Concentration Risk Management in NBFCs: Moving beyond exposure limits to portfolio resilience

Non-Banking Financial Companies have become an important source of credit across consumer finance, housing, vehicles, microfinance, infrastructure, small businesses and specialised lending segments. Their ability to serve borrower segments that may not always be adequately reached through conventional banking has contributed significantly to financial intermediation in India.

Specialisation, however, creates its own risk.

An NBFC may develop expertise in a particular product, geography, borrower category or industry and gradually build a portfolio that appears individually sound at the account level but is excessively dependent on a common risk factor. A deterioration in that factor can then affect a large proportion of the loan book simultaneously.

This is concentration risk.

Recognising its importance, the Reserve Bank of India has progressively strengthened the framework governing concentration of credit and investments by NBFCs. The regulatory architecture has now been consolidated through the Reserve Bank of India (Non-Banking Financial Companies – Concentration Risk Management) Directions, 2025, which apply concentration requirements according to the scale and systemic significance of NBFCs.

The regulatory message is significant: diversification cannot be viewed merely as a desirable portfolio characteristic. It is an essential component of financial resilience.

What is Concentration Risk?

Credit risk is normally analysed by examining the probability that an individual borrower may fail to meet obligations. Concentration risk arises when several exposures can suffer at the same time because they share a common source of vulnerability.

The most obvious example is excessive lending to one borrower.

Suppose an NBFC has Tier 1 capital of Rs. 1,000 crore and lends Rs. 200 crore to one corporate borrower. A severe default would represent a material exposure relative to the institution’s capacity to absorb losses.

But concentration can take many other forms.

An NBFC may have thousands of separate borrowers and still remain highly concentrated if most borrowers:

• operate in the same industry;
• earn income from the same economic activity;
• are located in the same geographical region;
• belong to interconnected corporate groups;
• depend upon the same large customer;
• rely upon the same commodity;
• depend upon similar collateral values; or
• are vulnerable to the same economic shock.

A portfolio containing 50,000 loans is therefore not necessarily diversified.

The relevant question is not simply “How many borrowers do we have?”

It is “How many independent risk drivers do we have?”

Why concentration can build up quickly in NBFCs

The business models of NBFCs make concentration management particularly important.

Many NBFCs succeed because they specialise. A vehicle financier develops expertise in commercial vehicles. A housing finance company develops specialised property assessment capabilities. A microfinance institution builds rural distribution networks. An infrastructure finance company develops expertise in long-duration projects.

Specialisation can improve underwriting capability. However, if growth remains concentrated in the same segment, the organisation’s expertise may gradually become dependence.

Competitive pressures can add to the problem. When one lending segment produces attractive yields and low defaults, institutions naturally allocate more capital towards it. Historical performance may provide confidence precisely when future concentration is increasing.

Concentration risk can therefore accumulate during good times and become visible only after conditions deteriorate.

RBI’s scale-based approach

The RBI framework follows the principle of proportionality. Requirements become more stringent as an NBFC moves from the Base Layer to the Middle Layer and ultimately to the Upper Layer.

Base Layer: Internal Limits Become Essential

For applicable NBFCs in the Base Layer, the Board is expected to establish a comprehensive concentration risk management policy, including internal credit and investment concentration limits for individual borrowers and borrower groups.

The framework also gives particular attention to consumer credit. NBFCs are required to review sectoral exposure limits for consumer credit and establish Board-approved limits for relevant sub-segments, with specific limits for unsecured consumer credit.

This requirement carries an important risk-management message.

A portfolio consisting of lakhs of small unsecured personal loans may have virtually no single-borrower concentration. Nevertheless, borrowers may react similarly to unemployment, income stress, inflation or excessive household indebtedness. The absence of a large individual account does not eliminate concentration risk.

Middle Layer: Regulatory Exposure Limits

For NBFCs in the Middle Layer, excluding Infrastructure Finance Companies, credit and investment exposure taken together should ordinarily not exceed:

• 25 per cent of Tier 1 capital to a single party, and
• 40 per cent of Tier 1 capital to a single group of parties.

Additional exposure is permitted in specified circumstances where it relates to infrastructure lending or investment.

Infrastructure Finance Companies have separate higher limits reflecting the nature of their specialised business.

The use of Tier 1 capital is important. Concentration limits are thereby connected directly with the institution’s core loss-absorbing capacity.

The Middle Layer framework also requires attention to Sensitive Sector Exposures, particularly capital market and commercial real estate exposures, with Board-approved internal limits.

Upper Layer: Large Exposure Framework

The regulatory approach becomes substantially more sophisticated for Upper Layer NBFCs.

A Large Exposure is broadly an exposure equal to or exceeding 10 per cent of the NBFC’s eligible capital base to a counterparty or group of connected counterparties.

For an Upper Layer NBFC other than an Infrastructure Finance Company, exposure to a single counterparty is generally limited to 20 per cent of the eligible capital base.

The Board may permit an additional 5 per cent under prescribed conditions, but the single-counterparty exposure cannot ordinarily exceed 25 per cent for such NBFCs.

For a group of connected counterparties, the general limit is 25 per cent of the eligible capital base, subject to the specific infrastructure-related provisions contained in the regulatory framework.

The framework therefore moves from simple borrower limits toward identification of the underlying economic relationship between exposures.

The importance of connected counter-parties

One of the most significant aspects of modern concentration risk management is that legal separation does not necessarily mean economic independence.

Consider an NBFC lending separately to five companies. Each company may have a different legal identity and separate loan documentation. If all five companies are controlled by the same promoter, difficulties affecting the group could weaken all of them simultaneously.

The same problem can exist even without common ownership.

Two companies may be economically dependent because one receives most of its revenue from the other. Several entities may depend on the same repayment source. One company may guarantee the liabilities of another. Two borrowers may depend predominantly on the same source of funding.

The RBI framework therefore recognises both control relationships and economic interdependence when identifying groups of connected counterparties.

This is a major advancement over a purely name-based approach to exposure monitoring.

Credit systems must be able to identify who ultimately controls a borrower, where its revenues originate, what guarantees exist, how cash flows are connected and whether distress in one entity could spread to another.

For risk managers, this becomes a form of contagion analysis.

Sector Concentration Can Be More Dangerous Than It Appears

Regulatory borrower limits provide an essential safeguard, but an NBFC can remain within every single-borrower limit and still develop excessive sector concentration.

Consider an NBFC with a Rs. 10,000 crore loan portfolio.

Suppose no individual borrower represents more than 1 per cent of the portfolio, but Rs. 4,000 crore has been lent to commercial real estate.

There may be no borrower concentration violation. Yet a major decline in property demand, delays in project approvals, falling prices or refinancing difficulties could affect a substantial portion of the portfolio simultaneously.

Sector limits should therefore be determined according to more than historical default rates.

An effective framework should examine:

• existing exposure;
• pipeline commitments;
• expected portfolio growth;
• asset quality trends;
• collateral dependence;
• economic outlook;
• borrower leverage;
• refinancing requirements; and
• stress-test results.

A sector that currently demonstrates low non-performing assets may still contain significant forward-looking risk.

Geographic concentration deserves equal attention

Geographic concentration can be especially important for regional NBFCs and microfinance lenders.

An institution may have thousands of customers concentrated in a few districts. A flood, cyclone, drought, political disruption, industrial closure or local economic slowdown could impair a large number of borrowers simultaneously.

Climate change makes this dimension increasingly relevant.

Flood-prone districts, areas exposed to extreme heat, drought-sensitive agricultural regions and coastal locations vulnerable to cyclones may create correlated credit losses even when individual borrowers appear unrelated.

Geographical concentration dashboards should therefore move beyond state-level reporting and, where appropriate, identify district, city or even postal-code clusters.

Collateral does not automatically diversify risk

A portfolio may appear secure because loans are collateralised. However, if many borrowers provide similar collateral, another concentration can emerge.

For example, an NBFC may have a large portfolio secured against commercial property. Borrower defaults might initially appear manageable because each loan has adequate security.

But during a severe real estate downturn, borrower defaults and falling collateral values can occur at the same time.

This is known as wrong-way risk: precisely when the borrower becomes weaker, the protection expected from collateral also loses value.

The same principle can apply to shares, vehicles, commodities and other assets.

Risk managers should therefore ask not merely whether a loan is secured but whether the value of the security is correlated with the reason the borrower might default.

Credit risk transfer: Useful but not risk elimination

The RBI framework permits specified credit risk transfer arrangements to be recognised while computing exposures.

Eligible mechanisms include certain cash margins or security deposits, qualifying government guarantees and specified credit guarantee schemes, subject to regulatory conditions. Guarantees that qualify for recognition are expected to satisfy requirements such as being direct, explicit, irrevocable and unconditional.

This provides NBFCs with legitimate tools for managing concentration.

However, risk transfer should never be confused with risk disappearance.

When a guarantee or credit protection substitutes for the original exposure, the organisation may acquire exposure to the protection provider.

Risk management must therefore examine the quality, enforceability and concentration of the protection itself.

A portfolio cannot truly be described as diversified if numerous loans are all dependent upon the same guarantor.

Stress testing concentration risk

One of the best methods for determining whether concentration is dangerous is stress testing.

Suppose an NBFC has significant exposure to vehicle finance. Management could test scenarios involving:

• a sharp increase in fuel prices;
• declining freight demand;
• falling resale values of commercial vehicles;
• higher interest rates;
• deterioration in borrower cash flows; and
• simultaneous increase in delinquencies.

A commercial real estate lender could test falling occupancy, delayed completion, reduced property values and refinancing constraints.

An unsecured consumer lender could model unemployment, income compression and simultaneous deterioration in particular borrower cohorts.

The purpose should not be to predict exactly what will happen.

It should answer a more useful question:

If a major common risk factor deteriorates, can the NBFC absorb the resulting losses without threatening capital, liquidity or normal operations?

Concentration risk should be linked to risk appetite

Regulatory ceilings should be regarded as outer boundaries rather than business targets.

An NBFC should normally establish internal limits well before regulatory limits are reached.

A comprehensive risk appetite framework could contain:

• single counterparty limits;
• connected group limits;
• industry limits;
• geographical limits;
• product limits;
• unsecured lending limits;
• collateral concentration limits;
• large exposure thresholds; and
• limits for sensitive sectors.

Early-warning thresholds can be placed below final limits.

For example, management attention may be triggered when a sector reaches 70 per cent of its approved limit and escalation to the Risk Management Committee may occur at 85 or 90 per cent.

This enables concentration to be managed before it becomes a constraint on future business.

The board’s role is central

The RBI framework repeatedly emphasises Board-approved policies, reflecting an important governance principle.

Concentration risk cannot be delegated entirely to individual credit officers.

A relationship manager evaluates whether a particular borrower should receive a loan. The Board and senior management must consider a different question:

Even if this borrower is creditworthy, does the institution already have too much exposure to this borrower, group, sector or common risk factor?

Both decisions can be correct independently. A high-quality borrower may still need to be declined because the portfolio is already over-concentrated.

For Upper Layer NBFCs, Board oversight extends further, including policies for connected counterparties, important sectoral limits and conditions governing exceptional exposures.

Data is the foundation

Effective concentration risk management ultimately depends upon data quality.

An NBFC cannot aggregate exposures correctly if customer names are inconsistent across systems, group relationships are incomplete, guarantees are not mapped, promoter connections are missing or sector classifications are inaccurate.

Modern risk architecture should enable a risk officer to move from:

Group 1 Company 1 Borrower 1 Facility 1 Security 1 Guarantor 1 Sector 1 Geography

and determine the total exposure at each level.

Analytics can further identify hidden correlations that conventional reporting may miss.

However, sophisticated dashboards do not compensate for poor underlying data. Governance over borrower classification, group mapping and exposure calculation remains fundamental.

From compliance to resilience

Perhaps the most important lesson from the RBI’s concentration framework is that regulatory compliance should be the starting point rather than the final objective.

An NBFC may comply with every prescribed numerical limit and still remain vulnerable because of concentration in a particular product, geography, customer type, collateral or funding source.

Good concentration risk management therefore asks three questions:

Where are we concentrated today?

Which common event could affect these exposures simultaneously?

Would our capital and liquidity remain adequate if that event occurred?

These questions convert concentration management from a compliance calculation into an enterprise risk discipline.

Conclusion

Concentration risk is deceptive because it frequently builds during periods of successful growth. Strong performance in a particular segment encourages further lending, good historical asset quality creates confidence and specialised expertise supports expansion.

The danger becomes visible only when the common factor supporting that portfolio deteriorates.

The RBI’s concentration risk management framework recognises this reality through progressively stronger requirements across Base, Middle and Upper Layer NBFCs. Individual and group exposure limits, sensitive sector controls, identification of connected counterparties, recognition of eligible risk-transfer mechanisms and the Large Exposure Framework collectively create important prudential safeguards.

But numerical limits alone cannot create resilience.

NBFCs need to understand the economic connections hidden behind their portfolios. Sector, geography, borrower group, product, collateral and common sources of repayment must be analysed together. Stress testing should reveal where apparently diversified loans could behave as a single exposure during a crisis.

The real objective of concentration risk management is therefore not simply to ensure that no borrower becomes too large.

It is to ensure that no single event, relationship or risk factor becomes large enough to threaten the institution itself.