Commercial Loan Underwriting in US Banks: The Complete 2026 Process Guide

Commercial loan underwriting in a US bank runs fourteen stages: intake, screening, CIP and beneficial ownership, document collection, third-party reports, spreading, global cash flow, ratio and covenant setting, risk rating, credit memo, committee, approval, closing and post-closing monitoring. A clean C&I file closes in three to six weeks. Most of that is not analysis.

Key facts

• The industry is 4,238 institutions deep and still growing loans. The FDIC counted 4,238 insured institutions at 30 June 2026, down 41 in the quarter, with annual loan growth of 6.8% (FDIC, *Quarterly Banking Profile*, Second Quarter 2026, released 25 August 2026).
• Most applicants do not get the full amount. Of employer firms that applied for financing, 42% received the full amount sought, 36% some or most, and 22% none; 57% of small-bank applicants were fully approved (Federal Reserve Banks, *2026 Report on Employer Firms: Findings from the 2025 Small Business Credit Survey*, 3 March 2026).
• YuSight delivers 3x faster decision turnaround by removing the drafting and rekeying stages from the critical path, with every figure in the memo traced to its source document and page.
• Model risk guidance changed in April 2026. SR 11-7 is gone. SR 26-2 / OCC Bulletin 2026-13 (17 April 2026) replaced it, narrowed the definition of a model, and put generative and agentic AI expressly outside scope (Federal Reserve, SR 26-2; OCC Bulletin 2026-13).
• Beneficial ownership collection got lighter in February 2026. FinCEN granted exceptive relief from identifying and verifying beneficial owners at each new account opening (FinCEN Order, 13 February 2026).

What are the stages of commercial loan underwriting?

Here is the full run for a $1m–$10m C&I or owner-occupied CRE request at a community or mid-size bank, with the role that owns each stage and the thing that actually delays it.

Add it honestly and a clean, well-papered file is 21 to 40 business days from complete application to funding. Of that, perhaps four days is credit judgement. The rest is collection, rekeying and queueing.

Who does what in a US bank credit shop?

Titles vary; functions do not.

• Relationship Manager (Commercial Banker). Owns the client and the request. Sizes the ask, negotiates indicative structure, chases documents.
• Loan Assistant / Credit Administration Assistant. Builds the file, orders the 4506-C, the flood determination, the UCC and lien searches, the entity good standing certificates.
• Credit Analyst. Spreads the financials, builds global cash flow, computes ratios, drafts the memo.
• Portfolio Manager. In banks that split the role, owns the ongoing file — covenant testing, annual reviews, renewals — and often co-owns covenant setting.
• Credit Officer / Underwriter. Independent credit judgement. Assigns the risk rating, approves within delegated authority, or recommends to committee.
• Senior Credit Officer / Chief Credit Officer. Owns policy exceptions, house limits and concentration decisions.
• Officers' Loan Committee and Directors' Loan Committee. The approval ladder above delegated authority. Directors' committee typically handles the largest exposures and anything to insiders.
• Appraisal Review. Independent of the loan officer, by regulation. Engages, reviews and accepts the appraisal.
• Loan Operations / Closing. Documents, perfects, funds, and books the exception tracking.
• Loan Review. Independent of the origination line. Post-approval sampling, rating validation, policy exception reporting.
• Special Assets. Where the file goes when the rating drops.

The structural rule that matters: credit approval authority must be independent of the revenue line. A bank where the RM can approve their own deal has a governance finding waiting to happen, regardless of how good the credit is.

What happens at application and intake?

Intake is where most turnaround is lost, because most banks treat it as an administrative step.

A complete intake package establishes five things before any analysis starts:

1. The exact borrowing entity. Not the trade name, not the parent, not the operating company when the real estate sits in a sister LLC. Get the EIN, the state of formation, and the current entity documents.
2. The purpose and the source of repayment. "Working capital" is not a purpose. "Fund a 45-day receivable cycle on a new contract with a national retailer" is. Primary repayment source, secondary source, and tertiary source get named separately.
3. The full obligor group. Affiliates, common ownership, the guarantors, and anything the guarantors already guarantee elsewhere. Discovering an affiliate at stage 8 costs two weeks.
4. The existing debt schedule. Every facility, lender, balance, rate, maturity, payment and collateral, signed by the borrower.
5. Whether the request is even inside policy. Industry, concentration, LTV, tenor, geography. A deal that fails a concentration test should fail on day one, not at committee.

Note the reporting overlay coming: the CFPB's revised Section 1071 rule was published 1 May 2026, effective 30 June 2026, with a single compliance date of 1 January 2028. It narrows "small business" to gross annual revenue of $1 million or less and applies only to institutions originating at least 1,000 covered credit transactions in each of two consecutive years (Federal Register, 91 FR, 1 May 2026). If your intake form does not capture the demographic data fields today, it needs to before 2028.

How do you verify the entity and beneficial ownership?

Two distinct obligations that banks routinely conflate.

Customer Identification Programme. Name, address, EIN, and formation documents for the legal entity. Standard, unchanged.

Beneficial ownership under the CDD rule (31 CFR 1010.230). Each individual owning 25% or more of the equity, plus one control person. This is where 2026 changed things. On 13 February 2026 FinCEN issued exceptive relief from the requirement to identify and verify beneficial owners at each new account opening. Collection is now required when a legal entity customer first opens an account, when facts call the existing information into question, or as the institution's risk-based ongoing due diligence warrants (FinCEN Order, 13 February 2026).

In practice that means an existing commercial deposit customer taking a fourth loan does not trigger a fresh beneficial ownership certification. It does not mean the file can be thin. Every other AML obligation — ongoing monitoring, keeping customer information current on a risk basis — is untouched.

For underwriting, the ownership work goes further than the rule requires anyway. You need the full org chart, because:

• Guarantees follow ownership, and a 20% owner who runs the company still gets asked to guarantee.
• Affiliate obligations follow ownership, and they belong in global cash flow.
• Related-party rent, management fees and inter-company loans distort both the operating company's margins and the guarantor's personal cash flow. Both need recasting.

Which documents does a commercial underwriting file need?

The standard set for a $1m–$10m secured request. Anything missing restarts the clock.

Business financial information

• Three years of business federal tax returns, all schedules and K-1s, signed
• Three years of CPA-prepared financial statements — note the level: audit, review or compilation
• Interim financial statement and balance sheet, dated within 90 days
• Accounts receivable ageing and accounts payable ageing, as of the interim date, with concentrations visible
• Inventory listing where inventory is collateral
• Business debt schedule, signed, tying to the interim balance sheet
• Projections with stated assumptions, where the request is for expansion, acquisition or startup

Guarantor information

• Three years of personal federal tax returns, all schedules, signed
• Personal Financial Statement, dated within 90 days, signed
• Schedule of real estate owned with debt service, rents and vacancy
• Contingent liability schedule — every guarantee already given

Verification

• Form 4506-C, IVES Request for Transcript of Tax Return, for the business and every guarantor. This is not optional, and it is the single most useful document in the file, because it compares what the borrower gave you against what they told the IRS (IRS, Income Verification Express Service). Order it at intake, not after the spread.
• Business bank statements, typically 3 to 12 months, all operating accounts
• Certificate of good standing, entity resolutions, operating agreement or bylaws
• Insurance certificates naming the bank as loss payee or mortgagee

Third-party reports — appraisal, environmental, title, survey, flood determination, UCC and judgement searches.

On appraisals, know the thresholds cold, because they drive both cost and calendar. Under 12 CFR 34.43 an appraisal is not required where the transaction value is $500,000 or less for a commercial real estate transaction, $400,000 or less for a residential transaction, or where the transaction is a business loan of $1 million or less not dependent on the sale of or rental income from real estate as the primary source of repayment (eCFR, 12 CFR 34.43). Below those thresholds an evaluation still has to be performed — "no appraisal required" is not "no valuation required."

Two document checks deserve naming. The tax return you were handed should tie to the transcript you ordered; if it does not, you have a conversation before you have a credit. And the bank statements should be tested for authenticity before they become the basis of a cash flow conclusion — the checks that actually surface tampering are set out in how to detect a fake or tampered bank statement.

What does spreading actually involve?

Spreading is the conversion of three different presentations of the same company — tax return, CPA statement, interim — into one comparable, multi-year format the bank's rating model and credit policy can read.

The mechanical part is data entry. The analytical part is recasting, and it is where files diverge:

• Owner compensation above or below market, adjusted to a normalised figure
• Related-party rent adjusted to market
• Non-recurring items — gains on asset sales, insurance proceeds, one-off legal settlements — stripped out
• Discretionary expenses run through the business, added back only with evidence
• Book-to-tax differences reconciled, especially Section 179 and bonus depreciation
• Operating leases and their treatment under the bank's own covenant definitions
• Distributions to owners, separated from compensation

Every one of these is a judgement call, and every one of them needs a written basis in the file. The most common examiner finding in this area is not a wrong adjustment; it is an unexplained one. The full mechanics, including how the same borrower produces different spreads in different hands, are in what financial spreading is.

How do you build global cash flow and set covenants? A worked example

Global cash flow answers one question: after everything the obligor group must pay, is there enough left to service this loan?

Harrow Fabricating LLC — a metal fabricator, single owner, requesting a $2,600,000 seven-year equipment term loan at 7.25%, alongside an existing $2,000,000 revolver. FY2025 revenue $18,400,000.

Step 1 — Build adjusted EBITDA

Net income (pass-through, no entity tax) 742,000 + Interest expense 386,000 + Depreciation 611,000 + Amortisation 54,000 = EBITDA 1,793,000 + Owner compensation above market 180,000 − Non-recurring gain on equipment sale (95,000) = Adjusted EBITDA 1,878,000

Step 2 — Build pro forma debt service

Existing term debt P&I (per debt schedule) 412,000 New term loan: $2,600,000, 84 months, 7.25% monthly payment $39,565 × 12 474,780 Revolver interest: $1,200,000 avg o/s × 8.00% 96,000 = Total pro forma annual debt service 982,780

Step 3 — Compute the ratios

DSCR = 1,878,000 ÷ 982,780 = 1.91x Fixed charge coverage: Adjusted EBITDA 1,878,000 − Unfinanced maintenance capex (165,000) − Owner tax distributions (305,000) = Cash available for fixed charges 1,408,000 FCCR = 1,408,000 ÷ 982,780 = 1.43x Funded debt = 1,480,000 + 2,600,000 + 1,200,000 = 5,280,000 Leverage = 5,280,000 ÷ 1,878,000 = 2.81x

Step 4 — Set the covenants, then test the cushion

This is the step most files skip. A covenant without a cushion calculation is a number somebody copied.

Proposed FCCR covenant of 1.20x. What EBITDA does that permit?

Required cash for fixed charges = 1.20 × 982,780 = 1,179,336 Add back capex and distributions = 165,000 + 305,000 = 470,000 Adjusted EBITDA at the covenant floor = 1,649,336 Cushion = (1,878,000 − 1,649,336) ÷ 1,878,000 = 12.2%

Proposed leverage covenant of 3.50x:

Adjusted EBITDA supporting 5,280,000 at 3.50x = 5,280,000 ÷ 3.50 = 1,508,571 Cushion = (1,878,000 − 1,508,571) ÷ 1,878,000 = 19.7%

The FCCR covenant binds first, at a 12.2% earnings decline. That is the sentence the credit memo should contain, and it is the sentence the committee should discuss — not "covenants: FCCR 1.20x, leverage 3.50x." Whether 12.2% is enough cushion depends on this borrower's revenue volatility and customer concentration, which is a judgement, not a formula.

Where the guarantor's personal cash flow, household expenses and affiliate obligations get folded into this, and how a specific programme sets a floor, is worked through in how global DSCR is calculated for SBA 7(a) loans.

How does risk rating work, and what does 2026's model guidance change?

Every commercial loan gets a rating at origination and a review at least annually. The regulatory anchor is the regulatory classification scale — pass, special mention, substandard, doubtful, loss — and the OCC's Rating Credit Risk booklet of the Comptroller's Handbook remains the reference for how a rating system should be designed and validated (OCC, Comptroller's Handbook, Commercial Credit booklets).

Most banks run a finer internal scale — commonly 8 to 12 pass-and-criticised grades — mapping upward to the regulatory categories. Federally insured credit unions have an explicit requirement: 12 CFR 723.4(g)(3) obliges a credit union's commercial loan policy to include a credit risk rating system with ratings assigned at inception and reviewed regularly (eCFR, 12 CFR Part 723).

The model risk point, stated accurately. SR 11-7 was superseded on 17 April 2026 by SR 26-2, issued jointly by the Federal Reserve, OCC and FDIC and published by the OCC as Bulletin 2026-13. Three things changed that matter to a credit shop:

1. The definition narrowed. A model is now "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates." The guidance expressly excludes simple arithmetic calculations such as those in spreadsheets, and deterministic rule-based processes and software.
2. Generative and agentic AI are out of scope. The guidance states that generative AI and agentic AI models "are novel and rapidly evolving. As such, they are not within the scope of this guidance." The agencies signalled a future request for information on AI.
3. It rescinded four issuances — the OCC's Model Risk Management booklet, OCC Bulletins 1997-24 and 2011-12, and OCC Bulletin 2021-19 on BSA/AML model risk — and, on the Federal Reserve side, SR 11-7 and SR 21-8.

Read carefully, this is a narrowing of the model risk perimeter, not a licence. Your PD/LGD model and your risk rating scorecard are still models. A deterministic spreading rule set probably is not. And a generative AI tool that drafts a credit memo falls outside SR 26-2 — which means it falls under general safety and soundness, third-party risk and internal control expectations instead, and the agencies said as much. Examiners will still ask how the output is validated and how a human is accountable for it; they will simply not ask you to fit it into a model inventory. What they do ask is set out in what examiner review requires from an AI-drafted credit memo.

What goes into the credit memo, and who approves it?

The memo is the document the bank approves the loan on. Every other artefact — the spread, the appraisal, the transcript — is an exhibit to it.

A complete commercial credit memo carries: the request and structure; borrower and management background; ownership and org chart; industry and market analysis; historical financial analysis with the spread; global cash flow; the ratio and covenant analysis with cushions; collateral description and advance rates; guarantor analysis; risk rating with rationale; policy exceptions listed individually with mitigants; the relationship's total profitability; and a recommendation with conditions precedent. Section-by-section structure is in what a credit assessment memo is.

Approval runs a delegated authority ladder set by the board:

Two rules that trip up new analysts: authority is exercised on aggregate obligor group exposure, not on the facility being requested, and a weaker risk rating typically pushes the file one rung up the ladder regardless of size.

What happens at closing and after?

Closing. Loan documents, entity resolutions and incumbency, UCC-1 filings in the correct jurisdiction, mortgage or deed of trust recording, landlord and subordination agreements, flood insurance where required, title policy, and satisfaction of every condition precedent. Exceptions that survive funding get logged and tracked, with an owner and a date.

Post-closing monitoring is the stage most banks under-resource and every examiner tests:

• Covenant certificates collected on schedule and actually recomputed, not filed
• Borrowing base certificates for revolvers, with ineligibles applied
• Annual review with fresh financials, a re-spread and a rating affirmation or change
• Site visits and inspections per policy
• Loan review sampling independently, validating ratings and reporting exceptions to the board
• CECL — the allowance depends on rating accuracy and on segment-level loss data, so a stale rating is not just a credit problem

The thing that makes all of this work is a file where each figure can be traced to the document it came from. That is also the thing that makes the annual review cheap: if the memo cites its sources, next year's re-spread starts from a known baseline instead of a fresh archaeology project.

FAQ

How long does commercial loan underwriting take?

For a clean, well-papered $1m to $10m secured request, 21 to 40 business days from a complete application to funding is normal. Only about four days of that is credit judgement. The rest is document collection, third-party reports, memo drafting and waiting for a committee slot.

What are the stages of commercial loan underwriting?

Application and intake, screening and term sheet, CIP and beneficial ownership, document collection, 4506-C transcripts, third-party reports, spreading, global cash flow, ratio and covenant setting, risk rating, credit memo, loan committee, approval and closing, then post-closing monitoring.

Who approves a commercial loan in a US bank?

It depends on the board's delegated authority matrix. Small exposures go to a single credit officer, mid-size deals need two signatures, larger ones go to an officers' loan committee, and the biggest exposures plus anything involving insiders go to a directors' loan committee. Authority is measured on total obligor group exposure, not on the individual facility.

What is a 4506-C and why does every commercial file need one?

Form 4506-C is the IVES request that lets a lender pull tax transcripts directly from the IRS. It is the only cheap way to test whether the tax return the borrower handed you matches the one they filed. Order it at intake — waiting until after the spread is finished is how files lose two weeks.

Does SR 11-7 still apply to bank models?

No. SR 11-7 was superseded on 17 April 2026 by SR 26-2, issued jointly by the Federal Reserve, OCC and FDIC and published by the OCC as Bulletin 2026-13. The new guidance narrows what counts as a model and expressly places generative and agentic AI outside its scope.

If generative AI is out of scope for SR 26-2, does that mean it is unregulated?

No — it means it is not governed by the model risk framework. General safety and soundness expectations, third-party risk management, internal controls and consumer compliance all still apply, and the agencies have signalled a future request for information on AI. Practically, you still need to show an examiner how the output is checked and who is accountable for it.

Do banks still have to collect beneficial ownership on every new loan?

Not at every account opening. FinCEN's 13 February 2026 exceptive relief limits collection to the first time a legal entity customer opens an account, when facts call the existing information into question, or when the bank's risk-based ongoing due diligence warrants it. Every other AML obligation is unchanged.

When is an appraisal required on a commercial loan?

Under 12 CFR 34.43, an appraisal is not required where the transaction value is $500,000 or less for a commercial real estate transaction, or where it is a business loan of $1 million or less that does not depend on the sale of or rents from the real estate for repayment. Below those thresholds an evaluation is still required — the valuation obligation does not disappear.

What is the difference between a credit analyst and a portfolio manager?

The credit analyst builds the underwriting — spreads, global cash flow, ratios, the memo. The portfolio manager owns the credit after it closes: covenant testing, borrowing base review, annual re-spreads, renewals and early warning. Some banks combine the roles; the ones that separate them usually have cleaner covenant compliance.

How is global cash flow different from business DSCR?

Business DSCR looks only at the operating company's cash flow against its own debt service. Global cash flow adds the guarantor's personal income, subtracts household living expenses and personal debt service, and folds in every affiliate the guarantor supports or is supported by. A business that covers 1.60x on its own can fall below 1.00x globally once a guarantor's other obligations are counted.

Key takeaways

• Fourteen stages, ten distinct roles. The delay is in stages 4, 6, 11 and 12 — collection, third-party reports, memo drafting and committee scheduling — not in analysis.
• Order the 4506-C and the third-party reports at intake and run them in parallel. Serial ordering is the most expensive habit in commercial lending.
• Nail the borrowing entity and the full obligor group on day one. Discovering an affiliate at global cash flow stage costs two weeks and a re-rating.
• Recasting is where two competent analysts produce two different spreads. Write down the basis for every adjustment; the finding is almost never the adjustment itself, it is the missing explanation.
• Set covenants by computing the cushion, then state the cushion in the memo. "FCCR 1.20x" tells the committee nothing; "the FCCR covenant binds at a 12.2% earnings decline" tells them everything.
• SR 11-7 is superseded. SR 26-2 and OCC Bulletin 2026-13, both dated 17 April 2026, narrow the model definition and put generative and agentic AI outside the model risk perimeter — which shifts the governance question, it does not remove it.
• FinCEN's February 2026 relief means beneficial ownership is not re-collected at every account opening. Ongoing monitoring obligations are untouched.
• Post-closing is underwriting. A covenant certificate that is filed rather than recomputed is a covenant you do not have.

Take the drafting and the rekeying out of the critical path, and the four days of judgement get the calendar they deserve.

See your first CAM in 30 minutes — [book a live demo](https://yuverse.ai/yusight).