The OCC concentrations of credit handbook, version 3.0

The OCC concentrations of credit handbook is the booklet OCC examiners work from when they look at how much a bank has lent to one industry, one region, one kind of collateral or one group of related borrowers. Version 3.0 was issued on 30 September 2026 and replaced version 2.0 of October 2020 outright. The definition at its centre did not move a word: a concentration is still the sum of direct, indirect or contingent obligations above 25 percent of tier 1 capital plus the allowance for credit losses. Nearly everything arranged around that sentence did move — limits now have a section of their own, securitisation arrives for the first time, and the words size, complexity, and risk profile run through the booklet seven times. Botminds' Credit Concentration Risk Monitoring is built on the same shape: the board's limits on one map, re-tested as each loan funds, with the figures, the documents and the approvals an examiner asks for already attached.

The bank, the people and the loans used as examples on this page are fictional sample data from the solution. Everything attributed to the OCC or the FDIC is quoted from the published booklet or manual and linked where it appears.

What is the OCC concentrations of credit handbook, and who it is written for

It is an examiner's manual, published openly. The booklet says so in its first paragraph: it is "prepared for use by OCC examiners in connection with their examination and supervision of national banks, federal savings associations (FSA), and federal branches and agencies of foreign banking organizations" (OCC, Concentrations of Credit, version 3.0). It is not a rule. No bank is in breach of the handbook. What a bank is measured against is what the booklet tells the examiner to look for, which in practice is tighter than a rule, because the examiner reads it with your loan book open.

The audience matters when you decide whether it applies to you. A state non-member bank is examined by the FDIC, and the FDIC's own RMS Manual of Examination Policies sets the listing thresholds its examiners use. A state member bank is examined by the Federal Reserve. The arithmetic the three share is the capital base — tier 1 capital plus the allowance related to loans and leases — but the trigger levels are not identical, and a bank that builds its reporting from the wrong manual reports the right numbers against the wrong lines.

The booklet is short. Sixteen pages of guidance, six pages of examination procedures, one page of questions, a page of abbreviations and two pages of references. The brevity is the point: it is a checklist for a conversation, not a rulebook, and almost every sentence in it turns into a question someone in the bank has to answer from evidence.

What changed in the 2026 OCC concentrations of credit booklet

The transmittal bulletin lists the changes plainly. The revised booklet "was reorganized to keep similar information together", "includes more comprehensive discussion of risks associated with concentrations of credit", "includes clarity regarding ranges of practices for banks of with different sizes, complexities, and risk profiles", "clarifies the relationship between correlations and concentrations", "includes new information about securitizations and the relationship to concentration levels", and "adds clarity regarding risk management practices relative to determining aggregate risk" (OCC Bulletin 2026-49). Read next to the two tables of contents, that reorganisation is sharper than it sounds.

Something also left. Version 2.0 told banks it was important to estimate potential losses for each pool, and suggested limits framed as losses — a share of earnings or capital, a cut in the allowance, a suspended dividend, a downgrade of the bank's own credit rating. None of that survives; version 3.0 does not use the word estimate at all. Where version 2.0 wrote long illustrative passages — natural gas prices against chemical manufacturers, steel prices against fabricated metal — version 3.0 states the principle and stops. The booklet got shorter and harder.

How does the OCC define a concentration of credit? The sentence that did not change

The definition is one sentence, and version 3.0 repeats it exactly: obligations above 25 percent of tier 1 capital plus the allowance for credit losses, a sentence the guide to concentration risk reads word by word. The transmittal bulletin goes out of its way to say that the revised booklet "continues to define" a concentration that way (OCC Bulletin 2026-49), which is itself a signal that nothing in the reorganisation should be read as a change of threshold.

What counts as an obligation is longer than most limit schedules allow for. The booklet's list runs from every type of loan, overdrafts, cash items and leases through securities bought outright or under resale, federal funds sold, placements, acceptances and letters of credit, to loans the bank has endorsed or guaranteed, derivative exposure and any other actual or contingent liability — aggregated bank-wide, across all lines of business. A bank that measures an industry limit on funded commercial loans alone is measuring something narrower than the definition it is being examined against.

Committed or outstanding is a judgement, not a rule. The booklet lets the amount be either, depending on how likely the bank is to fund the undrawn part and whether it is legally bound to, and gives a worked contrast: outstandings may suit a credit card portfolio, commitments better capture a book of home equity lines. The sample bank on this page measures on commitments, drawn plus undrawn, because a line can be drawn in a day; that is a setting, and the alternatives sit beside it. Where that choice bites hardest is in the arithmetic of the ratio itself.

One distinction is worth keeping straight, because banks lose it constantly: 25 percent is a definition, not a limit. Crossing it makes a pool a concentration that has to be identified and managed. It does not breach anything. The lines a bank can breach are the ones its own board set, and those are usually several multiples of 25 percent for a broad industry — which is exactly why where a board sets its own limit is a separate question.

Thresholds and limits: a section version 2.0 did not have

Version 3.0 opens the new section with a sentence that reads like an expectation: "Sound concentration risk management practices include establishing thresholds and limits." It then sets a test for whether yours are any good: a limit should be reachable but not routinely breached — neither so high it is never approached nor so tight it is crossed as a matter of course, a standard the guide to setting limits works through. Carried over from version 2.0, a broad-pool limit above 100 percent of capital is expected to have sublimits for its material segments.

A quiet rewrite sits underneath. Version 2.0 said that "Banks often combine a size limit of less than 25 percent of capital with a credit risk benchmark in order to identify pools that merit heightened scrutiny and monitoring". Version 3.0 drops the less than 25 percent: "Some banks combine a size limit of a percentage of capital with a credit risk benchmark", and the 10, 15 and 20 percent examples stay. The older sentence tied heightened monitoring to a sub-definitional size; the newer one leaves the percentage to the bank and puts the weight on the pairing — size plus a credit quality measure.

The benchmarks the booklet lists are ordinary portfolio statistics: special mention and classified levels, net loss rates, nonaccrual rates, delinquency or roll rates, growth in commitments or utilisation, the risk rating distribution, weighted-average risk ratings, probability of default, loss given default and capital intensity. The booklet also separates static from dynamic measures and says the dynamic ones "might provide an earlier warning of increasing risk" — a pool above a size threshold whose classified share is growing above a rate, rather than merely sitting above a level.

Thirty-one board limits, each with its use, its room and eight quarters behind it

What does the OCC say about securitisation and concentrations?

It says a securitisation reduces a concentration only when the exposure genuinely leaves the bank. This is new in version 3.0, and it is the sharpest sentence in the booklet.

Securitizations do not reduce the amount of a bank's concentrations unless the reference obligations associated with the securitization are removed from the bank's balance sheet and are no longer a direct, indirect, or contingent bank exposure or extension of credit.

OCC, Comptroller's Handbook, Concentrations of Credit, version 3.0, September 2026

The booklet names five structures — traditional or cash securitisation, synthetic securitisation, a direct-issue credit-linked note, a credit-linked note through a special purpose vehicle, and bilateral credit protection — and warns that "not all securitization structures are alike". Where the reference obligations stay on the balance sheet, as when a bank issues credit-linked notes or swaps against loans it still holds, the concentration is unchanged. Retained or repurchased interests go back on the balance sheet and back into the concentration. So does any credit risk retained through credit-enhancing representations and warranties.

There is a careful second half. An appropriately structured securitisation "can mitigate credit risk, which could reduce the quantity of risk when examiners assess the quantity of concentration risk". The amount does not fall; the examiner's judgement of how dangerous that amount is may. A bank that reports a lower concentration after a synthetic transfer has answered the wrong question, and version 3.0 now has a sentence that says so.

What "size, complexity, and risk profile" means when an examiner is in the building

That phrase appears seven times in version 3.0 and not once in version 2.0. It is easy to read as relief — a small bank may do less. Read it alongside the booklet's own example and it is the opposite: it is an instruction to justify what you do. "Small, noncomplex banks with low-risk or limited concentrations generally have basic concentration risk management practices," the booklet says, which means a small bank with a large or high-risk concentration does not get the basic standard. Size is one of three inputs, and the other two are about the book, not the balance sheet total.

The practical consequence is an evidence burden rather than a practice burden. Whatever a bank does, it has to be able to show the reasoning that connects its practice to its own profile: why quarterly is often enough for the pools that sit at a third of their limit, and why the pool at 96 percent is looked at differently. A bank that tests every limit as each loan funds has a short answer to that question for every pool at once, and a dated trail behind it.

What do examiners look at for concentration risk, objective by objective

The examination procedures are organised into five objectives. Each one is a question the bank will be asked, and for each one there is evidence a bank either has on the day or spends a fortnight assembling.

The staffing objective is the one risk teams underestimate. It is not a headcount question. The examiner is testing whether the people named in the policy are the people who actually did the work, and whether their authority matches what they signed. In the sample bank, a non-bank lender's category is proposed by an agent with the passage and the page it rests on, and counts in the limits only after a credit risk analyst or the director confirms it; a way back under a breached limit is proposed by the director and approved by the Chief Risk Officer; a limit change goes to the board risk committee and nowhere else. Each of those is a named seat with a dated act behind it.

The six questions in the internal control questionnaire

The questionnaire closes the booklet. The OCC explains what a "no" means before it asks anything: "'No' answers indicate potential control weaknesses; however, examiners should focus on whether internal controls are sufficient based on the bank's specific operations and circumstances." A "no" is not a finding. It is the start of a conversation in which the bank has to show a mitigating control, and an unprepared answer becomes a finding on the way.

Question six catches more banks than the other five together. Independent review of concentration risk management means reviewing the process, not re-running the report, and the booklet points directly at the weak spot: "Internal audit typically includes accuracy of reporting in the scope of credit-related audit(s)." An audit that confirms the report was produced on time has tested the calendar, not the number.

What goes on the concentrations page of a report of examination

Version 3.0 gives this a section of its own; version 2.0 mentioned the page only in passing. For a national bank the page is "a conditionally required section", required when concentration levels "pose a challenge for management or present unusual or significant risk to the bank". It carries a table and may carry a narrative, and where a concentration is listed the narrative "should address, as necessary, the quality of concentration risk management, appropriateness of risk limits, and accuracy of reporting". Those three subjects are the examiner's agenda, in order.

The OCC also says it "uses an industry taxonomy that assigns NAICS codes to report concentrations", with granularity chosen for the bank, and that examiners may identify concentrations that do not correspond to any NAICS code at all. That is the practical reason a bank's own industry mapping should hold a code it can defend from the borrower's tax return rather than one typed into the core years ago — the examiner's grouping and the bank's will be laid side by side.

For a state non-member bank the FDIC's manual sets out the listing lines in numbers. Asset concentrations of 25 percent or more of tier 1 capital plus the related allowance are listed by individual borrower, small interrelated group, single repayment source or individual project; 100 percent or more by industry, product line, collateral type or short-term obligations of one institution; and funding concentrations of 10 percent or more of total assets by a single type. A written analysis of risk management is required at 300 percent for an industry, product line or collateral concentration — "Industry, product line, or collateral type loan concentrations of 300 percent or more of T1C plus the ACL related to loans and leases" (FDIC, RMS Manual, section 16.1). The manual is careful that these lines only tell the examiner when to list and when to write, and are not limits for the bank — the distinction the guide to concentration risk turns on — and that "Sound examiner judgment must be used to determine the most appropriate ROE treatment."

The board report, with every number citing where it came from

There is a difference between a report that answers the examiner and one that merely contains the same figures. The booklet's complaint is specific: inaccurate or late data make board reports less useful, and a reporting system that gets the numbers wrong can reassure the bank falsely and point its attention at the safer pools — the first thing to test in any system that produces them. A number that cites the limit it was tested against, the funding that moved it and the person who confirmed its classification is answering all three of the ROE narrative subjects at once. One that cannot be traced is answering none of them, however correct it happens to be.

A breach, escalated on a clock the policy set

To see the limit map, the examination evidence and the report together on a loan book, start from Credit Concentration Risk Monitoring.

Questions people ask

What is the OCC concentrations of credit handbook?

It is the booklet of the Comptroller's Handbook that OCC examiners use when examining concentrations of credit at national banks, federal savings associations and federal branches and agencies of foreign banking organizations. Version 3.0, dated September 2026, replaced version 2.0 of October 2020. It is guidance for examiners rather than a rule for banks, but it sets out what an examiner will look for and the questions they may ask.

Does the OCC require banks to set concentration limits?

The booklet is not a rule, so it imposes nothing directly. It does say that "sound concentration risk management practices include establishing thresholds and limits", and the internal control questionnaire asks whether the bank has established them. A bank without limits is answering "no" to a control question and will be asked to explain what it has instead.

Did version 3.0 change the 25 percent threshold?

No. The transmittal bulletin states that the revised booklet "continues to define" a concentration as obligations exceeding 25 percent of tier 1 capital plus the allowance for credit losses. The definition is unchanged in wording and in effect; what moved around it was the structure, the risk discussion and the new material on limits and securitisation.

Where does version 3.0 differ most from version 2.0?

In three places. Limits and thresholds get a named section for the first time; securitisation appears at all, with a rule that it reduces a concentration only when the exposure leaves the balance sheet; and a section on reports of examination tells the examiner what goes on the concentrations page. Version 2.0's guidance on estimating each pool's potential losses, and on limits framed as losses, is gone.

Does the handbook apply to a state-chartered bank?

Not as the examiner's manual. A state non-member bank is examined by the FDIC under its RMS Manual of Examination Policies, which sets its own listing thresholds — 25 percent of tier 1 capital plus the related allowance for a single borrower, 100 percent for an industry, product line or collateral type, and a written risk-management analysis at 300 percent. A state member bank is examined by the Federal Reserve. The OCC booklet is still useful reading, because the analytical approach is common ground.

What is an internal control questionnaire, and do we have to answer it?

It is a tool the examiner uses to test internal controls, not a form the bank files. The concentrations booklet carries six questions, covering policies, limits, monitoring, board reporting, industry review and independent review. The OCC tells examiners that a "no" indicates a potential weakness but that the judgement is whether controls are sufficient for the bank's own operations, so the answer that matters is the evidence offered alongside it.