Why Don’t Banks Follow the Square-Root Rule?

4,564 banks. 36,512 quarterly observations. Why does so little of the expected diversification benefit appear in margin volatility?

Bill Igoe · November 8, 2026

Having worked in bank treasury and risk management, I would expect a larger bank to have more opportunities to diversify. More borrowers. More industries. More places to lend. In an age of credit-default swaps, it can also transfer credit exposure to somebody else.

Using RainbowStats, we examined 4,564 banks with eight quarterly observations apiece: 36,512 bank-quarter observations. We calculated the variability of each bank’s net interest margin and compared it with the bank’s starting size.

The result is hard to overlook. Larger banks showed very little reduction in margin variability. The decline was nowhere near the simple square-root benchmark.

This was a comparison across thousands of institutions, each represented by a complete eight-quarter history. That breadth makes the pattern worth taking seriously. It also makes the question more pressing: where did the expected diversification benefit go?

That is a useful question for a risk manager. A reassuring portfolio total is only the beginning. I want to know which economic assumptions support those assets, who has promised to absorb the losses, and whether those promises will work when needed.

Thousands of banks, a remarkably flat relationship

We used FDIC data to compare starting bank size in late 2021 with the variability of quarterly net interest margins during 2022–2023. The 36,512 quarterly records become 4,564 bank-level volatility estimates—the observations used in our regression. The estimated relationship was:

If the number of equal-sized, independent exposures grew in proportion to assets, the simple diversification benchmark would have an exponent of −0.5. Our estimate is nowhere near that: its approximate heteroscedasticity-robust 95% interval is −0.039 to −0.016.^[1]

This is strong evidence against that simple bank-size scaling relationship in this sample. It does not overturn the mathematics of independent risks. It tells us that bank size alone does not deliver the volatility pattern implied by that benchmark. Assets may be a poor proxy for independent exposures; funding structure, leverage, and business choices may also offset diversification. Our regression does not separate those explanations.

We are not the first to ask where the benefit went

Demsetz and Strahan’s Diversification, Size, and Risk at Bank Holding Companies, published in 1997, found that larger banking companies were better diversified without being less risky overall. Lower capital ratios and larger commercial and industrial loan portfolios offset their diversification advantage. Their earlier New York Fed working paper also found lower firm-specific risk alongside greater systematic risk.^[6]

That is familiar territory for a risk manager. An institution gains capacity to absorb risk and then uses that capacity. It can lend more aggressively or operate with less capital. Diversification can be working while the reported total risk barely falls.

Their measure was stock-return risk; ours is margin variability. Their study does not replicate our estimated exponent. It supplies an independently documented explanation for why the simple size–risk relationship can be weak. It also finds circumstances in which growth reduces risk. The choices that accompany growth matter.

Stiroh and Rumble’s 2006 study found a related pattern: diversification benefits were offset by increased exposure to more volatile noninterest activities. Wagner’s 2010 theoretical paper adds a system-wide warning. Banks can each diversify while becoming more alike, increasing the possibility that they fail together.^[7] A portfolio can contain many names and still share its central vulnerabilities with every bank down the street.

An oil department lends to oil companies

An oil-lending department can lend to hundreds of companies. It is still an oil-lending department.

The borrowers may have different management teams and different properties. But their ability to repay can depend on the same oil price, the same collateral market, and the same willingness of lenders to refinance them. Adding another name need not add much economic independence. A larger bank can also make larger individual bets rather than spread its money more widely.

For equal-weight exposures with equal individual volatility σ and common pairwise correlation ρ, portfolio volatility is:

With zero correlation, we recover the square-root rule. With positive correlation, an exposure shared across borrowers remains even as their number grows. There is also an important distinction between the volatility of a portfolio rate or average, which this expression describes, and total dollar losses, which can grow with the portfolio.

We moved from margins to actual credit losses

Margins reflect funding costs and repricing as well as lending decisions. So we extended the data through 2025 and examined variability in quarterly net charge-off rates. There were 4,272 banks with complete sixteen-quarter histories; 4,271 also had starting concentration measures.

We calculated concentration across five broad loan categories. The first comparison was striking:

The apparently more concentrated banks had steadier reported losses. But our index was largely distinguishing real-estate-heavy banks from other lenders. A broad category is not a map of common economic risks.

After adding lending mix and starting charge-offs to size and concentration, the level-response model’s in-sample R² rose from 1.4% to 26.9%. The concentration coefficient changed sign, with robust uncertainty including zero. A log specification gave a different direction. Size had a negative association after those controls, but we did not establish the square-root relationship.^[1]

The measured departure from the simple benchmark is clear. Our proposed explanation—concentration—has not yet been cleanly identified. Oil companies and manufacturers can occupy the same commercial-loan category while presenting very different common exposures.

Shouldn’t CDS let the big banks transfer the risk?

Yes. A credit-default swap can transfer specified credit losses to a protection seller. That is a genuine risk-management tool. Larger size alone, however, tells us neither how much protection a bank has purchased nor how well it matches the loans.

There is a second question: what does the bank do with the capacity the hedge creates? Instefjord’s 2005 theoretical study shows that credit derivatives can improve risk sharing while encouraging additional risk-taking. If the additional risk dominates, better hedging technology need not produce a safer banking sector.^[8]

As a risk manager, I would ask what remains after the trade. Is the borrower, maturity, and credit event actually covered? Can the protection seller pay? How much collateral is already available, and how quickly can it be realized? If we must replace the hedge during a crisis, will anyone quote a workable price?

If the seller weakens when the protected exposure deteriorates, the protection introduces wrong-way risk. Collateral and enforceable netting can reduce exposure, but they do not make every scenario disappear. Supervisory guidance explicitly calls for attention to these connections.^[2]

Our CSVs do not measure CDS protection, collateral, hedge effectiveness, or the financial strength of the protection sellers. We cannot use our regressions to conclude that derivatives failed to diversify these banks.

AIG: protection that became a system-wide question

AIG illustrates why the counterparty deserves as much scrutiny as the original borrower. Its Financial Products unit accumulated mortgage-related derivatives exposure outside the insurance subsidiaries directly supervised by state insurance regulators. AIG did have a group-level supervisor—the Office of Thrift Supervision—but supervision failed to contain the risk. Bernanke subsequently emphasized the need for effective oversight of the whole group.^[3]

My risk-management reaction to Goldman Sachs’s connection with AIG is to ask how much dependence on one counterparty was acceptable. Goldman said collateral and market hedges protected its position. Gross exposure is not the same as unprotected loss exposure. Yet the TARP inspector general questioned the ease of liquidating the underlying assets during an AIG failure.^[4]

I would also ask whether expectations of official support influenced the comfort people took from their positions. That is a moral-hazard question. It is not evidence that Goldman knew the Federal Reserve would intervene.

Follow the exposure beyond the bank

Private lending makes that question relevant beyond conventional bank portfolios. Banks can lend to funds that then lend to companies, and committed credit lines can become cash demands under stress. The comparison with earlier off-balance-sheet vehicles is useful, but not exact: many private-credit funds use long-term investor capital, reducing short-term funding pressure.^[5]

Consider a hypothetical AI-infrastructure portfolio: a data-center developer, an equipment lessor, a power supplier, and a contractor. Four borrower names and several industry labels. Yet all four projects might depend on sustained, profitable demand for computing capacity. That does not predict an AI credit crisis. It identifies an assumption worth stress-testing across the whole portfolio.

The questions I would put to a risk committee are concrete:

• Which borrowers fail together if our central economic assumption is wrong?
• Where have several desks independently accumulated the same exposure?
• Who owes us protection, and how do they fund that promise?
• What cash and collateral demands arrive before an eventual hedge settlement?
• Which exposures sit in affiliates, funds, guarantees, or undrawn commitments outside this report?

Our 36,512 quarterly observations make the weak relationship between bank size and margin volatility visible across thousands of banks. They cannot reveal every hidden connection inside those banks. That is where the risk manager’s work begins.

A large number of loans is easy to count. A large number of independent risks is much harder to establish. When the common assumption fails, how many of our supposedly separate bets fail together?

Explore and reproduce

Open the study in RainbowStats

Explore the saved study and inspect its results. The underlying data and reproduction script are also available below.

The public files include definitions, source fields, and missing-data flags:

• Bank cross section: starting exposures and subsequent outcomes
• Quarterly charge-off panel — use an observation limit of 100,000
• Data dictionary

C=CROSS_SECTION("https://rainbowstats.com/data/bank_repricing_cross_section.csv")
B=EXTRACT(C,"where:postbaseline_nim_observations=8")
M=CROSS_SECTION_MODEL(B,"LOG(100*column(nim_sd_observed_2022_2023_pp))=a+b*column(log_assets_2021q4)")
SLIDESHOW(M)