How to run a portfolio concentration review for early warning

What does a portfolio concentration review give you?

A portfolio concentration review shows where a lender’s exposure is bunching in one borrower, one connected group or one sector, and how much headroom is left before a limit is reached. The early warning comes from the direction of travel, not only from the current position against the limit.

A finished portfolio concentration review produces three things:

• A ranked list of single-borrower and group exposures, each shown as a percentage of the relevant capital base, with the level (consolidated or solo) stated.
• Sector utilisation against the limits the bank has set for itself.
• A short list of watch items, each with an owner and an action.

Which RBI limits does a portfolio concentration review test?

For Commercial Banks, a portfolio concentration review tests the limits in the Reserve Bank of India (Commercial Banks - Concentration Risk Management) Directions, 2025, issued on November 28, 2025 and updated as on October 01, 2026.

Paragraph 3 of these Directions covers banking companies other than Small Finance Banks, Payment Banks and Local Area Banks, along with corresponding new banks and the State Bank of India. Lenders outside that definition should check the rules that apply to their own lender type. The review method below still works for them as general working practice, but the paragraph references do not apply.

Which exposures have a different limit or are exempt?

Some exposures in a portfolio concentration review sit outside the 20 percent and 25 percent tests, so each name should be routed before it is ranked. The Concentration Risk Management Directions, 2025 (updated as on October 01, 2026, Commercial Banks) set these other treatments:

The capital base also differs between these rows. Paragraph 80 uses capital funds, while paragraph 62 and paragraph 81 use Tier 1 and Tier I capital.

What do you need before starting a portfolio concentration review?

A portfolio concentration review needs the inputs below. Each input carries its own date, and the review should state every date rather than assume they match.

• A bank-wide exposure file by customer, with funded outstanding, non-funded limits and undrawn commitments, as at a stated date.
• The eligible capital base from finance, at consolidated and at solo level. Paragraph 4(3) takes it from the last audited balance sheet, so its date will usually differ from the exposure file’s date. Note any permitted addition after that date.
• The Board-approved policy for determining connectedness, which paragraph 31 requires, and the Board-approved policy on the additional five percent under paragraph 6(1)(i). Note the approval date of each.
• The sector limits the bank has set, and the dated output of the last review, so that movement can be measured.
• Evidence on the larger borrowers that bears on connectedness: shareholding and voting agreements (paragraph 21), share of receipts or expenditure with one counterparty and common funders (paragraph 25), and the soft information held by loan officers and relationship managers (paragraph 30).

How do you run a portfolio concentration review, step by step?

Paragraph references in these steps are to the Concentration Risk Management Directions, 2025, updated as on October 01, 2026, and apply to Commercial Banks.

1. Fix the denominators. Paragraph 4(3) defines eligible capital base as Tier 1 capital per the last audited balance sheet. Tier 1 infused after the published balance sheet date may be added once an external auditor’s certificate has been submitted to RBI (DOS, CO). An Indian bank also reckons profit accrued during the year, subject to the capital adequacy directions. Paragraph 7 applies the framework at the consolidated group level, against the consolidated capital base, and at the solo level, against the standalone position. Where a limit uses a different base, such as capital funds in paragraph 80, take that base. What good looks like: every percentage in the review is labelled with its level, its capital base, the balance sheet date and any additions.

2. Measure each exposure. Paragraph 32 includes on-balance sheet and off-balance sheet items, in both the banking book and the trading book, and instruments with counterparty credit risk. Paragraph 33 values banking book assets net of specific provisions and value adjustments, or gross as an alternative. Paragraph 36 converts off-balance sheet commitments using credit conversion factors (CCFs, the percentages that turn a non-funded item into a credit equivalent), with a floor of 10 percent. What good looks like: non-funded lines are converted, one provisioning basis is used throughout, and consortium and multiple banking lines are included, since paragraph 12 applies the limits to them too.

3. Apply credit risk mitigation (CRM) only where eligible. Paragraph 37 recognises eligible financial collateral and unfunded credit protection. Paragraph 38 says receivables, commercial and residential real estate and other collateral do not reduce exposure values. Where an eligible guarantee or similar protection reduces the exposure to the borrower, paragraph 46 requires an exposure to the protection provider for the amount of the reduction. What good looks like: each large name is shown both with and without CRM, because paragraph 14(2) also captures exposures at or above 10 percent measured without CRM.

4. Route each name, then rank and test it. First set aside the exempt exposures listed in paragraph 8, noting that paragraph 11 still requires reporting of those at or above 10 percent. Next send NBFC, interbank and G-SIB exposures to their own limits in the table above. Then sort the remaining names by exposure value and test each against the 10 percent large exposure mark and the 20 percent single counterparty limit. Paragraph 14(4) puts the 20 largest exposures in the reporting template whatever their size, so that list is a natural starting point. What good looks like: each name shows which limit applied to it and why, and the bank-wide position is tested at both consolidated and solo level, since a regional file shows only part of the picture.

5. Build connected groups by control. Paragraph 21 treats ownership of more than 50 percent of voting rights as automatic control, and also lists voting agreements, influence over board appointments and influence over senior management as evidence. Paragraph 23 extends the examination to common owners, shareholders or managers. What good looks like: every group has a named basis for inclusion.

6. Build connected groups by economic interdependence. Paragraph 25 sets minimum criteria, including 50 percent or more of gross receipts or expenditure coming from the other counterparty, a guarantee large enough to bring down the guarantor, a shared repayment source and a shared main funder with no alternative. The illustrations in paragraph 26 include an auto parts supplier and an auto manufacturer, and two auto component makers who both depend on sales to one commercial vehicle maker. Paragraph 26(2) says a counterparty dependent on two other entities is added to both groups, which is not double counting. Paragraph 27 lets the bank keep counterparties apart if it can demonstrate that one could find alternative partners or funding within an appropriate time. Paragraph 30 expects best efforts on missing information, including public information and soft information held by loan officers and relationship managers. What good looks like: anchor buyers and common funders are mapped, and any decision to keep names apart has evidence on file.

7. Test sectors. Compare exposure by sector with the bank’s own limits. Paragraph 6(2)(iv) puts those sector limits before the Board at the periodicity necessary, and paragraph 89 says the bank reviews and revises them periodically. As general working practice, classify a borrower by what it actually does and flag any shared anchor buyer or cluster that sits across sector lines. What good looks like: sector totals reconcile to the exposure file, and no material amount sits in an unclassified bucket.

8. Read the movement. Compare each name, group and sector with the last review, then calculate headroom and how soon it runs out at the current pace. This step is general working practice, and internal watch levels vary by institution. What good looks like: pipeline sanctions and undrawn limits are included, so the reader sees the position after commitments, not only today’s number.

9. Escalate with an action. Common early actions are to hold further limit increases, complete a pending connectedness check, seek eligible protection or sell down. These are general working practice, and authority varies by institution. Paragraph 18 says any breach of the paragraph 15 or 16 limits may arise only under exceptional conditions beyond the bank’s control, must be reported immediately to RBI (DOS, CO) and must be rapidly rectified. What good looks like: each watch item has an owner, an action and a date for the next check.

Worked example, made-up numbers

All names and figures in this worked example are invented. A commercial bank has an eligible capital base of ₹1,000 crore, and the example is run at solo level only. That makes 5 percent ₹50 crore, 10 percent ₹100 crore, 20 percent ₹200 crore and 25 percent ₹250 crore. A CCF of 50 percent is assumed for every non-funded line, purely for illustration.

None of the four is an exempt or special-limit counterparty, so all four are tested against the general limits. Taken one at a time, every name looks comfortable. None reaches the ₹100 crore large exposure mark.

The group view changes the reading. A earns 60 percent of its gross receipts from D, and B earns 55 percent. Both pass the 50 percent test, and the file has no evidence of alternative buyers, so D, A and B form one connected group.

The group is a large exposure at 20.5 percent and sits within the 25 percent limit. Exposure rose ₹35 crore since the last review. At the same pace it reaches ₹240 crore at the next review and ₹275 crore at the one after, which crosses the limit. A new ₹50 crore limit for B, fully drawn, would take the group to ₹255 crore straight away.

Two further points follow from the table. C’s ₹35 crore does not exceed ₹50 crore, so C is not pulled into the economic interdependence investigation, though C still counts in the sector view. A’s commercial property charge of ₹40 crore does not reduce A’s ₹62 crore, because real estate is not eligible.

The sector limits below are assumed for this example. Actual limits vary by institution.

Auto holds D, A, B and C at ₹240 crore, plus ₹240 crore of other names. The group’s ₹35 crore rise accounts for more than half of the sector’s ₹60 crore rise, so the single watch item covers both findings. The action is to hold limit increases for the group until the receipts data for A and B has been verified, with credit and risk named as owners.

What are the common errors in a portfolio concentration review?

These errors recur in portfolio concentration reviews. Paragraph references are to the Concentration Risk Management Directions, 2025, for Commercial Banks.

• Using one denominator for every limit. Eligible capital base means Tier 1 under paragraph 4(3). Paragraph 7 tests consolidated and solo levels separately, and paragraph 80 uses capital funds (Tier I plus Tier II) for gold loan NBFCs.
• Testing every name against the same two marks. Paragraph 8 exempts some exposures, and paragraphs 62, 79 to 83 set other limits for interbank, NBFC and G-SIB exposures.
• Counting only funded outstanding. Paragraphs 32 and 36 bring off-balance sheet items in, after conversion.
• Netting property or receivables. Paragraph 38 does not allow either to reduce exposure values.
• Applying the single-name limit to a group. A connected group is treated as one counterparty under paragraph 19, and its limit is the 25 percent in paragraph 16.
• Stopping at ownership. Paragraph 20 makes economic interdependence a separate route into a group, so a common anchor buyer can connect borrowers with no shared owner.
• Reading the 5 percent mark too widely. Paragraph 28 concerns only the economic interdependence investigation. Control relationships still need testing below that mark.
• Treating bills under a letter of credit as borrower exposure by default. Paragraph 13 places the exposure on the issuing bank where the negotiating and issuing banks are different entities and payment is not made under reserve.
• Treating a regional slice as the bank’s position. Paragraph 7 applies the framework to the whole bank, so a regional review feeds that test rather than replacing it.
• Waiting for the limit. A name close to its limit with rising drawdowns needs action at this review, and that holds whatever watch level the institution uses.