Concentration Risk in Banks: Limits, Measurement and RBI Rules (CAIIB RM 2026)
When a bank lends a disproportionate share of its capital to one borrower, one industry, or one geography, a single default can threaten its solvency. That danger is what we call concentration risk in banks — the risk that arises from an uneven or "lumpy" distribution of exposures rather than from any single credit going bad. For CAIIB Risk Management candidates, this is a high-yield topic because the RBI has hard-coded numerical ceilings through its Large Exposures Framework (LEF), and examiners love testing those exact percentages. This guide walks you through the definition, the types, the prudential limits, the measurement tools, and the way concentration risk sits inside a bank's ICAAP under Pillar 2 of Basel.
🎯 What Concentration Risk Means for a Bank
Concentration risk is the possibility of loss arising because a bank's exposures are not adequately diversified. Even a portfolio of individually sound loans can be dangerous if those loans are all to the same borrower group, the same sector, or the same region — because a common shock (a policy change, a commodity price crash, a regional drought) can push many of them into default at once. In other words, concentration risk is about correlation, not just individual credit quality.
The concept is closely tied to obligor and borrower risk, but it operates at the portfolio level rather than the single-name level. Basel treats it as a distinct risk precisely because Pillar 1 minimum capital charges assume a well-diversified, "granular" portfolio. When that assumption breaks down, the standardised capital charge understates the true risk, and the bank must hold additional capital under supervisory review. Unlike unexpected loss on a single account, concentration risk can wipe out a large slice of the loan book simultaneously, which is why regulators cap it with absolute limits instead of leaving it to internal judgement.
💡 Exam Tip: Concentration risk is a Pillar 2 risk, not a Pillar 1 risk. If an MCQ asks where it is addressed in the Basel framework, the answer is the Supervisory Review Process / ICAAP — never the minimum capital requirement.
🧩 The Main Types of Concentration Risk
Examiners expect you to distinguish the sub-categories cleanly. Broadly, concentration risk on the asset side falls into these buckets:
Single-name (obligor) concentration — too much exposure to one counterparty or one group of connected counterparties. This is the type the RBI Large Exposures Framework directly controls. Sectoral or industry concentration — an outsized share of the book in one industry such as real estate, power, or gems and jewellery, so that a sector-wide downturn hits many accounts together. Geographic concentration — exposures clustered in one state or region, vulnerable to local droughts, floods, or industrial decline. Product concentration — over-reliance on a single product line such as unsecured personal loans.
There is also funding (liability-side) concentration, where a bank depends heavily on a few large depositors or a single funding market — a liquidity vulnerability rather than a credit one. A related idea is that collateral itself can be concentrated; if most loans are secured by the same type of asset, a fall in that asset's value undermines recovery across the book. This links closely to the way banks apply credit risk mitigation techniques, because relying on one form of collateral simply converts credit concentration into collateral concentration.
⚠️ Common Mistake: Students assume concentration risk is only about big single borrowers. Sectoral and collateral concentration are equally examinable — a portfolio can be "granular" by borrower yet dangerously concentrated by industry.

📊 RBI Large Exposures Framework: The Numbers
The RBI's Large Exposures Framework, effective since 1 April 2019, replaced the older single/group borrower exposure norms and aligns India with the Basel Committee standard. The eligible capital base under the LEF is the bank's Tier 1 capital (not total capital). An exposure becomes a "large exposure" once it reaches 10% of Tier 1, and the sum of all large exposures is monitored and reported to the RBI.
| Exposure type | Ceiling (% of Tier 1 capital) | Reportable as "large exposure"? |
|---|---|---|
| Single counterparty (normal) | 20% | ✔ once ≥ 10% |
| Single counterparty (exceptional, Board-approved) | Up to 25% | ✔ |
| Group of connected counterparties | 25% | ✔ once ≥ 10% |
| Exposure between two G-SIBs | 15% | ✔ |
| Threshold to identify "connected" parties | > 5% | ✘ (identification trigger only) |
So a single borrower is normally capped at 20% of Tier 1, extendable to 25% only in exceptional circumstances with Board approval, while a connected group is capped at 25%. Between two global systemically important banks the limit tightens to 15%. These ceilings are absolute prudential limits — they apply regardless of collateral or rating, which is what makes them the RBI's blunt instrument against single-name concentration. Compare this discipline with the way sovereign exposures are handled under country risk management in banks, where provisioning grades rather than hard ceilings do the work.
📐 How Banks Measure Concentration
Beyond the regulatory ceilings, banks quantify concentration internally so they can price it and hold economic capital against it. The most examinable metric is the Herfindahl-Hirschman Index (HHI), calculated by summing the squares of each exposure's share of the total portfolio. An HHI close to 1 (or 10,000 if expressed on a 0–10,000 scale) means the book is dominated by a few names; an HHI near zero means it is highly granular and well diversified. A rising HHI over successive quarters is an early warning that the portfolio is becoming lumpier.
Other tools include the Gini coefficient for inequality of exposure distribution, sector-wise and rating-wise concentration ratios, and simple "top-20 borrower" exposure as a percentage of capital. Banks also run stress testing and scenario analysis to see how a shock to one sector cascades through correlated exposures — for example, modelling a power-sector default wave or a sharp fall in real-estate collateral values. These outputs feed the internal capital assessment. The interaction with the expected credit loss framework matters too: correlated defaults in a concentrated book raise both the probability of default and the loss given default in downturn scenarios, inflating provisions faster than a diversified portfolio would.
📌 Remember: HHI = sum of squared exposure shares. Higher HHI = more concentration = worse diversification. This one-line rule answers most numerical MCQs on the topic.

🛡️ Managing Concentration Risk under ICAAP
Managing concentration is a governance exercise as much as a measurement one. Banks set internal exposure ceilings that are usually tighter than the RBI's regulatory maximums — for instance, an internal single-borrower cap of 15% even though the LEF permits 20%. The Board's Risk Management Committee approves a concentration risk appetite, sectoral caps, and threshold triggers, and the risk function reports breaches upward. This sits squarely within the bank's Internal Capital Adequacy Assessment Process (ICAAP), where the bank must demonstrate that it holds enough capital for risks not fully captured under Pillar 1, concentration being a prime example.
Mitigation actions include diversifying across sectors and geographies, syndicating or selling down large exposures, buying credit protection, and tightening sanction terms for over-weighted industries. Sound governance also demands independent oversight through the three lines of defence in banks, so that the business line, the risk function, and internal audit each check concentration limits from a different angle. Because concentration amplifies losses precisely when the economy turns, it links directly to the capital buffers built up under the Basel III capital adequacy framework. For candidates preparing the broader syllabus, note that concentration also surfaces in FEMA and cross-border reporting contexts — see the treatment of the late submission fee for delayed regulatory filings, which is a reminder that limit breaches carry compliance consequences too. Round out your revision with the wider Risk Management topic hub and structured practice.

🧠 Practice MCQs: Concentration Risk in Banks
Q1. Under RBI's Large Exposures Framework, an exposure to a single counterparty is classified as a "large exposure" once it reaches at least what percentage of Tier 1 capital? (a) 5% (b) 10% (c) 15% (d) 20%
Answer: (b) — A large exposure is the sum of exposures to a counterparty equal to or above 10% of the bank's Tier 1 capital.
Q2. The normal single-counterparty exposure ceiling under the LEF is: (a) 15% of Tier 1 (b) 20% of Tier 1 (c) 25% of Tier 1 (d) 40% of Tier 1
Answer: (b) — A single counterparty is capped at 20% of Tier 1 capital, extendable to 25% only in exceptional cases with Board approval.
Q3. For a group of connected counterparties, the LEF ceiling is: (a) 20% (b) 25% (c) 30% (d) 10% of Tier 1 capital
Answer: (b) — Total exposure to a group of connected counterparties cannot exceed 25% of the bank's eligible (Tier 1) capital base.
Q4. Which index is most commonly used to measure portfolio concentration? (a) Sharpe ratio (b) Herfindahl-Hirschman Index (c) Beta coefficient (d) Altman Z-score
Answer: (b) — The HHI, the sum of squared exposure shares, is the standard concentration metric; a higher value signals greater concentration.
Q5. Concentration risk is primarily addressed under which element of the Basel framework? (a) Pillar 1 minimum capital (b) Pillar 2 supervisory review / ICAAP (c) Pillar 3 market discipline (d) It is not covered by Basel
Answer: (b) — Pillar 1 assumes a granular portfolio, so concentration risk is captured under Pillar 2 through the supervisory review process and ICAAP.
Want chapter-wise mock tests with 100+ MCQs? Start practising free
Authoritative reference: see the latest guidelines on the Reserve Bank of India website and the IIBF syllabus portal.
Is concentration risk the same as credit risk?
No. Credit risk is the risk of a single borrower defaulting, while concentration risk is a portfolio-level risk arising when exposures cluster around one borrower, sector, or region so that many can fail together. Concentration amplifies credit risk rather than replacing it.
What capital base does the RBI Large Exposures Framework use?
The eligible capital base under the LEF is the bank's Tier 1 capital, not total regulatory capital. All exposure ceilings — 20% for a single counterparty and 25% for a connected group — are expressed as a percentage of Tier 1 capital.
When must a bank identify connected counterparties?
Banks must examine whether counterparties are "connected" whenever the exposure to a single party exceeds 5% of the capital base. If entities are found to be connected, they are aggregated and treated as one group subject to the 25% ceiling.
Does concentration risk require extra capital?
Yes, indirectly. It is a Pillar 2 risk, so a bank must assess it within its ICAAP and hold additional internal (economic) capital where its portfolio is materially concentrated, over and above the Pillar 1 minimum capital requirement.
Concentration risk rewards precise recall of the LEF percentages and a clear grasp of the Pillar 2 logic — exactly the kind of factual, high-return topic that lifts your CAIIB Risk Management score. Lock in the numbers, then test yourself with full-length mocks on the CAIIB course to turn this chapter into guaranteed marks.
Practice this topic
Take a free mock test, download chapter PDFs, or watch a video class — all included on iibf.store.