Regulator Aligned 60–90 Day Loan Concentration Monitoring for US Banks

Loan concentration monitoring is a program that identifies correlated exposures, measures their potential impact on capital and earnings, and triggers timely mitigation. It starts with fixing the underlying data, setting internal early-warning thresholds ahead of any supervisory benchmark, running a targeted stress test on the most vulnerable subpools, and preparing board reporting that ties each exposure to net worth and capital.

---

• Monitoring thresholds should be set around 10% to 20% of capital plus ACL, enabling early action before reaching the 25% supervisory limit.
• Concentration categories must be tracked simultaneously across borrower, industry, geography, product, and collateral to manage stacked risks effectively.
• Accurate data aggregation, linking related borrowers, and refreshing collateral valuations are critical operational steps that prevent blind spots in concentration reports.
• Stress testing should target specific vulnerable subpools with scenarios tailored to the concentration type, influencing limit adjustments and contingency plans.
• An automated, audit trail-enabled platform streamlines concentration management, reduces operational errors, and supports exam readiness through real-time alerts and comprehensive documentation.

---

Table of Contents

• Concentration types every credit portfolio team must track
• Measuring concentrations without hiding the real exposure
• Building the data and reporting backbone monitoring depends on
• Designing stress tests that actually change decisions
• Setting policy, limits, and escalation that hold up in an exam
• Reducing exposure once a threshold is close or breached
• Making concentration monitoring operational with automation
• Practical priorities for the next quarter
• Putting concentration monitoring on autopilot
• Regulator guidance worth keeping on file
• Sources
• FAQ

Concentration types every credit portfolio team must track

A concentration is any exposure large enough that a single event, borrower, or economic shift could produce losses that threaten capital or earnings. The categories overlap constantly, which is why examiners expect institutions to look at exposures from several angles rather than a single dollar total.

Single-name concentration covers a borrower or a group of related borrowers whose combined exposure moves the needle on portfolio performance if one relationship deteriorates. Industry concentration groups loans by sector, such as agriculture, hospitality, or healthcare, where a common demand shock or input cost spike hits every borrower at once. Geographic concentration reflects exposure clustered in one metro area or region, where a local employer closure or a natural disaster can trigger correlated defaults. Product concentration applies to loan types like interest-only commercial mortgages or variable-rate construction loans that behave similarly underrate or liquidity stress. Collateral concentration arises when many loans are secured by the same asset class, for example a single property type in commercial real estate. Contingent concentration includes undrawn commitments, letters of credit, and guarantees that do not appear on the balance sheet today but can convert to funded exposure quickly.

The correlation between these categories is where the real risk sits. A bank with heavy exposure to hotel loans in one coastal market is not managing one concentration, it is managing three stacked on top of each other: product, industry, and geography. NCUA's concentration risk guidance directs credit unions to monitor exposures across borrower, industry, geography, product, and collateral simultaneously, with a board-approved policy connecting each category back to net worth.

Common types worth formalizing in policy documentation include:

• Single-name and related-party exposure, tracked at the relationship level, not the individual loan level.
• Industry and sector exposure, segmented finely enough to catch a subsector downturn.
• Geographic exposure, mapped at the metro or regional level where local economies diverge.
• Product exposure, separating structures like interest-only, balloon, or floating-rate loans.
• Collateral and contingent exposure, including undrawn lines and guarantees that can convert under stress.

Supervisors expect all five categories represented in concentration reporting, not just the one or two that happen to be easiest to pull from the loan system.

Measuring concentrations without hiding the real exposure

Measurement starts with the denominator, and getting it wrong understates risk more often than any other mistake in concentration monitoring. The three most common ratios are exposure as a percent of Tier 1 capital plus the allowance for credit losses, exposure as a percent of net worth for credit unions, and exposure as a percent of total assets for a broader view of balance sheet reliance.

The OCC's Comptroller's Handbook on Concentrations of Credit sets the formal supervisory definition at exposures exceeding 25% of Tier 1 capital plus ACL, whether the obligation is direct, indirect, or contingent. That 25% line is a regulatory ceiling, not a target, and institutions that wait until they are close to it have already lost their early-warning window.

Statistic: The OCC's Comptroller's Handbook recommends institutions adopt internal early-warning thresholds, often set at 10%, 15%, or 20% of capital plus ACL, combined with risk-quality triggers well below the 25% formal definition. Setting the first alert at 10% gives a credit committee months, not weeks, to act before an exposure becomes a supervisory finding.

Practical measurement steps for a credit portfolio team:

1. Define the denominator explicitly in policy: Tier 1 capital plus ACL for banks, net worth for credit unions, and total assets as a secondary lens.
2. Pull committed exposure, not just funded balances, since undrawn lines and letters of credit convert to funded risk under stress.
3. Consolidate exposure across legal entities and product wrappers so a borrower with a commercial loan, a line of credit, and a guarantee does not appear as three smaller, unrelated exposures.
4. Segment every major concentration category into subpools, such as commercial real estate by property type, loan-to-value band, and debt service coverage ratio.
5. Rank the top 10 and top 25 exposures separately from category totals, since a handful of large relationships can drive most of the risk even in a diversified-looking portfolio.
6. Track migration of large exposures across risk ratings quarter over quarter, since deterioration in rating almost always precedes a breach.

None of these tiers replace the 25% regulatory definition; they exist to keep the institution from ever needing to explain to an examiner why a concentration was allowed to reach that level with no prior action.

Net worth and asset-based ratios matter because capital-based ratios alone can mask liquidity strain. NCUA guidance flags heightened scrutiny when concentrations exceed large shares of net worth, since a credit union's capital cushion is thinner and recovers more slowly than a bank's.

Building the data and reporting backbone monitoring depends on

Concentration monitoring is only as good as the loan-level data feeding it, and most monitoring failures trace back to aggregation problems rather than flawed limit calculations. A loan system that tracks balances accurately but cannot link related borrowers, consolidate legal entities, or pull undrawn commitments will consistently understate real exposure.

Essential fields for any concentration data set include borrower and guarantor identifiers, relationship linkages across legal entities, industry classification codes, property type and geographic location for collateral-backed loans, loan-to-value and debt service coverage ratios at origination and as updated, commitment amount versus funded balance, risk rating history, and maturity or repricing dates. Missing any one of these fields creates a blind spot that only surfaces when a concentration has already grown past a comfortable threshold.

Aggregation and deduplication deserve as much attention as the fields themselves. A borrower with loans booked under three related entities needs to appear once in concentration reporting, consolidated at the relationship level, not three times as separate small exposures. OCC practitioner guidance notes that exposures booked under different product names or legal entities are a common source of hidden concentration, and that operational failures such as late data feeds or stale financials cause more monitoring gaps than poor math.

Dashboards built for a credit committee and a board should include:

• Top 10 and top 25 exposures by relationship, refreshed at least monthly.
• Concentration ratios against internal thresholds and the regulatory benchmark, shown as a trend line rather than a single point.
• Breach and near-breach alerts with the date first flagged and the mitigation status.
• Risk-rating migration for large exposures, since a downgrade trend often predates a breach by several quarters.
• Segmented commercial real estate views by property type, loan-to-value band, and debt service coverage ratio, since aggregate CRE totals can hide a vulnerable subpool.

A credit risk dashboard built around these widgets gives a credit committee the same view examiners expect to see during a review, which shortens the exam prep cycle considerably.

Pro Tip: Reconcile your concentration data feed against the general ledger every quarter, not just at exam time. Small mapping errors compound quickly when a portfolio is growing.

Operational failure points tend to cluster in three places: commitments that never make it into the concentration calculation, cross-entity relationships that get missed because loan officers book them under different borrower names, and collateral valuations that go stale for years on loans that renew without a full reappraisal. Each of these is fixable with a data governance checklist reviewed at least annually, well before the next exam cycle begins.

Designing stress tests that actually change decisions

Stress testing exists to answer one question: what happens to this concentration under conditions worse than today, and what should change as a result. FDIC guidance on managing commercial real estate concentrations is explicit that stress testing should combine periodic risk assessments, board-approved limits, regular reporting, and portfolio- and loan-level testing, with contingency plans that tie results to capital, ACL, and liquidity decisions.

Scenario design should reflect the variables most likely to hurt the specific concentration being tested, not a generic economic downturn applied uniformly across the book. A rate shock scenario matters most for floating-rate commercial loans and construction lines. A property value decline and rising vacancy scenario matters most for commercial real estate, particularly office and retail. A revenue shock scenario, modeling a 15% to 25% drop in borrower cash flow, matters most for industries with thin margins or seasonal exposure.

Selecting the test pool matters as much as the scenario itself. Testing an entire commercial real estate book at once can produce a comfortable-looking average that hides a small, high-risk subpool. FDIC guidance on commercial real estate concentrations points to segmentation by repayment source, loan-to-value band, tenancy, and geography as the way to isolate the loans that would actually fail first.

A useful way to structure the test design and its downstream use:

Steps for running the process end to end:

• Define the scenario variables and severity levels in advance, tied to the categories that matter most for the institution's actual book.
• Select vulnerable subpools using loan-level attributes, not portfolio averages.
• Model the outcome on capital, ACL, and net worth, and compare it against existing limits.
• Feed results into limit adjustments, ACL assumptions, and capital planning discussions, not a standalone report that gets filed and forgotten.
• Validate the model assumptions and document the methodology for independent review.

FDIC and OCC guidance is consistent that stress-testing output should function as a decision tool, changing limits, ACL, and contingency plans, rather than remaining a compliance artifact reviewed once a year and set aside. A deeper walkthrough of how stress testing connects to capital and ACL planning is useful for teams building this process from scratch. Frequency should match the pace of change in the vulnerable subpool: quarterly for fast-growing or high-risk categories, at minimum annually for the rest of the book.

Setting policy, limits, and escalation that hold up in an exam

A board-approved concentration policy is the document examiners ask for first, and its absence or vagueness is a common finding regardless of how good the underlying monitoring actually is. The policy needs to define scope, measurement methodology, limit structure, exception handling, and reporting cadence in language specific enough that two different reviewers would reach the same conclusion about whether a limit has been breached.

Limits should be set relative to capital, ACL, and the institution's strategic plan rather than picked as a round number that feels safe. A bank planning to grow commercial real estate exposure over the next three years needs a limit structure that anticipates that growth, with interim thresholds that trigger review well before the limit itself is reached.

Building the policy and escalation structure:

1. Define scope and measurement methodology in the policy itself, including denominators, inclusion of commitments, and consolidation rules across entities.
2. Set tiered limits tied to capital, ACL, and net worth, with internal thresholds below the regulatory benchmark.
3. Document an exception process for any loan or relationship that pushes a concentration past its threshold, including required approvals.
4. Establish reporting cadence: monthly for credit committee, quarterly for the board, with more frequent reporting for any category near a threshold.
5. Define escalation timing: front-line credit staff flag emerging concentrations at origination, credit committee reviews monthly, senior management reviews any threshold breach within days, and the board receives formal notification at the next scheduled meeting or sooner for a material breach.
6. Require independent review or internal audit of the concentration monitoring process at least annually, with findings tracked to resolution.

NCUA's 2026 supervisory priorities emphasize forward-looking portfolio monitoring, with examiners reviewing underwriting, ACL methodology, and capital planning together rather than treating concentration limits as a standalone exercise. That means the exam-ready artifact is not just the concentration report, it is the full chain from measurement to board minutes showing the board actually discussed and acted on what the report said.

Reducing exposure once a threshold is close or breached

Once a concentration approaches an internal threshold, the mitigation menu should already be defined so the team is choosing between prepared options rather than improvising under time pressure. Loan participations and sales are the most direct lever, moving exposure off the balance sheet to a partner institution while retaining the customer relationship where possible. Tighter underwriting standards for new originations in the affected category, such as lower loan-to-value maximums or higher debt service coverage requirements, slow further growth without disrupting the existing book.

A temporary stop on new originations in a specific subpool is a blunter but sometimes necessary tool, particularly when a category has moved from an internal warning threshold toward the regulatory benchmark faster than expected. Pricing adjustments can also do quiet work here: raising rates or fees on a concentrated category naturally reduces demand from borrowers who have other options, while preserving volume from relationships the institution wants to keep.

Options worth having pre-approved in policy so they can move quickly:

• Loan participations or outright sales to reduce single-name or sector exposure without exiting the relationship entirely.
• Tightened underwriting criteria for new loans in the affected category, applied going forward rather than retroactively.
• Temporary origination caps or holds on the most concentrated subpool.
• Pricing adjustments that make the concentrated category less attractive relative to the rest of the book.
• Increased ACL allocation for the affected category when stress testing points to elevated loss content rather than simple volume growth.

The choice between shrinking exposure and increasing ACL or capital depends on what the stress test actually shows. If the concentration is large but well underwritten with strong collateral coverage, an ACL adjustment and closer monitoring may be sufficient. If the stress test shows meaningful loss content under a plausible scenario, exposure reduction becomes the more defensible path, and examiners will expect to see that judgment documented.

None of this works without workout capacity ready before it is needed. A credit team that has never had to work out a concentrated commercial real estate relationship should build that capability, whether through internal hires, a third-party workout specialist, or a documented relationship with an outside firm, before a downturn forces the issue. Waiting until a concentration turns into a loss to figure out who handles the workout is a common and avoidable gap.

Making concentration monitoring operational with automation

The gap between a good concentration policy and a good concentration monitoring program is almost always operational. Policies get written; the hard part is aggregating loan-level data across systems, linking related borrowers correctly, and getting alerts to the right person before a threshold is quietly crossed.

Automation addresses the three most common failure points directly. Data aggregation pulls loan-level fields, commitment amounts, and collateral attributes from origination and servicing systems into one consolidated view, removing the manual spreadsheet work that introduces errors. Borrower-linking logic identifies related entities and guarantors automatically, so a relationship spread across three legal entities shows up as one consolidated exposure instead of three small ones. Near-real-time alerts flag a concentration approaching an internal threshold as new loans are booked, rather than surfacing the issue at the next scheduled quarterly report.

A scenario engine turns stress-test design from a manual modeling exercise into a repeatable process, applying rate, property value, and revenue shock scenarios across segmented subpools and feeding the results directly into limit and ACL calculations. RiskInMind's Loan Application and CRE loan risk predictor tools are built around this kind of segmentation, identifying vulnerable subpools by property type, loan-to-value, and debt service coverage rather than relying on portfolio-wide averages that can mask real risk.

Audit trails matter as much as the analysis itself. Examiners want to see not just the concentration ratio on a given date, but the history of when a threshold was flagged, who reviewed it, and what action followed. A platform with granular, timestamped logging turns exam prep from a scramble into an export.

Practical elements worth prioritizing:

• Loan-level data aggregation across origination, servicing, and collateral systems into a single consolidated view.
• Automated borrower and guarantor linking to prevent hidden multi-entity concentrations.
• Threshold alerts triggered at loan booking, not only at quarterly reporting cycles.
• A scenario engine that applies stress variables to segmented subpools and outputs limit and ACL implications.
• Timestamped audit trails covering every threshold flag, review, and resulting action.

The platform is built with SOC 2® aligned controls and bank-grade security, which matters when handling borrower-level financial data and feeding board and examiner reporting. Readers building out this kind of program can review the step-by-step approach to risk assessment for more detail on scoping and documentation standards that hold up under exam scrutiny.

Practical priorities for the next quarter

If you run credit risk for a bank or credit union, the next 90 days matter more than the next annual policy rewrite. Three actions produce the most value fastest: fix the data feeds that consolidate commitments and related-party exposure, run a targeted stress test on the one or two subpools that worry you most rather than the entire book, and build a board reporting package that shows trend lines against internal thresholds, not just a single point-in-time ratio.

The blind spots that catch experienced teams are rarely the obvious ones. Undrawn commitments get left out of concentration math because they feel hypothetical until they are not. Cross-entity aggregation breaks down when loan officers book related borrowers under slightly different names, and nobody notices until an examiner does the math manually. Collateral data goes stale on loans that renew year after year without a fresh appraisal, so a loan-to-value ratio from three years ago keeps showing up in a concentration report as if it were current.

A short operational checklist worth keeping on hand:

• Confirm every commitment and contingent exposure is captured in the concentration calculation, not just funded balances.
• Verify related-party and cross-entity linkages are reviewed at least quarterly.
• Refresh collateral valuations on any loan that anchors a concentration limit calculation.

None of this requires a large team or a long timeline. It requires deciding that concentration monitoring is a discipline practiced every month, not a report generated once a year for the board packet.

Putting concentration monitoring on autopilot

Most of the work described above, consolidating loan-level data, linking related borrowers, running scenario-based stress tests, and generating board-ready reports, is the kind of repetitive, detail-heavy process that eats a credit team's time without adding judgment to the outcome. RiskInMind was built to take that operational load off risk and portfolio teams at credit unions, community banks, and lenders, so the humans on the team spend their time on the decisions the data surfaces rather than the labor of producing it.

The platform's Portfolio and Bank OS product lines handle the aggregation and dashboarding work described in the MIS section, while a dedicated scenario engine operationalizes the kind of stress testing outlined above, turning results directly into limit and ACL inputs instead of a static report. Every threshold flag, review, and action is logged with a timestamped audit trail, so exam prep pulls from the system rather than from memory. If you are evaluating a monitoring platform, a practical checklist is worth running: does it consolidate commitments and cross-entity exposure automatically, does it segment stress tests by subpool rather than portfolio average, and does it produce exam-ready documentation without extra manual work.

Readers ready to see how this works on their own portfolio can request a demo or review plan details on the pricing page for Starter, Professional, and Enterprise tiers.

Regulator guidance worth keeping on file

Three documents belong in every credit portfolio team's reference folder. The OCC's Comptroller's Handbook on Concentrations of Credit sets the formal 25% definition, explains examiner expectations, and ties concentration analysis to stress testing. FDIC guidance on managing commercial real estate concentrations is the sharpest resource on sector-specific stress testing and the supervisory triggers that follow a breach. NCUA's concentration risk guidance, paired with its 2026 supervisory priorities, covers board reporting expectations and where examiners are focusing forward-looking review this cycle. Together they cover the definitional, sector-specific, and supervisory-priority angles a policy needs to reference.

Sources

• Concentrations of Credit | Comptroller's Handbook
• Concentration Risk | NCUA
• Managing Commercial Real Estate Concentrations in a Challenging Economic Environment | FDIC

FAQ

What are the 3 C's used to measure borrower risk?

Definitions vary across institutions, but a common version references character, capacity, and collateral as the core factors underwriters weigh when assessing a borrower. Some versions add a fourth or fifth C, such as capital or conditions, depending on the lender's own credit policy.

What are the Basel III pillars?

Basel III organizes bank capital regulation around three pillars: minimum capital requirements, supervisory review of capital adequacy, and market discipline through public disclosure. These pillars sit alongside, but separate from, the concentration-specific guidance that the OCC, NCUA, and FDIC issue for individual institutions.

What is considered a concentration risk?

A concentration risk is any exposure, whether to a single borrower, industry, geography, product, or collateral type, large enough that a single adverse event could produce a material loss to capital or earnings. The OCC's formal definition sets the supervisory threshold at exposures exceeding 25% of Tier 1 capital plus ACL, though institutions are expected to set internal thresholds well below that level.

What are the 3 C's for a loan?

For an individual loan, the 3 C's typically refer to character, capacity, and collateral, the same factors used more broadly in borrower risk assessment. Lenders apply these at origination and revisit them during periodic credit reviews as part of ongoing concentration and portfolio monitoring.

How often should loan concentration be monitored?

Concentration monitoring works best as a layered cadence: real-time or monthly tracking of top exposures and threshold alerts, monthly credit committee review, and quarterly board reporting. Categories approaching an internal threshold, such as the 10%, 15%, or 20% levels the OCC recommends, warrant more frequent review until the exposure stabilizes or is reduced.

Recommended

• 90 Day Regulator Aligned Fair Lending Monitoring for U.S. Lenders
• 90 Day BSA/AML Monitoring Checklist for U.S. Banks Before an Exam
• Tier 1 First: SR 11-7 Compliance for U.S. Banks in 30–180 days
• 90 Days to Fix Risk Data Quality for Banks, Aligned With BCBS 239