top of page

Rating Credit Risk With Commercial Lending Expert Vin Vieten

WFC 22 | Rating Credit Risk

Simply put, credit risk is the risk of loss due to a borrower not repaying a loan. Today, Mark Treichel interviews subject matter expert Vin Vieten on rating credit risk.

Why did NCUA make it a Regulatory requirement in $723.4(g)? Credit risk ratings must be assigned to commercial loans at inception and reviewed as frequently as necessary to satisfy the federally insured credit union's risk monitoring and reporting policies, and to ensure adequate reserves as required by generally accepted accounting principles (GAAP). Tune in and learn all this and more.

If you are someone who is thinking about getting into commercial lending, this is an episode you don’t want to miss.


Listen to the podcast here

Rating Credit Risk With Commercial Lending Expert Vin Vieten

We've got another great episode today. I'm thrilled to have Vin Vieten here with me. Vin, how are you?

I'm great, Mark. How are you doing?

I'm doing good. You've been on a couple of other episodes. Vin is a commercial lending guru, formerly of NCUA and other places. Could you introduce yourself to those readers who may not have read our previous chats?

I was a commercial lender in New England for good 30 years. Thanks to the '90s, there were a lot of changes in bank ownership. I worked for a number of banks and was exposed to a number of good credit systems, including large regional banks. That was very helpful in developing knowledge for commercial lending. I had the opportunity to start 2 commercial loan departments and 2 community banks. That was a lot of fun.

I've got to work with a lot of small and medium-sized businesses and learn the importance of providing a good, valuable commercial lending service to those businesses because of their importance in their local communities between the economic activity they create and also the employment they provide. I had an opportunity to go to work for one of my customers, a large ready-mix concrete company. Those are the guys who deliver concrete to the job sites. It was located in 3 states and had about 300 employees. I got to get a feel for what it's like to be a borrower because I managed banking and leasing relationships.

What that taught me is how important small business lending is as this business had 300 people. He used to say, "I have to feed 300 families every week." It does reinforce how important and rewarding to provide commercial financing in the right way to a business. After that, I had an opportunity to work as a regulator. I've now been a lender, a borrower, and now a regulator, working for the NCUA, where I spent the last eleven years of my career. I retired in February of 2021. While there, I was able to take that experience as a lender in good and bad times, working for that ready-mix concrete company and getting involved with providing commercial lending the expertise to the agency and credit unions.

A couple of things I was involved with that I really enjoyed at NCUA were working on the taxing situation and helping to write guidance. The most important contribution was being the principal author on the rewrite of part 723 of the commercial lending regulation. It was a lot of fun. I felt very fortunate to end my career having an influence nationwide, helping credit unions, which I have a strong affection for because of your purpose of serving members and making sure they get the best financial services.

You were the principal author of NCUA's commercial lending rule, which was more of a principles-based rule. We've talked about different parts of that rule up until this point in time, global cashflow being one of them. Our topic is going to be rating credit risk. Is that what we're talking about in this episode, Vin?

That's what we're talking about in this episode, rating credit risks.

Going back to the regulation you were the principal author of, why didn't you make it a regulatory requirement to have a credit risk as part of policies and procedures at credit unions?

To be effective, the risk grading system should be accurate at all times.

It was interesting because when we were writing the rule, we had a conversation with our regional lending specialists to say, "What do you think the percentage of credit unions are using a credit risk rating system?" They said, "Probably a little over 50%," which reinforced that it's important that we discuss and make it a requirement to have a credit risk rating system. Rating credit risk is a standard and accepted practice in managing commercial loan risk. All the other regulators focus on it.

That's not the reason to do it because other regulators do it, but since it is the accepted practice, those of us who were involved with commercial lending in the past knew how important it was in monitoring risk. Another reason why it made sense is what we had noticed is sometimes boards were not as informed as they should be at the level of risk in the commercial portfolio. That reinforced why it was important that the credit risk rating system be put in place as part of the new rewrite of 723.

We required the board to be reasonably informed in a reasonably timely way of the level of risk in the commercial loan portfolio at the credit union. I don't think there's any better way. I'm going to keep saying accepted practice. It is accepted practice in the commercial lending world that you inform those responsible for the risk in the department of the level of risk through a credit risk rating system.

It only made sense that we felt overall credit unions with over 50%. That was an anecdotal survey. The science do it, but since over 50% had been using them, it probably was the right thing to do to make sure there was a common practice in the industry. It made sense to make sure that all credit unions focused on that and that it would help the board fulfill its obligation to know the level of risk in the portfolio.

Let's speak to what's in a good credit risk rating system. We established the concept that we should rate it. You do it A, B, C, D, E, F, or G. You do high, medium, or low. Can you walk through what the regulation requires and what the options might be? The regulations are a little less prescriptive in some areas, but can you speak to what prescriptiveness there is relative to how to do this as it relates to the regulation?

I want to make one more point. To be effective, the risk rating system should be accurate at all times. Being reasonable, if something happens with a borrower and you don't hear about it for a few weeks, and there's no way you could have known, that's fine. Each credit should be rated at inception and then ongoing risk management through site visits, regular submission of financial information, annual review of the credit, and third-party reviews. There should be an additional confirmation of the risk.

If the risk rating changes as a result, then that should be reported to the board. I'll talk about this a little bit later in the discussion. Well-applied accurate credit risk rating system ensures that all your risk monitoring systems are in place. The initial underwriting has to be thorough and comprehensive in order to be accurate when you first assign a risk rating. Regular risk monitoring has to be in place to ensure that the current rating is accurate.

You reminded me of my early days at NCUA when I was an examiner and a problem case officer. NCUA used to send people they wanted to learn about how to review commercial loans to the School of Banking of the South at Louisiana State University. The first time I had crawfish, we had a crawfish boil on Sunday, and they flew in. Monday morning, you met a gentleman named Willie Staats. He was a professor of commercial lending at School Banking of the South.

I remember Willie up in the front of the class talking about when he was a commercial lender, and he had to foreclose on a chicken farm. There were chickens running all over the place. They had to figure out how to keep the chickens healthy and how to feed chickens. He was contrasting that day the difference of making a car loan that you measure the risk on the front end other than making sure that they have insurance.

It's not a high-maintenance type loan after you grant that car loan. He was contrasting that for the students on the first day that this is not one and done. It's not that you approve it and move on. As you're explaining that you're going to want to do the credit risk rating, you're going to want to understand it based on the financials. Maybe it's a low risk at one point in time and stays that way, but it might transition to another.

WFC 22 | Rating Credit Risk
Rating Credit Risk: It is an accepted practice in the commercial lending world that you inform those responsible for the level of risk through a credit risk rating system.

I'll tell you a quick story. I remember back in the '90s when the world was upside down. We were very actively monitoring risks on all accounts. I called one borrower on Wednesday one week and had a conversation with them. Everything seemed fine. On Monday, when I was driving to work, that time I was with a bank that was owned by a foreign concern. Nobody was comfortable that they had a job. On my way to work on Monday, I noticed that store that he was the landlord of was empty. I panicked. I talked to him. I should have known this was happening. I went screaming back to the office.

That was before the days of texts and emails and everything else. I left him a message. He called back a few days later. He said, "Don't worry. I told you I would pay you. Don't worry about it, but my tenant moved out." I felt better, but at the same time, I quickly went in, downgraded that credit, and put it on the watch list. Had I ignored that, I wasn't accurately monitoring responsibly monitoring the risk associated with that credit. We got paid in full, and that's where character comes in. You knew he owed the money, and he was going to pay it, whether he had income or not from the property.

That's the thing you need to recognize. A good lender is out there visiting with their borrowers. As a good lender, you develop a sense over time. You can walk into a business and feel something's not right. I've always told this story. If you go into a business at 11:00 and the individual says, "Everybody went for an early lunch because nothing's happening," make sure you go back a week later at 2:00 in the afternoon to see if they're taking a late lunch. If they're taking a late lunch, it's time to have a conversation.

That might impact where you have lunch and also your credit rating.

That was the best source of new business. On the way back from lunch, you are passing a customer, or in this case, a member. I was a banker at the time. Stop in and say hi. You're going to find out a little bit about the business. Also, that's when somebody says, "I've been thinking about calling you."

Back to the regulation and what it requires, let's talk a little bit about what a credit rating risk rating system is, how you might set it up, what the regulation requires, and what options they might have. I dumped about six questions on you, but feel free to tackle any of them in any particular order about a credit risk rating system.

This show isn't to give you everything you need to know about what a risk rating system is but just conceptually talk about what you should be thinking about and where you can go for some help. We wanted the credit unions to know their risk at all times. Ultimately, what we wanted was not examiners doing a credit review, which was happening.

The examiners were reviewing credit as he was a credit review person. That slowed down the examiners. They only got through a few credits and had then formed an opinion about the whole portfolio and the quality of the portfolio based on that. If they've pulled 2 or 3 credits that they felt were not well underwritten, the examiner applied that opinion to the rest of the portfolio because that's the only information they had.

What this transition to requiring credit risk rating is to put the burden in an aggressive way but put the burden of knowing the credit risk on the credit union and the board of the credit union. If you have a good credit rating system, then you probably have all the other policies and procedures probably in good shape and will support the credit risk rating. Instead of reviewing credits, the examiner will come in and evaluate the accuracy of the credit risk rating system.

They're going to say, "This credit is rated 3," then they're going to read your policy what makes up a 3, and then review your underwriting and risk monitoring to see if they agree or not. There was an old rule of thumb that generally, what the other regulators do is evaluate credit risk grades. You want to be less than 5% of those that are reviewed changing. That can be changing in either direction. You've upgraded the credit or downgraded the credit.

If you have a good credit rating system, your other policies and procedures are probably in good shape.

Clarify that. If you don't want a change of more than 5%, how?

Let me do it with an easy number because I can't do the math on small numbers. There are hundreds of credits. You wouldn't want five of those credit ratings changed by the examiner.

The examiner is saying, "I disagree either because your rating system is flawed or it says that you would downgrade in these scenarios and you did not."

Even upgraded. I'm going off on a tangent a little. Often you hear is, "We're conservative, so we don't upgrade." What we're talking about is we want accurate grades. They should be accurate. Being conservative can also indicate that you're shortcutting. It's easier to keep it at a lower grade than do the work to upgrade it. You need to make sure they're accurate because what you should be doing also is analytics on the migration and trends of your credit risk grades in your portfolio. If they're all moving to a lower level, you want to address whatever's causing that in policies or even personnel.

If it's upgrading, the borrower should get the benefit of that and also should you in your portfolio. You asked about what should be in our credit risk rating system. I suggest that everybody read the examiner's guide on credit risk ratings because that will give you a real good idea of what the expectations of the agency are regarding a credit risk rating system. Often what you see is a matrix. I'm from the old school that I like to see definitions that make sense for each credit grade. Let's say you have an eight-grade system.

A 1 should be defined to have these characteristics to 2, 3, 4, and then just go down. What's important is that there's qualitative and quantitative evaluation. A matrix is very good for the quantitative. That would leverage debt service coverage and that thing. The qualitative is, "How good is that management? Is there some competition coming in that could impact this credit? Did they lose their top salesman who had been producing all the business?" I personally believe that the quantitative is the easy part.

The qualitative is where your skills as a lender come in. There should be, in defining these risk grades, some comment on the qualitative issues that should be considered. If you strictly use a matrix to arrive at a rating, there are ways of using the qualitative process. If it’s a management, you rate the management, the market position, and that thing.

A lender should also have the flexibility to say, "I know this rates as a 3, but I'm going to make it a 4 because of whatever the following reasons are." It's like a picture. Paint the picture, stand back, take a look at it, and adjust it the way you think it should be. Be able to support the reasons you may be downgrading or upgrading it based on what a definition may be.

A top-grade would be what?

Number one, usually, it's cash secured.

WFC 22 | Rating Credit Risk
Rating Credit Risk: It would help the board fulfill its obligation to know the level of risk in the portfolio.

What would it be called?

Risk rating 1. General numbers are used, but you can use letters. You can use an ordinal system that progresses through the level of risk.

Typically, you see 1. What would be the worst?

What you find for credit unions with 7 to 8 ratings would be 1 through 4 being passed ratings, meaning good quality credits, but you want granularity even in your past grades so that if there are a progression of downgrades, meaning all of a sudden a 2 is a 3 and you've got 3s moving to 4, you can pick up those trends earlier. It's important to have granularity in the past grades. I used to think maybe you only need one, but I've changed my opinion on that. That progression is very important.

With analytics available these days, it's even more important because you can drill down on that. That's the passed grades, and then there's the adversely rated. NCUA talks about what the system should have. It doesn't specifically say, "This is what you should do. Use this system." However, the adversely classified, those credits that are not strong, the best way to manage that is to follow the regulatory risk grades on substandard doubtful and loss.

That relates back to when I looked at loans a long time ago. The first commercial lending rule that went in place piggybacked off of what the bankers had created substandard loan losses.

It's a proven system. There's plenty of support for it unless you can come up with a better one. I don't think I've ever seen a better one because most credit unions use that standard. Although it's not stated clearly in the guidance that that's an acceptable way to do it, it does indicate that's a good way to go. We've got 1 through 4, and we did 6 through 8, and then there's that 5. What is that?

The watch list is not technically a risk grade. It generally falls in that 4 to 5 area. With a watch list, you've got the credit. Something's happening with that credit or customer borrower where the rating could change or move in an adverse direction. You want to keep an eye on it. Generally, that's called the transition rating. Something's going to happen within the next six months, but that's not carved in stone.

You've got your risk rating there. When it slips into that category, is the credit union re-evaluating it more frequently? When your CAMEL code goes from a 2 to a 3 , you're going to see NCUA every 6 months, but if a CAMEL code goes from a 3 to a 4, you're going to see them every 4 months. A borrower slips to a 5, what does that mean relative to the level of effort that it's going to take for the credit union to watch that?

We're using 5 as an example. The answer to that is yes. You're going to be looking at it more often because you've identified some issues. Either they've lost a big customer, or there's new competition in town. There's a list of things, but you want to see how the business responds to whatever this issue or something that may have an impact on their business. You'll probably visit them more often.

Develop that rapport with your borrower so that they respect your opinion, and respectfully discuss those things that could impact their business and are important to their business.

Along with that, when there's a watch list, you should have a plan associated with how you are going to monitor it. There should be a plan of how often you're going to collect financial information, how often you are going to visit the borrower, and what may cause it to be downgraded to a lower risk grade. We talked about adverse credits.

Relative to credit risk, what would you like to speak to next?

I wanted to go over a few important things that the agency identifies as important to be involved with or be part of the credit risk rating system. It should be dynamic. We've mentioned this already. If there's a change in that credit in a reasonable amount of time, the lender needs to recognize that. What that reasonable amount of time is it's not an exact time, but considering the complexity and risks of the credit, that should determine how quickly you should be identifying those issues. That's important that the response is, "We haven't seen him in three months. How would we know?" That's not a good answer.

You should know your credits well enough to know who you have to see more often than 3 months and every 3 months. When we were writing the rule, it hit us, being in the member service business, how important it is to know the level of risk because we're in business for that individual sitting across from the desk, meaning the member borrower or commercial borrower.

If you have an accurate risk grade, it means that you're actively monitoring the account. If you see an issue developing early that could impact the business, you're providing a great service to that borrower to let them know, "We have some concerns here." Develop a relationship where you can say that. Telling somebody something negative about their business is important. I've said this before, but I'll say it again.

The best service that a commercial lender provides to their borrower at least once a year is they get a full financial review of their business for free while they're paying an interest rate, but no direct charge of their business. Develop that rapport with your borrower so that they respect your opinion and in a respectful way, discuss those things that could impact their business and are important to their business. With a credit risk rating system, maintain that and keep it up to date and accurate. You're visiting that borrower. You know what's going on, and you can share your financial expertise with them if you see some trends that are of concern. The earlier you get them, the easier the fix.

One of the things that NCUA and credit unions are always wondering how NCUA is going to approach it relates to the allowance for loan loss and lease loss, the ALLL, and how that relates to the commercial loans and credit risk rating. Is there anything you can share with the readers relative to how these credit risk ratings can ultimately play to the financials? Are there any best practices that you might suggest in that regard? It could be from the common sense of what's doubtful and substandard.

When you're setting those reserves, and I'm not a seasoned expert in how it will play there, if you're going to look at the buckets and see where the risks are, and hopefully assign the proper amount of reserves for each of those buckets, as you get further into it, maybe you're going to be looking more for specific reserves to those credit's doubtful and loss. You've identified all of those. In order to set the proper reserve, you need to know the risk. How can you know the risk of the overall portfolio and individual credits unless you have some way to rate it?

Let's go back to the contrast between seven-column worksheets in the systems that were replaced when you started in commercial lending and where it was at when you were last doing it and helping NCUA. There are MIS systems and CUSOs out there that can call data and every element so that you can analyze the quantitative side of things.

The ability to analyze that quantitative has gotten better, but still, it comes down to the qualitative side of that. You need to understand what those numbers mean. Over your career, were there a-ha moments relative to, "Now that we can track this quantitative number, it makes things easier or better?"

WFC 22 | Rating Credit Risk
Rating Credit Risk: A well-applied and accurate credit risk rating system ensures all your risk monitoring systems are in place.

This is where commercial lending is different. When you get into the analytics of a consumer portfolio, you get loan-to-value, credit scores, and price values, which you can adjust in the overall portfolio to find out what bucket they fit in for risk. This is what I liked about commercial lending. You estimate the risk based on that. Portfolio analytics, I support wholly. It's a great process.

It's the only way you're going to be able to manage the risk in a consumer portfolio, but here's the beauty of commercial lending. You know the risk of each credit. Speaking of events, commercial lending is the safest lending you can do because you know the level of risk with the borrower. If you have proper covenants, you can take action to help the borrower. I know not only are covenants the way to take aggressive action against the borrower, but it gives you some leverage to sit down with the borrower and help them make the changes in their business.

With that said, now you can take the debt service coverage ratio, leverage, and everything else and put that into the MIS systems. Unless there's a consistent way to look at each one of those, the quality of that input is only good as the quality of the lender. It's not always accurate to say, "Anything with the debt service coverage is under 1.15 or over 1.25." It all depends on how they looked at it. With credit risk rating, it's supported by the analysis. That reviewer that goes in there is going to double-check it. If you're looking at migration of credit risk, hopefully, all that underneath the underwriting, the monitoring, and all that stuff, support that risk rating. The risk rating itself tells you a lot.

I wrote down covenants too. That might be something. We can talk offline about this. That might be an actual episode that talks about, "What are your favorite covenants that you've seen? What's the goal of certain covenants?" That would be a good one. It's just a deep dive. Maybe it would be a shorter episode on that particular topic, but put that in your notes to remind me that we'll do that. If a credit union wants to improve their credit risk rating, they read this, or it's somebody who's thinking about getting into commercial lending, what resources would you recommend that they take a look at?

There are four. Look at the preamble to the rules, what it says about it, and the parts of the MBL commercial lending rule part 723. Look at what the rule specifically says about it. That's one. Two would be the examiner's guide on rating credit risk or credit risk rating. There are two other good resources. One is The Interagency Guidance on Credit Risk Review. The NCUA was part of the interagency group that wrote that guidance. It does a good job of discussing how to use a credit risk rating system, how credit review should use a credit risk rating system, how that should be reported to the board, and what the appropriate components should be in the independence of assigning those risk ratings.

That's an excellent piece of guidance. There's a preamble that goes with that too. That stuff may put you to sleep, but at least you'll say, "I know where to look for that," when you have a question down the road or know where to look when writing your policy and your process. The Bible for rating credit risk is the OCC Handbook on Rating Credit Risk. Your question earlier about what I've seen change was what I found interesting when I looked up the OCCs handbook on rating credit risk was written in 2001. It's an accepted practice.

Oldie, but it's a goodie. They haven't been able to improve on that. That says a lot. That would be a great resource.

I just read off some of the tables of contents, but these sections are important, like functions of a credit rating system, expectations, the development of the risk rating system, the risk rating process, examining risk ratings, rating credit risk, and then the credit risk evaluation process, which includes financial statement analysis of the repayment sources funding. It's an excellent guide beyond just rating credit risk but commercial loan risk management process.

Any last thoughts here before we wrap it up and I get one more Willie Staats reference from my LSU days of School Banking of the South?

If you manage risks correctly, not only does the credit union benefit by having a stronger portfolio and less adverse effects from having a poor portfolio, which means losses. The one who benefits the most, if you care about what you're doing, is the borrower. I'm going to talk about the lender as a financial expert, and you're the financial expert on financing a business. A fully informed lender can then structure the best credit package for that borrower. If you look at it that way, you're going to be sure to get all the information you need to make sure that you're recommending the right solution for that borrower.

On that covenants, for the future episode, I'm going to connect that to my reference to the School of Banking of the South when I was down there learning from some experiences that they had the teachers and Willie Staats, in particular, relative to commercial loans that had gone bad. He told a joke about the fact that you need to control the draws on a commercial loan and that you need to make sure that you do inspections, and if you're giving them 10% to do X, Y, and Z, make sure that you have covenants in place and that you do different reviews. His joke was, "A commercial loan gone bad would allow people to take that first draw and purchase a boat."

They would take it, and it would all be profit. The commercial construction people would get their profits. He said down in Louisiana at the time, "The most common name for boats of people in the construction business was First Draw that they took the money, and they bought their boat." That's not how you want to do commercial lending.

Sometimes you can learn from war stories like that. I referred back to this class, where I learned a lot of things early on in my career. You know so much more than that. You went to a much deeper level, but let's slot that we'll talk about covenants in a future episode. Vin, I want to thank you for your time. For those readers out there, I want to thank you for your time. Hopefully, we'll see you again, or you'll read again.

Important Links


bottom of page