Internal limits are policy-based caps that a bank or other financial institution sets on exposure to a borrower, sector, geography, asset class, or risk type. They are a core control because they prevent concentration: if too much risk builds up in one place, a single failure can cause outsized losses. In practice, limits are built into credit approvals, portfolio rules, vendor risk checks, and automated monitoring systems.
In security terms, internal limits reduce the blast radius of bad data, fraud, or a compromised counterparty by forcing decisions to stay within pre-approved thresholds. Attackers and abusive traders may try to work around them by splitting activity into smaller pieces, using many entities, or slowly increasing exposure to avoid alerts. Defenders counter this with rule engines, approval escalation, exception tracking, and regular limit reviews so the controls stay effective as risk conditions change.