FRM Exam Part II · Governance

Credit Policies, Limits and Underwriting Standards in Banks

Updated 11 October 2026 · Fact-checked

Credit policy sets how a bank lends: who it lends to, on what terms and with what controls. Limits cap exposure by borrower, sector, country or product. Delegated authority decides who can approve what size. Underwriting standards define the analysis needed before a loan. All of these turn board risk appetite into daily lending rules.

Understand Credit Policies, Limits and Underwriting Standards

A bank needs a way to turn broad board intentions into thousands of lending decisions. It does this through a chain. The risk appetite statement says how much and what kind of credit risk the board will accept. The credit policy translates that into rules for lending. Limits and underwriting standards put the rules into practice.

The credit policy covers target markets, prohibited or restricted lending, required analysis, acceptable collateral, pricing principles, documentation, monitoring and exception handling. Risk appetite is a statement of how much risk the bank will take. Credit policy is the set of rules for how it takes it. Appetite is set by the board. Policy is approved by the board or a board committee and applied by management.

Limits cap exposure. Common types are single-name or borrower limits, connected-group limits, industry or sector limits, country limits, product limits and rating-band limits. Limits control concentration risk, where a single event hits many exposures at once. Limits are often set as a share of capital, for example Tier 1 capital, or as an absolute amount. Many banks use a hierarchy of early-warning triggers below a hard limit, so that management acts before the limit is reached.

Delegated approval authority gives individuals or committees the right to approve credit up to a set size and risk grade. Authority is usually tiered. Small, low-risk exposures go to front-line officers. Larger or riskier ones go to senior credit officers, then a credit committee, then the board. Credit approval should sit with people independent of sales targets. Higher risk grades, weak collateral or policy exceptions push a decision up the ladder.

Underwriting standards are the minimum analysis and conditions for granting credit. They include assessing the borrower's repayment capacity from cash flow, understanding the purpose of the loan, checking financial strength, verifying data, setting collateral and covenants, and using an internal rating. Weak standards, often loosened during booms to win market share, are a classic cause of later losses. Exceptions to policy should be tracked, reported and kept small.

Key formulas to remember

Single-name limit utilisation: Utilisation = Current exposure ÷ Limit; Above 100% is a breach. Banks often set an early-warning trigger at a lower level, such as a set share of the limit.
Concentration as share of capital: Concentration ratio = Exposure to name, group or sector ÷ Tier 1 capital; Compare with the policy limit. The denominator is whatever capital measure the policy specifies, so read the question.
Excess over limit: Excess = Exposure − Limit (if positive); A breach needs escalation and approval or a remedy plan. Do not treat it as a routine exception.
Aggregate exposure to a connected group: Group exposure = Σ exposure to each connected borrower; Connected borrowers are treated as one risk where one's problems would likely hurt the others. Add them before testing the limit.
Debt service coverage (common underwriting test): DSCR = Cash flow available for debt service ÷ (Interest + Scheduled principal); Below 1 means cash flow does not cover scheduled payments. Minimum levels vary by bank policy.

How to solve Credit Policies, Limits and Underwriting Standards questions

Most questions test whether you can match a control to its purpose, or apply a limit or authority rule to a scenario.

1Identify the layer being tested: risk appetite, credit policy, limit, delegated authority or underwriting standard.
2Note who owns each layer. The board sets appetite and approves policy. Management implements. Independent risk functions monitor and challenge.
3For limit questions, add exposures first, including connected parties and all products, then compare with the limit using the stated base.
4For authority questions, find the tier for the size and risk grade. Policy exceptions or breaches usually go up a level.
5For underwriting questions, ask whether the borrower's repayment capacity is shown independently of collateral. Collateral is a secondary source of repayment.
6Check independence. Approval or limit monitoring done by those paid on sales volume is a weakness.
7Pick the answer that links the control to the risk it contains, such as concentration, adverse selection or weak standards in a boom.

Quickest way: Layer, owner, test

When to use it: Use for scenario MCQs with four plausible governance statements.

Name the layer: appetite, policy, limit, authority or underwriting.
Ask who should own it and whether the scenario respects that.
If numbers are given, sum the exposures and divide by the stated base.
Eliminate options that put sales staff in charge of approval or treat collateral as the main repayment source.
Choose the option that escalates breaches and exceptions rather than quietly absorbing them.

Common mistakes in Credit Policies, Limits and Underwriting Standards

Treating risk appetite and credit policy as the same thing.
Both are board-level documents and the terms sound alike.
Fix: Appetite is how much and what kind of risk the bank will accept. Policy is the rules for lending within it.
Testing a single-name limit without adding connected borrowers.
Candidates read each borrower as a separate line in the question.
Fix: Combine entities that are economically connected, then compare the total with the limit.
Treating collateral as a substitute for repayment capacity.
Secured lending feels safe.
Fix: Standards require a primary source of repayment from cash flow. Collateral is a fallback and can lose value when the borrower fails.
Assuming limits remove all concentration risk.
Limits look like a complete control.
Fix: Limits cap known buckets. Hidden correlations across sectors or countries can still create concentration, so they need portfolio analysis and stress tests.
Thinking delegated authority is based on size alone.
Simple examples show only amount thresholds.
Fix: Authority usually depends on size, risk grade, collateral and exceptions. Riskier or non-standard deals need higher approval.
Seeing a policy exception as harmless if the loan is profitable.
Business pressure frames exceptions as flexibility.
Fix: Exceptions must be approved at the right level, tracked and reported. Rising exceptions signal weakening standards.

Worked examples

Example 1

A bank has Tier 1 capital of USD 4 billion. Its policy limits exposure to any connected group to 10% of Tier 1 capital. Company A has USD 220 million of loans and Company B, its subsidiary, has USD 150 million of loans. Company C, a connected affiliate, has USD 60 million of undrawn committed lines that would be drawn in full in a stress. Which statement is correct if all three are one connected group?

Show the solution

Limit = 10% × USD 4,000 million = USD 400 million.
Group exposure = 220 + 150 + 60 = USD 430 million, counting the committed lines at full draw.
Excess = 430 − 400 = USD 30 million.
Utilisation = 430 ÷ 400 = 107.5%, a breach.

Answer: The group is USD 30 million over its limit (107.5% utilisation). It is a breach that needs escalation and a remedy plan.

Example 2

A relationship manager whose bonus depends on loan volume proposes a loan that exceeds her approval authority and does not meet the policy's minimum cash flow coverage. She suggests the borrower's property collateral makes the loan safe. What is the right treatment?

Show the solution

The size exceeds her authority, so it must go to the higher tier named in the delegation.
Failing the minimum coverage test is a policy exception, which also requires higher-level approval and recording.
Collateral does not fix weak repayment capacity. It is a secondary source of repayment.
A sales-incentivised officer should not be the final approver, so independent credit review is needed.

Answer: Escalate to the proper higher authority as an exception, with independent credit review. Collateral does not cure the failed repayment test, and the approval should not rest with the sales officer.

Exam tips

Know the order: board sets appetite, policy follows, then limits, authority and underwriting implement it.
In numeric questions, check for connected borrowers and off-balance-sheet commitments before comparing with a limit.
Words like independent, escalate and exception are usually pointers to the correct option.
Collateral as the main basis for approval is almost always a wrong answer.
Tie concentration questions to a specific cause: single name, sector, country or correlated risk factors.

Practice questions from Governance

Credit Policies, Limits and Underwriting Standards: frequently asked questions

What is the difference between credit policy and risk appetite?

Risk appetite is the board's statement of how much and what type of credit risk the bank will accept. Credit policy is the set of lending rules that keep the bank within that appetite. Appetite sets the boundary and policy shows how to operate inside it.

How are credit approval authorities delegated?

The board gives authority to committees and officers in tiers. Authority depends on exposure size and usually on risk grade, collateral and policy exceptions. Larger, riskier or non-standard deals go to higher levels.

What are underwriting standards in banks?

They are the minimum analysis and terms required before credit is granted. They cover repayment capacity, purpose, financial strength, data verification, collateral, covenants and internal rating. Loosening them in a boom often leads to losses later.

How do limits control concentration risk?

Limits cap exposure to a single borrower, connected group, sector, country or product, often as a share of capital. This stops one event from causing a large share of losses. Limits should be paired with portfolio analysis because correlations can hide concentrations.