Credit Risk in Banking: How Banks Measure and Manage It

Lending is a bank’s core business — and the risk that borrowers do not pay back is the core danger. Credit risk is where most banks make their money and where most banks, when they fail, lose it. This guide explains what credit risk is, how banks measure and manage it, the role of provisions and capital, and why it sits at the heart of banking.

What is credit risk and where does it arise?

Credit risk is the possibility that a party owing money to the bank — a borrower, a bond issuer, or a trading counterparty — fails to pay as agreed. It arises across the balance sheet: in loans to individuals and businesses, in securities the bank holds, in off-balance-sheet commitments like guarantees, and in counterparty exposures from trading. Because lending is what banks do, credit risk is typically their largest single risk, and managing it well is the difference between a profitable bank and a failed one.

Credit risk is one pillar of the broader risk framework covered across our banking hub.

How do banks measure credit risk?

Banks quantify credit risk using three core parameters: the probability of default (PD) — how likely the borrower is to fail to pay; the loss given default (LGD) — how much the bank would lose if default occurs, after recoveries and collateral; and the exposure at default (EAD) — how much will be owed at that point. Multiplying these gives the expected loss. Banks build credit scoring and rating models to estimate these for each borrower and portfolio, distinguishing routine expected losses, which are priced and provisioned for, from rarer unexpected losses, against which capital is held.

How do banks underwrite and price for credit risk?

Underwriting is the front-line defence: assessing each borrower’s ability and willingness to repay before lending, using the kind of analysis covered in our guide on how banks assess business loans. Pricing then reflects the risk — riskier borrowers pay higher interest to compensate the bank for higher expected losses and the capital it must hold. Done well, this ensures the bank is paid for the risk it takes. Done poorly — lending too cheaply to risky borrowers, or relaxing standards to chase growth — it stores up losses that surface later, often all at once in a downturn.

What role do provisions play?

Provisions are amounts a bank sets aside to cover expected loan losses, reducing reported profit now in anticipation of losses to come. Modern accounting requires banks to provision for expected credit losses on a forward-looking basis, rather than waiting until a loan actually goes bad. This means provisions rise when the economic outlook darkens, smoothing recognition of losses and giving an earlier signal of deteriorating credit quality. Adequate, honest provisioning is essential: under-provisioning flatters profits and capital while hiding real losses, a classic warning sign in troubled banks.

How does diversification reduce credit risk?

Concentration is the enemy. A bank with loans spread across many unrelated borrowers, sectors, and regions can absorb individual defaults because they are unlikely to fail together. A bank concentrated in one industry, one region, or a handful of large borrowers is exposed to a single shock wiping out a large slice of its book at once. Diversification — limiting exposure to any single name, sector, or correlated group — is one of the most powerful and basic credit-risk controls. Many bank failures trace directly to concentration: heavy exposure to one sector, such as commercial property, that turned down sharply.

How does credit risk behave over the economic cycle?

Credit risk is deeply procyclical. In good times, defaults are low, collateral values are high, and credit looks safe — tempting banks to lend more freely. In a downturn, defaults rise, collateral falls, and losses mount across the book simultaneously. This means the riskiest lending is often done in the good times, with the bill arriving in the bad ones. Sound credit-risk management requires discipline precisely when it is hardest — maintaining standards and pricing during booms — and adequate capital and provisions to absorb the losses that cluster in recessions, linking credit risk directly to capital management.

How do collateral and guarantees mitigate credit risk?

Collateral and guarantees reduce loss given default — the amount a bank loses if a borrower fails to repay. Collateral is an asset the bank can seize and sell: property, equipment, inventory, receivables, or financial securities. If the borrower defaults, the bank recovers value from the collateral, reducing or eliminating its loss. Guarantees bring in a third party who promises to pay if the borrower cannot, transferring risk to a stronger party. Both improve recovery and can justify lending to riskier borrowers or at better terms. However, collateral values can fall in a downturn — exactly when defaults rise — so a bank cannot rely on security alone; the borrower’s cash-flow capacity to repay remains the primary basis for sound lending, with collateral as a backstop.

What is concentration risk and how do banks limit it?

Concentration risk is the danger of heavy exposure to a single borrower, sector, geography, or risk factor, so that one adverse event causes outsized losses. A bank with much of its book in commercial property, or to a handful of large borrowers, or in one region, is vulnerable to a shock specific to that concentration. Banks limit it by setting exposure limits — caps on lending to any single name, industry, or correlated group — and monitoring the portfolio for hidden concentrations, such as many borrowers all dependent on the same economic driver. Diversification across uncorrelated exposures is the antidote, spreading risk so that no single event can threaten the bank. Repeated banking crises trace directly to concentration that looked profitable until the concentrated sector turned, making its control one of the most important credit-risk disciplines.

How do credit ratings and credit scoring work?

Banks assess borrower creditworthiness using ratings and scoring. For larger borrowers, internal or external credit ratings grade the borrower’s likelihood of default on a scale, informing the probability-of-default estimate and pricing. For high-volume retail and small-business lending, credit scoring models combine data — credit history, income, existing debt, behaviour — into a score that predicts default risk, enabling fast, consistent decisions. Both translate information about a borrower into a risk measure the bank can price and provision for. The quality of these assessments is critical: models built on poor data or flawed assumptions can systematically under-price risk, seeding losses that surface later. Banks continually validate and recalibrate their rating and scoring systems against actual default experience to keep them accurate.

How does credit risk connect to a bank’s capital?

Credit risk and capital are inseparable. Expected credit losses are covered by provisions, charged against profit, but the rarer, larger unexpected losses are absorbed by capital. Because lending consumes capital — more for riskier assets under the risk-weighting rules — a bank must hold capital in proportion to the credit risk it takes, as set out in our guide to capital adequacy and the Basel framework. This links the two directly: a bank that takes on more or riskier credit must hold more capital, and a bank whose credit losses exceed its provisions eats into capital, weakening it. Managing credit risk well therefore protects not just the loan book but the capital base on which the entire institution’s safety rests.

How does credit risk transfer work?

Banks can move credit risk off their balance sheet rather than simply holding it. Securitisation pools loans and sells them as securities to investors, transferring much of the credit risk while freeing capital to lend again. Credit derivatives, such as credit default swaps, let a bank buy protection against a borrower’s default without selling the loan. Loan sales and syndication distribute large exposures across multiple lenders. Credit insurance and guarantees shift risk to third parties. These tools let banks manage concentration, free capital, and tailor their risk profile. Used prudently, they improve risk management; used recklessly — as some securitisation was before the 2008 crisis, when risk was passed on without proper scrutiny — they can spread and obscure risk across the system. The lesson is that transferring credit risk is valuable only when the risk is honestly assessed and the transfer is genuine rather than illusory.

What warning signs indicate rising credit risk in a bank?

Several signals suggest a bank’s credit risk is deteriorating. Rapid loan growth well above peers can indicate loosening standards. Rising non-performing loans and increasing arrears show borrowers struggling. Falling or inadequate provisions relative to a worsening loan book may mean losses are being under-recognised. Concentration in a single sector, geography, or large borrowers raises vulnerability to a specific shock. Aggressive lending into a late-cycle boom, or heavy exposure to sectors showing stress, are red flags. For anyone assessing a bank — an investor, a large depositor, or a counterparty — watching these indicators gives early warning of credit problems that, if they accumulate, can erode capital and ultimately threaten the institution, well before they appear in headline failures.

How does credit risk differ across lending types?

The nature of credit risk varies by what is being lent and to whom. Retail lending — mortgages, credit cards, personal loans — spreads risk across many small borrowers, so it is managed statistically through scoring and portfolio diversification, with losses fairly predictable in aggregate but sensitive to unemployment and the economy. Corporate and commercial lending involves larger, more individual exposures requiring detailed underwriting of each borrower, where a single default can be significant. Specialised lending — property development, project finance, leveraged deals — carries concentrated, structure-dependent risk needing expert assessment. Each type demands a different management approach: statistical and diversified for retail, name-by-name for corporate, and specialist for complex deals. A bank must match its risk management to the kind of credit it extends, and weakness in any one area — such as over-concentration in commercial property — can produce outsized losses even if the rest of the book is sound.

Frequently Asked Questions