Guide to the Guidance: Concentrations in Commercial Real Estate Lending

This is the short-short version of Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices, the December 2006 regulatory guidance put out by the FDIC, FRB, OCC, and OTS.
The good news is that the whole guidance is only 3 pages, so it won’t take you long to read the whole thing.  Keep reading below for the summary, or just go straight to the source here:

• Federal Register Notice (FDIC, FRB, and OCC) [PDF]
• Federal Register Notice (OTS) [PDF]

Basically, community banks have been increasing their concentrations in CRE lending over the past few years, but the sophistication of their risk management systems have not evolved in kind. This troubled the FDIC, FRB, OCC, and OTS enough that they put out special regulatory guidance in December 2006 titled Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices. The regulatory agencies mostly forgot about this in 2007, but certain events triggered increased scrutiny in the second half of 2008.
This applies to any bank regulated by the FDIC, FRB, OCC, or OTS making CRE loans, especially if you have a high concentration of CRE loans. You have a high concentration of CRE loans if either:

• Construction and land development loans exceed 100% of your risk-based capital
• -or-
• Total covered CRE loans exceed 300% of your risk-based capital

The guidance goes out of its way to make sure to explain that these numbers do not imply either a safe harbor for banks below these guidelines nor limits for banks above these guidelines. Evaluations of CRE concentrations are risk-based and different from bank to bank.
Covered loans include those primarily backed by income from CRE. This means that you don’t have to worry about most owner-occupied CRE loans or loans where the CRE is just bonus collateral. You do need to worry about these:

• 1 – 4 family residential and commercial land development and construction loans
• Multifamily real estate loans (50% or more secured by income or sale)
• Nonfarm nonresidential real estate loans (50% or more secured by income or sale)
• Unsecured loans to land developers

CRE concentration analysis deserves special attention. This means looking at how your CRE loans compare to your other loans and your capital as well as looking at concentrations within your CRE portfolio.

You need to identify segments within your CRE portfolio that have common risk characteristics. When putting together your concentration analysis, consider these guidelines:

• Be honest – don’t segment your portfolio with unsupportable logic to mask concentration risk
• High concentration does not equal high risk – high concentrations can be justified if the risk is low or is sufficiently mitigated
• Beware of correlation between related segments – if multiple segments are subject to the same external factors, rethink your segmentation
• Suggested concentrations – property type, location, underwriting standard, take-out commitments (for construction loans), liquidity

Managing your risk with regards to your CRE portfolio is key. Your regulator will expect you to show that your CRE portfolio is reasonable and supportable. The guidance stresses that your existing risk management system may not be good enough. The whole reason that this guidance came about was because concentrations in CRE lending have been increasing faster than the sophistication of risk management systems.
When evaluating your risk management system, consider these guidelines:

• Evaluate risk at the portfolio level – it’s not enough to know the risk of each loan individually
• Know your market – have updated, appropriate market analysis that proves you know your environment
• Stress test – evaluate the sensitivity of your portfolio and risky segments by stress testing environmental issues like PGI, vacancy, cap rates, and interest rates
• Review underwriting standards – make sure underwriting standards are reflective of your complete risk landscape
• Involve your board – the board bears the ultimate responsibility and should dictate strong strategy, policy, controls, and oversight
• Review technology – your management information systems should conform to your risk analysis, not the other way around; upgrade as necessary