Credit limits are used mainly when the front office checks the remaining room under a limit before executing a trade, and when the risk management unit compares each day's usage with the limit.

What credit limits are for

A credit limit is the maximum exposure (the amount that could be lost if the counterparty failed) that a financial institution allows itself to hold against a single counterparty. With OTC derivatives, counterparty credit risk exposure can grow suddenly. If a counterparty fails after its exposure has grown, the loss is larger than expected1. By setting credit limits in advance, the institution keeps its exposure to any one counterparty within the range it has decided to accept.

Two documents set out sound practice for credit limit management. One is the Basel Committee on Banking Supervision's Guidelines for counterparty credit risk management, finalized in December 2024. The other is the supervisory guidance that US banking regulators issued in 2011 (revised in June 2026; referred to below as the US supervisory guidance)2. Each institution decides which metrics to use and how detailed its systems should be, in line with the size, complexity, and riskiness of its trading3.

A limit can cause problems if it is too large or too small. If it is too large, a sudden rise in exposure does not break the limit, so the rise is noticed late. If it is too small, usage breaks the limit and requests for approval become frequent. Neither kind of limit correctly reflects the amount of risk the institution is willing to take4.

How limits are set for each counterparty

A credit limit starts from an assessment of the counterparty's credit quality. When a relationship begins, the institution analyzes the counterparty using financial information and also non-financial information, such as its reputation, strategy, and actual risk management practices5. The institution assigns the counterparty an internal rating and uses it to decide its trading policy and to set credit limits6. For a counterparty about which the institution cannot obtain enough information, the institution takes a conservative approach, for example by assigning a lower rating, setting a smaller credit limit, and demanding stricter margin terms5.

A limit framework includes both limits on individual counterparties and limits on concentrations of exposure7. Concentrations include exposure to each legal entity and exposure aggregated at the parent level or across related entities1. The limits also cover other exposures to the same counterparty, such as loans4. For this reason, exposures of different forms to the same counterparty, such as derivatives exposure and drawn loan amounts, should be visible in a single report or system8.

The size of a limit and the level at which it is approved depend on the counterparty's credit quality, the tenor of the trades, and the liquidity of the positions and hedges. The larger the exposure to the counterparty, the weaker its credit quality, or the longer the tenor, the more senior the person who must approve the limit9. Limits are reviewed regularly to match the institution's risk appetite, market conditions, and business strategy, and also when the counterparty's credit quality or exposure changes4.

How credit limit usage is measured

Credit limit usage is normally measured by the maximum of potential future exposure (PFE) for each counterparty. PFE is a high percentile (often 95% or 99%) of the distribution of exposure at each future date, calculated date by date out to the maturity of the longest trade. Usage is the largest of these values11. The usage compared with the limit is measured by such high-percentile values, not by expected exposure (EE). A high-percentile value represents the amount of risk the institution accepts from a single counterparty, while EE is a measure suited to credit models that combine many counterparties and to the calculation of CVA9. The definitions and calculation of PFE and EE are covered in Exposure Measures: CE, PFE, EE/EPE and EAD.

Current exposure (CE) and PFE, which form the basis of usage, are calculated daily for each counterparty from the previous day's trade positions and collateral movements8. CE is the market value that would be lost if the counterparty failed (never below 0), and it is also called replacement cost11. Close-out netting and collateral reduce usage. How much they reduce it is covered in Risk Reduction through Netting and Collateral.

At institutions with heavy trading activity, trades that the measurement system handles poorly are sometimes calculated outside the main system, and the resulting amounts (add-ons) are added to the portfolio's PFE. Conservative (larger) add-ons are suitable only in limited cases, where the main system cannot capture the risk of complex products. Relying too much on add-ons distorts the measurement, so the institution reviews its use of add-ons at least once a year and also caps the growth of trading in products that rely on them12.

Besides PFE, comparing exposure under stress with credit limits is also listed as a sound practice13. The reason is that PFE misses some risks. For example, if the institution holds more collateral than it needs, PFE becomes zero. But if the counterparty fails and the collateral loses much of its value before it can be sold, a loss can still occur14. Some institutions also set limits on CVA or on CVA value at risk (VaR), but such limits do not remove the need for PFE-based credit limits9.

Deep diveExposure calculated by regulatory methods

SA-CCR (the standardized approach to calculating exposure on derivatives), used in capital adequacy rules, calculates exposure with formulas rather than models. Exposure equals the sum of replacement cost and PFE, multiplied by 1.4. Under the US rules, the 1.4 multiplier does not apply to trades with commercial end users. This PFE is derived from inputs such as notional amount, maturity, and supervisory factors set by regulators for each asset class15. The trade-level amounts behind PFE assume zero market value and zero collateral. They are designed to give a conservative (larger) estimate of effective EPE (the average expected exposure used in regulation)16. Although it has the same name, the PFE in SA-CCR serves a different purpose from the PFE maximum (a high-percentile value) that institutions use internally for credit limits, and the two values do not match even for the same counterparty.

Pre-trade checks and daily monitoring

Credit limits are enforced in two stages: a check before each trade and daily monitoring after it. Consider a hypothetical example in which P Bank has several interest rate swaps with Company C (a nonfinancial company), its credit limit for Company C is 2 billion yen, and usage (the PFE maximum) is 1.2 billion yen.

  1. When Company C asks for a new interest rate swap, P Bank's front office checks in the system, before execution, what usage would be with the trade added to the existing trades. Procedures and systems that calculate a trade's effect on usage before execution are one way to control trading during the day17.
  2. If usage with the trade added is 1.6 billion yen, it stays within the 2 billion yen limit (80% of the limit is used), so the front office can execute the trade. If usage with the trade added would be 2.3 billion yen, it would exceed the limit by 300 million yen. The front office cannot execute the trade as it stands and must seek approval from a designated, more senior authority7.
  3. After execution, the risk management unit recalculates usage at least daily, in a system independent of the trading business, and compares it with the limit9. When usage approaches the limit, the unit issues an early warning18. If P Bank sets its warning level at 90% of the limit (1.8 billion yen), it alerts the front office and the credit officer on the day usage goes above 1.8 billion yen.
  4. Depending on the counterparty and market conditions, the risk management unit supplements daily measurement with intraday measurement. Intraday measurement is meant to give early warnings when an excess is likely18.
Front officeRisk management unitSenior authorityWithinOverExcessBefore execution,checks usage withthe new trade addedWithin the limit,so executesOver the limit,so decides onapprovalAfter execution,compares usagewith limit dailyWarns when usageapproaches thelimitReports an excesswhen usage goesover the limitEscalates by sizeof excess anddecides approval
Figure 1Flow for checking limit usage and handling an excess
Figure description

The diagram follows the pre-trade check, daily measurement after execution, and the handling of an excess across the front office, the risk management unit, and a senior authority. Before the trade, the front office checks usage with the new trade added to the existing trades. If usage stays within the limit, the front office executes the trade as it is. If usage would exceed the limit, a senior authority decides on approval. After execution, the risk management unit recalculates usage every day and compares it with the limit. It issues a warning as usage approaches the limit and reports an excess when usage goes over it. A reported excess is escalated to a higher level according to its size, and a large excess requires approval from a senior position. Note that the diagram shows the flow when approval is given and does not show what happens when it is not.

A large number of limit excesses may be caused by weaknesses in the measurement systems. System weaknesses that call into question whether the limit framework is sound should be fixed quickly19.

What happens when a limit is exceeded

The procedure for a limit excess depends on the size of the excess. A large excess requires approval at a senior level, and the approval is recorded in a system or similar record18. Even when approval authority is delegated to staff, final accountability stays with senior management and the risk management committee20.

Usage can exceed the limit without any new trade, when market moves change market values. This is called a passive excess, and it goes through the same approval process as an excess caused by a new trade18. In the earlier example, suppose rates move sharply three months later and P Bank's usage for Company C rises to 2.1 billion yen. No new trades have been added, but usage is 100 million yen over the limit. P Bank's risk management unit reports the excess and either obtains approval or decides how to reduce usage.

Ways to reduce usage include tightening the terms under which the institution receives collateral from the counterparty, adding a guarantee to support the counterparty's credit quality21, and restricting trading with the counterparty22. When relying on a guarantee, the institution checks the guarantor's credit quality and whether the guarantee contract reliably covers the counterparty's payment obligations under the derivatives. A guarantee with a cap on the amount can fall short for derivatives, whose exposure can swing widely with the market21. Counterparties with which trading may be restricted or from which risk reduction may be requested are kept on a watch list on an ongoing basis22.

An excess in which usage is wrongly overstated because of bad data or a system error (a technical excess) is not left alone either. It goes through approval like an ordinary excess. To keep monitoring usage until the cause is fixed, the institution may also adjust the limit with approval18.

Roles of the front office and the risk management unit

Credit limits are set by a unit independent of the front office that does the trading, taking into account the counterparty's credit quality, financial condition, and leverage18. The institution makes its risk management unit independent of the trading business and gives it the authority to enforce policies and to escalate problems to senior management23. The table below shows the role of each party24.

Party Role in credit limit management
Board of directors and senior management Approve the framework for setting counterparty limits and concentration limits, and receive reports on limit excesses and on approved exceptions
Committee that sets limits (such as a risk management committee) Sets limits, reviews them regularly, and approves large excesses
Credit and risk management units Assess counterparties' credit quality and set limits, measure usage daily, and manage excesses
Front office Checks usage before execution and trades within limits. Seeks approval when a trade would exceed a limit
Internal audit Periodically audits whether limit approval procedures, ratings, and monitoring are adequate

Counterparty credit risk has both market risk and credit risk aspects, so the market risk and credit risk units manage it together25.

Credit limits are mainly internal caps that financial institutions set and manage themselves. Separately, Japan's Banking Act caps the total credit that a bank extends to a single person, including persons with a special relationship to that person, at the bank's capital multiplied by a set ratio. These rules are known as the large exposure regulation. A Cabinet Order and a Cabinet Office Order define which items count as credit and how the amounts are calculated28.

The calculation of exposure under capital adequacy rules (SA-CCR and other methods) is covered in Overview of the Regulatory Treatment of Counterparty Risk.

Notes

  1. Office of the Comptroller of the Currency et al., "Interagency Supervisory Guidance on Counterparty Credit Risk Management" (June 2011, revised June 2026), III.3, "Concentrations," page 6. ↩ ↩2

  2. Financial Services Agency (FSA) and Bank of Japan (BOJ), "バーゼル銀行監督委員会「カウンターパーティ信用リスク管理に関するガイドライン」について" (On the Basel Committee on Banking Supervision's Guidelines for counterparty credit risk management) (April 2025; referred to below as the FSA and BOJ commentary), page 4, "背景・経緯" (Background) (in Japanese). The US supervisory guidance, cover page (June 29, 2011; revised June 2026). ↩

  3. The US supervisory guidance, III.1, "CCR Metrics," page 5, and the introduction to Appendix A, page 20. ↩

  4. The FSA and BOJ commentary, page 15, "Limits（信用枠・リミット）" (Limits) (in Japanese). ↩ ↩2 ↩3

  5. The same document, pages 8–9, "デューデリジェンスとモニタリング" (Due diligence and monitoring) (in Japanese). ↩ ↩2

  6. Bank of Japan Financial System and Bank Examination Department, Center for Advanced Financial Technology, "信用リスク管理態勢の整備" (Developing a credit risk management framework) (August 2019), page 9, "①目的の明確化" (1. Clarifying the purpose) (in Japanese). ↩

  7. The US supervisory guidance, II.1, "Board and Senior Management Responsibilities," page 3. ↩ ↩2

  8. The US supervisory guidance, III.2, "Aggregation of Exposures," page 5. ↩ ↩2

  9. The same document, V.1, "Counterparty Limits," page 13. ↩ ↩2 ↩3 ↩4

  10. The same document, IV, "Systems Infrastructure Considerations," under "Data Integrity and Reconciliation" and "Automation and Tracking," pages 11–12. ↩

  11. The same document, Appendix A, "Current Exposure" and "Peak Exposure," pages 20–21. The document calls the high percentile at each date "peak exposure." ↩ ↩2

  12. The same document, IV, "Add-Ons," page 13. ↩

  13. The same document, Appendix A, "Stressed Exposure," page 21. ↩

  14. The FSA and BOJ commentary, page 13, "Potential future exposure (PFE)" (in Japanese). ↩

  15. Federal Deposit Insurance Corporation, "Standardized Approach for Counterparty Credit Risk" (May 2021), page 4, "SA-CCR Mechanics," "Potential Future Exposure," and "Alpha Factor." ↩

  16. The same document, page 5, "Adjusted Derivative Contract Amount." ↩

  17. The US supervisory guidance, V.1, "Counterparty Limits," page 14. ↩ ↩2

  18. The FSA and BOJ commentary, page 20, "Limit governance and exception management（リミットのガバナンスと超過管理）" (Limit governance and exception management) (in Japanese). ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  19. The US supervisory guidance, IV, "Data Integrity and Reconciliation," page 12. ↩

  20. The FSA and BOJ commentary, page 18, "Risk framework（リスク管理の枠組み）" (Risk framework) (in Japanese). ↩

  21. The same document, pages 10–11, "信用リスク削減手法" (Credit risk mitigation) (in Japanese). ↩ ↩2

  22. The same document, page 22, "Closeout practices（取引の清算）" (Closeout practices) (in Japanese). ↩ ↩2

  23. The US supervisory guidance, II.3, "Risk Management Function and Internal Audit," page 4. ↩

  24. The US supervisory guidance, II.1 (page 3), II.3 (page 4), and V.1 (pages 13–14), and the FSA and BOJ commentary, pages 15 and 18–20 (in Japanese). ↩

  25. The FSA and BOJ commentary, page 17, "People and risk culture（人材とリスク・カルチャー）" (People and risk culture) (in Japanese). ↩

  26. The same document, page 19, "Management reporting（経営陣への報告）" (Management reporting) (in Japanese). ↩

  27. The US supervisory guidance, II.2, "Management Reporting," page 4. ↩

  28. "銀行法" (Banking Act, in Japanese; English translation: Japanese Law Translation), Article 13, paragraphs 1 and 6. The cap that includes subsidiaries and similar entities is in paragraph 2 of the same article. ↩