Risk-based lending is a tiered pricing methodology where a credit union assigns loan rates based on each member's individual credit risk profile, so that higher-risk borrowers pay a spread above the base rate while lower-risk borrowers receive the most favorable terms. The practical result: more members get approved, the portfolio diversifies across risk grades, and the credit union prices for the cost of expected losses rather than averaging them across everyone. Before drafting a full policy, paste this starter tier table into your working document and adjust the spreads to your cost-of-funds and charge-off history.
| Risk Tier | Credit Score Range | Rate Adjustment | Example APR (Base + Spread) |
|---|---|---|---|
| Tier 1 (Prime) | 700 or above | Base rate | 7.50% |
| Tier 2 (Near-Prime) | 650–699 | Base + 1.25% | 8.75% |
| Tier 3 (Standard) | 600–649 | Base + 3.25% | 10.75% |
| Tier 4 (Sub-Prime) | 580–599 | Higher rate adjustment | Higher example APR |
| Tier 5 (High-Risk) | Below 580 | Highest rate adjustment | Highest example APR |
Base rate in this example is 7.50%; your credit union should substitute its current cost-of-funds plus a target margin. Pilot the table on a single product, such as unsecured personal loans, before extending it across the portfolio.
Maintain 100% NCUA & OCC Audit Readiness
Monitor regulatory updates 24/7, check internal credit policies, and generate compliance trails with Erina (AI Regulatory Agent).
(This corrects mismatched score ranges between this tier table and later underwriting cutoffs.)
Base rate in this example is 7.50%; your credit union should substitute its current cost-of-funds plus a target margin. Pilot the table on a single product, such as unsecured personal loans, before extending it across the portfolio.
Table of Contents
- What every credit union risk-based lending policy must include
- Sample tiered pricing table and provisional point adjustments you can adapt
- Underwriting criteria examples and how to apply scoring adjustments
- What regulators expect on compliance, monitoring, and governance
- How to implement risk-based pricing step by step
- Key Takeaways
- The governance trade-off most credit unions underestimate
- Riskinmind turns your tier policy into a live monitoring system
- Useful sources and where to look in each
What every credit union risk-based lending policy must include
A defensible risk-based lending program starts with a written policy that the board approves before the first tiered loan is booked. NCUA Guidance Letter 174 is explicit: parameters for riskier loans must be determined in advance, based on the credit union's financial condition, business plan, and ALM program. Examiners will look for that document on day one of a review.
The policy should cover these core elements:
- Scope and objectives. Name the specific loan products covered (e.g., unsecured consumer, used auto, credit cards), the membership segments eligible for each tier, and any dollar-limit caps per tier.
- Risk appetite and concentration limits. Express limits as a percentage of net worth or total loans. Concentrations that exceed 100% of net worth require documented board rationale per NCUA concentration risk guidance.
- Tiering methodology and pricing governance. Describe how tiers are constructed (credit score bands, point adjustments, approved spreads) and who has authority to change them. Changes to tier spreads should require CRO sign-off and board notification.
- Exception framework. Define what qualifies as an exception, the maximum rate deviation allowed, required compensating factors, and who may approve. Gut-based exceptions attract examiner criticism; every override needs a written rationale.
- Recordkeeping and adverse-action process. Specify what to retain (credit score at decision, tier assigned, point adjustments, decision-maker identity) and for how long. Adverse-action notices under ECOA/Reg B must be issued within 30 days of a completed application.
- Reporting cadence and KPIs. Set quarterly reporting to the board covering delinquency by tier, charge-off rates, migration rates, and concentration metrics.
- Policy review timeline. Annual review at minimum, with board approval of any material changes.
Pro Tip: Before the board votes on the policy, run a one-page summary that maps each policy element to the relevant NCUA guidance or regulation. Examiners respond well to a credit union that can show it understood the regulatory basis for each design choice, not just that it copied a template.
Sample tiered pricing table and provisional point adjustments you can adapt
The five-tier table in the opening section gives you the credit-score backbone. What makes a risk-based program genuinely useful, and defensible under fair-lending scrutiny, is a documented provisional-points system that allows modest rate adjustments for factors beyond the raw score.
Provisional point adjustment examples
The table below shows sample adjustments a lending officer can apply within a board-approved cap. Points translate to rate basis points in your final pricing formula.
| Factor | Condition | Point Adjustment |
|---|---|---|
| Membership tenure | 5+ years of continuous membership | −15 points (rate reduction) |
| Payroll deduction | Loan payment via direct payroll deduction | −10 points |
| Collateral quality | New vehicle vs. used vehicle (3+ years old) | −10 / +10 points |
| On-time payment history | No late payments on prior CU loans (6+ months) | −10 points |
| Loan purpose | Debt consolidation with documented payoff | −5 points |
| DTI above 40% | Debt-to-income ratio 40–45% | +20 points |
| Thin file | Fewer than 3 open tradelines | +15 points |
Maximum cumulative adjustment: ±25 points unless a senior credit officer provides written approval. Cap the total manual adjustment in the policy to control fair-lending exposure.
Provisional points should be logged in the loan origination system at the time of decision, not reconstructed afterward. When presenting the table to the board, include a column showing the dollar impact on expected yield at current origination volume so directors understand the revenue trade-off of each adjustment category.
Where to log calculations matters as much as the math itself. Many risk-pricing systems capture the credit score at request time and do not automatically reprice if a new report arrives later in the process. Build a workflow step that confirms the score used for final pricing matches the score at the time of approval, and document any discrepancy.
Underwriting criteria examples and how to apply scoring adjustments
Standard underwriting variables give the tier table its structural integrity. Without defined cutoffs, the tiers become suggestions rather than controls.
Core underwriting variables and suggested cutoffs:
- FICO/credit score: Minimum 580 for any approval; scores of 700 or above qualify for Tier 1, 650–699 for Tier 2, 600–649 for Tier 3, and 580–599 for Tier 4. Scores below 580 are Tier 5 and require senior approval.
- Debt-to-income ratio (DTI): Maximum 45% for Tiers 1–3; 40% for Tiers 4–5. DTI above 40% triggers the +20-point provisional adjustment shown above.
- Loan-to-value (LTV): Auto loans capped at 110% of NADA clean retail; unsecured loans have no collateral floor but require compensating factors above $15,000.
- Employment and income: Minimum 12 months at current employer for Tiers 4–5; self-employed borrowers require two years of tax returns.
- Co-signers: Permitted for Tiers 3–5; the co-signer's score must meet the minimum for the tier being approved.
Compensating factors that justify point reductions should be specific and documented in writing.pdf) for every manual exception. Acceptable examples include: substantial liquid assets equal to 6+ months of loan payments, a demonstrated repayment history on a prior credit union loan with no late payments, or recently closed revolving accounts that have reduced the member's utilization ratio below 30%.
Concrete scoring-adjustment scenarios:
- A member with a 635 score (Tier 4) but 8 years of membership and payroll deduction qualifies for −25 points total, effectively pricing the loan at the Tier 3 spread.
- A member with a 710 score (Tier 2) and a DTI of 43% receives +20 points, keeping the loan in Tier 2 pricing but flagging it for quarterly monitoring.
Red flags that should block exceptions entirely: unexplained income gaps of 90+ days, related-party transactions where the borrower and a guarantor share a repayment source (an associated-borrower situation that also triggers aggregation against concentration limits), and any application where the stated income cannot be verified through at least two independent sources.
Pro Tip: Limit manual override authority to no more than two point bands above or below the system-assigned tier. Require the approving officer to enter a written justification of at least three sentences in the LOS before the exception is saved. That single discipline reduces examiner findings more than any other procedural control.
What regulators expect on compliance, monitoring, and governance
Regulatory expectations for risk-based lending programs center on three pillars: fair-lending controls, concentration management, and continuous portfolio monitoring. Each has concrete operational implications.
Fair-lending controls under ECOA and NCUA guidance
The NCUA has been direct: manual rate deviations for similarly situated applicants may require enhanced fair-lending monitoring to avoid disparate impact. That means exception logs must capture the demographic profile of approved exceptions versus denied ones, and the compliance function should run a disparate-impact screen at least annually. The NCUA's risk-based credit card guidance reinforces that pricing determinations must rest on legitimate credit risk, not any factor prohibited by ECOA.
Documentation standards for fair-lending compliance:
- Maintain a centralized exception log with decision-maker name, date, tier assigned, tier overridden to, compensating factors cited, and re-review date.
- Run a quarterly comparison of exception approval rates by protected class using HMDA or internal demographic data where available.
- Trigger a formal disparate-impact test when exception rates for any demographic group exceed the overall exception rate by more than 10 percentage points.
Concentration risk controls and stress testing
Regulators are increasingly focused on concentration risk in higher-volatility products, and they expect boards to assess tail-loss potential at policy limits rather than rely on average-loss assumptions. A practical stress scenario for a used-auto concentration: model a 25% decline in used-vehicle values combined with a 200-basis-point rise in unemployment, then calculate the stressed capital impact against the credit union's net worth ratio. Industry guidance suggests a 7% net worth ratio as a capital adequacy benchmark when defining acceptable loss buffers.
State-level regulators echo this expectation. Texas Department guidance, for example, urges measurable concentration limits with independent reviews for higher-risk exposures and periodic policy updates, a standard that reflects broader supervisory consensus across U.S. jurisdictions.
KPIs and reporting cadence
| KPI | Measurement | Reporting Frequency |
|---|---|---|
| Delinquency rate by tier | 30-day buckets per tier | Monthly to management; quarterly to board |
| Charge-off rate by tier | Net charge-offs / average loans per tier | Quarterly |
| Credit migration rate | % of loans moving down one or more tiers | Quarterly |
| Concentration ratio | Tier 4–5 balances / total net worth | Monthly |
| Exception rate | Exceptions / total approvals | Monthly |
Pro Tip: Before broadening exception authority or adding a new high-risk product, scope and run a fairness impact assessment. Document the baseline exception approval rates by demographic group, then re-run the analysis 90 days after the change. That before-and-after record is the single most persuasive evidence you can show an examiner that your program is monitored, not just designed.
The most dangerous losses in a credit portfolio often come from credit migration of initially good loans, not from the high-risk tier at origination. Continuous monitoring and predictive analytics are the operational response to that reality. An automated dashboard that flags tier migration in real time gives the lending team weeks of lead time that a quarterly spreadsheet review cannot provide.
How to implement risk-based pricing step by step
A phased rollout protects the credit union from overextending before the controls are proven. The sequence below assumes a 6–9 month timeline from policy draft to full rollout.
- Draft the policy (Weeks 1–4). CRO and lending manager draft the policy document covering all elements in Section 2. Compliance reviews for ECOA alignment. Legal counsel reviews exception framework.
- Design the tier table and point schedule (Weeks 3–6). Finance models the yield impact of each tier spread against current cost-of-funds. The provisional-points schedule is finalized with a written cap on cumulative adjustments.
- Board approval (Week 6–8). Present the policy, tier table, and a one-page stress scenario to the board. Board resolution approves the program, the concentration limits, and the exception authority matrix.
- System configuration (Weeks 8–12). IT configures the LOS to enforce tier logic, capture the credit score at decision, log point adjustments, and generate adverse-action notices automatically. Test with 20–30 synthetic loan files before go-live.
- Staff training (Weeks 10–12). Lending officers complete training on tier assignment, the exception process, and the documentation requirements. Compliance delivers a 30-minute fair-lending module.
- Pilot launch (Months 3–6). Go live on one product only, typically unsecured personal loans, with a volume cap (e.g., no more than 15% of monthly originations in Tiers 4–5 during the pilot). Track the KPIs in the table above monthly.
- Pilot review and board update (Month 6). Present delinquency-by-tier, exception rates, and concentration metrics. If Tier 4–5 delinquency exceeds the modeled stress case, tighten the tier cutoffs or reduce the volume cap before expanding.
- Full rollout (Months 7–9). Extend the program to additional products with board approval of any product-specific modifications to the tier table.
Pilot success metrics to track:
- Tier 4–5 delinquency rate stays within 150% of the modeled stress-case assumption.
- Exception rate remains low relative to total approvals.
- No adverse-action notice failures identified in a compliance spot-check of 25 files.
- Credit migration rate for Tier 3 loans stays below 5% per quarter.
Quick mitigation if the pilot deteriorates faster than expected: tighten the Tier 4 minimum score by 10 points, reduce the volume cap to 10%, and shorten the pilot review cycle to 45 days. Do not wait for the scheduled 6-month review if monthly delinquency data shows a trend.
Key Takeaways
A well-structured risk-based lending program requires a board-approved policy with defined tiers, documented exception controls, and continuous portfolio monitoring to remain both profitable and compliant.
| Point | Details |
|---|---|
| Start with a written policy | Board approval before the first tiered loan is booked is a regulatory expectation, not a formality. |
| Cap manual adjustments | Limit cumulative provisional-point overrides to ±25 points and require written justification for every exception. |
| Monitor credit migration | Loans that migrate down tiers after origination drive the majority of charge-offs; track migration rates quarterly. |
| Run fair-lending screens | Compare exception approval rates by demographic group at least annually and document the results. |
| Riskinmind automates the controls | Riskinmind's AI platform provides real-time tier-migration alerts, automated exception logging, and audit-ready reporting to operationalize these requirements. |
The governance trade-off most credit unions underestimate
Risk-based lending programs succeed or fail at the governance layer, not the pricing layer. Most credit unions spend the bulk of their design time on the tier table, which is the easy part. The hard part is building the exception discipline and the monitoring cadence that keep the program defensible two years after launch, when the original design team has moved on and the exception log has grown to several hundred entries.
The mission argument for risk-based lending is real. Credit unions with larger non-prime pools can achieve materially higher ROA and loan yields than peers, while extending credit to members who would otherwise be declined. That is a genuine alignment of margin and mission. But the programs that attract examiner criticism are almost always ones where the exception rate crept above 15%, the documentation became inconsistent, and the board stopped receiving meaningful migration data.
The practical lesson: treat the exception log as a living compliance document, not an administrative afterthought. Every entry should include the decision-maker's name, the compensating factors cited, and a re-review date. When an examiner opens that log and sees 200 entries, each with three sentences of documented rationale, the conversation about fair-lending controls becomes much shorter.
Concentration risk deserves the same discipline. A credit union that grows its Tier 4–5 book from 8% to 22% of total loans in 18 months has a concentration problem, regardless of how well the individual loans were underwritten. Set the board-approved limit before you launch, and treat a breach of that limit as a mandatory agenda item at the next board meeting, not a footnote in the quarterly report.
Riskinmind turns your tier policy into a live monitoring system
Designing a tier table and writing an exception policy are necessary first steps. Keeping that policy alive, accurate, and audit-ready across thousands of loans and hundreds of exceptions is where manual processes consistently fall short.
Riskinmind's AI platform is built specifically for credit unions that need to operationalize risk-based lending controls without adding headcount. The platform delivers real-time tier-migration alerts so your team sees credit deterioration weeks before it shows up in a delinquency report. Automated exception workflows capture every override with the required documentation fields at the point of decision, not reconstructed later. Audit-ready reporting gives examiners a clean, timestamped record of every pricing decision and every exception approval. Fair-lending monitoring tools run ongoing disparate-impact screens against your exception log so you are never surprised by a pattern you did not see building.
If your credit union is piloting risk-based pricing or updating an existing program, see how Riskinmind's loan application automation and portfolio monitoring tools support each phase of the implementation checklist above. Request a demo to see the exception workflow and migration dashboard in a live environment.
Disclosure: This article is published by Riskinmind, which provides the AI risk management platform described above.
Useful sources and where to look in each
These primary sources and guidance documents are the foundation for any U.S. credit union risk-based lending policy. Each entry notes the most relevant section for lending officers and risk managers.
- NCUA Legal Opinion: ECOA and Risk-Based Loan Pricing Adjustments — Focus on the section addressing manual rate deviations for similarly situated applicants; the core fair-lending compliance reference for exception authority design.
- NCUA Legal Opinion: Risk-Based Credit Card Accounts — Read the FACTA risk-based pricing notice requirements and the ECOA/TILA disclosure obligations; directly applicable to any tiered credit card program.
- NCUA Letter to Credit Unions: Concentration Risk — Review the concentration-limit framework and the scenario analysis examples for HELOC and fixed-rate mortgage portfolios; the board-rationale requirement for concentrations above 100% of net worth is stated here.
- NCUA Examiner Guide: Associated Borrower — Study the aggregation tests and the examples of when loans to related parties must be combined against concentration limits; critical for commercial and member business loan portfolios.
- NCUA Guidance Letter 174 (August 1995) — The foundational guidance on risk-based lending for credit unions; the requirement to set parameters before program launch originates here.
- Baker Group: Concentration Risk Management Framework — Focus on the stress-case loss rate methodology and the stressed capital impact calculation; useful for building the board-level concentration scenario analysis.
- Texas Credit Union Department: Guidance on Asset Concentrations — Relevant for any credit union in a state with active supervisory guidance on concentration limits; the measurable-limits and independent-review requirements reflect national supervisory consensus.
- Riskinmind: AI-Powered Risk Management for Credit Unions — Covers governance frameworks and how AI supports board-level risk appetite setting and continuous portfolio monitoring.
This article provides general information for educational purposes and does not constitute legal, regulatory, or compliance advice. Confirm current NCUA rules, state requirements, and your credit union's specific circumstances with qualified legal counsel or your examiner before implementing a risk-based lending program.