Credit Risk, Concentration and Expected Credit Loss Regulation

Introduction and regulatory context

Credit is the principal earning asset of most banks and also the largest source of banking failure. A loan creates an expected return through interest and fees, but exposes the bank to the possibility that the borrower will not pay principal, interest, or both. Credit-risk regulation therefore seeks to achieve two related outcomes: prudent risk-taking before a loan is granted and timely recognition of deterioration after it is granted.

Modern regulation combines supervisory rules, accounting standards, internal governance, and market discipline. The Basel framework addresses capital adequacy, large exposures, credit-risk mitigation, and supervisory review. Accounting standards such as IFRS 9 address measurement and impairment recognition. National legislation determines enforceable definitions of default, non-performing assets (NPAs), connected lending, collateral, and reporting. Accordingly, the precise threshold or limit differs across jurisdictions; institutions must apply the rules of the relevant regulator rather than assume that an international principle is itself domestic law.

This chapter examines the credit life cycle from underwriting to recovery. It also explains exposure concentration, connected lending, collateral, provisioning, and expected credit loss (ECL), with particular attention to IFRS 9.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Evaluate underwriting standards and credit-governance arrangements.
2. Distinguish obligor, facility, industry, geographic, and systemic concentration risk.
3. Explain large-exposure limits and connected-lending controls.
4. Assess collateral and other credit-risk mitigants without confusing them with repayment capacity.
5. Classify exposures, NPAs, defaults, and stages of credit deterioration.
6. Calculate a basic ECL estimate and interpret IFRS 9 staging.
7. Critically assess model risk, management judgment, ethics, and regulatory reporting.

1. Credit risk and the credit life cycle

Credit risk is the risk of loss arising from a borrower’s or counterparty’s failure to meet contractual obligations. It includes default risk, migration risk (deterioration in credit quality), settlement risk, country risk, counterparty credit risk in derivatives, and dilution risk in receivables finance.

A sound credit process is a controlled cycle:

• strategy and risk appetite;
• customer identification and information gathering;
• credit assessment and approval;
• documentation and disbursement;
• monitoring, covenant management, and early warning;
• classification, impairment recognition, restructuring, or recovery; and
• independent review, audit, and lessons learned.

The central underwriting principle is that repayment should primarily arise from the borrower’s sustainable cash flow. Collateral is a secondary source of repayment. A bank that approves a weak cash-flow loan merely because collateral appears valuable is vulnerable to valuation error, legal delay, liquidation discounts, and correlated declines in asset prices.

Core underwriting standards

An effective credit file normally contains verified identity and beneficial ownership, purpose of borrowing, historical and projected financial statements, cash-flow analysis, debt obligations, industry information, management assessment, collateral evidence, proposed structure, pricing, covenants, and approval records. For retail lending, standardized scorecards may be appropriate, but they must be supported by affordability assessment, data quality controls, and outcome monitoring.

Important analytical measures include debt-service coverage, leverage, liquidity, and loan-to-value. For example, debt-service coverage ratio (DSCR) is:

Cash flow available for debt service and debt service due must be measured over the same period and on a consistent basis. A DSCR above 1 indicates accounting or projected coverage, but does not guarantee repayment; the acceptable buffer depends on volatility, stress conditions, borrower type, and policy.

Loan-to-value (LTV) is:

The exposure and collateral value must be comparable in timing and currency. Regulatory valuation may require haircuts, legal enforceability, insurance, margining, or periodic revaluation. LTV is not a substitute for cash-flow analysis.

Underwriting should include sensitivity and stress testing. A borrower may pass the base case but fail if interest rates rise, foreign currency depreciates, sales decline, commodity prices fall, or a major customer is lost. Stress testing should be plausible, severe enough to reveal vulnerability, and linked to management action.

2. Governance and the three lines of responsibility

Credit risk is a board responsibility. The board approves risk appetite, delegated authorities, concentration tolerances, and policies for related parties and exceptions. Senior management implements these policies and ensures adequate systems, staffing, data, and collections capability.

A practical governance model has three lines:

1. First line: business and credit officers originate, assess, document, and monitor facilities.
2. Second line: risk management sets methodology, challenges proposals, monitors limits, validates ratings, and reports independently.
3. Third line: internal audit evaluates the effectiveness of governance and controls.

Credit committees should have clear mandates and conflict-of-interest rules. Exceptions must be recorded, justified, time-limited, and reported. Remuneration should not reward loan volume without regard to subsequent performance. Independent directors and risk functions must be able to challenge optimistic assumptions.

3. Exposure classification, default, and NPAs

Exposure classification supports consistent supervision, pricing, provisioning, and recovery. Terminology varies, but common categories include performing, special mention or watch-list, substandard, doubtful, and loss. A non-performing exposure generally involves material delinquency or evidence that the borrower is unlikely to pay without realization of security. The exact past-due period and unlikeliness-to-pay criteria are jurisdiction-specific.

Classification should reflect economic substance, not temporary cosmetic actions. Interest capitalization, repeated refinancing, evergreening, and collateral substitution can conceal deterioration. A restructured loan may receive relief from a concession, but restructuring does not automatically restore it to performing status.

A default definition should be documented and consistently applied across regulatory capital, risk management, and accounting systems, while recognizing that accounting and prudential rules may use different purposes or thresholds. The bank should identify default at obligor and facility levels where required, preserve historical default data, and prevent manual overrides from weakening comparability.

Early-warning indicators include missed payments, excesses over limits, declining turnover, covenant breaches, adverse bureau information, falling collateral margins, auditor qualifications, management disputes, tax arrears, and sector stress. Early action is usually cheaper than late recovery.

4. Concentration risk and large exposures

Diversification reduces idiosyncratic risk but cannot eliminate common-factor risk. Concentration risk is the possibility that correlated exposures produce losses large enough to threaten earnings, capital, or liquidity. Concentration can occur by:

• single borrower or connected group;
• industry, commodity, or supply chain;
• geography or sovereign;
• product, collateral type, or maturity;
• currency and interest-rate sensitivity; and
• underwriting channel, model, or funding source.

A portfolio may appear diversified by borrower count while being concentrated in the same property market or employer group. Concentration analysis therefore requires aggregation of direct and indirect exposures and identification of common economic dependencies.

A large-exposure regime limits the loss that can arise from one counterparty or connected counterparties. A typical framework measures exposure as a proportion of eligible capital and imposes a regulatory ceiling, with stricter rules for exposures between internationally active banks where applicable. The numerical ceiling is set by the applicable jurisdiction and Basel implementation; it must not be inferred from a generic textbook percentage.

Exposure measurement may include funded loans, undrawn commitments, securities, derivatives, guarantees, and other contingent claims, after permitted credit-risk mitigation. Off-balance-sheet items are converted using regulatory credit-conversion factors. The bank should monitor both gross and mitigated exposure, because collateral may be unavailable or legally unenforceable in stress.

Concentration limits should operate at several levels: hard regulatory limits, internal risk-appetite limits, warning triggers, and portfolio targets. Breaches require escalation, a documented remediation plan, and possibly restrictions on new lending. Stress tests should examine sector-wide default, correlated collateral decline, and contagion through common counterparties.

5. Connected lending and related parties

Connected lending occurs when a bank lends to persons or entities linked to the bank, its directors, senior management, significant shareholders, or one another. Connections may be ownership-based, control-based, managerial, familial, economic, or contractual. The purpose of regulation is to prevent conflicts of interest, self-dealing, preferential terms, and the diversion of depositor funds.

Controls normally include a legal definition of related parties, a complete register of relationships, independent approval, arm’s-length terms, disclosure, aggregate limits, prohibition or restriction on lending to directors, and board or shareholder approval where required. Interested directors must abstain from decisions. Banks should examine beneficial ownership and circular structures rather than rely only on formal corporate names.

Connected lending is not necessarily unsafe, but it has elevated governance risk. A loan to a related entity should satisfy the same underwriting, collateral, pricing, monitoring, and impairment standards as an unrelated loan—and often more stringent documentation requirements.

6. Collateral and credit-risk mitigation

Credit-risk mitigation includes eligible collateral, guarantees, credit derivatives, netting agreements, insurance, and structural protections. Regulatory recognition depends on legal enforceability, documentation, valuation, control, correlation, and operational capability.

Collateral types include cash, government securities, marketable securities, receivables, inventory, plant and machinery, and real estate. Each has distinct risks:

A prudent collateral process verifies title, priority, enforceability, insurance, location, custody, valuation method, and realization costs. Haircuts reflect volatility, liquidity, currency mismatch, and time to sell. Guarantees require assessment of the guarantor’s capacity and willingness to pay; a guarantee from a weak or correlated guarantor provides little protection.

Collateral can reduce loss given default, but it does not normally reduce the probability that a borrower defaults. It also creates model and operational risk. Banks should avoid double counting collateral in both pricing and impairment calculations unless the relevant framework explicitly permits it.

7. Provisioning and expected credit loss

Provisioning recognizes expected impairment rather than waiting until a loss is certain. Under an incurred-loss approach, recognition is triggered by evidence of an incurred loss. Under IFRS 9, impairment uses forward-looking expected credit losses from initial recognition, subject to the standard’s staging rules.

IFRS 9 staging

• Stage 1: At initial recognition and while credit risk has not increased significantly since initial recognition. Recognize 12-month ECL.
• Stage 2: Credit risk has increased significantly since initial recognition, but the asset is not credit-impaired. Recognize lifetime ECL.
• Stage 3: The asset is credit-impaired. Recognize lifetime ECL, with special treatment of interest revenue based on the applicable carrying amount.

The 12-month ECL is not the cash shortfall expected only during the next twelve months. It is the present value of lifetime cash shortfalls arising from default events possible within the next twelve months. Lifetime ECL considers default events over the remaining expected life.

A general probability-weighted formulation is:

where PD_t is the probability of default during period t (with care taken to avoid double counting when using marginal probabilities), LGD_t is loss given default after recoveries and costs, EAD_t is exposure at default, and DF_t is the discount factor. The summation covers relevant future periods and scenarios. For a precise model, PD must be defined as a marginal default probability or a conditional probability consistently; LGD and EAD should be conditional on the same scenario and default definition.

The discount factor may be represented as:

where r is the effective interest rate per period and t is the number of periods. Units and compounding frequency must match. IFRS 9 requires discounting to the original effective interest rate, subject to requirements for certain modified or purchased credit-impaired assets.

Expected cash shortfall can be expressed as contractual cash flows minus expected cash flows, discounted at the effective interest rate. Estimates should incorporate reasonable and supportable information about past events, current conditions, and forecasts of future economic conditions. Multiple scenarios may be probability-weighted rather than simply using a single optimistic forecast.

Illustrative ECL calculation

Suppose a one-year performing loan has exposure at default of CU10 million, a one-year PD of 3%, LGD of 40%, and a discount rate of 5%. A simplified one-period estimate is:

This illustration assumes one period, constant EAD and LGD, a single scenario, default loss occurring at period end, and a PD that is appropriate for that period. A real IFRS 9 estimate may require monthly or annual cash-flow projections, prepayments, recoveries, collateral costs, multiple macroeconomic scenarios, and lifetime transition analysis. The example therefore demonstrates method, not a universal regulatory calculation.

Significant increase in credit risk

The comparison is generally between credit risk at the reporting date and credit risk at initial recognition, not simply between current balances. Indicators may include rating migration, delinquency, watch-list status, restructuring, adverse macroeconomic developments, and changes in lifetime default risk. The assessment should consider reasonable information available without undue cost or effort. Low-credit-risk simplifications may be permitted under IFRS 9, but they are not a license to ignore emerging risk.

8. ECL models, data, and model risk

Banks commonly use a probability-of-default, loss-given-default, and exposure-at-default architecture, supported by cash-flow models for complex or impaired assets. Model governance should cover data lineage, segmentation, variable selection, calibration, validation, back-testing, overrides, scenario design, performance monitoring, and independent challenge.

Historical data may be biased by benign credit cycles, regulatory forbearance, or changed underwriting. Macroeconomic forecasts are uncertain and can create procyclical provisions if applied mechanically. Management overlays may be necessary when models do not capture new risks, but overlays must be evidence-based, documented, approved, time-bound, and separately reported.

Artificial intelligence can assist document extraction, fraud detection, early-warning systems, and portfolio monitoring. However, opaque models may create discrimination, instability, privacy breaches, and explainability problems. Banks should maintain human accountability, audit trails, challenger models, fairness testing, access controls, and a clear basis for adverse credit decisions. Compliance with data-protection and consumer-protection law remains essential.

9. Integrated illustrative case

The Meridian Bank property-concentration case (fictional illustration). Meridian Bank has grown rapidly in commercial real estate. It reports strong collateral coverage because most loans have LTV ratios below its internal ceiling. However, 38% of corporate lending is linked directly or indirectly to one metropolitan property market. Several borrowers are owned by a common investment group, although the legal entities have different names. Interest rates rise sharply, vacancy increases, and property prices fall by 20%.

Problem. Three weaknesses emerge: borrower connections were not aggregated; collateral values were based on outdated appraisals; and ECL models used a benign property forecast. Two borrowers breach covenants, while one receives repeated refinancing without a proper unlikeliness-to-pay assessment.

Analysis. The bank maps beneficial ownership, common tenants, guarantees, and shared cash-flow dependencies. It recalculates single-name and connected-group exposures, including undrawn commitments. It commissions independent valuations and applies liquidation costs and time-to-sale assumptions. It reassesses stage classification using both delinquency and lifetime credit-risk migration. Stress testing shows that collateral recovery would be materially lower than the contractual loan balances.

Approach. The board imposes a temporary origination limit for the affected sector. Risk management separates cash-flow viability from collateral coverage, moves qualifying facilities to Stage 2 or Stage 3, and records a documented management overlay for model blind spots. Recovery teams negotiate viable restructuring only where sustainable cash flow supports it; otherwise, they pursue timely enforcement. The bank also strengthens beneficial-ownership data, related-party declarations, valuation frequency, and committee escalation.

Outcome. Reported profit and capital decline in the short term because recognition is earlier, but the bank avoids further concentration, improves transparency, and reduces the likelihood of a disorderly loss. Supervisors view the remediation more favorably because the bank can demonstrate traceable decisions and credible governance.

Learning points. Low LTV does not prove low credit risk; connected exposures must be aggregated; forward-looking ECL must respond to changing conditions; and timely recognition is a governance strength rather than a failure of lending.

10. Regulatory, ethical, and managerial implications

Credit regulation protects depositors and financial stability, but compliance should not become a mechanical box-ticking exercise. Excessively rigid rules may restrict productive lending, while weak enforcement encourages regulatory arbitrage. Supervisors therefore combine limits with risk-based review, stress testing, disclosure, and corrective action.

Ethically, credit decisions affect access to housing, education, entrepreneurship, and employment. Discriminatory variables, misleading sales practices, hidden fees, aggressive collections, and arbitrary restructuring can harm vulnerable customers. Banks should provide understandable terms, protect confidential information, ensure responsible affordability assessment, and distinguish inability to pay from deliberate misconduct.

Senior managers should monitor risk-adjusted returns rather than gross loan growth. Useful dashboards include migration, vintage performance, arrears, cure rates, non-performing exposures, coverage ratios, concentrations, limit breaches, collateral realization time, model overrides, and post-approval exceptions. Regulatory capital, accounting provisions, and economic capital are related but not interchangeable: capital absorbs unexpected loss, while ECL recognizes expected loss under the accounting framework.

Contemporary developments and best practices

Current practice is shaped by climate-related credit risk, cyber and operational dependencies, private-credit exposures, higher interest rates, supply-chain disruption, and rapid changes in borrower behavior. Climate risk may affect PD through transition costs and LGD through stranded or exposed collateral; it should be translated into conventional risk measures rather than treated only as a narrative concern.

Best practice is to:

• define risk appetite in measurable terms;
• use independent, cash-flow-based underwriting;
• aggregate direct, indirect, and connected exposures;
• maintain conservative, current collateral information;
• identify early-warning signals and act before default;
• align regulatory, accounting, and management data definitions;
• validate ECL models and document overlays;
• stress portfolios for correlated shocks;
• preserve independent challenge and auditability; and
• treat customers fairly throughout origination, servicing, restructuring, and recovery.

Chapter Summary

Credit-risk regulation covers the complete life cycle of lending. Sound underwriting begins with verified information, sustainable repayment capacity, appropriate structure, covenants, and stress testing; collateral is a secondary protection rather than a substitute for cash flow. Concentration risk arises from common borrowers, sectors, locations, collateral, currencies, or economic drivers. Large-exposure rules and connected-lending controls limit contagion and conflicts of interest by requiring aggregation, independent approval, and reporting.

Exposure classification and NPA identification must reflect economic substance and resist evergreening. IFRS 9 introduces forward-looking impairment through Stage 1 12-month ECL, Stage 2 lifetime ECL after a significant increase in credit risk, and Stage 3 lifetime ECL for credit-impaired assets. A basic ECL framework combines PD, LGD, EAD, discounting, and scenario analysis, but practical models require careful definitions, reliable data, validation, and governance. Effective regulation ultimately depends on timely recognition, credible challenge, ethical conduct, and management action—not on ratios considered in isolation.

Key Terms

Credit risk: Risk of loss because a counterparty fails to meet contractual obligations.

Underwriting: Process of assessing and approving a credit facility.

DSCR: Cash flow available for debt service divided by debt service due.

LTV: Exposure divided by prudently valued collateral, expressed as a percentage.

Default: Failure to meet defined obligations or a condition of unlikeliness to pay.

NPA: Exposure that is no longer performing under applicable regulatory criteria.

Concentration risk: Risk arising from correlated or excessively large exposures.

Large exposure: Exposure to one counterparty or connected group subject to a regulatory limit.

Connected lending: Lending to related persons or entities linked to the bank or its decision-makers.

Collateral: Asset or protection supporting repayment of a credit obligation.

Haircut: Reduction applied to collateral value for volatility, liquidity, or other risks.

PD: Probability of default over a specified period.

LGD: Percentage loss after recoveries, costs, and mitigation following default.

EAD: Expected exposure outstanding when default occurs.

ECL: Present value of probability-weighted expected credit shortfalls.

Stage 1: IFRS 9 category requiring 12-month ECL.

Stage 2: Category requiring lifetime ECL after significant increase in credit risk.

Stage 3: Credit-impaired category requiring lifetime ECL.

Evergreening: Concealing deterioration through inappropriate refinancing or restructuring.

Model risk: Risk that a model is unsuitable, incorrectly implemented, or misused.

Review Questions

Short Answer Questions

1. Why should cash-flow capacity normally be the primary basis for lending decisions?
2. Distinguish concentration risk from single-borrower risk.
3. What is the purpose of connected-lending regulation?
4. Explain the difference between Stage 1 and Stage 2 under IFRS 9.
5. Why does collateral not eliminate probability of default?

Long Answer Questions

1. Explain the credit life cycle and show how governance should operate at each stage.
2. Discuss the design and practical operation of a large-exposure framework.
3. Critically evaluate collateral as a credit-risk mitigant.
4. Explain IFRS 9 ECL measurement, including PD, LGD, EAD, discounting, and scenarios.
5. Examine the ethical and managerial challenges of credit-risk modelling and automated lending.

Analytical / Application Questions

1. A bank’s loan portfolio is diversified by legal borrower but concentrated in one property market. Identify the relevant risks, data required, stress tests, and management actions.
2. A one-year exposure is CU8 million, PD is 4%, LGD is 35%, and the discount rate is 6%. Using a one-period simplified model, calculate ECL and state the assumptions required.
3. A borrower has low LTV but declining cash flow, repeated refinancing, and a covenant breach. Assess whether collateral should prevent Stage 2 or Stage 3 classification and justify your conclusion.

Multiple Choice Questions with Answers

Question 1

Which principle is most appropriate for sound credit underwriting?

A. Collateral should replace analysis of repayment capacity

B. Repayment should primarily arise from sustainable borrower cash flow

C. Loan volume should be maximized before monitoring begins

D. A low current LTV guarantees low credit risk

Correct Answer: B. Repayment should primarily arise from sustainable borrower cash flow

Question 2

What does concentration risk primarily describe?

A. The risk that one employee makes an approval error

B. The risk of correlated exposures producing material losses

C. The risk that cash is held in a branch

D. The risk that a loan has a fixed interest rate

Correct Answer: B. The risk of correlated exposures producing material losses

Question 3

Under IFRS 9, Stage 2 generally requires recognition of:

A. No impairment allowance

B. Only a one-month expected credit loss

C. Lifetime expected credit loss

D. Only realized collateral losses

Correct Answer: C. Lifetime expected credit loss

Question 4

In the simplified ECL relationship, which combination is used?

A. PD × LGD × EAD, with appropriate discounting

B. Interest rate × collateral value only

C. Revenue ÷ assets × capital

D. LTV × maturity without default assumptions

Correct Answer: A. PD × LGD × EAD, with appropriate discounting

Question 5

What is a principal purpose of connected-lending rules?

A. To encourage preferential loans to directors

B. To prevent conflicts of interest and self-dealing

C. To eliminate all lending to customers

D. To replace credit committees with automated systems

Correct Answer: B. To prevent conflicts of interest and self-dealing

Question 6

A haircut applied to collateral primarily recognizes:

A. The borrower’s sales growth

B. Volatility, liquidity, and realization risk

C. The bank’s dividend policy

D. The legal definition of default only

Correct Answer: B. Volatility, liquidity, and realization risk

Question 7

A one-period exposure has PD 2%, LGD 50%, and EAD CU5,000,000. Ignoring discounting, the simplified ECL is:

A. CU5,000

B. CU25,000

C. CU50,000

D. CU100,000

Correct Answer: C. CU50,000

Question 8

Which action is most likely to indicate evergreening?

A. Independent annual collateral valuation

B. Refinancing a deteriorating loan without assessing repayment capacity

C. Recording a covenant breach

D. Aggregating related borrowers

Correct Answer: B. Refinancing a deteriorating loan without assessing repayment capacity

Question 9

Which function should independently challenge credit models and portfolio risk?

A. Only the sales team

B. The second-line risk function

C. The borrower’s marketing department

D. The collateral custodian alone

Correct Answer: B. The second-line risk function

Question 10

Why can a bank not treat regulatory capital and ECL provisions as identical?

A. Capital absorbs unexpected loss, while ECL recognizes expected loss under accounting rules

B. Both are unrelated to credit risk

C. ECL is always larger than capital

D. Capital is used only for collateral valuation

Correct Answer: A. Capital absorbs unexpected loss, while ECL recognizes expected loss under accounting rules