Reg W Limits the Risks to Banks from Which Entity? Affiliate Transactions Explained

Regulation W limits the risks to banks from which entity? It limits them from affiliates: any company that controls the bank, sits under common control with it, or is sponsored and advised by it, including its own subsidiaries and financial subsidiaries. Reg W (12 CFR Part 223) caps credit extensions, asset purchases, and certain other covered transactions between a member bank and those entities. Congress built Section 23A and 23B of the Federal Reserve Act as a firewall, so a bank's balance sheet cannot be used to prop up related businesses.

That one-sentence answer hides a demanding rulebook. Reg W converts a statutory principle into quantitative limits, collateral rules, and attribution mechanics. The deeper question is why affiliates, rather than ordinary borrowers, deserve a dedicated firewall.

The affiliate firewall mechanism

The core risk is contagion by structure, not by creditworthiness. A bank inside a corporate group can be directed to lend to a struggling sister company at favorable terms. Without a limit, the bank becomes the group's cheapest funding source. Depositors and the deposit insurance fund absorb the downside if the affiliate fails.

Section 23A attacks this in three ways. First, it defines covered transactions broadly. Second, it caps each one against the bank's capital. Third, it requires collateral for credit-like exposures. Section 23B adds an arm's-length overlay: covered transactions, and several related dealings, must occur on terms at least as favorable to the bank as comparable transactions with nonaffiliates.

The limits are expressed as percentages of the bank's capital stock and surplus. For a well-capitalized bank, covered transactions with any one affiliate are capped at 10 percent of capital. Covered transactions with all affiliates combined are capped at 20 percent. Critically, the 10 percent sublimit applies to the aggregate across all covered transaction types, not to each type separately. A USD 100 million capital base therefore permits at most USD 10 million of covered transactions with a single affiliate and USD 20 million with the whole affiliate family.

Some transactions carry a stricter treatment. The purchase of low-quality assets from an affiliate is generally prohibited outright. The rule also reaches indirect exposures through attribution rules that look past the named counterparty.

Counting exposures through attribution

Attribution is where compliance teams earn their keep. Reg W does not only count transactions with a named affiliate. It attributes exposures back to the affiliate whose risk ultimately drives the bank's exposure. If the bank lends to a company that uses the proceeds to benefit an affiliate, that loan can be treated as a transaction with the affiliate. Guarantees and cross-collateral arrangements pull exposures into the count the same way.

The practical effect is that a bank must map the purpose of a transaction, not just the identity of the borrower. A loan to a customer that flows to a parent company is not an ordinary loan. A purchase of securities issued by a nonaffiliate can be an affiliate transaction if an affiliate stands behind them.

A counterintuitive detail: subsidiaries of the bank itself are generally not treated as affiliates for these purposes. The firewall targets the risk that the parent or a sister company drains the bank, not the bank's own downstream operations. But a financial subsidiary, which can engage in activities the bank cannot, is treated as an affiliate.

Quantified context and the capital denominator

The caps are only as strong as the capital base they reference. The denominator is capital stock plus surplus, which approximates tier 1 and tier 2 capital for these purposes. For a bank with USD 500 million in qualifying capital, the single-affiliate cap is USD 50 million and the aggregate cap is USD 100 million.

These are not abstract numbers. A mid-sized bank serving a corporate parent faces real allocation choices. Suppose the group wants USD 40 million of funding for one subsidiary and USD 90 million across three subsidiaries. The first fits under the single-affiliate limit only if no other covered transactions with that entity exist. The second fits under the aggregate limit only with USD 10 million of headroom to spare.

Comparisons across related rules help clarify the firewall's role. The table below contrasts Reg W with mechanisms that address overlapping risks.

The loans-to-one-borrower and Reg O regimes are distinct from Reg W. Confusing them is a common mistake.

The regulatory evolution timeline

The firewall has been rebuilt several times as banking structures changed. The timeline below shows the major moments.

The 2002 consolidation matters for anyone reading older guidance. Before Reg W, an examiner might consult the statute, the Board's interpretations, and staff opinions separately. After 2002, those threads were assembled into one part with defined terms. Older compliance manuals can therefore understate current requirements, especially on derivatives.

Edge cases: derivatives, securities financing, and indirect credit

Derivatives receive specific attention. Credit exposure from a derivative with an affiliate counts toward the caps. The bank must compute a credit-equivalent exposure, not the notional amount. A USD 1 billion notional interest rate swap with an affiliate might carry only a small credit exposure if the position is near the money. But a deeply out-of-the-money position can produce an exposure that approaches the cap.

Securities financing transactions, including repurchase agreements and securities lending, are covered when the counterparty is an affiliate. The bank must treat the transaction as an extension of credit or a purchase of assets, depending on structure. A repo with an affiliate is not a routine money-market trade when the affiliate's credit is the real exposure.

Collateral rules add another layer. Credit extensions to affiliates generally require collateral in amounts ranging from 100 to 130 percent of the exposure, depending on collateral type. Cash and Treasury securities sit at the low end. Other collateral, such as real estate or securities with price volatility, requires more. Low-quality assets are not acceptable collateral at all.

Red-flag conditions that should trigger a compliance review:

A loan to an outside borrower whose proceeds flow to a parent or sister company. A purchase of assets from a nonaffiliate that an affiliate guarantees. A derivative position with an affiliate that has moved against the bank. A securities financing trade with an affiliate whose credit quality has deteriorated. A bank subsidiary buying assets from a company the parent sponsors. Collateral that has fallen below the required ratio since the transaction closed.

Misconceptions that persist

The first misconception is that the caps count each transaction type separately. They do not. The 10 percent single-affiliate limit is a bucket that fills with all covered transaction types. A bank that has used half its single-affiliate capacity on loans has only half remaining for asset purchases.

The second is that nonbank affiliates are outside the rule. The rule applies to companies that control the bank, companies under common control, and companies the bank sponsors and advises. A bank holding company and its nonbank subsidiaries are classic affiliates. A joint venture the bank sponsors may also qualify.

The third is that arm's-length terms and quantitative limits are alternatives. Both apply. A bank can stay under the 10 percent and 20 percent caps while still violating Section 23B by charging an affiliate below-market rates. The two tests are cumulative, not interchangeable.

The fourth is that the bank's own subsidiaries are always exempt. The general exclusion for bank subsidiaries has exceptions, and financial subsidiaries are treated as affiliates. A bank that pushes risky activities into a financial subsidiary does not escape the firewall.

Practical compliance actions

Compliance starts with a complete affiliate inventory. The bank should list every entity that controls it, shares control with it, or is sponsored and advised by it. That list should be refreshed at least annually and after any acquisition.

Every counterparty should be screened against the affiliate list before booking. The screen should capture indirect attribution, not just named affiliates. A borrower questionnaire asking about use of proceeds is a practical control for attribution risk.

Exposure aggregation should run on a single ledger. Covered transactions of all types should roll up to two running totals: one per affiliate and one across all affiliates. The per-affiliate total must stay under 10 percent of capital, and the all-affiliate total under 20 percent.

Collateral should be monitored continuously. The required ratio changes with collateral type and market value. A quarterly review catches pledged securities whose value has dropped below the threshold.

Derivatives and securities financing deserve separate reporting. Credit-equivalent exposure should be recomputed regularly, not locked at trade date. A position that was small at inception can become material after a market move.

Section 23B documentation should mirror nonaffiliate comparables. Pricing, fees, and other terms should be recorded alongside the nonaffiliate benchmark used. An examiner will ask how the bank knows the terms are at least as favorable.

Limitations and what the rule cannot do

Reg W is a quantitative and transactional firewall, not a guarantee of bank safety. It limits exposures at a point in time, but rapid balance-sheet growth can outrun capital. A bank whose capital falls after the caps are measured may find itself over the limit without any new transaction. Compliance therefore requires continuous monitoring of the denominator, not just the numerator.

The rule also cannot stop every indirect benefit. Attribution rules reach many indirect exposures, but transactions structured to benefit an affiliate without a traceable link can evade the letter of the rule while violating its purpose. That is why supervisory judgment and Section 23B remain important complements.

Cross-border structures add complexity that the rule does not fully resolve. A foreign affiliate's risk profile may be difficult to measure with the bank's standard data. The rule sets the floor, but the bank's own risk assessment must go further.

A professional caveat: the specific numeric thresholds and treatment of derivatives reflect the current regulatory framework, and supervisory interpretations evolve. Banks should confirm current requirements with counsel and their primary regulator before relying on any figure here.

This article is general educational information, not legal, regulatory, or investment advice, and it does not create a compliance program for any specific bank. Do not rely on it as a legal opinion or as a substitute for review by qualified counsel or your primary federal regulator.