Concentration risk mitigation strategies are the actions a bank takes to bring an over-weight pool of loans back inside the line its board drew, and they divide cleanly into the ones that work in weeks and the ones that work in years. The OCC's own list runs to seven: tighter underwriting, deliberate diversification, altering limits or benchmarks, guarantees and insurance, participations and whole-loan sales, holding more capital, and buying credit derivative protection. On the Monday a limit is actually crossed, only three of those are available — give up income now by selling part of the book, ask for a dated exception, or ask the board to move the line — and the only honest way to choose between them is to price all three against the same map on the same day. Botminds' Credit Concentration Risk Monitoring models exactly that, with the effect on every limit each option touches, the income given up and the weeks it takes.
The bank, the borrowers and the loans below are fictional sample data from the solution — Ellsmere Bank & Trust, an $18.4 billion bank, on Monday 12 October. Everything attributed to the OCC or the FDIC is quoted from the published document and linked where it appears.
One crossing, three ways back
$4.2M
over the trucking limit when a $12.0 million equipment loan funds at 10:14
94.4%
use of the limit after selling a $15 million participation — the only option back under the limit as it stands inside the 30-day clock
$0.4M/yr
of net interest income given up to buy that headroom, for about three weeks of work
What are concentration risk mitigation strategies, in the order they bite
The booklet's framing is worth reading before its list. Mitigation is a decision, not an obligation: "Bank management typically decides whether and what type of mitigation is appropriate for a particular pool of loans. For some pools of exposures, management might determine that the bank is adequately compensated for incurring certain exposures and assumes some level of concentration risk deliberately" (OCC, Concentrations of Credit, version 3.0). A concentration is not a fault. What makes it a finding is holding one without a limit, or crossing a limit without a plan.
Order the seven by how long each takes to show up in the number, and the choice on any given Monday becomes obvious.
The seven mitigation actions the OCC names, by how fast each one moves the measured exposure
| Action | How it works | Time to show in the ratio |
|---|---|---|
| Selling participations or whole loans, non-recourse | Exposure leaves the balance sheet, so the pool falls by the amount sold. | Weeks — a term sheet, a credit review at the buyer, and settlement. |
| Altering exposure limits or credit risk benchmarks | The line moves rather than the book. Needs the approval of whoever set it. | One board or committee meeting — days to weeks. |
| Securitisation | Reduces the concentration only when the reference obligations leave the balance sheet entirely. | Months, and often no reduction at all. |
| Buying credit derivative protection | Transfers the risk of loss while the exposure stays booked. | Weeks to price — but the measured concentration does not fall. |
| Obtaining insurance or guarantees | Government, corporate or personal guarantees reduce the quantity of risk in a pool. | Loan by loan, at renewal or amendment — quarters. |
| Modifying underwriting or account management | New business tilts to lower-risk borrowers; higher-risk relationships are exited. | Quarters — it changes what funds next, not what is funded. |
| Diversifying and expanding the portfolio | Growing pools that do not move with the concentrated one lowers its share of the book and the chance that everything turns at once — but not its share of capital. | Years — and the ratio to capital falls only if capital grows faster than the pool. |
Only the first two move the number this quarter. That is the whole shape of the problem: the list is long, the menu on the day is short, and a bank that has never priced the short menu in advance discovers it at the worst possible moment. The booklet expects the thinking to have been done before the crossing — "Banks' policies and procedures typically describe risk mitigation actions when concentrations approach or reach certain thresholds or limits."
10:14 on a Monday: a limit crossed as a loan funds
At 07:00 the overnight run put truck transportation at 95.9 percent of its board limit — $184.6 million committed against a $192.4 million line, which is 10 percent of the capital base. Amber, watched, inside. At 10:14 loan operations released the wire on Redfield Freight Lines' $12.0 million five-year equipment term loan: 48 sleeper tractors and 60 dry vans, Joplin, Missouri. Trucking went to $196.6 million, 102.2 percent of the limit, $4.2 million over.
The first hour of a breach, by the clock
- 07:00 overnight run · 95.9% of the limit3h 14m
- 10:14 the wire releases · 102.2%the moment
- the run: posted, mapped, 31 limits re-tested, ways back modelled23s
- case opened, three options priced, plan proposedwithin the hour
- Chief Risk Officer approves · notice to the committee chairsame day
What happened in those 23 seconds is the part that decides whether the rest of the day is useful. The industry mapper confirmed NAICS 484121, long-distance truckload, from the borrower's 2025 tax return, and placed Joplin in the Plains region — out of footprint, which is a second limit. The aggregator found that the owner, Dale Redfield, guarantees a $3.1 million line to Redfield Logistics LLC, a freight broker: related exposure, reported with the obligor group but outside the trucking pool. Then all 31 limits were re-tested, three ways back were modelled, and the notices were drafted.
Who does what on a funding, and what no agent is allowed to do
Agent
Exposure aggregatorPosts the funding from the core, adds related and contingent exposure across the obligor group, ties to the general ledger nightly.
Never: edits core data, or lets a difference above $1M go unreported
Agent
Industry and geography mapperConfirms the NAICS industry from the borrower’s own tax return and statements, and places the borrower in a region.
Never: overrides the relationship manager’s code without review
Agent
Limit monitorRe-tests every limit the funding touches, opens the breach case and starts the escalation clock.
Never: waives, raises or changes a limit
Agent
Remediation plannerModels each way back with its effect on every limit, the income given up and the time it takes, and recommends one.
Never: commits the bank to a sale or a change
A person decides
Director, credit portfolio riskPicks an option, adds what the planner cannot know, and submits it.
Never: approves her own plan
A person decides
Chief Risk OfficerApproves the plan or the exception, and the notice to the board risk committee chair goes out when he does.
Never: moves a board limit — that is the committee’s
How 8.93 percent of capital became 10.22 percent, loan by loan
That waterfall is the honest answer to how limits are crossed at banks with good credit committees. Nobody approved a breach. Four separate decisions, each correct on the day it was made, arrived in a different order than they were approved. The Director's Reference Guide puts the governance question in one line that a board can ask without any technical knowledge: "What are the processes when the bank is approaching risk limit(s)? What is the process for breached limit(s)? What is the process for remediating a breached limit?" (OCC, Director's Reference Guide to Board Reports and Information).
How does selling a loan participation reduce a concentration?
It reduces it because the exposure stops being the bank's. The OCC lists "selling loan participations, or whole-loan sales on a nonrecourse basis, to reduce exposures" among its mitigation actions, and the two conditions in that short sentence carry all the weight. Non-recourse means the buyer takes the credit risk; a participation sold with recourse leaves the seller on the hook and leaves the exposure in the pool. And the bank must stop holding the sold share in substance as well as in form — a retained first-loss piece, or a credit-enhancing representation, puts the risk back.
On the sample bank's Monday, the option priced was a $15 million participation in Ostrom Freightways' term loan, sold to Sorrel Creek Bank. Trucking falls from $196.6 million to $181.6 million — 9.44 percent of capital, 94.4 percent of the limit, $10.8 million of room. It also takes transportation equipment from 89.1 percent of its limit to 85.2 percent, which matters because a second pool is quietly rising behind the first. It costs about $0.4 million a year of net interest income and takes about three weeks, because the buyer has to run its own credit process.
The practical catch is the asset you choose to sell. It will not be the loan that caused the breach: Redfield funded this morning and selling it now is a bad look with a new borrower. It will be a seasoned, clean credit the buyer wants — which means mitigation costs the bank one of its better relationships, not one of its worse ones. That trade is the part a spreadsheet rebuilt at quarter end never shows, because by then the choice has already been made by default.
Asking for an exception: what a defensible one contains
An exception does not reduce exposure. It records that someone with the authority to accept the risk has accepted it, for a stated period, for a stated reason. That makes it the fastest answer available and the one examiners read hardest, because the alternative reading of an exception is that the limit was never real.
The Director's Reference Guide names the red flag directly, in a list of warning signs for boards:
Concentrations exceed established limits with no plans in place to reduce exposure to acceptable levels.
OCC, Director's Reference Guide to Board Reports and Information, November 2020
The operative words are no plans. An exception that comes with a dated path back is a plan. An exception that renews each quarter is the red flag, and a bank whose limits are "routinely exceeded" has the other failure version 3.0 of the handbook warns about, where limits are so rigid they are breached as a matter of course.
On the sample Monday the exception priced was to 30 November, when Carrow Line Haul's $9.6 million term loan matures. It is honest arithmetic and a poor answer: the bank gets back under only on 30 November, at 97.2 percent of the limit, after seven weeks over the line — well past its own 30-day clock. A board risk committee reading that option next to a three-week participation can see which one it is being asked to prefer, and why.
Asking the board to move the limit
Altering exposure limits is on the OCC's own list, so a limit change is a legitimate mitigation and not an admission of defeat. What makes it defensible is the order of operations. A limit changed because the risk appetite changed, debated on its merits and approved before the exposure arrives, is risk governance working. A limit changed because the bank happens to be over it is the limit being retrofitted to the book, and version 3.0 tells examiners to judge whether a bank's limits actually control its concentration risk and reflect its stated risk appetite — a test the guide to setting limits applies line by line.
The sample bank's third option is to ask the board risk committee on 22 October to raise trucking from 10 percent to 11 percent of capital, which would put the current book at 92.9 percent of the new line. It is instructive that the board cut this very limit from 12 percent to 10 percent in April. Asking for 11 percent six months later is asking the committee to unwind half of its own decision, and the paper has to say why the April reasoning no longer holds. If the answer is only "we are over", the request should not be made.
Three ways back, each with its effect, its cost and its date
The three options a bank actually has on the day, priced on one map
What it does to the limit: $196.6M to $181.6M: 94.4 percent of the limit, $10.8M of room. Transportation equipment also falls, 89.1 to 85.2 percent.
What it costs, and when: About $0.4M a year of net interest income, and a good relationship partly handed to another bank. About three weeks.
What it does to the limit: Nothing today. When Carrow Line Haul’s $9.6M matures, 97.2 percent — still inside, but barely.
What it costs, and when: No income given up, and seven weeks over a board limit on the record. Same day, by the Chief Risk Officer.
What it does to the limit: The book unchanged at $196.6M, measured against a $211.6M line: 92.9 percent of the new limit.
What it costs, and when: A committee asked to reverse half of its April decision. The next meeting, 22 October.
Does securitisation reduce a concentration? Only if the exposure leaves
Only when the loans leave the balance sheet and stop being a direct, indirect or contingent exposure of the bank. Version 3.0 of the OCC's booklet says so for the first time, and the guide to the new booklet reads the rule in full. For a bank looking for a way back under a limit, it sorts the structures into two piles.
A traditional cash sale into a vehicle that qualifies for derecognition takes the assets off, and the concentration falls — on the timetable of a securitisation, which is months, not the three weeks of a participation. A synthetic transfer, a direct-issue credit-linked note or bilateral credit protection leaves the loans exactly where they were, so the measured concentration does not move at all. Retained tranches and repurchased interests come back on. So does credit risk kept through credit-enhancing representations and warranties.
The booklet allows the other half: a well-structured transfer can lower the quantity of risk an examiner assesses, even though the amount stays. The size of the pool is one thing and how dangerous it is, is another. A bank that reports a smaller concentration after a synthetic transfer has confused the two — and is still over its limit the next morning.
The slow mitigations: underwriting, pricing, run-off and diversification
The other four actions are real, and they are what a bank does between breaches rather than during one. Modifying underwriting standards tilts what funds next quarter; the booklet pairs it with increased oversight "while executing exit strategies from higher-risk relationships (e.g., increasing pricing or tightening terms and conditions)", which is the quiet way a pool shrinks without anything being sold. Guarantees and insurance reduce the quantity of risk loan by loan, at renewal. Holding additional capital raises the denominator every limit is a share of, slowly. Diversification is the slowest of all, and the most often promised: it lowers the pool's share of the loan book and the chance that everything turns at once, but not its share of capital — a pool at 10 percent of capital falls to 9 percent only if capital grows about 11 percent while the pool stands still.
There is one more slow mitigation the list does not name, and it is the one most banks actually use: run-off. Letting maturities roll out of a pool costs nothing and nobody has to approve it. It is also entirely passive, which is why it belongs in a plan with a date beside it — the sample bank's option B is run-off with a deadline attached, and it is instructive that even with a $9.6 million maturity falling inside the window, run-off alone gets the bank back under only after seven weeks over the line.
How long does a bank have to get back under a limit?
No regulation sets a clock. The deadline comes from the bank's own credit policy, and that is precisely why it should be written before it is needed. The sample bank's policy section 7.4 gives three times: the Chief Risk Officer within one business day, the chair of the board risk committee within two, and back under the limit — or covered by an approved exception — within 30 days. Each of those is a setting rather than a rule of the product, and the alternatives sit beside them: same day or one business day to the Chief Risk Officer; one or two days or the next meeting for the chair; 30, 60 or 90 days to be back under.
What a clock buys is not speed but evidence. A breach that reaches the right people on a stated schedule, with a plan and a date, answers the Director's Reference Guide's three questions before they are asked. A breach found when the quarterly report is rebuilt answers none of them, because by then the only honest account of the process is that there was not one.
The cost of never having an answer is on the record. Tennessee Commerce Bank failed in January 2012 with a large concentration in a specialised, economically sensitive corner of commercial lending — leasing companies and lease brokers financing trucks and buses — a failure the guide to concentration risk reads in detail. Among the supervisory lessons, the review found that a more proactive response "could have included placing greater emphasis on TCB establishing prudent limits on its industry and borrower concentrations, holding higher levels of capital, and implementing stronger risk management practices" (FDIC Office of Inspector General, report AUD-12-014). The failure was not that the bank lent to trucking. It was that nothing stopped it in time.
Testing the next five proposals before the committee votes
Mitigation is wasted if the next committee meeting undoes it. Five proposals went to Wednesday's credit committee at the sample bank, each tested against every limit it touches, with the Ostrom Freightways participation assumed closed. Duval Fleet Logistics' $28 million equipment line would still take truck transportation to 108.9 percent of its limit; up to $10.8 million fits today. Corrigan Axle Works' $35 million would breach the auto parts limit instead. Each test is written as a note and attached to the credit memo, so the committee votes on a number rather than on a recollection.
Each proposal tested against every limit it touches, before anyone votes
That is the difference between a mitigation plan and a mitigation habit. The plan gets the bank back under the line; testing every proposal against the map keeps it there, and makes the relationship manager's conversation with the borrower an early one rather than a retraction. Where the limits themselves come from, and how a board sets one that holds, is a question of its own; to see the breach case, the modelled options and the committee test on a loan book, start from Credit Concentration Risk Monitoring.
Questions people ask
What are the main concentration risk mitigation strategies?
The OCC's booklet names seven: modifying underwriting or account management, diversifying the portfolio, altering exposure limits or credit risk benchmarks, obtaining insurance or guarantees, selling participations or whole loans on a non-recourse basis, holding additional capital, and buying credit derivative protection. Only participations and limit changes move the use of a limit within weeks — the first by cutting the exposure, the second by moving the line; the rest work over quarters or years.
How do you reduce a loan concentration quickly?
By moving exposure off the balance sheet — a non-recourse participation or whole-loan sale — or by not adding to it, which means holding new deals in the same pool until there is room. Both cost income. Everything else either takes longer than a quarter or leaves the exposure in place while transferring the risk of loss, which reduces how dangerous the pool is without reducing its size.
What is a concentration limit exception, and who approves it?
It is a recorded decision to accept being over a limit for a stated period and a stated reason, approved by whoever the credit policy gives that authority to — commonly the Chief Risk Officer or a credit committee, with the board or its risk committee for the limit itself. It reduces nothing. Its value is that someone with authority has accepted the risk on the record, with a dated path back attached.
How long does a bank have to get back under a limit?
As long as its own credit policy says, because no regulation sets the period. A policy might set 30, 60 or 90 days, with a shorter clock for telling the Chief Risk Officer and the board risk committee. What matters to an examiner is less the length than that it exists, is met, and is not quietly extended each quarter.
Does buying credit protection reduce a reported concentration?
Not the amount. If the loans stay on the balance sheet — as with a synthetic transfer, a credit-linked note or a credit default swap — the exposure is still a direct, indirect or contingent obligation and stays in the concentration. The OCC does allow that appropriately structured protection can reduce the quantity of risk an examiner assesses, which is a judgement about danger rather than a change in the measurement.
What should a breach notice to the board say?
Which limit was crossed, by how much and when; what caused it, loan by loan; what the options are with their effect, cost and timing; which one is recommended and who approved it; and the date by which the bank will be back under. The Director's Reference Guide treats a concentration over its limit with no plan to reduce exposure as a warning sign, so the plan and its date are the part the notice exists to carry.