What is credit risk?

In banking, credit risk means the chance of losing money because a borrower or counterparty does not pay as agreed. The Basel Committee on Banking Supervision defined it in 2000 as "the potential that a bank borrower or counterparty will fail to meet its obligations in accordance with agreed terms" (BCBS, September 2000). Loans are the largest source for most banks. The same paper names interbank transactions, trade financing, swaps, bonds and guarantees as further sources. Credit risk in finance outside banks works the same way: a bond investor carries the credit risk of the issuer.

Credit risk vs default risk: default risk is the probability that the borrower defaults at all. Credit risk also covers how much is lost when it does. The Basel Framework splits that loss into the probability of default (PD), the loss given default (LGD) and the exposure at default (EAD) (Basel Framework, CRE30). An example: a bank has lent €1 million (EAD) and recovers €400,000 from collateral after the default, so its LGD is 60%.

Banks calculate capital for credit risk with one of two methods, which the CRR names the "Standardised Approach" and the "IRB Approach". Both produce risk-weighted exposure amounts, the base for the capital ratios in Article 92 CRR.

Under the standardized approach, the CRR sets fixed risk weights per exposure class; for many classes the weight depends on a credit assessment by a rating agency. Under the IRB Approach, a bank uses its own credit risk models, and it needs permission from the competent authority (Article 143 CRR). In the foundation version, the bank estimates PD and takes the other parameters from the supervisor. In the advanced version, it also estimates LGD and EAD (CRE30).

CRR III added an output floor. The total risk exposure amount of a bank with internal models must be at least 72.5% of the amount under the standardized approaches (Article 92(3) CRR as amended). Banks may phase the floor in, from 50% in 2025 to 70% in 2029 (Article 465 CRR).

Credit risk management is how a bank decides whom to lend to and how it watches the loans it has made. The Basel Committee's Principles for the Management of Credit Risk, updated on April 30, 2025, cover four areas: a suitable credit risk environment, a sound credit-granting process, credit administration with measurement and monitoring, and controls over credit risk (BCBS, April 30, 2025).

Credit risk assessment and credit risk analysis come before a loan is granted. Principle 4 says banks "must operate within sound, well-defined credit-granting criteria". Principle 5 asks for overall credit limits for individual borrowers and for groups of connected counterparties. Principle 10 encourages an internal risk rating system, which gives each borrower a credit risk rating.

Credit risk mitigation techniques reduce the loss when a borrower defaults. Chapter 4 of the CRR credit risk title recognizes funded credit protection, such as on-balance sheet netting and collateral, and unfunded credit protection, such as guarantees and credit derivatives.

Collateral counts only after a haircut. Under the Basel Framework, a bank values shares from a main index at 80% of their market value, a 20% haircut, while cash in the same currency keeps its full value (Basel Framework, CRE22.49).

Until a dedicated EU regime applies, Article 501d CRR, inserted by CRR III, sets a transitional treatment. A tokenized traditional asset counts as the asset it represents. Asset-referenced tokens whose issuers comply with MiCA and that reference traditional assets get a risk weight of 250%. Other crypto-assets get 1,250%, and a bank's total exposure to them may not exceed 1% of its Tier 1 capital.

The Basel standard on cryptoasset exposures has been in effect since January 1, 2026. It also sets a 1,250% risk weight for the riskiest group, Group 2b (SCO60.84).

In Germany and Austria the CRR applies directly. In the euro area, the ECB has supervised significant banks directly since November 4, 2014, and national authorities supervise the less significant ones (OeNB). In Germany, the Bundesbank and BaFin share banking supervision (Bundesbank). The ECB has its seat in Frankfurt am Main, and its list of supervised banks with the cut-off date July 1, 2026 names 110 banks under its direct supervision (ECB). BaFin's MaRisk circular 06/2024 (BA) of May 29, 2024 names Adressenausfallrisiken first among the risks a bank must treat as material (AT 2.2) and sets the processes for them in module BTR 1. In Austria, the FMA supervises banks together with the OeNB, which carries out the on-site inspections.

Switzerland is outside the EU, so the CRR does not apply there. The Federal Council's revised Capital Adequacy Ordinance (CAO) and FINMA's Ordinance on the Credit Risks of Banks and Securities Firms (CreO-FINMA) implement the final Basel III standards. Both entered into force on January 1, 2025 (FINMA, March 27, 2024). This page gives no legal advice.