A commercial loan at a US bank is approved by the person or committee that the board's lending policy authorises for that deal: a loan officer up to a personal limit, a senior lender or credit officer above it, a loan committee above that, and the board or its directors' loan committee for the largest relationships and for insiders covered by Regulation O. Which of them decides depends on four facts, and the first is the hardest to get right: the total exposure to the borrower and everyone related to it. Botminds' Loan Approval Workflow is software for the stretch between a finished credit memo and a recorded decision. Its agents add up the relationship, apply the bank's matrix and send the deal to the right approver, and the people named in the matrix decide.
The routing looks mechanical, and most of the time it is. It goes wrong in a predictable place: a related company's loan that the memo left out, an owner who is also a director's business partner, an exception nobody named. Each of those sends a deal to someone without the authority to approve it. That is the first thing examiners test.
The numbers that bound a commercial loan's route
15%
of capital and surplus: a national bank’s general limit to one borrower
plus 10% more if fully secured by readily marketable collateral
$500K
insider credit above this always needs advance approval by a majority of the entire board
a lower trigger also applies: the higher of $25,000 or 5% of capital
73%
of banks can require three or more approval levels for a large, complex small-business loan
FDIC survey of about 1,300 banks
80%
of banks say a larger loan or larger total exposure adds approval levels
Four questions decide who approves a commercial loan
The route is set by the relationship's total exposure, insider status, policy exceptions and risk rating, asked in that order. The OCC's 2026 handbook describes exactly this kind of ladder: in laddered or joint arrangements, "individuals have escalating levels of approval based on the size of the loan, exceptions to policy, borrower history, risk rating, and other factors". The law adds two hard edges, the legal lending limit and Regulation O. Everything else is the bank's own choice, written in its lending policy and approved by its board.
The order matters because the questions interact. A deal that is small on its own may be large once a related company's loans are added. An exception that would send a $4 million loan one level up changes nothing for a loan already going to committee. An insider's interest overrides size altogether.
The routing questions, worked in Loan Approval Workflow on one sample deal
How big is the whole relationship?
Add every commitment to the borrower, its guarantors and its related entities, new money included. Compare the total with each approver’s limit.
RuleBank policy; legal lending limit, 12 CFR 32.3 and 32.5
Sample deal
$35.8M, not the memo’s $33.2M: above the CCO’s $15M, inside the committee’s $40M.
Is an insider or a related interest involved?
If a director, executive officer or principal shareholder, or a company one of them controls, is on the borrowing side, Regulation O prior approval by the board may apply.
Rule12 CFR 215.4(b)
Sample deal
No insider or related interest of a director. The originating officer presents but does not vote.
Does it break the credit policy?
Each exception is listed with its policy section. Many policies move an excepted deal one level up, or require the approver to rule on the exception by name.
RuleBank policy; OCC lending authorities guidance
Sample deal
Three exceptions. Committees rule on their own, so the route stays with the committee.
How is it rated?
Weak ratings often go to committee whatever the size, so a small criticised renewal can outrank a large pass-rated loan.
RuleBank policy
Sample deal
Rated 4, a pass grade: no change.
Route: Senior Loan Committee, which may approve up to the bank's $40M house limit, at its next Tuesday meeting.
Question one: how big is the relationship, really?
Approval authority is almost always measured on the aggregate relationship, not the new money. The Federal Reserve's examination manual says lending policies should set limits for every officer and for "group authority, thereby allowing a combination of officers or a committee to approve larger loans than the members would be permitted to approve individually". A policy that measured only the new loan would let a relationship grow past an officer's limit one modest renewal at a time.
So the sum includes the borrower's existing loans, unfunded commitments, guaranties the borrower has given, and the loans of entities the policy treats as related: common owners, affiliates, guarantors. Take a sample deal as it runs through the solution. Merrow Precision Components asks Brennwood Bank & Trust, a fictional bank, for $23.0 million to buy a competitor: a $20.0 million term loan and a $3.0 million revolver increase. The credit memo showed relationship exposure of $33.2 million. Two minutes after the memo was finished, the deal router found a $2.6 million loan to Merrow Building LLC, which owns the plant and is wholly owned by the same two people. The relationship is $35.8 million.
At Brennwood that difference decides the approver. The chief credit officer's own limit is $15 million and the Senior Loan Committee's is $40 million, so both figures route to the committee. But had the memo's figure been $14 million and the true figure $16.6 million, the CCO would have signed a loan beyond her authority, with nothing in the file to show it.
Loan Approval Workflow's route, with the loan the memo left out
What counts toward the sum: the law's test and the bank's
Two different aggregation tests are in play, and they are easy to confuse. The legal lending limit combines loans to separate borrowers only under the federal combination rules: when one loan's proceeds are used for "the direct benefit of the other person", or when a common enterprise exists, which needs a shared source of repayment, or common control plus "substantial financial interdependence", defined as 50 percent or more of one borrower's gross receipts or expenditures coming from the other. A bank's approval policy is free to aggregate more widely, and many do, because the question it answers is different: not "may we lend this much?" but "who should look at it?"
Two ways of adding up a relationship
Legal lending limit (12 CFR 32.5): May the bank lend this much to one borrower at all?
Approval authority (bank policy): Who has the authority to approve this relationship?
Legal lending limit (12 CFR 32.5): Borrowers whose loans directly benefit another, or who form a common enterprise under the rule’s tests.
Approval authority (bank policy): Whatever the policy says: at Brennwood, every entity with common owners, plus guarantors and affiliates.
Legal lending limit (12 CFR 32.5): Not enough: common control needs substantial financial interdependence (50% of receipts or expenditures).
Approval authority (bank policy): Enough at Brennwood: two companies owned by the same two people are one relationship.
Legal lending limit (12 CFR 32.5): 15% of capital and surplus, plus 10% if fully secured by readily marketable collateral.
Approval authority (bank policy): The board’s matrix, with a house limit set below the legal one.
Legal lending limit (12 CFR 32.5): $70.2M: 15% of $468M capital and surplus. Merrow uses 51%.
Approval authority (bank policy): $40M house limit for the committee; the directors above it.
How is the legal lending limit calculated?
A national bank's legal lending limit is 15 percent of its capital and surplus for loans to one borrower, plus another 10 percent for any amount above that which is fully secured by readily marketable collateral. Both percentages come from 12 CFR 32.3; the base they multiply comes from the definitions in 12 CFR 32.2. For most banks, "capital and surplus" is tier 1 plus tier 2 capital as reported in the Call Report, plus the part of the allowance for credit losses not already counted in tier 2. A community bank that has elected the community bank leverage ratio uses tier 1 capital plus its allowance instead.
Worked on the sample bank: Brennwood reports $468 million of capital and surplus. Fifteen percent is $70.2 million, the most it may lend to one borrower on ordinary terms. A further $46.8 million is allowed only for exposure fully secured by readily marketable collateral, such as listed securities marked to market, which few operating-company loans have. A manufacturer secured by plant, inventory and receivables gets the $70.2 million line and no more. State-chartered banks follow their state's limit, which can be computed differently, and federally insured credit unions apply the greater of 15 percent of net worth or $100,000 to commercial loans under 12 CFR 723.4.
Brennwood's legal lending limit, worked through
| Step | Calculation | Result |
|---|---|---|
| Capital and surplus | Tier 1 + tier 2 capital + allowance not counted in tier 2, from the Call Report | $468.0M |
| General limit, any borrower | 15% × $468.0M | $70.2M |
| Extra limit, if fully secured by readily marketable collateral | 10% × $468.0M | $46.8M more |
| Merrow relationship against the general limit | $35.8M ÷ $70.2M | 51% |
No approver at any level can authorise a loan above this limit. A breach is a violation, not a policy exception to approve, and officers are held to it personally. In February 2025 the OCC barred a former chief credit officer and a former chief lending officer of BancCentral, N.A. after cash collateral that certain loans required was never secured, which put the bank over its legal lending limit (OCC, NR 2025-12). The vote was not the failure there. The condition that made the loan lawful was never met, which is why a well-run route carries its conditions through to closing.
What happens if a loan exceeds the legal lending limit?
It depends on when it crossed the line. A loan above the limit on the day it is made is a violation. A loan that was within the limit when made and later sits above it because capital fell, borrowers merged or formed a common enterprise, or the rules changed is treated as "nonconforming" rather than a violation. The bank must then use reasonable efforts to bring it back within the limit, and where the cause is a fall in the value of the collateral that supported the secured 10 percent, it has 30 calendar days. A bank that wants to serve a relationship larger than its limit sells participations, so that only its own share counts.
Many banks also set a house limit below the legal one and send anything above it to the board. Brennwood's matrix stops the Senior Loan Committee at $40 million, 57 percent of the legal limit, and gives the Directors' Loan Committee the rest. Merrow, at 51 percent, stays with the committee.
Does the board have to approve insider loans?
Yes, above a threshold: Regulation O requires a majority of the entire board to approve in advance any credit to an insider that, with everything else lent to that person and their related interests, exceeds the higher of $25,000 or 5 percent of capital and surplus, and every such credit above $500,000. An insider is an executive officer, director or principal shareholder, "and includes any related interest of such a person", meaning a company that person controls. The interested party must abstain, and 12 CFR 215.4(b) treats taking part in the discussion, or any attempt to influence the vote, as indirect participation in the voting. For a bank of Brennwood's size, 5 percent of capital is far above $500,000, so the $500,000 line is the one that applies.
Three details trip banks up. "Majority of the entire board" counts seats, not attendance: on an eleven-member board, six directors must vote yes even if only seven came. The approval must come before the money moves, although a draw on a line the board approved within the previous 14 months needs no fresh vote. And the abstention belongs in the record: the OCC's examination procedures check that the interested director's abstention was written into the board minutes, which the OCC treats as prudent practice even though the regulation does not use those words (Insider Activities booklet). EagleBank paid a $9.5 million Federal Reserve penalty in 2022 after extending nearly $100 million to entities its CEO owned or controlled without the required disclosures to, or approvals from, a majority of the board.
The routing question is therefore not only "is the borrower an insider?" but "does any owner, guarantor or related company belong to one?" In the solution, the insider and conflict checker compares the borrower, its owners and related entities with the bank's insider list and members' disclosures before each vote. It flags; the chair rules who may vote.
Questions three and four: exceptions and the risk rating move a deal up
Policy exceptions and weak ratings route a deal above where its size alone would place it. The OCC's 2026 handbook counts lending authorities among the core topics of every lending policy, and it puts the power to grant an exception in the same sentence as the power to approve a loan or change its terms (Lending and Loan Portfolio Risk Management). Banks agree that exceptions slow things: in the FDIC's survey, 70 percent of banks said an exception to credit policy lengthens the review of an application, and 67 percent said insufficient debt service coverage adds approval levels.
The common designs are to move an excepted deal one level up, or to let each authority approve exceptions within its own limit but require the exception to be named and justified in the approval. Brennwood does both: an exception moves an officer's deal up one level, as far as the CCO, and committees decide their own exceptions with a reason and report them to the board. Its policy also sends anything rated 6 or worse to the Senior Loan Committee at any size, so a $14.1 million renewal rated 6, inside the CCO's own limit by size, goes to the committee on the same morning as a $23 million acquisition. The exception register is where those decisions are kept.
One bank's authority ladder, as its board approved it
| Authority | Up to | Rated 6 or worse | With a policy exception | Clock |
|---|---|---|---|---|
| Loan officer | $1.0M | Committee | One level up | 1 day |
| Senior lender | $3.0M | Committee | One level up | 1 day |
| Regional credit officer | $7.5M | Committee | One level up | 2 business days |
| Chief credit officer | $15.0M | Committee | Decides, with a reason | 3 business days |
| Senior Loan Committee | $40.0M house limit | Decides | Decides, with a reason | Next Tuesday meeting |
| Directors’ Loan Committee | $70.2M legal limit | Decides | Decides, with a reason | Monthly; insiders under Regulation O |
The routing tree, worked on one deal
On the Merrow deal the four questions resolve in under a minute, and only the first changes anything. The relationship is $35.8 million, inside the committee's $40 million and 51 percent of the legal limit. No insider or related interest of a director is involved; the relationship manager who originated the deal sits on the committee, so he presents and does not vote. Three exceptions are listed (senior leverage of 3.35 times against a 3.00 times maximum, a guaranty limited to $10.0 million, and one customer at 29 percent of revenue), and the committee rules on them itself. The rating is 4, a pass grade.
The useful output is not the answer but the working. An examiner reviewing the decision will check that whoever approved it held the authority for that amount under the limits in force, and a route that shows its sum facility by facility, with the version of the matrix it applied, answers the question before it is asked. What the rest of the file must show is covered in what examiners check in an approval file.
The same rules as a calculator
Do bank boards approve individual loans?
Boards approve some loans themselves, by rule or by choice, and delegate the rest. Regulation O makes the board the approver for insider credit above its thresholds. Beyond that the law leaves the split to each bank, and the OCC's handbook describes the common outcome: the board "generally reviews and approves any commercial loan large enough to adversely affect the bank's financial condition in the event of borrower default" (OCC, 2026). The OCC's guide for directors gives a board's credit committee the loans that are large relative to the bank's size and capital (Director's Book).
Two other models sit alongside prior approval. In the Federal Reserve's description, most banks with loan committees review every new loan "either before or after funding, with the threshold for prior approval being the amount of either the loan or the aggregate debt to the borrower" (Commercial Bank Examination Manual). Below the threshold, the committee or board sees the loan after it is made, as a report it can question but not undo. And how often directors sign individual loans depends heavily on the bank's size: the FDIC found that 62 percent of small banks involve a board member or the full board in some small-business loans, against 9 percent of large banks (FDIC, 2024). Why that matters for speed is the subject of how long a bank takes to approve a business loan.
Three ways a board touches a commercial loan
| Model | What the board does | Typical trigger | What the record must show |
|---|---|---|---|
| Prior approval by rule | Votes before the loan is made | Insider credit above the Regulation O thresholds | A majority of the entire board, and the insider’s abstention |
| Prior approval by policy | Votes through the board or its loan committee | Exposure above the house limit, or large relative to capital | The deal, the exceptions, each member’s vote |
| Review after funding | Receives a list of loans made under delegated authority | Everything below the prior-approval line | That each approver stayed inside a limit the board set |
Where routing goes wrong
Routing errors cluster in three places, and none of them is arithmetic. The first is the relationship boundary: an entity with common owners that sits under a different name, a guaranty given by the borrower to someone else, a participation sold that the system still counts. The second is the insider list: a director's new business, a principal shareholder's family company, a member's undisclosed interest. The third is authority that has drifted. The FDIC's Inspector General found that First NBC Bank's chief executive held a personal lending authority of $13 million by 2009, which it called excessive; the bank failed in 2017 with an estimated $996.9 million loss to the Deposit Insurance Fund (material loss review).
Each of these is a data problem before it is a judgement problem. The loan system holds the commitments, the insider register holds the names, and the board's minutes hold the current matrix. What fails is the join between them, done by hand at the moment a memo is finished and everyone wants it on the next agenda. For how the matrix itself is designed, see the six decisions behind an authority matrix.
Before a deal goes to an approver
- Add up the whole relationship
Existing loans, unfunded commitments, guaranties and every entity with common owners, not only the new money.
- Show the sum line by line
An approver, reviewer or examiner should be able to check it without rebuilding it.
- Check owners and guarantors against the insider list
Including related interests: companies an insider controls.
- Name each policy exception with its section
An exception nobody named cannot be approved, only discovered later.
- Apply the rating rule
Weak ratings often go to committee whatever the size.
- Record which version of the matrix was applied
Limits change; the approval must be judged against the ones in force that day.
- Carry conditions to closing
A collateral or consent condition that makes a loan lawful or acceptable must be met before funds move.
In the solution, the deal router does the first, second, fourth and sixth of these on every finished memo, the insider and conflict checker does the third, and the conditions travel with the deal to closing. It never routes a deal below the matrix and never lowers an authority.
Questions people ask
What is delegated lending authority?
It is the power to approve loans that the board hands, through the lending policy, to named officers and committees, each up to a set limit. The Federal Reserve's manual expects each officer's limit to reflect that officer's experience, tenure and record of following the loan policy, and expects committee limits above them (Commercial Bank Examination Manual). The board can reduce or withdraw it at any time, and an approval outside it is an examination finding even if the loan performs.
What is a related interest under Regulation O?
A company the insider controls, or a political or campaign committee the insider controls or that benefits from the money. Control starts at 25 percent of any class of voting shares, the power to elect a majority of the directors, or a controlling influence over management, and a person who is also an officer or director of the company is presumed to control it from just over 10 percent (12 CFR 215.2). Credit to related interests is added to the insider's own when the thresholds are tested.
Who counts as a principal shareholder?
Anyone who owns, controls or can vote more than 10 percent of any class of the bank's voting shares, directly or acting with others. Shares held by members of the person's immediate family count as the person's own. A principal shareholder is an insider under Regulation O even without a seat on the board.
Can an insider get a better rate than other borrowers?
No. Insider credit must be made on substantially the same terms, including rate and collateral, as comparable loans to outsiders, under underwriting that is no less strict, and must not carry more than the normal risk of repayment (12 CFR 215.4(a)). The one carve-out is a benefit programme widely available to employees that does not favour insiders over other staff.
Is there a cap on all insider loans together?
Yes. Credit to all insiders combined may not exceed the bank's unimpaired capital and unimpaired surplus, and each insider is also held to the bank's ordinary limit to one borrower. Examiners test the totals from the bank's own insider reports, so the insider list has to aggregate related interests correctly.
Can a committee approve an insider loan instead of the full board?
Not when Regulation O's prior-approval threshold is crossed: the rule asks for a majority of the entire board, so a committee vote alone does not satisfy it. Below the threshold, the bank's own policy decides who approves, and many send insider credit to the board anyway.