Concentration Risk in Lending: Regulatory Expectations and Limits
7/9/2026
Concentration risk is the single most reliable predictor of which banks fail. Not credit underwriting quality in the abstract — concentration. Institutions that failed in the last several downturns generally did not make uniquely bad loans; they made a large number of ordinary loans that turned out to be the same loan.
This post treats concentration as a portfolio management discipline across every loan type. Our companion post on commercial lending covers the commercial real estate concentration guidance specifically, including the supervisory screening ratios. The discipline described here applies equally to a bank whose concentration is agricultural, medical, franchise, construction, or a single large employer's workforce.
What a Concentration Actually Is
The working definition: a group of exposures with correlated performance — they deteriorate together because they depend on the same thing.
That last clause is what most concentration reports miss. Institutions monitor concentrations by call report code, which groups loans by collateral and purpose. Correlated performance frequently does not follow those lines.
Concentrations worth identifying:
By loan type and collateral. The conventional cut — CRE, construction and development, agricultural, C&I, consumer, residential. Necessary and insufficient.
By industry. All the borrowers whose revenue comes from the same sector. A bank with fifteen restaurant loans, three restaurant-occupied buildings, and two food distributors has a hospitality concentration that no collateral-based report shows.
By geography. Loans dependent on the same local economy, which for most community banks is the entire portfolio and is therefore worth stating explicitly rather than treating as background.
By single employer or economic driver. The plant, the hospital system, the university, the military installation, the resort. If one employer supports the local economy, consumer loans, residential mortgages, and commercial loans to businesses serving those employees are all the same exposure.
By borrower and related interests. Legal lending limit compliance handles the individual borrower; the concentration question is broader — a developer with eleven single-purpose entities is one relationship for correlation purposes even where each entity is a separate legal borrower.
By repayment source. Loans dependent on the same tenant, the same government program, the same commodity price, or the same reimbursement rate.
By structure or feature. Interest-only loans, loans with the same balloon year, loans underwritten with the same policy exception, loans priced off the same index with the same floor. A group of loans that all reprice in the same eighteen months is a concentration of interest rate and refinance risk.
The productive exercise is to ask, for each candidate grouping: what single event or change would cause most of these loans to deteriorate at once? If the answer is specific and plausible, the grouping is a concentration whether or not it appears on a standard report.
Why the Standard Report Misses Them
Three recurring reasons, each worth checking against the institution's own reporting.
The data does not support the cut. Industry concentration analysis requires an industry code on every commercial borrower, populated consistently and maintained. Most core systems have the field; many institutions have it populated for a fraction of the portfolio, coded inconsistently, or captured at origination and never updated. An institution that cannot produce a reliable industry distribution does not have an industry concentration report, regardless of what its board package shows.
Related exposures sit in different buckets. The developer's construction loan, the completed project's permanent financing, the operating company's line, and the principal's personal residence are four loans in four categories to one economic interest.
Off-balance-sheet exposure is excluded. Unfunded construction commitments, unused lines, and letters of credit are exposure the institution has already agreed to. A construction concentration measured on outstanding balances understates it substantially, because construction loans fund over time — the concentration arrives after the decision that created it.
Limits That Constrain Something
A concentration limit that has never affected a credit decision is decorative. Three design questions determine whether it does anything.
Against what is it measured? Total capital is the standard denominator for the concentrations that could threaten solvency, and it is the right one for the largest categories because it answers the only question a board ultimately has: how much of our capital depends on this one thing. Total loans is a useful secondary measure for portfolio management. Measuring only against total loans has a specific failure mode — a concentration can stay flat as a percentage of a growing portfolio while rising steadily against capital.
Is it tiered? A single hard limit produces a binary at the worst moment: the institution is either fine or in breach, and the breach arrives with a loan already in the pipeline. Tiered thresholds — a monitoring level that triggers reporting and analysis, an approval level requiring senior sign-off on additions, and a hard limit — give the institution somewhere to act before the only remaining options are declining good business or breaching policy.
What happens at each level? This is the part most policies omit. A limit is only a limit if the policy states the consequence: enhanced reporting, a requirement that additions be approved at a higher level, a requirement that new originations be matched by participations or sales, or a suspension of new commitments in the category.
Two further points on limit setting. Sub-limits do most of the useful work. A CRE limit at the category level tells the institution little; sub-limits by property type — retail, office, hospitality, multifamily, industrial, special purpose — are where the risk actually differentiates, and the last several years have made the office and retail cases obvious. And limits should be set with reference to something, whether that is capital, historical loss experience in the category, the institution's demonstrated expertise, or the concentration's stress sensitivity. A number chosen because it is comfortably above the current position is a description, not a limit.
Exceptions and What They Reveal
When the institution is at or over a limit, there are three defensible responses and one that is not.
Reduce the exposure through participations, sales, or runoff. Raise the limit deliberately, with board approval, documented reasoning, and a stated view of why the higher level is acceptable. Or accept a temporary breach with a dated remediation plan and enhanced reporting in the meantime.
What is not defensible is redefining the category so the concentration disappears — splitting a property type, reclassifying loans, or changing the denominator. Examiners recognize this immediately, and it converts a manageable position into a governance finding.
Stress Testing a Concentration
The point of stress testing a concentration is not to produce a number. It is to answer a question the board should be asking: if this sector deteriorates, do we still have a bank?
The analysis does not require a vendor model. A serviceable version at a community bank has five steps.
Define the scenario specifically. Not "an economic downturn" but a stated set of conditions: vacancy in the concentration's property type rises by a defined amount, market rents fall, capitalization rates expand, the commodity price drops to a stated level, or the major employer reduces headcount by a stated proportion. Specificity is what makes the results arguable, and arguable results are the useful kind.
Apply it to the actual loans. Recalculate debt service coverage and loan-to-value at the stressed assumptions, loan by loan for the material credits. This is where institutions discover that a portfolio with a comfortable weighted-average coverage ratio contains a tranche of loans that fail at a modest stress, because averages conceal distributions.
Migrate the risk ratings. Estimate how many loans move to watch, substandard, and doubtful.
Translate to financial impact. Additional provision, charge-offs, lost interest income, and carrying costs on any resulting other real estate owned.
Compare to capital and earnings. State the result as a post-stress capital ratio and a post-stress earnings figure. That is the output a board can act on.
Two disciplines make the exercise honest. Include a severe scenario that is uncomfortable, because a stress test calibrated to a survivable outcome has assumed its own conclusion. And assign someone to argue the assumptions are too generous — the natural bias in this work is toward scenarios the institution passes.
The most valuable output is usually not the headline loss figure. It is the list of specific loans that fail first, which is actionable now: additional collateral, guarantees, amortization, or a conversation with the borrower while conditions are still normal.
Managing a Concentration You Cannot Eliminate
Many community bank concentrations are not mistakes. They reflect the local economy and the institution's actual expertise, and a bank in an agricultural county will have an agricultural concentration. The realistic goal is deliberate management rather than elimination.
The levers available:
Underwrite the concentration harder. Higher coverage requirements, lower loan-to-value, shorter terms, and required amortization inside the concentrated category. If the institution is going to hold more of one thing, each unit should be stronger.
Diversify within it. Within a CRE concentration, spread across property types, tenant profiles, submarkets, and lease maturity years. Within an agricultural concentration, across commodities and operation types.
Sell and participate. Participating out a portion of new production keeps the customer relationship and the fee income while capping the retained exposure. Institutions that build participation relationships before they need them have a lever available when the limit binds; those that wait discover that finding buyers is hardest exactly when everyone in the region needs one.
Hold more capital. The honest response to a concentration the institution intends to keep. Supervisory expectations for capital are explicitly risk-based, and a concentrated institution operating at the same capital level as a diversified peer has taken more risk with the same cushion.
Monitor more intensively. More frequent financial statement collection, more frequent inspections, market data tracking for the concentrated sector, and earlier watch-list escalation.
Build the expertise. A concentration managed by people who genuinely know the sector is a materially different risk from the same concentration managed by generalists.
Structured coverage is available through the Certificate in Financial and Credit Risk Management, Credit Risk Management: Managing, Monitoring, and Measuring, Credit Risk Management: Other Sources of Credit Risk, and the Certificate in Risk Management.
Reporting to the Board
Concentration reporting fails in a predictable way: a table of balances by category with percentages, presented quarterly, generating no discussion.
Reporting that earns board attention covers:
- Each identified concentration against its limit and its tiered thresholds, with the trend rather than only the current level
- Both denominators — capital and total loans — since they can move in opposite directions
- Committed exposure, not only outstandings
- Sub-category detail where the risk differentiates, particularly by property type or industry
- The most recent stress result for the material concentrations, expressed as post-stress capital
- Credit quality trend within the concentration compared to the rest of the portfolio, which is the earliest available signal that the concentration is deteriorating
- Any exception, its rationale, and the remediation plan
The item most often missing is the trend. A concentration at 240 percent of capital that was 180 percent eighteen months ago is a different situation from one that has been stable for a decade, and the number alone does not distinguish them.
Where Institutions Get This Wrong
Monitoring only the categories the guidance names, and therefore missing industry, employer, and repayment-source concentrations entirely.
Measuring outstandings rather than committed exposure, which understates construction and line-heavy portfolios.
Incomplete industry data, producing a report that appears to show a diversified portfolio because two-thirds of the borrowers are uncoded.
Limits set above the current position and never revisited, so they have never constrained a decision.
No sub-limits, leaving the actual differentiated risk invisible inside an aggregate that looks acceptable.
Stress testing that produces a number and no actions, with no list of the loans that fail first.
Growth concentration, which is the version nobody names: the fastest-growing segment of the portfolio is a concentration forming, and it is easiest to manage before it exists.
The pattern connecting these is that concentration risk is created gradually by decisions that are individually reasonable. No single loan creates it, which is precisely why it requires a portfolio-level discipline rather than sound credit judgment applied one file at a time.
Frequently Asked Questions
What makes a group of loans a concentration?
Correlated performance — the loans deteriorate together because they depend on the same thing. The useful test is to ask what single event would cause most of the group to deteriorate at once. If that event is specific and plausible, the grouping is a concentration whether or not it appears on a standard call-report-code report.
Which concentrations do banks most often miss?
Industry concentrations, because industry codes are frequently unpopulated or stale; single-employer concentrations, where consumer, residential, and commercial exposure all depend on one economic driver; repayment-source concentrations such as a shared tenant or reimbursement program; and structural concentrations such as a large group of loans repricing or ballooning in the same period.
Should limits be measured against capital or total loans?
Both, with capital as the primary denominator for concentrations large enough to threaten solvency. Measuring only against total loans has a specific failure mode: a concentration can hold steady as a percentage of a growing portfolio while rising materially against capital.
What makes a concentration limit meaningful?
A tiered structure with a stated consequence at each level — enhanced reporting, higher approval authority for additions, required participations, or suspension of new commitments — plus a basis for the number other than the current position. A limit that has never affected a credit decision is decorative.
How should a community bank stress test a concentration?
Define a specific scenario, apply it loan by loan to the material credits, migrate risk ratings, translate to provision and charge-offs, and state the result as a post-stress capital and earnings figure. No vendor model is required. The most useful output is the list of loans that fail first, because those can be addressed now.
Does a bank have to eliminate a concentration?
No. Many community bank concentrations reflect the local economy and the institution's genuine expertise. The expectation is deliberate management: tighter underwriting within the category, diversification inside it, participations, more capital, more intensive monitoring, and demonstrated expertise in the sector.
