​Concentration Risk

Credit union officials and management have a fiduciary responsibility to identify, measure, monitor, and control concentration risk. Concentration risk must be managed in conjunction with credit, interest rate and liquidity risks; as a negative event in any category may have significant consequences on the other areas, as well as strategic and reputation risks.

Concentration risk has increased in importance during the recent economic recession. Poor risk management of residential and commercial mortgage loan concentrations, in particular, is having an adverse effect on credit unions nationwide; resulting in significant loan losses, earnings deterioration, capital depletion, and increased credit union failures. Most of the recent large losses to the National Credit Union Share Insurance Fund (NCUSIF) are due to poor management of large concentrations in various asset classes in relation to the asset size and net worth level of the failed institutions.

What is concentration risk?

A risk concentration is any single exposure or group of exposures with the potential to produce losses large enough (relative to capital, total assets, or overall risk level) to threaten a financial institution’s health or ability to maintain its core operations.¹

Avoiding concentrating too much in any single product or service is a core tenet of effective risk management and when violated increases the risk of loss to the credit union and to the NCUSIF. Too much reliance on any single product or service increases the potential for adverse consequences from “event risk” (i.e. a negative event, such as a housing market crash, that significantly affects the financial condition of the institution). Every asset, liability, product, service, and third party provider presents a risk of loss to the credit union under varying conditions or events. Some risks are less likely than others to occur. It is up to credit union management to identify the risk in each product or service line, quantify the risk and set appropriate concentration limits based on the analysis.

What are some types of concentration risk?

Concentration risk is present in many forms across credit union operations. Examples include:

• Asset classes (e.g. residential real estate loans, member business loans, automobile loans, loan participations or investments).
• Concentrations within a class of assets. Examples include, but are not limited to:
  • Residential Real Estate Loans – collateral type, lien position, geographic area, non-traditional terms (such as interest-only, payment option, or balloon payment), fixed or variable interest rate, low or reduced underwriting documentation, and loan-to-value (LTV).
  • Member Business Loans (MBLs) – types of loans (e.g. real estate, working capital, and credit cards), collateral type, payment feature (such as interest-only, balloon payments), loan term, geographic area, and LTV.
  • Loan Participations – types of loans (e.g. residential real estate, MBL, and automobile) and the sub-classes associated with the types, originating lender, and geographic area.
  • Loans to one borrower or associated group of borrowers (may include several different types of loans – residential real estate, MBLs, consumer loans, etc).
  • Investments – types of investments (e.g. Treasury securities, certificates of deposit, and mortgage-backed securities), collateral type, interest rates, issuer (public or private), tranche priority, and broker.
• Liabilities (e.g. rate sensitive share deposits or callable borrowings).
• Third-party providers (e.g. CUSOs, indirect loan partners or mortgage brokerage firms).
• Services provided to other parties (e.g. loan underwriting and/or servicing, insurance services, and investment consultation).

When reviewing the types of concentrations in a credit union, examiners must be cognizant of other asset categories that may seem unrelated. For instance, the types of loans and characteristics of the loans may be one form of concentration risk that is easily identified. However, similar characteristics may exist in a loan participation portfolio or an investment portfolio. A clear example of this concept would be a credit union that holds a portfolio of real estate loans and also a portfolio of mortgage backed securities. There are common event risks in these types of assets that must be quantified and mitigated by management.

What are the largest exposures (risk concentrations) in credit unions?

Concentration in credit portfolios is considered to be the most significant source of risk to financial institutions. Trends in credit union balance sheets reflect increased exposure to concentration risk in areas of their credit portfolios, such as:

• Real estate loans (fixed rates) – As of December 31, 2009, real estate loans held by credit unions comprise 54 percent of total loans. Of the $217 billion in first mortgage loans, over 60 percent have fixed rate terms. In addition, fixed rate first mortgage loans have increased by 55 percent since 2005.
• Member business loans – As of December 31, 2009, member business loans totaled $35 billion. Credit unions grew their member business loan portfolios by 9.8 percent in 2009.
• Loan participations – As of December 31, 2009, credit union participations outstanding totaled $12.4 billion, and participation lending increased by 11.6 percent in 2009.
• Construction and Development (C&D) loans – As of December 31, 2009, credit unions owned $2.4 billion in commercial and residential C&D loans. While this trend has declined since 2007, the real estate market downturn could continue to have an adverse effect on credit unions with concentrations of C&D loans in their portfolio.
• Investments in Mortgage-Related Securities – As of December 31, 2009, credit union investments in mortgage-related securities totaled $58.7 billion; which is in addition to the real estate loan exposure stated above. Investments in mortgage-related securities have more than doubled since 2005.

How is concentration risk identified and measured?

Each product or service carries some risk of financial exposure or loss for the credit union. Management needs to perform a risk assessment which demonstrates their understanding of the risk of the product or service, quantifies the potential loss exposure, and documents a rational business decision on the acceptable concentration level based on the analysis.

The larger the concentration level, the more robust and advanced the analysis and risk management techniques should be. For instance, the sophistication and depth of risk management systems and analysis conducted on a real estate portfolio that represents 20 percent of total loans could be acceptably less than a real estate portfolio that represents 50 percent of total loans. Another example is the level of due diligence conducted on a third party service provider. The more important the service to the core operation of the credit union and the higher the amount of activity and dollar volume of credit union activity it handles, the more sophisticated and robust the due diligence oversight needs to be.

Similar to the depth and sophistication of the initial review, management must increase the intensity and depth of on-going monitoring and review of products and services with high concentrations. To measure and monitor concentration risk, credit unions must start with the systems used to store and analyze their data. For more complex products, establishing comprehensive data warehousing will allow management to track changes in the quality of their various lines of business over time. Without an allinclusive process to maintain and analyze data, the board of directors and senior management will not have the tools necessary to make strategic and operational decisions in a safe and sound manner.

Maintaining Comprehensive and Accurate Data

Credit union management must emphasize the importance of maintaining comprehensive and accurate data for each risk area. This includes a quality control function to ensure that data entry and changes are accurate and timely.

The credit union should have a data processing system capable of warehousing data on various lines of business, commensurate with its size and complexity, to properly identify and measure concentration risk. For example, this would include maintaining information relevant to the loan portfolio such as loan type, interest rate, interest rate reset dates (if applicable), payment amount, payment shock (the potential increase in payment from an interest rate reset or conversion from interest-only to principal and interest payments), credit score (including original and updated periodically), collateral description, and collateral value (including original and updated periodically). Another example would include maintaining information relevant to the investment portfolio such as type, interest rate, collateral information, market value (original and updated periodically), and external rating (original and updated periodically). This is not an allinclusive list, but rather a starting point for evaluating if the data processing system is capable of maintaining this type of data.

If the credit union does not have the data processing capability, management should contract with a third party to provide data warehousing and reporting. If management elects to pursue this route, examiners should review their initial and ongoing due diligence of the vendor to ensure it is in accordance with published guidance and safe and sound business practices.

Risk Rating System

Developing an effective, accurate, and timely risk rating system is an important tool for managing concentration risk in the loan portfolio. Risk ratings should be objective, sensitive to changes in borrower and/or loan characteristics, and validated via an independent review function. With loan participations, credit unions should assess the loan utilizing their own internal rating system. In the absence of an internal rating system, management should not rely on the originating institution’s system without completing timely, thorough, and ongoing due diligence of that system. Examiners should review management’s documentation of the original and ongoing due diligence; ensuring that it is consistent with safe and sound business practices.

Reporting

Management reporting must be periodic and timely, in a format that clearly indicates changes in concentration risk and is commensurate with the size, complexity, and risk exposure of the credit union. The reports should not only measure concentration risk against board approved parameters, but should also measure how the risks change over time. For example, a key factor in determining concentration risk in a loan portfolio would be to measure credit score migration, by obtaining updated credit scores on a periodic basis and analyzing those borrowers who have a declining credit score. The frequency of reporting should be commensurate with the type and size of the concentration; for example, larger portfolios should have at least quarterly reporting.

How is concentration risk managed?

Implementing sound risk management practices is the key to managing concentration risk. When credit unions have significant concentrations on their balance sheet, examiners need to ensure risk management practices are commensurate with the risk assumed relative to net worth, and management clearly identifies and measures the risk taken.

The ultimate responsibility for setting the level of concentration risk assumed by the credit union rests with the board of directors. Senior management is responsible for maintaining concentration risk within the parameters set by the board of directors.

Concentration risk has a substantial influence on credit, strategic, reputation, interest rate, and liquidity risks as all are closely related. All of these risks impact net worth and must be supported by a net worth level commensurate with the risk in the balance sheet. The board of directors and senior management need to manage all of these risk areas simultaneously.

One of the common flaws in managing risks within a credit union is to tie each risk independently to net worth, without monitoring the aggregate exposure of different risks to net worth. The result may be excessive reliance on the level of net worth to manage each individual risk. Effective risk management practices would not only include tying the limits of each product or service to net worth, but also consolidating the risks in products and services and measuring the totality of the risks against net worth.

Board Policy & Concentration Risk Limits

The board of directors must establish a policy which addresses its philosophy on concentration risk, limits commensurate with net worth levels, and the rationale as to how the limits fit into the overall strategic plan of the credit union. The board should use a global perspective when developing this policy, including identifying outside forces (such as economic or housing price uncertainty) which will affect the ability to manage concentration risk. For example, the board should not begin or expand a mortgage program that allows high loan-to-values at the height of a real estate bubble, which will likely lead to significant losses when the market declines.

The parameters set by the board should be specific to each portfolio and should include limits on loan types, share types, third party relationship exposure, etc. The risk limits should correlate to the overall growth objectives, financial targets, and net worth plan. The risk limits set forth in the concentration risk policy should be closely linked to those codified in related policies, including, but not limited to, real estate loan, member business loan, loan participation, asset/liability management (ALM), and investment policies. Concentrations that exceed 100 percent of net worth must be monitored carefully, and the board of directors should document an adequate rationale for undertaking that level of risk.

Third Party Oversight

When working with third parties, due diligence is essential to ensure the risks are properly identified and managed. Examples of third party services include purchase of participations in loans; underwriting, processing and safekeeping member loans; and purchase or safekeeping investments. Numerous guidance letters have been issued on this subject, and are listed in the references section of this letter. The guidance discusses the need for due diligence reviews to take into account the nature of the service, length and depth of expertise exhibited by the vendor, staffing changes, economic and regulatory changes, and risk mitigation strategies associated with vendor oversight. Also important to note is that due diligence is an ongoing process. It encompasses the original review at the outset of product or service implementation and should be updated periodically to monitor changes in the vendor’s ability to deliver products or services which meet the credit union’s expectations.

How is concentration risk monitored and controlled?

Once the appropriate risk management systems and policies are in place, it is essential monitoring and oversight become routine functions at the senior management level within the credit union. Ultimately, the board of directors is responsible for oversight and monitoring at a strategic level. Regular formal reporting to the board and senior management on compliance with the concentration and risk limits they establish is expected. In addition, management should implement appropriate internal controls, including segregation of duties, to ensure accurate reporting on concentration risk.

Compliance and Oversight

Senior management needs to implement procedures and controls to effectively adhere to and monitor compliance with established policies and strategies. Both the board and management must periodically review information that identifies and measures the level and nature of concentration risk and implement corrective action should the risk from any one area exceed the board approved tolerance level.

Credit unions with large and complex loan or investment programs should establish a specific risk management committee as a sound business practice. The composition of the committee will depend on the size and complexity of the credit union, but should be limited to a small number of senior executives and one or more board members. The agenda of this committee should be limited to risk management issues; specifically concentration risk, credit risk, interest rate risk, liquidity risk, and financial performance.

From a reporting perspective, management should demonstrate compliance with every board established policy limit dealing with concentration risk, as well as limits on associated risks such as credit, interest rate, and liquidity

Scenario and Sensitivity Analysis

Credit unions should routinely perform portfolio-level scenario and sensitivity tests to quantify the impact of changing economic conditions on asset quality, earnings, and net worth. In general, scenario analysis uses the model to predict a possible future outcome given an event or a series of events, while sensitivity analysis tests a model’s parameters without relating those changes to an underlying event or real world outcome.² The outcome of sensitivity analysis is to determine which assumptions have the most impact on the model’s results.

Credit unions should consider the susceptibility of portfolio segments with common risk characteristics to changing market conditions. Examples of common risk characteristics can be by loan type, investment type, collateral type, geographic area, individual or associational groups of borrowers, business lines, etc. An example scenario analysis for a concentration in HELOC mortgages would be the risk to earnings if unemployment in the area doubled while house market values declined by 25 percent, combined with the effect of interest rate resets and associated payment shock. An example scenario analysis for a concentration in 30-year, fixed-rate mortgages would be the risk to earnings and capital from liquidity and interest rate risks in a rising rate environment; where liquidity risk increases as mortgage cash flows decrease, and rising interest rate risk causes earnings to deteriorate as members seek higher dividend rates to maintain their deposits.

The analyses should be multi-faceted to explore the effect of single and multiple simultaneous negative events on the portfolio. The sophistication of scenario and sensitivity analyses should be consistent with the size, complexity, and risk characteristics of the portfolio as a whole.

What are basic review procedures for examiners related to concentration risk?

The following are some basic review steps and questions examiners should ask when conducting a review of concentration risk. Examiner expectations for the depth and sophistication of the responses from credit union management should increase if the initial review of a credit union’s balance sheet reveals potentially high exposure.

• Does the credit union have policies directly related to identifying, measuring, monitoring, and controlling concentration risk? Examiners should ensure credit unions consider the following when evaluating the board policies:
  • The level and nature of inherent risk on the balance sheet;
  • Management expertise;
  • Risk management practices;
  • Market conditions; and
  • Adequacy of reserves allocated for concentration risk.
• Has the credit union developed appropriate policies and procedures, including establishing acceptable risk limits for each product and service on an individual and aggregate basis?
• Has management assessed the adequacy of net worth based on the aggregate potential exposure to all forms of concentration risk, while also considering the potential credit, interest rate, and liquidity risk impact on net worth?
• Has the credit union considered the various types of concentrations and their interrelationship, particularly between asset classes or common products and service characteristics, which may present higher risk when aggregated?
• Has the credit union considered the “event risks” that may expose them to financial loss for each asset class, quantified the risk, and established appropriate risk tolerance limits based on the probability and potential impact from each event?
• Do the board and senior management receive regular reports on the individual and aggregate exposure to concentration risk?
• Does management have predetermined actions to take when risk limits are reached? Do they take the appropriate action? A material red flag is a credit union that simply raises the established limit when it is reached without advanced analysis supporting the rationale for the change in policy.
• Is the credit union’s system of identifying, measuring, monitoring, and controlling concentration risk commensurate with the level of potential concentration risk exposure?
• When credit unions have significant loan concentrations, does management maintain reports and perform analysis of the following:
  • Origination and portfolio trends by product, loan structure, originator channel, credit score, LTV, debt-to-income ratio (DTI), lien position, documentation type, property type, appraiser, appraised value, and appraisal date;
  • Delinquency and loss distribution trends by product and originator channel with accompanying analysis of significant underwriting characteristics, such as credit score, LTV, and DTI;
  • Vintage tracking³ (i.e., static pool analysis);
  • The performance of third-party (brokers, auto dealers, and correspondents) originated loans; and,
  • Market trends by geographic area and property type to identify areas of rapidly appreciating or depreciating housing values?

What options are available when a credit union or the examiner identifies elevated concentration risk?

The board of directors and management should have triggers and action plans in writing for any material risk area. If the credit union’s monitoring activities identify concerns with a concentration, the board of directors must respond accordingly. Similarly, if an examiner believes there may be elevated concentration risk issues present in a credit union, and management has not properly quantified and mitigated the risk, they should require corrective actions of management that include, but are not limited to:

• Expanding the review of the risk environment for the particular sector(s);
• Performing elevated scenario and sensitivity analyses;
• Expanding the review of performance of existing borrowers;
• Reviewing growth and limitations for new business lines; and/or
• Reviewing risk mitigation options and timeframes for reduction of risk, if necessary.

If management determines concentration risk is elevated, they should implement steps to mitigate the risk. If management does not properly assess or control the level of risk, examiners should require corrective actions to mitigate the risks, including but not limited to:

• Reducing limits or thresholds on risk concentrations;
• Reducing exposure to new business lines to address undue concentrations;
• Transferring risk to other parties by either selling directly or as part of securitization transactions; and/or
• Ceasing the product or service line.

Conclusion

Excessive concentration risk can severely impact the financial condition of a credit union. High concentrations in areas experiencing severe economic distress could result in significant losses exceeding a credit union’s net worth. It is the fiduciary responsibility of management and officials of credit unions to identify, manage, monitor, and control the risks facing the credit union, including concentration risk. Examiners need to ascertain whether the board of directors and management understand and actively manage this risk. Credit union management should know what their concentration risk is and be able to demonstrate appropriate risk management and mitigation practices to minimize the risk of significant financial condition decline.

References

1. Federal Deposit Insurance Corporation. Managing Commercial Real Estate Concentrations in Challenging Environment, FIL-22-2008. Issued March 17, 2008; http://www.fdic.gov/news/news/financial/2008/fil08022
2. National Credit Union Administration. Letter to Credit Unions No. 10-CU-02; Current Risks in Business Lending and Sound Risk Management Practices. Issued January 2010.
3. National Credit Union Administration. Letter to Credit Unions No. 08-CU-26; Evaluating Loan Participation Programs. Issued November 2008.
4. National Credit Union Administration. Letter to Federal Credit Unions No. 08-CU-20; Evaluating Current Risks to Credit Unions. Issued August 2008.
5. National Credit Union Administration. Letter to Credit Unions No. 08-CU-09; Evaluating Third Party Relationships Questionnaire. Issued December 2007.
6. National Credit Union Administration. Letter to Credit Unions No. 07-CU-13; Evaluating Third Party Relationships. Issued December 2007.
7. National Credit Union Administration. Letter to Credit Unions No. 05-CU-07; Managing Risks Associated with Home Equity Lending. Issued May 2005.
8. National Credit Union Administration. Letter to Credit Unions No. 03-CU-15; Real Estate Concentrations and Interest Rate Risk Management for Credit Unions with Large Positions in Fixed-Rate Mortgage Portfolios. Issued September 2003.
9. Federal Financial Institutions Examination Council. Advisory on Interest Rate Risk Management. Issued January 2010. http://www.ncua.gov/news/press_releases/2010/JR10-0107.pdf
10. Interagency Final Guidance on Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices, published in Vol. 71, No. 238 of the Federal Register. Issued December 12, 2006. http://edocket.access.gpo.gov/2006/pdf/06-9630.pdf
11. Basel Committee on Banking Supervision. Working Paper No. 15; Studies on credit risk concentration: an overview of the issues and a synopsis of the results from the Research Task Force project. Issued November 2006. http://www.bis.org/publ/bcbs_wp15.htm