What a credit risk management system costs, for concentrations

Anyone pricing a credit risk management system for concentrations is pricing the wrong thing first. The licence is a line item; the cost that already sits in the budget is about fifteen analyst-days a quarter spent rebuilding a position that is weeks out of date by the time the board risk committee reads it, plus whatever the crossing nobody saw turns out to cost. There are four honest ways to attack that — keep the spreadsheets, push the work into the core system's report writer, build it in a data warehouse, or put agents over the systems the bank already runs — and they differ less in price than in how much of the work each one still leaves to a person. Botminds' Credit Concentration Risk Monitoring is the fourth, and this guide prices it against the other three with every assumption written down.

The day counts and the before-and-after figures here are our own estimates for a bank of this size, and the timing figures are design targets; none of them is a customer's measured saving. The bank, borrowers and loans in the examples are fictional sample data from the solution. Everything attributed to a regulator is quoted and linked.

How much does a credit risk management system cost, and against what?

Licence prices for portfolio risk products are negotiated and depend on the bank's size and scope, so a published figure would mislead. What a buyer can do — and what a finance committee will ask for — is build the comparison the other way round: establish what the work costs today, then ask each option what it removes and what it adds. That comparison has four cost drivers, and only one of them appears on a quote.

The people. Analyst-days a quarter, every quarter, at fully loaded cost. This is the largest number for almost every bank and the one nobody budgets, because it is already being spent by people hired for something else.

The build or the implementation. One-off, and the figure most often underestimated — not because the software is hard but because reconciling limits that live in four documents and agreeing a nightly tie-out with finance takes the weeks it takes.

The running cost of staying correct. Call Report instructions change. The examiner's booklet is replaced. Borrowers amend and re-amend. Whoever owns the mapping owns that maintenance forever, and in a build it is a permanent claim on an engineering team that would rather be doing something else.

The cost of being wrong or late. A refiled schedule, a quarter-end overtime bill, an examination write-up, a deal held while the bank gets back under a limit — and, at the extreme, a concentration nobody controlled. Every one of those is real money and none of them is in a quote.

How many analyst days does a quarterly concentration report take?

At the sample bank the answer breaks into five tasks, and the shape of the split matters more than the total: two-thirds of the work is classification and assembly, not analysis. Nobody is paid fifteen days a quarter to think about concentration risk. They are paid to retype it.

The second thing the split shows is where the remaining 2.5 days go: almost entirely to confirmation and review. That is the right place for them. A programme whose last analyst-day is spent reading a draft and confirming the categories a document was read for is a programme with a person in the loop; one with no analyst-days left at all has quietly removed the control the examiner will ask about.

Option one: spreadsheets and core extracts

The status quo, and it should be priced honestly rather than dismissed. It has no licence, no implementation and no vendor. It is flexible in a way no product is — a new cut of the book is an afternoon — and the people who run it understand it completely.

Its cost is the fifteen days, repeated every quarter forever, and three structural weaknesses no amount of care removes. The position is only ever as current as the last rebuild, so a pool that crossed its limit in week three and fell back by week thirteen never appears. The classification is whatever the core says, because nobody re-reads a credit agreement for a spreadsheet. And the evidence trail is the workbook, which is why this option fails the OCC's reporting expectation long before it fails on arithmetic: "Accurate reports support an active and timely dialogue with the board and senior management regarding concentration exposures" (OCC, Concentrations of Credit, version 3.0). A dialogue about a number from eleven weeks ago is not timely, however accurate the number was when it was built.

Option two: the core system's report writer

Attractive, cheap and the right answer to half the problem. The core already holds obligors, facilities, commitments, outstandings and bookings; a report writer can aggregate them against a table of limits and run on a schedule. Banks that take this route usually remove the three days of extract pulling almost entirely, and sometimes most of the limit testing too.

What it cannot do is the part that takes seven of the fifteen days. A report writer reports the codes it is given. It will not read a borrower's tax return to decide what industry it is in, and it will not read a borrowing base to decide which Call Report category a non-bank lender belongs in. It also tends to be blind to related exposure that sits outside the core's own obligor grouping — a guarantee to a different entity in a different industry — which is the exposure most likely to be missed and most likely to be asked about.

The Director's Reference Guide names the version of this failure that boards should look out for: "Concentrations are not evaluated as a percentage of capital to assess magnitude of risk" (OCC, Director's Reference Guide to Board Reports and Information). A report writer producing dollar totals by booked code, against no capital base, has automated a listing rather than a measurement.

Option three: a data warehouse build

The most ambitious option, and the natural one for a bank that already runs a risk data warehouse, because it solves a general problem rather than this one. A warehouse can hold the core feed, the limits, the capital base and the history, and a competent team can build aggregation, limit testing and board reporting on top of it. Done well, it also serves five other risk programmes.

Three costs are routinely under-priced. The first is the classification problem, which does not go away: a warehouse stores an industry code, it does not decide one, so the four days of mapping move rather than disappear unless someone also builds document reading. The second is that the examiner's questions are about documents and confirmations — the page a category was read from, the person who confirmed it — and a warehouse that stores only values has nowhere to put them. The third is maintenance: when the Call Report instructions change a category definition, or a new booklet reorganises what examiners look at, the change lands on an engineering backlog that is already full.

The honest case for a build is a bank that has the warehouse already, has the document reading solved another way, and wants concentration limits to live beside its other risk measures. The honest case against is a bank whose first quarter of real data arrives long after the business case was approved, while the quarterly spreadsheet carries on in the meantime.

Option four: agents over the systems you already run

The fourth option changes which part of the job is automated. Instead of moving data to a new place and reporting from it, agents read from the systems that already hold the answer — the core for exposure, the general ledger for the tie-out, the borrower's own documents for what it is — and the limits stay the board's numbers held as settings.

What that buys is the two tasks the other three options leave on a person's desk. An industry comes from the borrower's tax return rather than from a field, with the relationship manager's code kept beside it and the difference flagged. A non-bank lender's Call Report category comes from its borrowing base with the passage and the page cited. On the sample bank's data a single funding is posted, mapped, joined to its related exposure, tested against all 31 limits, modelled for ways back and drafted into notices in 23 seconds; the design target for the funding-to-tested time is three seconds.

What it does not buy is a decision. No agent waives, raises or changes a limit, commits the bank or files a report, and no classification counts until a person confirms it. That is a deliberate cost: it is why 2.5 analyst-days a quarter remain, and it is the reason there is anything to show an examiner.

The output the quarter is actually for, and the schedule beside it

What does a concentration limit breach cost a bank?

Four different things, and they should be priced separately because they land on different people.

Income given up. The fastest way back under a limit is to sell exposure, and the exposure a buyer wants is a seasoned, clean credit. On the sample bank's Monday, a $15 million participation takes trucking from 102.2 percent of its limit to 94.4 percent and costs about $0.4 million a year of net interest income. That is the price of headroom bought in a hurry.

Deals held. While the bank is over, business in the same pool waits. A $28 million equipment line sat on hold in the sample case until trucking was back under. Whatever that relationship was worth is a cost of the crossing, charged to a relationship manager who did nothing wrong.

The examination write-up. This one is misunderstood. The FDIC's thresholds for listing a concentration, and for writing an analysis of the bank's risk management of it, are not limits at all; they tell the examiner when to list and when to write (FDIC, RMS Manual, section 16.1), a distinction the guide to concentration risk draws out. A bank can cross one of them without doing anything wrong. What it cannot do cheaply is reach a written analysis of its risk management practices — at 300 percent of tier 1 capital plus the related allowance for an industry, product line or collateral concentration — with nothing to show but a spreadsheet.

The refiled schedule. Getting a non-bank lender's category wrong is not a limit breach at all; it is a reporting error, and the new categories make it an easy one to make. The FDIC's own analysis of the new reporting records banks moving loans out of the residual category into the other four through the first half of 2025, after first filing on a best-efforts basis, and cautions that later audits may produce further reclassifications (FDIC, Banking Issues in Focus No. 1). A category found wrong after filing is the condition under which a schedule gets amended, and the cost is the regulatory reporting team's week plus a conversation nobody wanted.

At the far end sits the cost that makes the others look like rounding. Tennessee Commerce Bank was closed in January 2012 with a concentration in transportation lending: "the estimated loss to the DIF was $416.8 million (or 42 percent of TCB's total assets)" (FDIC Office of Inspector General, report AUD-12-014). That number is what a concentration cost a deposit insurance fund when nothing stopped it in time. It is not a saving any software can claim, and it should never appear in a business case as one. It belongs here for a different reason: it sets the ceiling on how much being right is worth.

Thirty-one limits, their use and their room, on one map

A three-year comparison, with every assumption written down

The table below is a framework rather than a quote. Put your own fully loaded analyst day rate and your own licence and build figures into it; the point is which rows exist, not what we would put in them.

Two assumptions are worth stating because they decide the answer. The first is the analyst day rate, fully loaded — the fifteen days are the largest term in every version of this sum, so the rate drives the result more than the licence does. The second is how often a crossing actually happens at your bank, which nobody knows until the limits have been re-tested across a closed quarter. That replay is the cheapest piece of evidence available before a contract, and it is set out in the guide on what to ask a vendor and how to test them.

How do you build a business case for credit risk software?

Not on a saving. A business case built on analyst-days invites the obvious reply — that the analysts are not being made redundant, so nothing is saved — and it deserves that reply. The strong case has three parts, in this order.

First, what the bank cannot currently do. It cannot say today what any pool stands at; it cannot evidence how a category was decided; it cannot test a deal against the map before the committee votes. Those are capability gaps, and they are answerable without arguing about headcount.

Second, the replay. Re-run the limit tests across a closed quarter and count the crossings nobody saw at the time. If the count is zero, the case rests on evidence and speed rather than on risk, and the project should probably be smaller. If it is not zero, the case is made by the bank's own data and no vendor had to assert anything.

Third, the evidence the second line and the examiner will ask for. The OCC's own list for a listed concentration is quality of risk management, appropriateness of limits and accuracy of reporting. A programme that can produce all three on the day is the cheapest version of every examination that follows.

The ability to accurately identify pools of transactions with similar characteristics and to associate them with various risk metrics in a timely manner depends on the quality and scope of the bank's management information systems.

OCC, Comptroller's Handbook, Concentrations of Credit, version 3.0, September 2026

One last caution on scope, because it changes the price. This covers industries, out-of-footprint regions, collateral, trade-exposed borrowers, leveraged loans, shared national credits and non-bank lenders. Commercial real estate concentration carries its own supervisory framework and its own stress testing and is priced separately; a business case that quietly folds it in will be wrong in both directions. How the programme itself is stood up, week by week, is set out in the guide to running it. To price the replay against your own closed quarter, start from Credit Concentration Risk Monitoring.

Questions people ask

How much does a credit risk management system cost?

Licence prices are negotiated and depend on the bank's size and scope, so a published figure would mislead. The useful comparison is against what the work costs now: at an $18.4 billion bank we estimate about fifteen analyst-days a quarter to rebuild the concentration report by hand, plus the implementation, the maintenance of staying correct as instructions change, and the cost of being late or wrong.

Is it cheaper to build concentration reporting in house?

For aggregation and limit testing, often yes, especially where a data warehouse already exists. The part that is expensive to build and more expensive to maintain is reading documents — industry codes from tax returns, Call Report categories from borrowing bases, re-checked on every amendment, each with a cited passage. Price that separately, including who maintains it when the instructions change.

How many analyst days does a quarterly concentration report take?

At a bank of this size we estimate about fifteen: roughly three pulling core extracts, four mapping borrowers to industry codes and regions, three sorting non-bank lenders into Call Report categories, two testing limits and chasing exceptions, and three writing the board report and the schedule. Two-thirds of that is classification and assembly rather than analysis.

What does a concentration limit breach cost a bank?

Income given up to get back under, deals held in the same pool while the bank is over, management time if an examination write-up follows, and a refiled schedule where the cause was a misclassification. The sizes depend entirely on the bank. The extreme case is a concentration nobody controlled: the FDIC's inspector general put the deposit insurance fund's loss on Tennessee Commerce Bank at $416.8 million, about 42 percent of the bank's total assets.

Should we just use the core system's reports for concentrations?

They are a reasonable answer to the mechanical third of the job and will remove most of the extract work. They report the codes they are given, so they will not re-read a borrower's documents, and they are usually blind to related exposure outside the core's own obligor grouping. If the booked codes on your book are trustworthy, this is a cheap and sensible step; testing that assumption is the first thing to do.

What is the cost of a late concentration report?

It is the cost of every decision made between the crossing and the report. A quarterly rebuild can leave a pool over its limit for up to four months before anyone is told, and in that window deals are approved against a stale position, no escalation clock has started, and the cheapest ways back — a participation, a dated exception — expire. The report itself is on time. The information in it is not.