Concentration risk in banking is the risk that a group of loans a bank has treated as separate credits will deteriorate at the same time, because something they share — an industry, a region, a type of collateral, a single source of repayment — turns against all of them at once. It is hard to see because nothing in the individual files looks wrong: every borrower was underwritten, every credit fit its limit on the day it was approved, and the pool crosses the line only when the loans are added up, which at most banks happens once a quarter in a spreadsheet built weeks after the quarter closed. Botminds' Credit Concentration Risk Monitoring keeps every board limit on one live map and re-tests each limit a loan touches within seconds of the funding, so the crossing is seen on the day it happens rather than in the next report.
The bank in the examples below — Ellsmere Bank & Trust, an $18.4B commercial bank — its borrowers, its loans and its people are fictional sample data inside the working product. The rules, thresholds and the bank failure are from the regulators' own publications, linked where they appear.
The three supervisory lines a concentration is measured against
25%
of tier 1 capital plus the allowance for credit losses — where the OCC says a concentration begins
100%
of that same base by industry, product line or type of collateral — where an FDIC examiner lists it in the report of examination
300%
of that base, where the FDIC examiner must also write an analysis of how the bank manages it
What is concentration risk in banking, in one paragraph
A concentration is a pool of exposures that share a characteristic or a sensitivity, held in a size that matters against the bank's capital. The risk is correlation, not quality. A bank with fifty-seven trucking borrowers has not made fifty-seven bets; it has made one bet on freight, spread across fifty-seven credit files. When diesel, driver pay and spot rates move, they move for all fifty-seven at once, and the bank discovers that its diversification was clerical rather than economic.
The OCC puts the point more plainly than most risk policies manage to. Individual loans, it notes, rarely sink a bank, because the lending limits already cap what one borrower can do. "However, large groups of individual transactions that may perform similarly can cause credit-related distress to banks and have been key factors in banking crises and failures. If the common characteristic or sensitivity becomes a common source of weakness, loans in the pool could pose considerable risk to earnings and capital. This statement is true even when each transaction within a pool is soundly underwritten" (OCC, Concentrations of Credit, version 3.0).
That last sentence is the whole subject. Underwriting quality and concentration risk are different questions, answered by different work. The first is answered one file at a time. The second can only be answered by adding the files up.
What is concentration of credit risk, as the OCC defines it
The supervisory definition is arithmetic, and it is short.
"A concentration is defined as the sum of direct, indirect, or contingent obligations exceeding 25 percent of a bank's tier 1 capital plus the allowance for credit losses (ACL)."
OCC, Comptroller's Handbook, Concentrations of Credit, version 3.0, September 2026
Three words in that sentence do most of the work. Sum means the pool, not the largest loan in it. Indirect and contingent mean that exposure the bank has not funded, and may never fund, still counts. And tier 1 capital plus the allowance fixes the denominator: concentrations are measured against the money that absorbs losses, not against total assets or total loans. At the sample bank that base is $1,924M — tier 1 capital of $1,712M plus a $212M allowance for credit losses — read from the Call Report draft at 30 September, so every limit in the schedule moves when the quarter's capital moves.
What the definition is not is a limit. The FDIC says so in terms, about its own listing thresholds: "The thresholds are only aimed at directing the examiner in the context of when to list a concentration for informational purposes and when to include a written analysis of a particular concentration in the Report of Examination (ROE). The thresholds are not limits for institutions" (FDIC, RMS Manual, section 16.1). A bank can hold a concentration far above 25% of capital lawfully and sensibly. What it may not do is hold one it has not decided to hold. The binding standard is in the safety and soundness rules: an institution should maintain prudent credit underwriting practices that "take adequate account of concentration of credit risk" (12 CFR 30, appendix A). Adequate account means a limit the board set, and evidence that the bank knows where it stands against it.
What counts as an obligation: loans, commitments, letters of credit and derivative exposure
Most banks under-count concentrations not because they measure badly but because they measure too little. The OCC's list of what belongs in the sum is deliberately wide: it is the bank-wide aggregate, across all lines of business, of every way the bank can end up owed money by the same pool.
Everything the OCC counts in a concentration, and the amount each one contributes
| The obligation | The amount that goes into the sum |
|---|---|
| Loans and leases of every type | The committed or the outstanding amount, chosen for the pool and written down |
| Overdrafts, cash items and suspense assets | The amount outstanding |
| Securities bought outright or under resale agreements | The exposure to the issuer or the counterparty behind them |
| Federal funds sold and placements | The amount placed — which is why exposure to other financial institutions aggregates |
| Acceptances and letters of credit | The face amount — contingent until drawn, and counted before it is |
| Loans endorsed, guaranteed, or subject to repurchase agreements | The amount the bank could be called on to fund or take back |
| Credit exposure from derivative transactions | The net current market value of the contracts with that counterparty, "plus a conservative measure of the potential future exposure of that portfolio" |
| Any other actual or contingent liability | The amount at risk — the list ends with a catch-all for a reason |
The off-balance-sheet lines are where the surprises live. Guarantees, liquidity lines and undrawn commitments cost nothing to carry and nothing to report in most monthly packs, and they are precisely the exposures that convert to funded balances in the conditions that make the concentration matter. A bank that measures its concentrations on drawn balances has built a measure that goes up last.
Why the undrawn part of a line belongs in the number
The booklet leaves the basis to the bank: the amount counted may be the committed or the outstanding figure, depending on how likely the bank is to fund the undrawn part and whether it is legally bound to. Outstanding amounts suit a credit card book, where the undrawn line is a marketing number. Commitments suit a home equity book, or a warehouse facility, or a revolving line to a fund — anything a borrower can draw in a day and will draw hardest when things go wrong.
The difference is not a rounding. At the sample bank, all lending to non-bank lenders stands at $2,842M of commitments against a capital base of $1,924M, which is 147.7% of capital and within sight of a 150% board limit. The drawn balance behind the same facilities is $1,720.7M — 89.4% of capital. Both numbers are true. Only one of them describes what the bank is exposed to if those borrowers draw.
Two fifths of one bank's largest concentration has not been drawn yet
$2,842M of commitments to non-bank lenders · 147.7% of a $1,924M capital base
- Drawn $1,720.7M — 89.4% of capital · 60.5%
- Undrawn $1,121.3M — a further 58.3% of capital · 39.5%
One warning about mixing the two. FDIC examiners listing a concentration on the report of examination use funded exposures only, and comment on the unfunded amount in the narrative instead. That is a convention for their table, not advice about your limit, and a bank that copies it into its own policy has quietly decided to watch the slower of the two numbers. The arithmetic of each basis, and the obligor-group rules that decide whose exposure joins whose, is worked line by line in the calculation guide.
The five risks a concentration carries, and only one of them is credit
A concentration is filed under asset quality, which encourages everyone to treat it as a credit problem with a credit answer. The OCC lists five.
Why a concentration shows up in five places on a bank's risk profile
| The risk | What the concentration does to it | Where it shows first |
|---|---|---|
| Credit | A common sensitivity makes the pool perform as one, so a large enough pool can take losses into capital even when every loan was well underwritten. | Risk ratings migrating across a whole industry in one quarter. |
| Liquidity | Concentrated loans are harder to sell, securitise or pledge exactly when the bank needs to, and revolving lines in the pool get drawn in stress. | A funding plan that assumed a book someone would buy. |
| Interest rate | Loans with similar tenor, pricing or amortisation move together with rates, and borrowers on adjustable terms become credit problems when rates rise. | One vintage of fixed-rate loans against short-term funding. |
| Operational | If the systems cannot identify, measure and monitor the pool accurately and on time, the bank is concentrated and does not know it. | A quarterly spreadsheet nobody can tie to the general ledger. |
| Strategic | A plan, a hiring push or an acquisition creates a concentration faster than the risk management, staffing and systems behind it. | A new vertical at a tenth of capital with no limit written. |
The operational line is the one that gets banks criticised. The booklet is blunt about it: none of the four jobs — identifying, measuring, monitoring, controlling — works without data that is accurate and on time, and a full set of data elements is worth little if it is wrong, late or never validated — the test to put to any system that reports it. A concentration report that is four weeks old is not a slow report. It is an inaccurate one, because the thing it reports has moved.
Why every loan can fit its limit and the pool can still break it
Here is the failure mode in its ordinary form, with no bad lending in it at all. At the sample bank, truck transportation stood at $171.8M on 30 September — 8.93% of capital against a board limit of 10%. Credit committee approved a $12.0M equipment loan to Redfield Freight Lines on 23 September; on the numbers in front of the committee that day, it would take trucking to 9.55%, comfortably inside.
Between that vote and that funding, three other things happened to the same pool. An existing borrower drew a $6.0M line increase on 2 October. A second trucking loan of $8.4M funded on 7 October. Scheduled paydowns took $1.6M off. None of those was a decision about trucking; each was the ordinary business of a lending bank. When the Redfield wire released at 10:14 on 12 October, the pool went to $196.6M — 10.22% of capital, $4.2M over a limit the board had tightened from 12% to 10% in April.
A board limit crossing at 10:14, on the map rather than in next quarter's report
Nobody in that sequence did anything wrong, and that is the point. The limit was tested once per credit, at approval, against a portfolio that then changed four times before the money moved. A limit that is tested at approval is a limit on decisions. A limit tested at funding is a limit on exposure, and only the second kind is the one the board thinks it set.
How much is too much concentration in a loan portfolio?
There is no published maximum, and any article that gives you one is inventing it. What the agencies publish are the points at which they start writing things down. An asset concentration of 25% or more of tier 1 capital plus the allowance by individual borrower, by a small interrelated group, by a single repayment source or by an individual project gets listed on the report of examination. The same base at 100% or more by industry, by product line, by type of collateral, or by short-term obligations of one financial institution gets listed too. At 300% or more by industry, product line or collateral, the examiner must also write an analysis of how the bank manages it.
Read those as a scale of supervisory attention rather than a speed limit. They are also not the 100% and 300% screens in the 2006 commercial real estate guidance, which test construction lending and total CRE against the same capital base and are worked through in their own guide. A sound community bank can run an agricultural or a CRE concentration well above 100% of capital; what distinguishes a sound one is not the level but that the level was chosen, is tested, has a sublimit structure underneath it and a written consequence above it. How to calibrate a limit that holds, and benchmark it against published data, is a subject of its own. The practical answer to "how much is too much" is: more than your board decided, or any amount at all that you cannot measure this week.
What a transportation concentration did to one bank
Tennessee Commerce Bank is worth reading because its failure was not caused by exotic products. The Tennessee Department of Financial Institutions closed it on 27 January 2012, and the FDIC Inspector General's material loss review found the cause in the ordinary place: "TCB had a significant concentration in an economically sensitive and specialized segment of the C&I market pertaining to the transportation industry," lending to leasing companies and lease brokers financing trucks, buses and other commercial vehicles (FDIC OIG, report AUD-12-014).
Two details deserve a place in any concentration policy. The first is that the growth ran ahead of the reporting: the bank's commercial book grew 59% in 2004, 67% in 2005, 51% in 2006 and 35% in 2007, and the transportation problems surfaced in 2007, at the end of the growth, where they always surface. A pool growing at half again a year will cross its limit between two quarterly reports. The second is that the industry pool was not the only thing stacked up. A December 2011 valuation found the twenty largest borrowing relationships were over 26% of the loan portfolio, and at a June 2009 examination six relationships — in transportation, construction and manufacturing — accounted for $32.4M of the $73.8M of adversely classified loans. Industry, single name and collateral had concentrated on the same borrowers at the same time.
What the same portfolio looks like when every limit is tested on each funding
The remedy is unglamorous: measure continuously, against limits written in percent of capital, with a consequence attached. In the product that means every funding, booking, amendment and paydown posts from the core as it happens; every limit the movement touches is re-tested within seconds; all 31 limits are re-tested in full each morning; and a crossing opens a case with its cause, the loans that caused it and the ways back out, rather than a line in a report that will be written in January.
Every board limit in Credit Concentration Risk Monitoring, with its room and its eight-quarter trend
The bank's own numbers are the ones that should drive a board conversation, and they are rarely the ones in the report. Trucking at this bank rose from 7.4% to 10.22% of capital across eight quarters — a trend that was visible in every one of those quarters and acted on in the last one.
Five tests you can run on your own portfolio this week
- Recompute every limit on the capital base in your latest Call Report draft, not the one the schedule was written against.
A limit schedule in dollars loosens when capital grows and tightens when it shrinks.
- Run each pool twice — once on commitments, once on drawn — and look at the gap.
If they differ by more than a few points of capital, the policy has to say which one the limit is set on, and why.
- Pick your three largest pools and list every exposure type in them besides term loans.
Letters of credit, undrawn lines, participations bought, guarantees given, derivative exposure to the same names. Anything missing makes the report low.
- Date-stamp the exposure figure in your last board report and count the fundings since.
The question is not whether it was right when written, but how much moved between the as-of date and the meeting.
- Find the pool that is growing fastest, not the one that is largest.
A pool at 60% of its limit growing 40% a year crosses it inside two years; one at 95% that has not moved in eight quarters is a smaller problem.
Concentrations are not an exotic risk, and the work of controlling them is not analytical so much as clerical: the same addition, done often enough to be true. To see the limits, the cases and the schedules on one book, start from Credit Concentration Risk Monitoring.
Questions people ask
Is concentration risk the same as credit risk?
No. Credit risk is the risk that a borrower does not repay; concentration risk is the risk that many borrowers do not repay for the same reason at the same time. The OCC treats it as a risk that shows up across five categories — credit, liquidity, interest rate, operational and strategic — precisely because the consequences run wider than losses on loans. A bank can have excellent underwriting and a dangerous concentration, and the tests that prove the first say nothing about the second.
What are the types of concentration risk in a bank?
They group by what the exposures share: one borrower or group of related borrowers; one source of repayment, including a guarantor; an industry, usually by NAICS code; a geographic area; a type of collateral; a product line such as credit cards or home equity lines; loans bought from one source; and exposure to other financial institutions, which aggregates loans, federal funds sold, investments and derivative exposure to the same names. They also arise across those categories at once, which is why a single loan can sit in three pools.
Is a concentration of credit a violation?
No. A concentration above 25% of tier 1 capital plus the allowance is a reporting definition, not a legal limit, and the FDIC says in terms that its listing thresholds "are not limits for institutions." What can be criticised is a concentration that the bank has not identified, has no limit for, exceeds its own limit with no plan to come back under, or cannot measure accurately and on time. Separately, 12 CFR 32 does impose hard lending limits on exposure to one borrower; that is a different test from a board concentration limit.
Does a concentration have to be reported to the board?
The safety and soundness standards require internal controls and information systems that give timely and accurate reports, and the OCC treats accurate concentration reports as what keeps the board and senior management in a current conversation about the exposures. In practice that means the board sees each concentration as a percentage of capital, against the limit it approved, with the trend. What no rule fixes is the frequency, which is why so many banks report quarterly and find out about crossings late.
What happens if a bank exceeds its own concentration limit?
Nothing automatic, which is the problem. Exceeding a board limit is not unlawful; it is a governance event, and what follows is whatever the bank's own policy says — usually notice to a named officer inside a stated time, a plan to come back under, and an approved exception if it will take a while. At the sample bank the policy gives the Chief Risk Officer one business day, the board risk committee chair two, and thirty days to be back under the limit or covered by an approved exception. A limit with no consequence written beside it is a target, and examiners read it as one.
Does the 25% definition apply to every kind of institution?
Not uniformly. The OCC booklet notes that a concentration in a federal branch or agency of a foreign bank is not measured against capital at all; examiners judge instead how far certain assets raise the risk profile of the branch. Federal savings associations carry additional statutory thresholds on what they must and may hold, which can create concentrations by operation of law. And the FDIC's listing conventions switch to a percentage of total assets — generally two percent — when a bank's capital has fallen so low that measuring against it stops being meaningful.