A bank concentration policy is the institution’s internal rulebook for how much credit exposure it will carry to any single borrower, industry, or geographic region, layered on top of the federal lending limits that already apply by statute. The policy exists because 12 USC 84 and related rules set only the outer boundary; a bank that wants to manage risk before it collides with that boundary has to set its own limits, define how it measures exposure, and spell out who acts when a limit is approached or breached.
The Legal Floor the Policy Sits On
Federal law caps how much a national bank can lend to one borrower. Unsecured loans and extensions of credit cannot exceed 15 percent of the bank’s unimpaired capital and surplus, and a separate 10 percent allowance applies to loans fully secured by readily marketable collateral with continuously available price quotations. The combined ceiling for one borrower reaches 25 percent of capital, but only if the portion above 15 percent is backed by qualifying collateral.1Office of the Law Revision Counsel. 12 USC 84 – Lending Limits
The OCC’s Comptroller’s Handbook then defines a “concentration” more broadly for supervisory purposes: the sum of all direct, indirect, or contingent obligations that exceeds 25 percent of a bank’s Tier 1 capital plus the allowance for loan and lease losses (ALLL) or allowance for credit losses (ACL). That definition captures more than loans. It includes overdrafts, securities purchased under resale agreements, letters of credit, derivative exposures, guarantees, and any other actual or contingent liability.2Office of the Comptroller of the Currency. Comptroller’s Handbook – Concentrations of Credit A concentration policy has to sweep in all of these obligation types, not just loan balances.
What Counts as a Single Borrower
Lending limits would be easy to sidestep if a company could route loans through subsidiaries or affiliates. Under 12 CFR 32.5, loans to one borrower get attributed to another, and both count as a single borrower, in two situations: when loan proceeds directly benefit the other person, or when a “common enterprise” links them.3eCFR. 12 CFR 32.5 – Combination Rules
A common enterprise exists under several tests. The most straightforward applies when two borrowers share the same expected repayment source and neither has independent income to cover the debt. Another test applies when borrowers are under common control and substantial financial interdependence exists between them, defined as 50 percent or more of one borrower’s annual gross receipts or expenditures flowing from transactions with the other. A third scenario arises when multiple borrowers take out loans to jointly acquire more than 50 percent of a business’s voting interest.3eCFR. 12 CFR 32.5 – Combination Rules Regulators can also declare a common enterprise on a case-by-case basis outside these specific tests.
Miscounting connected borrowers is where policies most frequently fail. Five moderate loans to five separate companies can turn out, at examination, to share a controlling owner and depend on the same revenue stream. A workable policy spells out exactly how loan officers identify connected parties before a credit is approved.
Types of Concentration a Policy Has to Address
A usable policy classifies risk into distinct categories, each with its own limits and monitoring expectations.
Credit Concentration
Credit concentration tracks total exposure to a single borrower or group of connected borrowers across every product the bank offers. A borrower with a commercial loan, a line of credit, and a letter of credit at the same institution creates cumulative exposure that must be aggregated. The lending-limit statute provides the legal ceiling; most concentration policies set internal triggers well below the statutory maximum so the bank has room to act before hitting a hard regulatory wall.1Office of the Law Revision Counsel. 12 USC 84 – Lending Limits
Sector and Industry Concentration
Sector concentration examines how heavily the portfolio leans into a single economic field: commercial real estate, agriculture, energy, healthcare, technology. A regulatory change or market shift that hits one industry hard produces disproportionate losses at a bank overweight in that sector. A concentration policy assigns percentage-of-capital limits to each major industry segment and requires escalation when a sector approaches those thresholds.
Geographic Concentration
Geographic concentration tracks where borrowers and collateral sit. A community bank serving a single metro area is exposed to that region’s economic health, natural disaster risk, and local regulatory changes. The policy should define what qualifies as a “region” for monitoring and set reporting triggers when a geographic pocket grows too large relative to capital.
Commercial Real Estate Thresholds
Commercial real estate draws special regulatory attention because CRE concentrations have historically been the leading credit-driven cause of bank failures. Interagency guidance from the OCC, Federal Reserve, and FDIC sets two supervisory benchmarks:
- Total construction, land development, and other land loans representing 100 percent or more of the institution’s total risk-based capital.
- Total CRE loans representing 300 percent or more of total risk-based capital, combined with a CRE portfolio that grew 50 percent or more over the prior 36 months.
These are not hard caps. Regulators describe them as benchmarks for identifying institutions that warrant closer supervisory scrutiny.4Office of the Comptroller of the Currency. Interagency Guidance on CRE Concentration Risk Management A bank can exceed either threshold and remain in good standing if its risk-management practices and capital levels are strong enough to match the elevated risk profile. Crossing a threshold typically brings heightened expectations: stronger board oversight of CRE lending, more comprehensive management information systems, enhanced portfolio monitoring, and capital planning that reflects the concentration.5Federal Reserve. Interagency Guidance on Concentrations in Commercial Real Estate Lending – Sound Risk-Management Practices
Extra Layers for Large Banks
The statutory lending limits apply to national banks of any size, but larger institutions face additional concentration rules aimed at systemic risk. Section 165(e) of the Dodd-Frank Act directs the Federal Reserve to cap credit exposure between large financial institutions. The general limit prohibits a covered company from having credit exposure to any unaffiliated counterparty exceeding 25 percent of its capital stock and surplus.6Federal Reserve. Calibrating the Single-Counterparty Credit Limit A tighter 15 percent limit applies between globally systemically important banks and other GSIBs or entities designated as systemically important by the Financial Stability Oversight Council.7A&O Shearman | Financial Regulatory Developments Focus. US Federal Reserve Board Approves Final Rule Regarding Single-Counterparty Credit Limits for Bank Holding Companies and Foreign Banking Organizations
Section 23A of the Federal Reserve Act, codified at 12 USC 371c, restricts credit a bank can extend to its own affiliates. Covered transactions with any single affiliate cannot exceed 10 percent of the bank’s capital stock and surplus, and total covered transactions with all affiliates cannot exceed 20 percent.8Office of the Law Revision Counsel. 12 USC 371c – Banking Affiliates Covered transactions include loans, investments in affiliate securities, asset purchases from affiliates, and guarantees or letters of credit issued on an affiliate’s behalf, and credit transactions with affiliates must be collateralized.9Federal Reserve. Comprehensive Review of Regulation W These affiliate rules exist because a parent company draining capital from its bank subsidiary through intercompany loans creates the hidden concentration regulators want to prevent.
Measuring Exposure Correctly
Undercounting is the most common measurement failure. The OCC’s definition captures all types of loans, overdrafts, cash items, securities purchases (outright or under resale agreements), federal funds sold, suspense assets, leases, acceptances, letters of credit, placements, loans endorsed or guaranteed, derivative exposures, and any other actual or contingent liabilities.2Office of the Comptroller of the Currency. Comptroller’s Handbook – Concentrations of Credit If the bank has any financial relationship with a counterparty that could produce a loss, it belongs in the calculation.
The denominator matters too, and it changed in 2020 for qualifying community banks. Institutions that elected the Community Bank Leverage Ratio framework stopped reporting Tier 2 capital, so the agencies adjusted the concentration ratio denominator to Tier 1 capital plus the entire ALLL, or Tier 1 capital plus the portion of ACL attributable to loans and leases for banks that adopted the CECL methodology.10FDIC. Adjusting the Calculations for Credit Concentration Larger banks reporting under the full capital framework continue using Tier 1 and Tier 2. Getting the denominator wrong inflates apparent headroom and can hide a concentration that has already crossed a supervisory threshold.
Board Oversight and Reporting
The board of directors owns the concentration policy. The OCC expects the board to approve the risk appetite statement, ensure it aligns with business strategy, capital targets, and liquidity objectives, and review it at least annually or more often when the risk profile or environment shifts.11Office of the Comptroller of the Currency. Comptroller’s Handbook – Corporate and Risk Governance The board also approves the concentration policy itself and the broader risk management framework.
Between board meetings, management produces reports comparing actual exposure against policy limits. Effective reports show trend analysis across recent quarters and stress test results under adverse scenarios. Banks with $100 billion or more in assets fall under the Federal Reserve’s supervisory stress testing program, which factors in concentration risk by modeling how CRE declines, corporate borrower distress, and regional economic shocks would hit capital.12Federal Reserve. 2025 Stress Test Scenarios Smaller banks are not subject to those formal tests but should run internal scenarios as part of concentration monitoring.
Internal audit verifies that management’s calculations follow the board-approved methodology and that the underlying data is accurate. Auditors flag discrepancies between reported exposures and actual balances, test whether combination rules are being applied to connected borrowers, and check that exceptions have been properly documented and approved.
Handling Exceptions and Breaches
When exposure to a borrower, sector, or region exceeds an internal policy limit, the breach triggers an escalation process. Notification typically starts with the chief risk officer and moves to the board or the board’s risk committee. That notification should happen promptly, not at the next scheduled quarterly meeting, because the board needs to decide whether to order an immediate reduction or grant a temporary exception.
A temporary exception requires written justification: why the exceedance occurred, what risk it poses, and the specific steps management will take to return to compliance. The documentation should carry sign-off from designated senior officers and the board chair. The remediation plan needs a defined timeline and concrete actions. Common strategies include selling a portion of the concentration through loan participations, declining to renew maturing credit facilities, hedging the exposure through credit derivatives, or raising additional capital.
Loan participations are a particularly useful mitigation tool. Selling a portion of a loan to another institution reduces exposure while preserving the borrower relationship. For community banks approaching policy limits in fast-growing segments, participations offer a way to shed concentration without turning away customers. Participation decisions should be driven by the same capital-impact analysis used to set the limits.
What Happens if the Policy Is Inadequate
Regulators do not treat concentration policy failures as paperwork problems. When examiners find that a bank lacks adequate policies for identifying, measuring, and controlling credit concentrations, consequences escalate quickly. The FDIC can issue cease-and-desist orders that specifically require the institution to develop concentration policies, set percentage-of-capital limits, and maintain ongoing economic analysis for any identified industry concentration.13FDIC. FIEA Manual Chapter 4 – Cease-and-Desist Actions
The OCC uses formal agreements and orders of prohibition to address concentration risk management deficiencies. A formal agreement is a contract between the regulator and the bank requiring corrective action within specified timeframes. An order of prohibition can permanently bar a director, officer, or other institution-affiliated party from participating in the affairs of any bank.14Office of the Comptroller of the Currency. OCC Announces Enforcement Actions Concentration risk management has been cited in OCC enforcement actions alongside deficiencies in capital planning, credit underwriting, and anti-money-laundering controls.
The most consequential tool is the authority under 12 USC 1831o to reclassify a bank’s capital category. If the FDIC determines that an institution is operating in an unsafe or unsound manner, which can include maintaining dangerous concentrations without adequate risk management, it can downgrade the bank’s capital classification. A well-capitalized bank can be reclassified as adequately capitalized; an adequately capitalized bank can be subjected to restrictions normally reserved for undercapitalized institutions.15Office of the Law Revision Counsel. 12 USC 1831o – Prompt Corrective Action Reclassification triggers mandatory restrictions on dividends, asset growth, and management fees that fundamentally alter how the bank operates.