Credit Policy

A credit policy is an approved governance framework that defines which credit risks an organization may accept and how those risks must be originated, approved, documented, monitored, and resolved. It translates risk appetite and legal requirements into usable limits, underwriting standards, delegated authority, exception rules, and review controls.

A policy is not a substitute for analyzing an individual borrower. It establishes decision boundaries and accountability so similar requests are evaluated consistently and material risks reach the right approver.

Key Takeaways

• A credit policy should identify acceptable products, markets, borrowers, structures, concentrations, and risk levels.
• It should separate mandatory requirements from guidelines that permit documented judgment.
• Approval authority must consider total related exposure, not merely the amount of one new request.
• Exceptions should identify the provision, reason, risk, mitigants, approver, duration, and monitoring.
• Procedures explain how to implement policy; they should not quietly change the policy’s risk boundary.
• Policy must be reviewed when products, law, economic conditions, portfolio performance, or operating systems change.
• A policy that is routinely bypassed is not an effective control, even if the document appears comprehensive.

What a Credit Policy Usually Covers

The appropriate detail depends on the organization. A bank, bond investor, manufacturer offering trade credit, and fintech lender do not need identical documents.

Policy vs. Related Governance Documents

Policy should not contain every screen click or operational detail. Procedures can change more frequently, but they should remain consistent with approved policy.

Worked Example: Applying an Approval Matrix

Assume a policy delegates approval based on total related exposure:

A borrower group already has $1.2 million outstanding and requests a new $700,000 facility. The combined exposure would be $1.9 million.

The request exceeds the senior credit officer’s $1.5 million total-exposure authority even though the new facility alone is only $700,000. It should be escalated to the credit committee under this hypothetical matrix.

Before escalation, the file should also determine:

• whether undrawn commitments and guarantees count toward exposure;
• whether related entities must be aggregated;
• whether an exception or adverse risk grade changes the authority level;
• whether a concentration or legal lending limit is implicated; and
• whether approval conditions must be completed before funding.

Splitting the request into smaller facilities should not be used to avoid the required authority.

Mandatory Standard or Judgment Guideline?

Clear drafting distinguishes:

• prohibition: the organization will not extend the specified type of credit;
• mandatory eligibility requirement: the request cannot be approved without satisfying the rule;
• approval condition: a stated action must occur before or after closing;
• guideline: the normal expectation, with an authorized exception path;
• monitoring trigger: a condition requiring review, escalation, or reporting; and
• portfolio limit: an aggregate boundary rather than an individual-loan test.

Vague words such as normally, generally, or acceptable can create inconsistent decisions unless the policy explains judgment, evidence, and escalation.

Managing Policy Exceptions

An exception is a deliberate departure from a policy requirement or guideline. It is not the same as a missing document, borrower covenant breach, model override, or legal violation, although one request can involve several types of deviation.

A useful exception record includes:

1. the exact policy provision;
2. the reason compliance is not achieved;
3. the additional risk created;
4. relevant compensating factors or mitigants;
5. the requested duration and cure plan;
6. the authorized approver;
7. monitoring and reporting requirements; and
8. whether similar approvals reveal a policy design problem.

An approver cannot waive a law, binding program rule, or requirement outside that person’s authority. Repeated exceptions can indicate that the policy is unrealistic, staff are not following it, or risk appetite has changed without formal approval.

Fair and Consistent Application

For covered credit decisions, policy and discretion should be applied consistently and in accordance with fair-lending and other applicable requirements. Controls can include:

• defined underwriting criteria and permitted data;
• comparable assistance and exception treatment;
• documented reasons tied to facts in the file;
• review of overrides, approvals, counteroffers, and denials;
• monitoring by product, channel, decision maker, and relevant applicant groups; and
• accurate adverse-action notices when required.

Consistency does not require identical outcomes for borrowers with materially different facts. It requires that relevant differences, rather than prohibited or unsupported considerations, explain the outcome.

Reviewing Policy Effectiveness

Policy review should consider both design and actual results:

• approval, decline, counteroffer, and withdrawal patterns;
• policy and pricing exceptions by type and approver;
• delinquencies, defaults, losses, recoveries, and risk-grade migration;
• concentrations and limit breaches;
• documentation and collateral exceptions;
• complaints and fair-lending monitoring;
• model performance and overrides;
• new products, channels, vendors, or data sources; and
• changes in law, regulation, funding, and economic conditions.

Low losses do not automatically prove strong policy if the portfolio is new, rapidly growing, or supported by unusually favorable conditions.

Common Mistakes

• Copying another lender’s policy without adapting it to products, authority, systems, and risk appetite.
• Mixing mandatory rules and flexible guidelines without an exception process.
• Setting approval limits by new money while ignoring total related exposure.
• Letting procedures or model settings change risk boundaries without proper approval.
• Recording exception counts without age, severity, concentration, or outcomes.
• Reviewing policy on a calendar schedule while ignoring material business changes.
• Treating collateral as the primary repayment source for ordinary lending.
• Writing a policy so broad that nearly every decision appears compliant.

Risks and Limitations

A written policy cannot compensate for unreliable information, weak analysis, conflicts of interest, poor systems, unauthorized overrides, or ineffective monitoring. Policy also cannot replace product-specific legal, accounting, consumer-protection, or regulatory advice.

This page is educational and is not personalized lending, legal, compliance, accounting, or financial advice.

Authoritative Sources

• OCC Lending and Loan Portfolio Risk Management
• FDIC Risk Management Manual of Examination Policies
• FDIC Consumer Compliance Examination Manual
• CFPB Regulation B

Related Terms

• Credit Approval Authority: Delegated decision power established by policy.
• Credit Underwriting: Application of evidence and standards to a credit request.
• Credit Administration: Implementation and monitoring after approval.
• Manual Underwriting: Human review using verified evidence and documented judgment.
• Compensating Factors: Documented strengths relevant to a permitted exception.

FAQs