Credit concentration risk monitoring, explained.

Fifty trucking borrowers, one bet: what a credit concentration is

How a concentration limit travels from the board to the book and back

1. The board sets the limitsThe risk appetite statement names the pools (one borrower, industries, regions, collateral, lender types) and a ceiling for each as a share of capital, with who is told when one is crossed.
2. Each deal is checked at committeeCredit committee tests the new loan against the limits it touches, using the book as it stood that day.
3. Loans fund and the book is added upEvery funding, draw, paydown and new category is posted to every pool it touches and re-tested. This is where a pool that every deal respected can still break, unseen until the next count.
4. A breach is escalatedThe chief risk officer (CRO) is told, a plan to get back under is chosen and approved, and the board's risk committee hears about it within the time policy sets.
5. The board and examiners read the reportEach quarter: where every pool stands, what was breached, what is near, what the stress shows, and whether the limits still fit.

Step 3 is the subject of this guide. Ellsmere Bank & Trust, its people and its borrowers are fictional.

Four facts about concentration limits that newcomers rarely expect

Four terms behind every concentration ratio

Fourteen terms are defined in the guide on one page.

Loans to one borrower: the legal lending limit, related borrowers and the board's own house limit

In shortThe smallest concentration is one borrower. Federal law caps a national bank's loans to one borrower at 15% of capital and surplus, plus 10% more if the excess is fully secured by readily marketable collateral. Related borrowers are added together when one benefits from the other's loan or when they form a common enterprise. State banks follow their state's statute. Most boards set a lower "house limit" so the legal ceiling is never in play.

For national banks and federal savings associations the rule is 12 CFR Part 32, which implements 12 U.S.C. 84. Its stated purpose is to prevent "excessive loans to one person, or to related persons that are financially dependent, and to promote diversification of loans".2

The general limit reads: total outstanding loans and extensions of credit to one borrower "may not exceed 15 percent of the bank's or savings association's capital and surplus, plus an additional 10 percent" if the amount above 15% "is fully secured by readily marketable collateral", whose market value must stay at 100% or more of that excess "at all times".2

Three details make the limit harder to apply than it reads.

• The base. "Capital and surplus" is tier 1 plus tier 2 capital plus any allowance not already counted in tier 2. For a community bank that elects the community bank leverage ratio, it is tier 1 capital plus the allowance, the same base as the concentration ratios.2 That framework's threshold fell from 9% to 8% on July 1, 2026, so more community banks can elect it.9
• The date. The limit is measured as of the last day of the preceding quarter, or the day the bank's capital category changes, effective when the Call Report is filed or due.2 A loss that shrinks capital shrinks the limit.
• Nonconforming loans. A loan that was within the limit when made, and later exceeds it because capital falls or borrowers merge, is "nonconforming", and the bank must use reasonable efforts to bring it back. If the cause is collateral losing value, the deadline is 30 calendar days.2

When two borrowers count as one

Section 32.5 attributes a loan to another person in two cases, and it caps a corporate group as a whole.2

The tests in 12 CFR 32.5.2

Guarantees sit beside these rules. A guarantor who stands behind three borrowers' loans is not a borrower under Part 32 for each of them, but the bank's credit risk now depends on one person three times. The Fed's manual tells examiners to count loans "endorsed, guaranteed, or cosigned by related individuals and their related interests" when they size a concentration.1 A good concentration report therefore keeps two views: the legal one (who is a borrower under the combination rules) and the economic one (whose cash repays what).

State banks and the largest holding companies

State-chartered banks follow their own statute. Iowa allows 15% of a state bank's aggregate capital, or 25% if the excess is fully secured by kinds of collateral the statute lists, and counts commitments and overdrafts as loans.10 New York's Banking Law caps loans to any one person at 15% of capital stock, surplus fund and undivided profits, with exceptions set out in the statute.11

At the other end, the largest bank holding companies carry a separate single-counterparty credit limit: aggregate net credit exposure to one counterparty may not exceed 25% of tier 1 capital, and 15% between the global systemically important banks and their major counterparties.12

Many boards keep borrowers well away from the legal ceiling. They set a house limit below it, a "hold limit" for the share of a large loan the bank keeps after selling participations, and a lower limit for weaker risk ratings.

Citizens Bank of Sac City, Iowa, shows why the legal limit also needs watching day to day: examiners cited violations of Iowa's lending limit in 2021 and 2022, as the bank advanced money to struggling trucking borrowers through overdrafts "often in excess of the State's lending limit".13 It failed on November 3, 2023.

Industry, region, collateral, product and lender type: the pools a whole-book report adds up

In shortBeyond one borrower, a concentration is any pool of loans that "may act like a single, correlated exposure", in the Fed's words. The examination manuals name the usual pools: industries, product lines, types of collateral, regions that depend on one employer or crop, loans to other financial institutions, and commercial real estate. The examiners' own thresholds cover some of them; the Call Report counts only a few. The rest the bank must define and measure itself.

The Fed's manual gives the key objective in one sentence: "to identify pools of transactions that may act like a single, correlated exposure."1 It adds the point every concentration policy starts from: "lending limits alone are not sufficient to prevent and control concentrations of credit."1 It then lists the pools examiners commonly find:1

• loans to unrelated borrowers that rely on the same company's stock or debt as collateral;
• loans that depend on one crop or livestock herd;
• interim construction loans with no permanent takeout;
• "loans to groups of borrowers who handle a product from the same industry or economic sector";
• loans in areas "economically driven by a certain industry or dominated by one or only a few business enterprises";
• loans to other financial institutions;
• retail products such as credit cards, home equity lines and auto loans, where the product's features are the shared risk.

The FDIC's report-of-examination instructions add funding: a single funding type above 10% of total assets is listed, and uninsured deposits above 50% of total deposits.3 The Call Report counts loans by type and collateral and, since December 2024, splits loans to non-bank lenders five ways for banks over $10 billion.4 It has no industry or region field.

One bank's 31 limits

A commercial bank's risk appetite statement can run to dozens of limits. Ellsmere Bank & Trust, the fictional bank in this guide's example, has 31, in five families, each expressed as a percentage of its $1,924 million capital base and measured on commitments: what is drawn plus what borrowers can still draw.

Each family needs its own mapping. Industries come from a NAICS code (the North American Industry Classification System) that someone assigned at booking; regions from where the borrower operates, which may differ from its mailing address; collateral from the security agreement; lender type from what the borrower lends against.

A loan usually lands in four or five pools at once. Redfield Freight Lines' $12.0 million equipment loan, in the example, counts toward truck transportation, the Plains region (Missouri is outside the bank's five-state footprint), transportation equipment collateral, and the obligor group of its owner.

How to calculate concentration risk: each pool against tier 1 capital plus the allowance, and the examiners' thresholds

In shortEvery pool is a fraction: exposure divided by tier 1 capital plus the allowance for credit losses on loans. Securities are divided by tier 1 alone. The examiners' thresholds are 25% for one borrower, 100% for an industry, product line or collateral type to be listed, and 300% for a written analysis. The two choices that move the number most are commitments versus drawn balances and the date of the capital figure.

Since March 31, 2020 the Fed, the FDIC and the OCC have used one denominator for credit concentrations: for banks on the current expected credit loss standard (CECL), "Tier 1 capital plus the portion of the allowance for credit losses attributed to loans and leases"; for the rest, tier 1 plus the entire allowance for loan and lease losses.8 The change was made because community banks that elect the leverage ratio framework no longer report tier 2 capital, which had been part of the old base, total capital.8

The OCC's revised "Concentrations of Credit" booklet, version 3.0, issued September 30, 2026, keeps the definition: obligations above 25% of tier 1 capital plus the allowance.15

The FDIC's instructions add two rules a bank's own report should mirror or deliberately depart from. Concentrations in securities and other non-credit assets are measured against tier 1 capital alone. And "when capital is so low that it is no longer useful in identifying an asset concentration", examiners use a share of assets, "generally two percent of total assets".3

Commitments or drawn balances

A loan's exposure can be counted as what is drawn or as what is committed, drawn plus undrawn. The Fed's manual says "the amount of loan commitments and other off-balance-sheet risk items should be considered", along with letters of credit, acceptances, overdrafts and loans the bank has guaranteed.1 The FDIC's examiners, for their report table, count funded exposure only and comment on unfunded amounts in their narrative.3

That is a convention for a table. A bank's own limit is usually better written on commitments for any pool of revolving lines, because a borrower draws hardest when its business is in trouble. For loans to non-bank lenders the gap is large: banks had committed $2.71 trillion against $1.65 trillion drawn in the first quarter of 2026.16

One pool, worked through

The same arithmetic, carried in dollars instead of percentages, drifts. If capital grows 6% in a year and the limit is written as "$192.4 million", every limit has loosened by 6% without a vote. If capital falls after a loss, a dollar limit is too loose exactly when the bank can least afford it. Writing limits as a share of the latest capital base, and printing the base and its date beside every ratio, avoids both.

The lending limit and concentration texts as of October 2026: what has held since 2006 and what changed after 2020

In shortThe core rules are old and stable: the legal lending limit (12 CFR 32), the safety and soundness standard that underwriting take "adequate account of concentration of credit risk", and the 2006 commercial real estate screens. What changed recently is how concentrations are measured and reported: a new denominator in 2020, a five-way split of loans to non-bank lenders in December 2024, new model guidance in April 2026, the FDIC's examination instructions revised in August 2026 and the OCC's concentrations booklet in September 2026.

The safety and soundness standard is the binding one for every insured bank. Appendix A to 12 CFR 30 asks for underwriting practices that "Take adequate account of concentration of credit risk".21 "Adequate account" is where examiners start: a limit the board set, a count the bank can trust, and evidence that management acted when a limit was approached.

Where commercial real estate fits: the 100% and 300% screens and their status in 2026

In shortCommercial real estate is the one pool with its own supervisory screens: construction and land loans at 100% of capital, and total CRE at 300% with 50% growth over three years. They date from December 2006, are still in force, and are measured against tier 1 plus the allowance. At the end of 2025 the median bank with $1 billion to $10 billion of assets held CRE at 311% of capital.

The 2006 interagency guidance leaves the size of a CRE book to each bank: the agencies said they revised the proposal "to make clear that the Guidance does not establish a limit on an institution's CRE lending activity."17

It names two screens that tell examiners a bank may have a concentration that needs heightened risk management: construction, land development and other land loans at 100% or more of capital, and total CRE (construction, multifamily, nonfarm nonresidential not occupied by the owner, and loans to finance CRE not secured by real estate) at 300% or more, where the CRE book has also grown 50% or more in the prior 36 months.17 Since 2020 both screens use tier 1 capital plus the allowance.8

A Federal Register search for 2025 and 2026 found no proposal to rescind or revise the guidance; the FDIC re-issued its CRE concentration advisory on December 18, 2023, telling banks to keep strong capital and allowances, manage construction and CRE loans closely and keep liquidity diverse.19 The FDIC's examiners write an analysis of non-owner-occupied CRE at 300% and of construction loans at 100%, the same lines as the guidance.3

For whole-book monitoring, CRE is one family of pools among several, usually with sublimits by property type and market. It interacts with the others: the same office building can sit in the CRE pool, a region pool and a single-borrower group.

Measuring it on its own, often in a separate stress test, is common; adding it to the same map as industries and lender types is what lets a bank see that a downtown office loan, a loan to the real estate trust that owns the building next door and a construction line to its developer are one bet.

The detailed CRE tests, owner-occupied exclusions and property-level stress are the subject of a separate guide.

Loans to non-bank lenders: five Call Report boxes decided by what each borrower lends against

In shortLending to finance companies, mortgage companies, private credit and private equity funds led the growth in bank lending over the year to mid-2026 and reached $2.06 trillion in September 2026 in the Fed's H.8 data. Since December 2024 banks over $10 billion sort it into five Call Report categories by what more than half of each borrower's assets or lending are. A name rarely tells you which; the borrowing base or credit agreement does.

The Call Report instructions define nondepository financial institutions (NDFIs) as entities that provide services like banks' but "do not accept deposits from the general public": mortgage companies, insurers, investment funds, pension funds, broker-dealers, securitization vehicles and others.4 Item 9.a carries the total. Banks with $10 billion or more of assets also report Memoranda items 10.a to 10.e:4

Because the category follows the assets, a warehouse line to an auto-loan securitization vehicle whose sponsor calls itself a sales finance company may have been booked as business credit when its collateral is mostly retail car loans. In the example, Ellsmere's $250 million line to Bluewater Funding II is coded business credit until the borrowing base certificate shows $222.4 million of $312.4 million in eligible receivables, 71.2%, are retail auto installment contracts: a consumer credit intermediary.

How much of the growth is new lending and how much is relabeling cannot be told apart: the Boston Fed says the jump since the end of 2024 "reflects both actual growth in lending to NBFIs and new reporting instructions that caused banks to reclassify certain preexisting loans".16 The FDIC's second-quarter 2026 profile shows loans to non-bank lenders up 22.4% on the year, against 6.8% for all loans.25

The exposure is concentrated in the largest banks. Loans to non-bank lenders were 52.3% of tier 1 capital plus the allowance across all banks in the third quarter of 2025, up from 4.1% in the first quarter of 2010; 68.1% at banks over $100 billion; 6.3% at banks under $10 billion.26 The FDIC notes the ratio "is not a supervisory designation" but uses it for analysis.26

Default rates have been low, about 0.1% in the first quarter of 2026 against 1.4% for business loans and 2.6% for consumer loans,16 which is the usual profile of a concentration: quiet until the shared risk turns.

Four approved loans, one broken limit: the arithmetic of a breach between committee and funding

In shortA limit is crossed by the sum of loans, so the moment to test it is when the sum changes: each funding, draw, paydown and recoding. A committee that tests a deal against the book on its own date sees a different number from the one the book reaches when the deal funds. Worked on the fictional bank: 8.93% at the quarter's report, 10.22% three weeks later, every loan approved inside the limit.

The fictional bank's truck transportation pool stood at $171.8 million on September 30, 8.93% of the $1,924 million capital base, against a 10% limit. Credit committee approved Redfield Freight Lines' $12.0 million loan on September 23 with that book in front of it: 9.55% with the loan, comfortably inside. Then three things happened before Redfield funded, none of them unusual.

The same funding moved two other pools: the Plains region, outside the bank's footprint, from 13.39% to 14.01% of capital against a 15% limit (93.4% of the limit), and transportation equipment collateral from 17.20% to 17.83% against 20% (89.1%). A related exposure surfaced too: Redfield's owner personally guarantees a $3.1 million line to Redfield Logistics, a freight broker. That line belongs in the owner's obligor group, and in a different industry, NAICS 488510 (freight arrangement), so it does not count toward the trucking limit.

The ways back, priced

A breach needs a plan, and a plan needs numbers. The three options the fictional bank weighed show the usual levers the Fed's manual lists, from loan participations to modifying limits:1

One more number decides how fast the bank must act. Another trucking borrower has a $28 million request on the next committee agenda. Today it would take the pool to 11.67% of capital, 116.7% of the limit; after option A, still 108.9%. Up to $10.8 million fits. A bank that tests proposals against the book as it stands, rather than as it stood at quarter end, can tell the relationship manager that before the vote.

Stress testing concentrations: why the same recession costs one bank under 1% of its loans and another over 20%

In shortA concentration limit says how much the bank may hold; a stress test says what holding it would cost if the shared risk turned. In the Fed's 2026 stress test, nine-quarter loan losses under the severe scenario ran from 1.5% on first mortgages to 17.1% on credit cards, and from 0.7% to 20.7% across banks, a spread the Fed puts down to "differences in loan portfolio composition". The mix of pools is the bank's risk.

The 2012 interagency guidance for banks over $10 billion describes stress testing as a way to find "unidentified or under-assessed risk concentrations and interrelationships", and defines concentrations as "groups of exposures and/or activities that have the potential to produce losses large enough to bring about a material change" in the bank's risk profile or financial condition.18

It names four approaches: scenario analysis (a story, such as a freight recession), sensitivity analysis (change one input "without an explicit underlying reason or narrative"), enterprise-wide testing, and reverse stress testing, which starts from a bad outcome, such as breaching a capital minimum, and works back to what would cause it.18 The Fed's manual tells banks to use "scenario analysis results, if conducted" in setting concentration limits.1

The same table shows the spread across banks: total loan loss rates from 0.7% to 20.7%, a range the Fed attributes to "differences in loan portfolio composition".27 Concentration is that composition. Two banks of the same size, in the same scenario, can lose a fifth of their loans or almost nothing, depending on which pools they lean on.

A concentration stress, worked

A community or regional bank does not need the Fed's models to stress its pools. A sensitivity test applies a loss rate to each pool and asks what is left of capital, and of the ratios. Using the Fed's 9.0% severe-scenario rate for business loans as an illustrative input on the fictional bank's trucking pool:

Illustrative: the loss rates are inputs to replace with your own. The reverse test is the useful one for limit setting: at Citizens Bank of Sac City, trucking loans reached 310% of capital,13 so a loss of about a third of that pool would consume all of it.

Stress results feed back into the limits. A pool whose stressed loss would take more of capital than the board will accept from one shared risk needs a lower limit or sublimits; a pool whose stress is mild may carry a higher one. The answer is only as good as the pool totals going in: stress applied to drawn balances, to an industry missing its related borrowers, or to last quarter's book understates the loss in the same way the concentration report does.

Nine bank failures from 2023 to 2025, and the four where inspectors general named a concentration

In shortNine banks failed between March 2023 and June 2025. The inspectors general named a concentration as a cause at four: Silicon Valley Bank, Signature and First Republic (concentrated depositors, and long-dated assets at SVB and First Republic) and Citizens Bank of Sac City, Iowa (trucking loans at 310% of capital). The other five failed through fraud or bad records, or through securities losses and liquidity. A concentration program that watches only loans would have seen one of the four.

Losses under $50 million get a shorter "failed bank review" rather than a full material loss review.13 Six more banks failed between January and September 2026, according to the FDIC's list;28 we found no inspector general review of them to read, so this guide does not describe their causes.

The lessons for a concentration program

• Concentrations of depositors are concentrations. SVB's review describes "multiple layers of concentration risks" that the board "did not fully understand or appreciate"; over 94% of its deposits were uninsured at the end of 2022.5 The FDIC's examiners now list uninsured deposits above 50% of deposits.3
• A concentration can be a sensitivity. First Republic's single-family loans were 46% of its assets, 61% with an initial interest-only period; as rates rose they lost value, which "limited its ability to obtain sufficient liquidity".7 The shared risk was the interest rate, and no industry code shows it.
• Industry and geography together. Citizens Bank moved from farm lending in its own area into trucking "in and outside of the bank's primary trade area", reaching 310% of tier 1 capital plus allowance and 43% of its loans by June 30, 2023, as its borrowers faced "supply-chain issues and increased costs of fuel, insurance, and repairs".13
• Limits that do not stop anything. Tennessee Commerce Bank, closed January 27, 2012, defined an industry concentration as more than 25% of tier 1 capital and 7% of loans, and its transportation lending was among them; its business loans ran at 438% to 612% of total capital against a peer group average of 100% to 117%.34

Undrawn lines, split obligor groups, stale codes: how a concentration report understates risk

In shortMost bad concentration reports are wrong in the same few ways: the count is late, the denominator is old, undrawn lines are left out, related borrowers are split, categories come from names, pools are tested one at a time, funding is ignored, benchmarks are stale, and nobody re-tests between committee and funding. Each one makes the bank look more diversified than it is.

The Fed's manual puts the examiner's question plainly: examiners "should verify the accuracy of listed concentrations" in the bank's records and determine whether its management information system (MIS) reports "are adequate and allow management to make informed decisions".1 A report that is right but late fails the second test as surely as a wrong one fails the first.

Industry risk moves faster than limits are reviewed: five years of shared national credit data

In shortEach January the three agencies publish how large syndicated loans graded, by industry. For 2025 they split the table into 21 sub-sectors. It shows how quickly an industry's risk rank changes: transportation services went from 30.2% classified in 2021 to 3.5% in 2025, while consumer services went from 4.3% to 23.5%. A limit calibrated against one year needs a review date.

The Shared National Credit program reviews loans of $100 million or more shared by three or more supervised lenders: in 2025, $6.9 trillion of commitments to 6,857 borrowers, of which 6.3% were classified (substandard or worse) and 2.2% special mention.35 Appendix C, widened in 2025 "to include a more granular industry breakdown of twenty-one sub-sectors from the prior seven sector grouping", gives five years per industry.35 It is syndicated credit, larger than a community bank's book, but it is the agencies' own ranking of industry risk and it is free.

Two uses follow for a limit framework. First, a benchmark: an industry whose classified share in the national data is rising is a reason to review its limit before the bank's own losses rise. Second, a review trigger: a limit calibrated in 2021 on transportation's 30% classified share and a limit calibrated in 2025 on its 3.5% describe different risks, and neither should go unreviewed for long. The FDIC asks its examiners to discuss "economic, market, and competitive factors" for every concentration they write up.3

Software adds up the pools on every funding; the chief risk officer and the board keep the limits

In shortAdding up pools and dividing by capital is arithmetic; software can do it on every funding instead of once a quarter. Reading a borrower's documents to choose its industry or lender category is judgment that software can propose and a person should confirm. Setting limits, approving exceptions and choosing a way back stay with the chief risk officer and the board.

The model risk guidance the agencies issued on April 17, 2026 (SR 26-2, FDIC FIL-15-2026, OCC Bulletin 2026-13) "supersedes and replaces" SR 11-7.20,22 The guidance attached to the letter excludes simple arithmetic and deterministic rule-based processes from its definition of a model, and says generative AI models, including AI that takes actions on its own, are not within its scope.20

Limit arithmetic is therefore ordinary software, tested like any calculation; a stress loss model or a tool that reads documents to propose a category is something the bank should test, document and govern under its own policy, whatever the label.

Software has three limits in this work. A document that does not say what a borrower does, or a borrowing base that mixes collateral, leaves the category to a person. A mapping error made by software repeats at scale, so samples should be re-read by hand. And a code revision, such as NAICS 2027, should be shown as a before and after for a person to accept.14

The quarter-end concentration report today: six seats, a 30-day build and the tools banks use

In shortAt most banks the report is a quarter-end job: a portfolio risk manager and an analyst or two pull core extracts, map borrowers to industries, regions and lender categories, compute every pool against capital and write the board pack weeks after the quarter closes. Committee checks each deal in between. No public study measures the hours; the cycle itself is what leaves breaches unseen.

Spreadsheets, a loan review module or a data warehouse: the three common setups

Whatever the tool, four questions tell a bank whether its process works: how many days pass between a crossing and the chief risk officer knowing; whether committee checks use today's book; whether every non-bank lender's category has a document behind it; and whether the board report ties to the general ledger.

A $12.0 million trucking loan breaks a 10% industry limit at 10:14 am, and the CRO approves the fix that morning

In shortThis is the example from the top of the page, inside the product. The loan book opens as a map of the bank's board limits. When Redfield Freight Lines' $12.0 million loan funds at 10:14 am, the trucking tile rises past its border, a breach case opens with the cause and three priced ways back, Rachel Lindqvist proposes one, and Martin Abernathy, the chief risk officer, approves it from his phone a few minutes later.

1

The morning: every board limit as a tile

Rachel Lindqvist, director of credit portfolio risk, opens the loan book. Each tile is one board limit, sized by the dollars the limit allows; the fill is what the bank has committed against it, rising from the bottom. After the 7:00 am run, 31 limits stand at none over and four near. Trucking (NAICS 484) is amber at 95.9%: $184.6 million of a $192.4 million limit.

The rail on the right lists the morning's fundings, each tagged with the limits it moved. Redfield's loan is next, released by loan operations and waiting to post.

2

Redfield funds, and trucking spills over its border

At 10:14 am the $12.0 million loan posts. The trucking tile rises past its border and turns red: $196.6 million against $192.4 million, 102.2% of the limit, $4.2 million over. The same funding takes the Plains region to 93.4% and transportation equipment to 89.1%. A breach case, B-2026-017, opens in the rail with the run on this funding underneath.

In the sample the whole run takes 23 seconds; the solution's design target is three seconds from a funding to every limit it touches re-tested, to be measured on your own book.

3

The case: how 8.93% became 10.22%

The breach case leads with four numbers (exposure, limit, over by, and where option A would leave the pool) and a waterfall from the third-quarter report: Dorvel Fleet Logistics' $6.0 million line increase, Halsey Tank Lines' $8.4 million loan, $1.6 million of paydowns, then Redfield. The note under it says what no quarterly report would: Redfield took trucking only to 9.55% when committee approved it on September 23.

4

Three ways back, and the run that found them

The remediation planner prices three options: sell a $15 million participation in Ostrom Freightways' term loan to Sorrel Creek Bank (94.4% of the limit, about $0.4 million a year of interest income given up, three weeks); a CRO exception until Carrow Line Haul's $9.6 million loan matures on November 30 (97.2%, over for seven weeks); or ask the board to raise the limit to 11% (92.9% of the new limit). All are projected, none booked.

Below them, the run on this funding: posted; industry confirmed as NAICS 484121, long-distance truckload, from the borrower's 2025 tax return; Joplin placed in the Plains, out of footprint; the owner's $3.1 million guarantee of a freight broker's line reported with the obligor group, outside the trucking limit; 31 limits re-tested; options priced; notices drafted.

5

Rachel proposes, the CRO approves

Rachel picks option A and submits it with a note: Sorrel Creek has the term sheet, and Dorvel Fleet Logistics' $28 million request stays on hold until trucking is back under. Martin Abernathy approves from his phone minutes later. The escalation clock from credit policy section 7.4 fills in: CRO within one business day, board risk committee chair within two, back under the limit by November 11, thirty days after the crossing.

Design targets from the solution: three seconds from a funding to every limit it touches re-tested, and all 31 board limits on one map, tested on every funding and each morning. Both are targets to measure on your book. The 23-second run and the clock times on these screens come from the fictional sample.

Limit detail, all 31 limits, regions, non-bank lenders, committee checks and the board report, screen by screen

In shortThe trucking breach is the story. These screens show the rest: one limit's eight-quarter history and largest borrowers, the notice to the board chair, all 31 limits in a table, the regional and non-bank lender views of the same map, industries and trade-exposed borrowers, the facility register with each lender's category from its documents, one facility checked against the Call Report test, the committee's proposals tested before the vote, the board report and Call Report schedule, and the bank's settings.

A breach plan carries two signatures: the director proposes, the chief risk officer approves, and six agents prepare the work

In shortEach agent does one job and has a line it never crosses. None of them changes a limit, commits the bank or files a report. A person confirms every non-bank lender's category before it counts, the director of credit portfolio risk proposes every plan, the chief risk officer approves it, and limit changes go to the board risk committee.

Six agents, from the exposure aggregator to the report writer

Who signs each concentration decision

Maker and checker stay separate: the director who proposes a plan does not approve it, and a category proposed by the classifier counts only after a person confirms it. Every funding, test, classification, proposal and approval is on the activity trail.

What the monitor reads from your core and borrower files, and the limit map, breach cases and board report it returns

In shortThe solution reads what the bank already has: core loan events, borrower and fund documents, the board's limits and the Call Report definitions. It gives back a map that is always current, breach cases with priced plans, categories with their pages, committee checks and the quarterly report. Nothing is written back to the core.

Core, general ledger, documents and Call Report: the systems it connects to

Built for examination: every number ties to the core and, nightly, to the general ledger; every category cites its document and counts only once a person confirms it; breaches escalate on the policy's clock; limit changes are versioned; and the activity trail records each funding, test, classification and approval. The solution runs at enterprise scale, across tens of thousands of loans and every board limit, with role-based access and maker-checker sign-off throughout.

Analyst days, unseen breaches and Call Report corrections: the price of a quarterly concentration count

In shortThe visible cost is analyst time: a few weeks of a risk specialist each quarter to rebuild the report. The larger costs are the ones nobody invoices: a limit crossed in October that the board learns about in February, a pool measured on drawn balances that is far larger committed, a non-bank lender in the wrong Call Report box, and a committee approving the next deal into a pool that is already full.

Six concentration costs you can measure in a week

Examiner findings, board trust and rushed sales: costs the calculator leaves out

Sizing the return on funding-time limit testing: report days, document reviews and days over a limit

In shortFive levers: fewer analyst days building the report, document reviews of non-bank lenders that take minutes instead of hours, crossings known on the day, committee votes on today's book, and a cleaner Call Report. The calculator values the first two in dollars and the third in days. Every default is illustrative unless marked: replace it with your own.

Five places the return on concentration monitoring comes from

With the defaults the analyst time saved is about $82,560 a year, and 132 days a year over a limit move from unseen to known. Try your own numbers: a bank with 30 report days a quarter and 150 facilities to review finds that most of the return comes from the document work. Weigh the dollars beside the days over a limit that become known, which the calculator counts and does not price, and beside committee votes taken on today's book.

Score your bank's readiness for funding-time concentration monitoring: eight scored questions and one for reflection

In shortEight scored questions, 0 to 2 points each, and one for reflection. They test whether your limits, data, documents and approvals are ready for a monitor that never waits for quarter end. Nothing you choose leaves this page.

Explore, pilot or implement: reading your concentration readiness score

Sixteen questions for any concentration risk software vendor, from commitments to Call Report categories

In shortAsk every vendor, including us, to show each answer on your own data. The questions cover how exposure is counted, how categories are decided, how breaches are handled, who approves what, and how the result stands up in an examination.

Replay one quarter of fundings against one family of limits: a ten-week concentration pilot

In shortPick a limit family where breaches have happened or nearly happened, such as industries or non-bank lenders. Rebuild last quarter by hand as a baseline, replay every funding through the tool, compare when each crossing would have been seen, check a sample of categories against the documents, then run live for a month. Decide on four measures.

1. Choose the family and measure the baseline: last quarter's report hours, every crossing and the day the CRO learned of it.
2. Write the settings: capital base, measure, near line, escalation clock, who confirms and who approves.
3. Replay last quarter: every funding, draw and paydown in date order; note when each limit would have crossed.
4. Check categories: 30 non-bank lenders or borrowers read by hand against the proposed categories and pages.
5. Run live for a month, with the CRO approving plans through it, and decide with the measures below.

Four measures that decide the concentration pilot

What risk officers ask about concentration limits, the legal lending limit and NDFI reporting

In shortThe questions risk officers and buyers search for most, each answered on its own.

The concentration monitoring guide on one page, with fourteen terms defined

In shortThe whole guide on one screen, and the words it uses.

Fourteen concentration terms