credit intermediaries, 60% for business credit, 40% for private equity funds, 30% for consumer credit and 25% for everything else. The structure means a facility moving category moves two numbers, and that one category can be full while the pool as a whole has room.
The limit schedule as settings, versioned, rather than as a policy nobody can test
Who approves a bank's concentration limits, and who may approve an exception
Limits are a board matter; exceptions are usually not. Separating the two is what keeps a limit from being quietly re-set by the deals that need it loosened. The division below is the sample bank's, and it is a conventional one.
Five seats around one limit, and where each one's authority stops
May decide: Confirm or reject a proposed non-bank lender category, with a reason, before it counts in a limit or a filing.
May not decide: Change a limit, approve an exception, or let a category count without a confirmation.
May decide: Propose a way back under a breached limit; confirm categories; hold a proposal while a pool is over.
May not decide: Approve her own plan, waive a limit, or commit the bank to a sale.
May decide: Approve a remediation plan and grant a dated exception while a pool is brought back under.
May not decide: Raise or remove a limit — that is the board risk committee’s.
May decide: Approve the risk appetite statement and every limit in it, and any change to one.
May not decide: Operate the limits day to day, or approve individual deals.
May decide: See, before committee, how much of a deal fits today and what it does to every limit it touches.
May not decide: Decide whether the part that does not fit is approved anyway.
A limit that binds before the vote, not after the funding
What happens when a concentration limit is breached
Whatever the policy says, which is why the policy has to say something specific. A board concentration limit is not law, so a crossing is a governance event rather than a violation, and the only thing that makes it consequential is a written chain: who is told, inside what time, who may authorise the bank to stay over, and by when it must be back inside. At the sample bank, credit policy section 7.4 gives the Chief Risk Officer one business day, the board risk committee chair two, and thirty days to be back under the limit or covered by an approved exception, with each of those as a setting.
The design point is that the clock starts from the crossing, not from the discovery. A policy that promises notice within one business day, applied to a pool measured quarterly, promises notice within one business day of someone building a spreadsheet. Those are different commitments, and only the first is the one the board thinks it approved.
The industry codes your limits are written in change in 2027
Industry limits are written in NAICS codes, and NAICS is revised every five years. The Office of Management and Budget published proposed updates for 2027 in July 2026, with a request for comments: among the recommendations, the Economic Classification Policy Committee "recommends moving electric motors for electric vehicles from 335312, Motor and Generator Manufacturing to 336310, Motor Vehicle Gasoline Engine and Engine Parts manufacturing" (OMB, Statistical Policy Directive No. 8, 91 FR 42976). Both 33631 and 336310 would be retitled Motor Vehicle Engine and Engine Parts Manufacturing; separately, NAICS 48811 Airport Operations would become Airport and Spaceport Operations.
That first one is not an abstraction for a bank with an auto parts limit. 335312 sits in electrical equipment manufacturing; 336310 sits inside NAICS 3363, motor vehicle parts manufacturing. At the sample bank the 3363 limit is 25% of capital, $481M, and stands at $462M — 96.0% of the limit, with $19.0M of room. Adopting the proposal could move borrowers into that pool without a single new loan, and a bank whose mapping updates automatically would discover the change as a breach rather than as a decision.
Eleven industry limits, 2,416 of 2,431 borrowers coded from their own documents
How one bank defined its own concentration — and failed anyway
Tennessee Commerce Bank, closed by the Tennessee Department of Financial Institutions on 27 January 2012, is the case that shows awareness is not a limit. Its loan portfolio had grown by $310 million, 39%, since the previous examination. Examiners suggested the board consider suspending or curtailing the growth strategy, and "further suggested that management consider establishing concentration criteria relative to capital in order to manage the bank's significant industry exposure and concentration risk, as had been done by regulatory agencies related to CRE lending" (FDIC OIG, report AUD-12-014).
The sentence immediately after that is the one to read twice: while the bank "demonstrated awareness of the concentrations as a percentage of capital", examiners noted the bank's financial condition was highly sensitive to economic conditions and recommended the board consider further strategies to mitigate concentration risk. The bank could measure. What it did not have was a number that stopped anything, with a consequence behind it, before the growth became a loss. That is the whole distance between a concentration report and a concentration limit.
Eight questions a director should ask about any limit in the papers
- What is this limit a percentage of, and as at when?
Tier 1 capital plus the allowance, from which quarter. An answer in dollars only means the limit has been drifting with capital.
- Is it measured on commitments or on drawn balances?
If drawn, ask what the undrawn amount is. If the two answers differ by several points of capital, the limit is on the slower number.
- Why is it this number?
The right answer names a loss experience, a stress result or a decision. "It is what we have always had" means it was never calibrated.
- When was the number last re-examined, and against what benchmark?
Published industry data moves fast — one SNC sub-sector went from 30.2% classified to 3.5% in four years.
- If the pool is broad, what are the sublimits?
Above 100% of capital the OCC expects sublimits for material segments. A broad limit with none permits any one segment to fill it.
- How current is the figure I am looking at?
Ask for the as-of time, not the as-of date, and ask how many fundings have posted since.
- What happens when it is crossed, and who decides?
A named officer, a stated time, and a date by which the bank is back under. If nobody can state them, it is a target.
- How many exceptions have been granted in the last year?
Repeated exceptions to one limit mean the limit is wrong, the pipeline is wrong, or the exception process has become the limit.
A limit that holds is not a stricter limit. It is a number with a reason, a benchmark, a review date and a consequence, tested often enough that crossing it is news. To see a whole schedule held that way, start from Credit Concentration Risk Monitoring, or work the arithmetic behind each number first.
Questions people ask
What is a sublimit in a loan portfolio?
A ceiling on a segment inside a pool that already has one — mortgage credit intermediaries inside all non-bank lending, say, or acquisition, development and construction loans inside commercial real estate. The OCC expects them where a pool is broadly defined, and particularly where the pool's limit exceeds 100% of capital, because a single headline number on a wide pool permits any one segment within it to grow to the whole limit.
How often should concentration limits be reviewed?
No rule sets a frequency; annually with the risk appetite statement is the common practice, and the useful trigger is whether anything the limit was calibrated against has changed. Capital moves quarterly. Published industry benchmarks move faster than most banks assume. And a taxonomy revision — the next NAICS update is proposed for 2027 — can move exposure between pools without a lending decision, which is a review event in itself.
What should a risk appetite statement say about concentrations?
Enough to be testable: which pools are limited, how exposure in each is measured, the limit as a percentage of capital, any sublimits, the level at which a pool is reported as near its limit, who owns each pool, and what happens on a breach. A statement that expresses appetite only in adjectives cannot be checked against a portfolio, which is the one thing a limit has to be able to do.
Who approves a bank's concentration limits?
The board, usually through a risk committee, as part of the risk appetite statement — and the same body approves any change. Exceptions are normally delegated, most often to the Chief Risk Officer, with a stated period and a date to be back inside. Keeping those two authorities apart is what stops a limit being re-set by whichever deal happened to need more room.
Is there a standard industry concentration limit for banks?
No. The published numbers are supervisory reporting thresholds — 25% of tier 1 capital plus the allowance by single borrower or repayment source, 100% by industry, product line or collateral, 300% for a written analysis — and the FDIC states in its examination manual that they are not limits for institutions. Banks commonly express industry limits somewhere between a few percent and tens of percent of capital depending on the pool, but any specific figure offered as a standard is someone's convention, not a rule.
Can a limit be set on something other than a percentage of capital?
Yes, and many banks pair tests. A share of the loan portfolio answers a diversification question, though it has the awkward property of improving as the book grows. The OCC also describes pairing a size limit with a credit risk benchmark, so that a pool above, say, 15% of capital attracts heightened monitoring once its criticised share passes a level, or once that share grows faster than a specified rate. What a reviewer will look for is which of the tests actually binds.