To manage concentration risk you need five capabilities working together — identify the pools, measure them against capital, limit them, monitor them, and have a way back when one is crossed — and many banks that ask how to manage concentration risk already have the first three written down and the last two running once a quarter. That is the real gap, and it is smaller than it looks: a quarterly programme and a continuous one use the same definitions, the same limit schedule and the same board report. What changes is the clock. Botminds' Credit Concentration Risk Monitoring is built around that observation — it changes nothing the board approved, takes the limits as a setting rather than as code, and re-tests them as each loan funds instead of once the quarter has closed.
The bank, people and loans in the examples are fictional sample data from the solution. The day counts below are our own estimates for a bank of this size, the eight-week plan is our construction rather than a measured delivery time, and everything attributed to a regulator is quoted and linked.
How do you manage concentration risk in a bank? The five capabilities
The OCC states the obligation in one sentence that covers all five: every bank is to identify, measure, monitor and control its risk through a risk management system sized to the bank — to its size, its complexity and its risk profile (OCC, Concentrations of Credit, version 3.0). Underneath that, the work divides into five jobs with different owners and very different difficulty.
Identify — decide which pools of loans move together and are therefore worth measuring as one thing. This is the capability banks most often get wrong, because it is a judgement about correlation that gets delegated to whatever codes happen to be in the core.
Measure — express each pool against the capital base, on a stated basis, with every obligation the definition includes. Mechanical, and dependent entirely on the data.
Limit — set lines the board owns and can defend: meaningful, neither unreachable nor routinely crossed.
Monitor — compare the two, often enough that a crossing is news rather than history.
Mitigate — have a priced, dated way back before you need one, and the authority to use it.
The regulation behind the programme is shorter still. Under the interagency safety and soundness standards, an institution "should establish and maintain a system that is commensurate with the institution's size and the nature and scope of its operations to identify problem assets and prevent deterioration in those assets", and among the six things that system should do is to "Consider the size and potential risks of material asset concentrations" (12 CFR 30, appendix A, II.G). That is the whole legal footing: a sentence in a list of six.
What does a concentration risk management programme include, level by level
Programmes do not differ by whether they have the five capabilities. They differ by how fast each one runs and what evidence it leaves. Five levels are enough to place most programmes, and a bank can be at different levels on different pools.
Five levels of concentration risk practice, and the evidence that puts a bank on each
Level 1
A quarterly spreadsheet
Exposure is rebuilt by hand from core extracts after the quarter closes. Industry codes come from the core as booked. There is a report; there is no monitoring between reports.
The evidence is the spreadsheet and the date it was saved.
Level 2
Limits written down
The board has approved a limit schedule and the quarterly report compares each pool with its line. Breaches are found at quarter end and explained in the same paper that reports them.
A limit schedule with board approval dates, and a report that tests against it.
Level 3
Monthly, with a named owner
The report runs monthly, someone owns it, classifications are reviewed rather than inherited, and an escalation path exists on paper.
Twelve dated reports a year, and at least one breach that followed the written path.
Level 4
Continuous measurement
Exposure posts from the core as it happens and every limit is re-tested as each loan funds. A crossing is known the day it occurs, with its cause loan by loan.
A breach case opened on the day of the crossing, with the run behind it.
Level 5
Tested before the vote
Every proposal is tested against every limit it touches before the credit committee votes, and ways back under a breached limit are priced on the same map the same day.
A limit test attached to each credit memo, and modelled options with their cost and date on each case.
A bank at level 2 or 3 tends to assume the move to level 4 is a data warehouse project. It usually is not. Levels 1 to 3 differ from each other by process and ownership; levels 4 and 5 differ from them only in when the arithmetic runs. The board-approved parts — the definitions, the schedule, the escalation path, the report — carry across unchanged, which is why this is a shorter piece of work than the organisation chart suggests.
The booklet is explicit that there is no single right level: practice is to be tailored to the bank's size, complexity and risk profile and to its particular concentrations, and only small, noncomplex banks whose concentrations are low-risk or limited are described as having basic practices. The condition is the part to read twice — a small bank with a large concentration in one economically sensitive industry does not qualify for the basic standard, as the guide to the OCC booklet sets out.
Identify: finding the pools the industry codes do not show
Identification is a correlation question dressed as a coding question. The OCC's test is whether a common characteristic makes a group of loans behave as one exposure, and codes are only a proxy for that. Three kinds of pool are routinely missed because no field in the core names them.
The first is the pool that spans codes. Borrowers whose costs depend on imported inputs do not share an industry; they share a sensitivity, and they will deteriorate together if tariffs or freight rates move. The sample bank carries a limit on trade-exposed borrowers, defined as imports at 30 percent or more of cost of goods — a threshold it set, and can change.
The second is the pool that spans entities. A guarantor who stands behind loans to three companies in three industries is one source of repayment, and the FDIC's report instructions list exactly that as a listing category: a concentration by "single repayment source" at 25 percent or more of tier 1 capital plus the related allowance.
The third is the pool hidden by coarse segmentation. "Transportation" holds long-distance truckload, local delivery and equipment leasing companies, and those three do not move together. The OCC assigns NAICS codes at a granularity chosen for the bank and says examiners may identify concentrations that correspond to no NAICS code at all, which is permission — and a warning — to segment on what actually correlates.
Senior management does not identify or report concentrations of credit, or inadequate portfolio segmentation prevents accurate identification of concentrations.
OCC, Director's Reference Guide to Board Reports and Information, November 2020 — a warning sign for directors
Every board limit as a tile, filled by what is committed against it
What data do you need to monitor concentrations?
Less than most programmes assume, and from more places than most data projects plan for. The OCC's data expectation is proportional rather than maximal: "the scope of data elements captured should be proportional to the portfolio's diversity and risk profile", with small banks focusing capture on the concentrations they have and large diversified ones capturing more.
In practice there are four sources and one rule. From the core loan system: obligor and facility identifiers, commitment and outstanding amounts, product type, collateral type, booking date and every subsequent funding, amendment and paydown. From the general ledger: the totals each pool must agree with, nightly. From borrower documents: tax returns and financial statements for industry, borrowing bases and credit agreements for what a non-bank lender lends against, and guarantees for the obligor group. From the Call Report: the capital base, which is tier 1 capital plus the allowance related to loans and leases.
The rule is that a figure nobody has tied out is not data. The handbook says as much: however complete a data set is, it is of little use if it is wrong, late or never validated. A nightly tie-out with a reported break above a threshold is the cheapest validation available, and it is the one that makes every number downstream defensible.
Limit: putting the board's own numbers in one place
Most banks discover at this point that their limits exist in four documents. The risk appetite statement has percentages; the credit policy has a different set with conditions attached; the board minutes have an amendment nobody folded back in; and the quarterly report tests against a fifth list that an analyst maintains. Consolidating those into one schedule, with the approval date and the capital base for each line, is usually a week of genuinely unglamorous work and it is the week that makes everything afterwards possible.
Three decisions have to be made explicitly rather than inherited. What capital base? Tier 1 capital plus the allowance related to loans and leases is the usual answer and the one the definition uses, but a bank may test some limits against total assets. Commitments or outstandings? The handbook leaves this to the bank, with a worked contrast: outstandings may suit a credit card book, commitments better capture undrawn home equity lines. Where does the warning sit? A near-limit threshold that fires at 90 percent of the line gives a different programme from one that fires at 75 percent.
Each of those belongs in a settings page rather than in code, for a reason that has nothing to do with convenience: they are the board's decisions, they change, and a change has to be attributable and reversible. How a board arrives at the numbers themselves is a separate question with its own answer.
The policy as settings: capital base, basis, clock and thresholds
How do you move from quarterly to continuous concentration monitoring?
By changing one thing: when the arithmetic runs. The definitions, the limit schedule, the escalation path and the board report all stay exactly as approved. What moves is the trigger — from "after the quarter closes, an analyst rebuilds the position" to "as each loan funds, the limits it touches are re-tested, and all of them again each morning".
That single change does four things at once. A crossing becomes news on the day rather than history at quarter end. The cause is knowable loan by loan, because the sequence of fundings is still in front of you. The escalation clock has somewhere to start. And proposals can be tested before a vote, because the position they would be added to is current rather than eleven weeks old.
It also removes the quiet reason quarterly programmes under-report: a position rebuilt at quarter end shows where the book ended, not where it went. A pool that rose to 103 percent of its limit in week three and fell back to 94 percent by quarter end never appears in any report at all, and that is not a reporting nicety — it is a breach that happened and was never escalated, approved or explained.
The same quarter, before and after, task by task
Rebuilt by hand: About 3 analyst-days a quarter assembling extracts into spreadsheets.
Measured as it happens: None. Exposure posts from the core as each loan is booked, funded or paid down.
Rebuilt by hand: About 4 days mapping borrowers to NAICS codes and regions.
Measured as it happens: About half a day. Codes come from the borrower’s own documents, with the booked code flagged where it differs.
Rebuilt by hand: About 3 days sorting lenders into Call Report categories, often from the name.
Measured as it happens: About half a day confirming categories read from borrowing bases, with the passage and page shown.
Rebuilt by hand: About 2 days testing every limit and chasing exceptions.
Measured as it happens: About half a day. Limits are tested on every funding and again each morning.
Rebuilt by hand: About 3 days writing them.
Measured as it happens: About 1 day reviewing a draft in which each number cites the limit, case or schedule behind it.
Rebuilt by hand: About 15 analyst-days, with the position known weeks after the quarter closed.
Measured as it happens: About 2.5 analyst-days, with the position known as it changes.
Mitigate: the plan that has to exist before the breach, not after it
The last capability is the one most programmes leave as a sentence in a policy. The OCC expects more: policies typically set out the mitigation actions to take when a concentration approaches a threshold or limit, as well as when it reaches one. Approach, not only reach. The question a programme has to answer is what happens at the warning level, not only at the line.
Three things make that answer real rather than aspirational. A named menu — which of the OCC's seven mitigation actions this bank would actually use, and which it has no realistic access to. A named authority for each — who may approve an exception, and who may move a limit, which is almost always the board or its risk committee and nobody else. And a clock: how long the bank gives itself to be back under. The sample bank's credit policy gives one business day to the Chief Risk Officer, two to the chair of the board risk committee, and 30 days to be back under or covered by an approved exception.
The failure mode a board report should surface is the one the Director's Reference Guide names as a warning sign: a concentration over its limit with no plan to bring it back. What the options cost, and how to choose between them on the day, is worked through in the mitigation guide.
What you need to bring: eight inputs, and who owns each
None of these is unusual, and all eight exist at any bank already running a quarterly report. The work is finding the current version of each and agreeing who owns it.
The eight inputs, and the seat that owns each one
- The board-approved risk appetite statement
Owner: the Chief Risk Officer. The source of the limits, and the only document that can justify a line.
- The credit policy
Owner: credit administration. Supplies the escalation times, the exception authorities and anything conditional attached to a limit.
- The limit schedule, consolidated
Owner: credit portfolio risk. Every pool, its percentage, its capital base and the date the board approved it — reconciled across all four places limits currently live.
- The core extract specification
Owner: the core system team. Obligor and facility identifiers, commitments and outstandings, product and collateral type, and the event feed for fundings, amendments and paydowns.
- The general ledger tie-out
Owner: finance. Which general ledger totals each pool must agree with, and the threshold above which a difference is a break rather than noise.
- The borrower and fund document set
Owner: credit administration. Tax returns, financial statements, credit agreements, borrowing bases, offering memos and guarantees — for the borrowers that matter, not for everyone.
- The board report template
Owner: the committee secretary. The report as the board already reads it, so nothing about the paper changes except how it was produced.
- The approval matrix
Owner: the Chief Risk Officer. Who confirms a classification, who proposes a plan, who approves an exception, and who may move a limit.
The item that generates the most discussion is the approval matrix, and it is worth having that discussion early rather than at go-live. It is where the bank states, on the record, that no automated step waives, raises or changes a limit, that no classification counts until a person confirms it, and that nothing is filed or sent without a person. Writing that down turns a software decision into a governance one, which is what it has always been.
How long does it take to implement concentration risk monitoring?
The plan below is eight weeks, and it is a plan rather than a promise: a construction from the eight inputs above, offered so a programme manager can test it against their own calendar. The gating item is almost never the software. It is the week the limit schedule is reconciled, and the week finance agrees what the tie-out is.
Eight weeks from the risk appetite statement to the first board report
- Weeks 1–2 · reconcile the limit schedule and agree the capital base and basis2 wks
- Week 3 · core extract and the nightly tie-out with finance1 wk
- Weeks 4–5 · classify the book, review the disagreements with credit2 wks
- Week 6 · limits live, warnings and escalation clock set from the credit policy1 wk
- Week 7 · replay last quarter and reconcile to the report that was issued1 wk
- Week 8 · first board report produced the new way, reviewed against the old1 wk
Week seven is the week that earns the programme its credibility and the one most plans leave out. Replaying the quarter just reported, and reconciling to the paper the board already saw, produces three piles: figures that agree, figures that differ because the old method was wrong, and figures that differ because the new one is. Working through the second and third piles in front of credit and finance is what makes the first new report believable. It is also where an unnoticed crossing, if the quarter had one, turns up.
The five seats after go-live, and what each one stops doing
Today
Spends roughly three weeks after each quarter end rebuilding the position, and learns about a crossing while building it.
With agents
Sees a crossing as the loan funds, with the cause loan by loan and priced options already on the case.
Still theirs: Choosing which way back to propose, and everything the model cannot know about the relationship.
Today
Hears about a crossed limit at the next quarterly report, with no way back worked out.
With agents
Gets the breach on the day with a recommended option, its cost and its date.
Still theirs: Approving every plan and exception. Moving a limit is still the board risk committee’s.
Today
Spends much of quarter end deciding what a borrower is from its legal name.
With agents
Confirms or rejects a category already read from the borrowing base, with the passage and page in view.
Still theirs: The confirmation itself — nothing counts in a limit until an analyst or the director says so.
Today
Learns that a facility moved category after the Call Report has been filed.
With agents
Receives a corrected schedule with the documents behind each move, before the filing date.
Still theirs: The filing, and the judgement on anything genuinely arguable.
Today
Each deal fit when the committee approved it, and the limit was crossed anyway.
With agents
Sees before the committee how much of a deal fits today and what it does to every limit it touches.
Still theirs: The conversation with the borrower — now an early one rather than a retraction.
The first report produced the new way, with citations under every number
One closing caution about scope. This programme covers industries, out-of-footprint regions, collateral types, trade-exposed borrowers, leveraged loans, shared national credits and non-bank lenders. Commercial real estate concentration has its own supervisory framework and its own stress testing, and belongs in a different programme; a plan that quietly folds it in will under-serve both. When an FDIC examiner writes up a listed concentration, the instructions ask for the bank's own method of identifying and monitoring it to be described (FDIC, RMS Manual, section 16.1) — so the method is examined alongside the number. To walk the five capabilities on your own limits, start from Credit Concentration Risk Monitoring.
Questions people ask
How do you manage concentration risk in a bank?
By running five capabilities together: identify the pools whose loans move as one, measure each against the capital base, set limits the board owns, monitor the two against each other often enough that a crossing is news, and keep a priced way back. The OCC asks each bank to do those things through a risk management system matched to its size, complexity and risk profile, so a small bank with a large concentration is held to more than a basic standard.
How often should concentrations be measured?
No rule sets a frequency, so the honest answer is: often enough that a crossing is found while something can be done about it. A quarterly position rebuilt after quarter end can miss a pool that went over in week three and came back by week thirteen. Measuring as each loan funds removes that blind spot without changing any definition the board approved.
Who owns concentration risk management in a bank?
The board owns the limits, usually through its risk committee. The Chief Risk Officer owns the appetite statement and approves exceptions and plans. Credit portfolio risk runs the measurement and proposes ways back. Independent credit risk review or internal audit tests the process, including the accuracy of the reporting, which the OCC expects to be in the scope of credit-related audits.
What data do you need to monitor concentrations?
Obligor and facility records with commitments and outstandings and an event feed for fundings, amendments and paydowns; general ledger totals to tie to nightly; borrower documents for industry, Call Report category and the obligor group; and the capital base from the Call Report. The OCC asks for data scope proportional to the portfolio's diversity and risk, and warns that even a comprehensive data set is of little use if it is unvalidated.
How long does it take to implement concentration risk monitoring?
The plan on this page is eight weeks, and it is a plan rather than a measured delivery time. The schedule is usually set by two things the bank controls: how long it takes to reconcile limits that currently live in four documents, and how quickly finance agrees the nightly tie-out. The software is rarely the long pole.
Do we have to rewrite the credit policy?
Usually not. Moving from quarterly to continuous measurement changes when the arithmetic runs, not what is measured or who decides. The definitions, limit schedule, escalation times and approval authorities carry across as they are — and should, because the examiner's question is whether practice matches the approved policy, not whether the policy is new.