CRO Outlook

Balancing the Business Model and Concentration Risk

It is extremely difficult to identify, measure and manage adverse concentrations. Why is it important to understand the effects of concentration risk on different business units and risk types, and what steps can financial institutions take to address this challenge?

Friday, March 15, 2024

By Clifford Rossi


While we often think of concentration risk in the context of managing credit or investment portfolios, it turns out this risk is ubiquitous across a bank’s risk taxonomy. It has over the years been a contributing factor to bank failure, whether it comes from conducting business with certain counterparties or from, say, an outsized reliance on subprime mortgages, commercial real estate, uninsured deposits, or held-to-maturity assets.

Despite significant strides that have been made to quantify the effect of concentration risk in portfolios, identification, measurement and management of this complex threat across the enterprise remains largely elusive. Indeed, it is very difficult to quantify a bank’s exposure and tolerance to other forms of concentration risk.

Identifying concentration risks that threaten the viability of the bank requires more than just ad hoc analysis. Best practice approaches should consider the potential interactions of key concentrations on the bank’s risk profile.

Identifying Concentration Risk Across the Risk Taxonomy

clifford-rossiClifford Rossi 

Concentration risks have a way of creeping up on banks at the worst time. Partly this is because normal economic periods may mask building concentrations until something breaks from some event – fueled by bank-specific, sector-specific or general economic conditions.

One way of detecting adverse concentrations is to measure the bank against its peers or the industry at-large, if applicable.

Calculating and comparing select concentration risk metrics to see if your bank is an outlier is crucial to gaining perspective that might otherwise seem reasonable given the bank’s business model. For example, if we are evaluating a bank that has the 99th percentile highest share of subprime mortgages in its portfolio, generating outsized returns compared to peers may be illusory during a boom period.

When the market turns, that subprime concentration will amplify credit and other risk exposures. Understanding where your bank stands relative to each concentration risk type can help avoid problems down the road.

A catalog of all concentration risks affecting key risk types at the bank is a first order activity that should take place across the enterprise. To start, a standardized way of depicting the relative risk of a particular concentration (e.g., wholesale deposits) for each specific type of risk (e.g., liquidity) must be established.

The figure below provides an example of one way to depict this for illustrative purposes. For the five key risk types shown (credit, interest rate, liquidity, counterparty, and operational), specific key concentration risks are captured, with their position on the figure describing their concentration risk, classified from low to high.


Each concentration risk can be measured in terms of its impact on each risk type. Using this approach, the bank can rank order concentration risks within and across risk types.

Measuring Concentration Risk and Avoiding the Fear Frontier

While understanding the effects of concentration risk on a specific risk type is critical, further analysis of the severity of the bank’s concentration risks across multiple risk types should also be conducted. Distributions can be generated after using peer analysis on key concentration risk metrics that can easily be drawn from publicly-available data – such as bank call reports. This data can provide industry benchmarks at key percentiles: e.g., 50th, 90th, 99th.

To illustrate this concept, consider Figure 2 below, which depicts concentration risk for four risk types: credit, counterparty, liquidity and interest rates (IRR). While more than one concentration risk per risk type can be evaluated, for ease of exposition, only one per risk type is provided in the figure.


Let’s assume a bank has significant exposure to commercial real estate (CRE) as a percent of its total loan portfolio (credit risk) and is concerned about its high percentage of uninsured deposits to total deposits (liquidity risk). Let’s further assume that it also uses multiple counterparties for lines of credit and has a high ratio of held-to-maturity (HTM) securities to total securities to manage interest rate risk (IRR).

Each of these ratios can be compared against peer institutions at the 50th, 90th and 99th percentile for each ratio shown by the dashed lines associated with its particular risk type (see Figure 2). A “fear frontier” could be established by the bank at the desired percentile (e.g., 99th) as a concentration limit across risk types.

The figure shows how the bank compares along each concentration risk metric to peers. In this example, the bank is an outlier on its interest rate risk concentration metric, as it lies beyond the 99th percentile of peer bank ratios. It also sits just below the 99th percentile for its liquidity concentration risk and is above average for CRE concentration risk.

Only the bank’s counterparty concentration risk is below the 50th percentile. While only one metric falls outside the fear frontier, the combination of high concentrations in IRR and liquidity risk could come back to haunt the bank in a scenario where it faces a liquidity event caused by above average CRE credit losses. This, in turn, could cause a run by uninsured depositors where the bank has insufficient liquid assets available to deploy against the run.

Parting Thoughts

Concentration risks are sometimes hard to avoid, simply because the business model, firm type or strategy is based on a specific sector, asset type or geographic footprint. Specialization can certainly bring with it many financial advantages, but it can also yield unintended concentrations that may go undetected for years, until an event exposes a flaw in the strategy.

The potential for such extenuating circumstances makes it even more important to feature concentration risk prominently in the risk identification, measurement and management processes.

It’s not just specialty financial institutions, moreover, that should be concerned about concentration risk. Even banks that are more diversified across products and markets must guard against excessive concentrations within and across key risk types.

Don’t wait to be an outlier from a concentration risk that puts your bank in peril.


Clifford Rossi (PhD) is the Director of the Smith Enterprise Risk Consortium at the University of Maryland (UMD) and a Professor-of-the-Practice and Executive-in-Residence at UMD’s Robert H. Smith School of Business. Before joining academia, he spent 25-plus years in the financial sector, as both a C-level risk executive at several top financial institutions and a federal banking regulator. He is the former managing director and CRO of Citigroup’s Consumer Lending Group.


BylawsCode of ConductPrivacy NoticeTerms of Use © 2024 Global Association of Risk Professionals