Risk concentration · COBAC large exposures regulation
Your risk concentration framework, measured against COBAC regulation and turned into a costed action plan.
10 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
Risk concentration · COBAC large exposures regulation
10 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One COBAC regulation on risk concentration and large exposures (Commission Bancaire de l’Afrique Centrale, CEMAC zone) assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
This mechanism (a level, a level above, and the action that links the two) is what turns an observation into a trajectory.
Are groups of connected clients identified and kept reliably up to date?
- N1
No structured identification. Exposures are tracked by individual client, links between counterparties are not recorded.
- N2
Groups are rebuilt manually at closing, based on relationship managers’ knowledge. The definition of links varies between analysts.
- N3
A written definition of control links and economic dependency is applied. Groups are recorded in the third party database and reviewed at each file renewal.
- N4
Group membership is assessed at onboarding and is a blocking step in the lending process. Aggregated exposures are recalculated at every movement, with an audit trail.
- N5
Groups are cross checked against external sources and market data, reviewed periodically, and detected discrepancies feed a documented review of the identification method.
Action to move from L2 to L3
Formalise an internal note defining the criteria for group of connected clients membership, integrate it into the credit assessment file, and task permanent control with checking its application on a sample of files during the quarterly portfolio review.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon COBAC.
What this framework covers
The COBAC regulation on risk concentration sets a limit on how much a credit institution in the CEMAC zone can be exposed to a single beneficiary or a single group of connected clients. It imposes three distinct requirements: identifying on and off balance sheet exposures by beneficiary, aggregating those relating to a single set of counterparties linked through control or economic dependency, and then respecting an individual cap relative to net own funds and an aggregate cap on total large exposures. Periodic reporting obligations come on top of this, directly linked to the own funds regulation, the denominator underlying the whole framework.
In practice, the difficulty lies not in the rule itself but in the data feeding it. Can the client database reconstruct a group of connected clients, or are capital and economic links captured in free text fields? Do signature commitments, confirmed but undrawn lines and securities portfolio exposures feed into the same aggregate as disbursed loans? Is a breach detected at the point of lending, or only found at quarterly closing, when it is too late to act. These three questions are what separate a reporting exercise from an actual steering framework.
Banking supervision in the CEMAC zone has tightened as COBAC gradually transposes Basel principles: an overhaul of prudential own funds, a build up of internal control, and governance and ICAAP requirements. Risk concentration now sits within this wider picture. A common confusion persists: meeting the cap does not exhaust the obligation. An institution can show a compliant ratio and still carry a sectoral, sovereign or geographic concentration that the regulation does not explicitly cap but that the supervisor will question. Concentration is a governance matter, not just a calculation.
Prudential supervision asks a binary question: is the cap breached, is the report filed on time. The maturity assessment asks a different question: what level of control does the framework actually reach, and what specific action moves it up a level. A bank that updates its groups of connected clients by hand once a year and a bank that recalculates them at every new relationship can show the same ratio. They do not share the same maturity, nor the same risk of discovering a breach after the fact.
Within Datamensio, the framework is ready to use and adapts to your organisation: single country network, regional banking group, microfinance institution subject to a distinct regime. The AI adjusts the themes, questions and levels, or builds a tailored version from your lending procedures, your regulatory returns and your credit risk policies.
Reference standard: COBAC regulation on risk concentration and large exposures (Commission Bancaire de l’Afrique Centrale, CEMAC zone)
The themes assessed
Concentration policy and risk appetite
Formalised risk concentration policy, internal limits stricter than the regulatory cap, sign off by the governing body, alignment with credit strategy and risk appetite.
Identification of beneficiaries and groups of connected clients
Definition applied for control links and economic dependency, assessment procedure, updates at onboarding and reviews, treatment of cross border groups.
Scope of exposures captured
Coverage of on and off balance sheet items, signature commitments, confirmed but undrawn lines, securities and interbank exposures, derivatives, exclusions and weightings applied.
Ratio calculation and reference to own funds
Determination of the net own funds used as the denominator, calculation of the individual cap and the aggregate cap on large exposures, recalculation frequency, audit trail of the calculation.
Detection and blocking mechanism at the point of lending
Limit availability check before a decision is made, threshold alerts, escalation procedure, conditions and traceability of exemptions granted.
Monitoring of breaches and remediation plans
Detection, qualification and reporting of breaches, plan to return under the cap, deadlines met, information to the governing body and the Commission Bancaire.
Data quality and information systems
Single source of truth for the third party database, reconciliation between the lending system, accounting and the reporting tool, automated consistency checks, management of duplicate counterparties.
Prudential reporting to COBAC
Production of large exposure returns, deadlines met, first and second line checks before submission, handling of correction requests from the supervisor.
Internal control and audit
Permanent controls dedicated to concentration, audit plan covering the framework, follow up of recommendations from internal reviews and on site inspections.
Reporting and risk governance
Concentration dashboard presented to the risk committee, analysis by sector, geography and signature type, decisions made and follow up on their execution.
A short version of the framework is available for the online self-assessment.
Frequently asked questions
Does this assessment replace a COBAC inspection?
No. The Commission Bancaire verifies that caps are respected and that reporting is accurate. The assessment positions the maturity of your framework on a progressive scale and points to the actions needed to strengthen it. It prepares for the on site inspection, it does not replace it and it does not issue any certification.
How does this differ from a regulatory compliance audit?
An audit concludes with a gap or a pass at a given point in time. The assessment measures the level of practical control practice by practice and links each gap to a costed improvement action. The two complement each other: the assessment feeds the action plan, the audit validates the result.
How long does the assessment take?
The short version is completed in one working session with the head of risk. The full version, run collaboratively with lending, compliance, permanent control and IT, takes one to two weeks, most of the time going into gathering evidence.
Can the framework be adapted to our institution?
Yes. Themes, questions and levels can be changed, and you can add your internal limits or portfolio specifics. The AI can also build a tailored version from your lending procedures and your regulatory returns. You retain full control of the framework.
Does it apply to microfinance institutions in the CEMAC zone?
MFIs fall under a distinct prudential regime, with its own risk concentration standards. The framework adapts to this: the governance, data quality and detection themes remain relevant, while thresholds and returns are adjusted.
How does this assessment relate to credit risk and own funds?
Risk concentration uses net own funds as its denominator and relies on the same exposure data as credit risk. A cross cutting roadmap consolidates several assessments and avoids duplicating the same action, particularly on the quality of the third party database.
Can several subsidiaries of a regional group be compared?
Yes. The same framework is rolled out to each entity, and scores can be compared by theme and over time. The consolidated readout highlights practice gaps between subsidiaries and feeds a group wide roadmap.
Where is the data hosted?
In France, with OVH, backed up with Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European providers.