4.6 Stress testing types

The specific design, complexity and level of detail of the stress test methodologies should be appropriate to the institution’s nature, scale and size, as well as the complexity and riskiness of its business activities. It should take into account the strategy and business model as well as the portfolio characteristics of the institution.

Institutions should take into account the stage within the economic cycle when designing stress test methodologies, including the scenario and the need for possible management actions.

Institutions should identify appropriate, meaningful and robust mechanisms for translating risk factors into relevant internal risk parameters (probability of default (PD), loss given default (LGD), write-offs, fair value haircuts, etc.) that provide an institution and a group view of risks.

The link between stressed risk factors and the risk parameters not only should be based on institutional historical experience and analysis, but should be supplemented, where available and appropriate, with benchmarks from external sources and, when possible, from supervisory guidance.

Because of the complexity involved in modelling hypothetical and macroeconomic-based risk factors/scenarios, institutions should be aware of the model risk involved and ensure that the following have been performed when setting those factors/scenarios:

• a) a regular and sufficiently conservative expert review of the model’s assumptions and mechanics has been performed and a conservative modelling approach to account for model risk has been followed;
• b) a sufficient degree of conservatism as appropriate has been applied when making assumptions that are difficult to measure in a quantitative way (e.g. diversification, exponential growth projected, fees projected, forward-looking management views) but may have an impact on the model’s outputs (e.g. the outputs of pre-provision net revenue models should be based on sufficient statistical support as well as business considerations); and
• c) the dependencies and sensitivities of the results on the assumptions have been acknowledged and their impact is assessed on a regular basis.

Shortcomings of models and mechanisms that link risk factors with losses or increased risk parameters should be understood, communicated clearly and taken into account when interpreting results. Models should take into account the interactions between solvency and funding liquidity and funding costs in order to not systemically and significantly underestimate the impact of a shock. Where possible, results for different modelling approaches should be compared (e.g. for pre-provision net revenue models, a comparison between the model used and other possible approaches and the rationale for their rejection should be available). These links should be based on robust statistical models. However, if data availability or quality or structural breaks in historical data do not allow for meaningful estimates (e.g. for pre-provision net revenue models, it is necessary to have historical data covering an interest rate cycle and a business cycle, as well as information on changes in business strategy and organisation structure), quantitative analyses should be supported with qualitative expert judgements. Even where the underlying modelling process is robust, expert judgement should play a role in challenging model outputs.

Institutions should assess possible non-linear interactions between risk factors and stressed risk parameters.

4.6.2 Sensitivity analysis

Institutions should conduct sensitivity analyses at the level of individual exposures, portfolios or business units, institution wide, and for specific risk types, proportionate to their complexity. Institutions should assess at which aggregation level sensitivity analyses are meaningful or even feasible. The use of expert judgements should be clarified in detail whenever applicable.

Institutions should identify relevant risk factors at various levels of application of prudential requirements and across different portfolios, business units and geographical locations. Institutions should ensure that all relevant types of risk factors are covered, including macroeconomic and macrofinancial variables, statistical aspects of risk parameters (such as the volatility of PD parameters) and idiosyncratic factors such as operational risks.

Institutions should define the risk factors identified using different degrees of severity as an important step in their analysis to reveal nonlinearities and threshold effects, i.e. critical values of risk factors beyond which stress responses accelerate.

Where there are uncertainties about the robustness of the estimated dependency between macroeconomic/macrofinancial risk factors and risk parameters or there is a need to validate the results of more comprehensive scenario analyses, institutions should endeavour to ensure that sensitivity analyses are also carried out by stressing statistical aspects of portfolio risk parameters according to historical distributions supplemented by hypothetical assumptions (e.g. with respect to future volatilities).

Single risk factor analyses should be supplemented by simple multi-risk factor analyses, where a combined occurrence is assumed, without necessarily defining a scenario.

Institutions should maintain a list of the risk factors identified.

4.6.3 Scenario analysis

Institutions should ensure that scenario analyses are a core part of their stress testing programmes.

The design of the stress test scenarios should not only be based on historical events, but should also consider hypothetical scenarios based on non-historical events. Institutions should ensure that scenario designs are forward-looking and take into account systematic and institution-specific changes in the present and foreseeable future. For that purpose, institutions should endeavour to have recourse to external data from similar risk environments relevant for institutions with similar business models. Institutions should use data that are relevant and available. Relevant data may be internal and/or external and incorporate benchmarking and supervisory guidance.

A range of scenarios should be considered to encompass different events and degrees of severity when meaningful and feasible.

Institutions should ensure that their stress test scenarios meet at least the following requirements:

• a) address the main risk factors that the institution may be exposed to; in this regard, the results obtained from single risk factor analyses, which aim to provide information about the sensitivity towards single risk factors, should be used to identify scenarios that include a stress of a combined set of highly plausible risk factors; no material risk factor should be left unstressed or unconsidered;
• b) address major institution-specific vulnerabilities, deriving from the regional and sectoral characteristics of an institution, as well as its specific product or business line exposures and funding policies: concentration and correlation risks, both of an intra- and of an inter– risk type, should be identified a priori;
• c) include a coherent narrative for the scenario, covering all main risk factors as well as their (forward-looking) development on the basis of multiple trigger events (i.e. monetary policy, financial sector developments, commodity prices, political events and natural disasters); institutions should ensure that the scenario narrative is plausible and non-contradictory when assuming the co-movement of risk factors and the corresponding reaction of market participants; and, where certain risk factors are excluded from the scenario narrative, institutions should ensure that this exclusion is fully justified and documented;
• d) are internally coherent, so as to ensure that the identified risk factors behave consistently with other risk factors in a stress event and that they contain explicit estimates and assumptions on the dependence structure among the main underlying risk factors; importantly, co-movements in risk factors that may appear contradictory should be explored to identify new sensitivities;
• e) take into account innovation and more specifically technological developments or sophisticated financial products without disregarding their interaction with more traditional products; and
• f) ensure that stressed risk factors translate into internally consistent risk parameters.

Institutions should determine the time horizon of stress testing in accordance with the aim of the exercise, the characteristics of the portfolio of the institution such as its maturity and liquidity of the stressed positions, where applicable, as well as the risk profile. Solvency stress testing and liquidity stress testing require different time horizons and scenarios.

Institutions should ensure that:

• a) stress tests explicitly take into account dynamic interdependences, e.g. among economic regions and among economic sectors, including the financial sector;
• b) the overall scenario takes into account system-wide dynamics, e.g. closure of certain markets, and risk concentrations in a whole asset class (e.g. mortgages); and
• c) adverse feedback dynamics, caused by factors such as interactions among valuations, losses and margining requirements, are covered.

Institutions should make qualitative assessments of second-round or feedback effects of stress at the individual level, where appropriate and in particular if no robust quantitative estimates can be established. For instance, an individual institution might create some price or volume adjustments to take into account some strategic effects (e.g. the level of lending strategy) and respond endogenously to the scenario.

4.6.4 Severity of scenarios

Institutions should ensure that stress testing is based on severe but plausible scenarios and the degree of severity should reflect the purpose of the stress test. To that end, stress tests should be:

• a) meaningful in terms of addressing relevant risks to the institution with a view to promoting the stability of the institution under adverse conditions and, in the case of systemically important banks, also the financial system at all points in the economic cycle and over market fluctuations including funding markets; and
• b) consistently applied across the institution, recognising that the impact of identical scenarios is not necessarily severe for all business lines.

Institutions should ensure that various degrees of severity are considered for both sensitivity analysis and scenario stress testing covering at least one severe economic downturn for the assessment of capital adequacy and capital planning purposes.

Institutions should ensure that severity is set taking into account the specific vulnerabilities of each institution to a given scenario on the basis of its business model (e.g. exposed to international markets). Institutions should develop their own scenarios and should not be dependent on scenarios from the supervisors. When assessing the severity of a scenario, the institution should be aware of the dynamics of risk environments and of experiences of institutions with similar business models.

Institutions should ensure that their scenarios assess absolute and relative changes of risk factors. In an absolute scenario, the degree of severity should be a direct change of the risk factor and not depend on the current level. In a relative scenario, the degree of severity should depend on the current level and economic situation (e.g. GDP growth decreases by 2%, i.e. a relative change to the absolute level). For example, will a 2% negative relative change in GDP from a starting point with a substantial positive output gap (i.e. current GDP is substantially above the structural GDP) not necessarily lead to a severe stress effect on GDP in absolute/level terms. Likewise, the worse the current economic situation at the outset the more severe the stress of a relative scenario. Institutions should ensure that their choice of the scenario is sufficiently severe in both relative and absolute terms. Both the choice and its impact on the degree of severity should be justified and documented.

For assessing the appropriate degree of severity of scenarios, institutions should also compare them with the scenarios outlined in their reverse stress testing, considering specific implications of the reverse stress test design for the scenario’s plausibility.

4.6.5 Reverse stress testing

Requirements

Institutions should perform adequate reverse stress tests as part of the stress testing programme, sharing the same governance, an effective infrastructure and quality standards, and to complement other types of stress testing, taking into account the nature, size, scale and complexity of their business activities and risks. Small and less complex institutions may focus more on the qualitative aspects of reverse stress testing while more sophisticated reverse stress testing techniques are required of larger or more complex institutions. The reverse stress testing should be clearly defined in terms of responsibilities and resources allocated and should be supported by an infrastructure that is suitable and flexible and by written policies and procedures. Reverse stress testing should be carried out regularly by all types of institutions and at the same level of application as ICAAP and ILAAP (e.g. institution wide and covering all relevant risk types).

Institutions should include scenarios identified through the reverse stress testing to complement the range of stress test scenarios they undertake and, for comparison purposes, in order to assess the overall severity, allowing the identification of severe but still plausible scenarios. Reverse stress testing should be useful for assessing the severity of scenarios for ICAAP and ILAAP stress tests. The severity of reverse stress testing scenarios can also be assessed by comparing it to, inter alia, historical or other supervisory and publicly available scenarios.

In carrying out their reverse stress tests, institutions should also consider whether failure of one or more of their major counterparties or a significant market disruption arising from the failure of a major market participant (in a separate or combined manner) would cause the pre-defined outcome. Use of reverse stress testing

Institutions should use reverse stress testing as a regular risk management tool in order to improve their awareness of current and potential vulnerabilities, providing added value to institutions’ risk management. The principle of proportionality applies to all aspects of the use of reverse stress testing. Institutions should also consider that the pre-defined outcome of reverse stress testing can be produced by circumstances other than the circumstance analysed in the stress test.

As part of their business planning and risk management, institutions should use reverse stress testing to understand the viability and sustainability of their business models and strategies, as well as to identify circumstances where they might be failing or likely to fail within the meaning of Article 32 of Directive 2014/59/EU. It is important that institutions identify indicators that provide alerts when a scenario turns into reality. To that end, institutions should:

• a) identify the pre-defined outcome to be tested (e.g. of a business model becoming unviable);
• b) identify possible adverse circumstances that would expose them to severe vulnerabilities and cause the pre-defined outcome;
• c) assess (depending on the institution’s size, as well as the nature, scale, complexity and riskiness of its business activities) the likelihood of events included in the scenarios leading to the pre-defined outcome; and
• d) adopt effective arrangements, processes, systems or other measures to prevent or mitigate identified risks and vulnerabilities.

Institutions should use reverse stress testing in planning and decision-making and to challenge their business models and strategies in order to identify and analyse what could possibly cause their business models to become unviable, such as the assessment of both the ability to generate returns over the following months and the sustainability of the strategy to generate returns over a longer period based on strategic plans and financial forecasts. The engagement of the management body and senior management throughout the process is expected.

Where reverse stress testing reveals that an institution’s risk of business model failure is unacceptably high and inconsistent with its risk appetite, the institution should plan measures to prevent or mitigate such risk, taking into account the time that the institution should have to react to these events and implement those measures. As part of these measures, the institution should consider if changes to its business model are required. These measures derived from reverse stress testing, including any changes to the institution’s business plan, should be documented in detail in the institution’s ICAAP documentation.

Institutions with particular business models, e.g. investment firms, should use reverse stress testing to explore their vulnerabilities to extreme events, in particular where their risks are not sufficiently captured by more traditional (e.g. solvency and liquidity) stress scenarios based on macroeconomic shocks.

Institutions using internal models for credit risk, counterparty credit risk and market risk, when carrying out reverse stress testing in accordance with Articles 177, 290(8) and 368(1)(g) of Regulation (EU) No 575/2013, should endeavour to identify severe, but plausible, scenarios that could result in significant adverse outcomes and potentially challenge an institution’s overall viability. Institutions should see these reverse stress tests as an essential complement to their internal models for calculating capital requirements and as a regular risk management tool for revealing the possible inadequacies of these internal models. In severe stress scenarios, even though this should not necessarily be taken as an indication that the modelling of the inputs into the IRB formula are inadequate, model risk will increase and may lead to a breakdown in the model’s predictability.

Institutions should perform qualitative analyses in developing a well-defined narrative of the reverse stress testing and a clear understanding of its feedback and non-linear effects, taking into account the dynamics of risk, and combinations of and interactions between and across risk types. When developing a well-defined narrative, an institution should consider external exogenous events such as economic events, an industry crash, political events, litigation cases and natural events, as well as risk factors such as operational risks, concentration and correlations, reputational risks and loss of confidence, and combinations of these events and factors. The proper engagement of the management body of the institution in the discussions of the narrative is fundamental, taking into account possible specific vulnerabilities and the impact on the whole institution.

Institutions should perform quantitative and more sophisticated analyses, taking into account the institution’s size as well as the nature, scale, complexity and riskiness of its business activities, in setting out specific loss levels or other negative impacts on its capital, liquidity (e.g. the access to funding, in particular to increases in funding costs) or overall financial position. Institutions should work backwards in a quantitative manner to identify the risk factors, and the required amplitude of changes, that could cause such a loss or negative impact (e.g. defining the appropriate loss level or some other measure of interest on the balance sheet of the financial institution such as capital ratios or funding resources). Institutions should understand and document in detail the drivers of risk (e.g. outputting the exact factor draws that had the most impact on the portfolio tail region), the key business lines and a clear and consistent narrative around weaknesses and the corresponding scenarios (e.g. about the underlying assumptions and sensitivity of the results to those assumptions over time) that cause the pre-defined outcomes and the events chain and the likely flow through (e.g. the most important factors may be mapped to macroeconomic variables according to the combinations for a given target loss/capital in a portfolio), identifying hidden vulnerabilities (e.g. hidden correlations and concentrations) and overlapping effects.

Institutions should, where appropriate, use sensitivity analyses as a starting point for reverse stress testing, e.g. shifting one or more relevant parameters to some extreme to reach pre-defined outcomes. An institution should consider various reverse sensitivity analyses for credit risk (e.g. how many large customers would have to go into default before the loss absorbing capital is lost), market risk, liquidity risk (e.g. stress on deposits in the retail sector and circumstances that would empty the institution’s liquidity reserves) and operational risk, among other risks, and a combination analysis where all risks are covered simultaneously. However, an institution should not primarily use a sensitivity analysis and simple metrics to identify the scenario relevant for the reverse stress test. The qualitative analysis should lead to the identification of the relevant scenario, combining expert judgement from different business areas, as thinking might be the most effective way to prevent a business model failure. A joint stressing of all relevant risk parameters using statistical aspects (e.g. volatility of risk factors consistent with historical observations supplemented with hypothetical but plausible assumptions) should be developed. The plausibility of the parameter shifts required to reach the pre-defined outcome gives a first idea about possible vulnerabilities in the institution. To assess the plausibility, historical (multivariate) probability distributions – adjusted, where deemed necessary, according to expert judgements – should, inter alia, be applied. Qualitative analyses and assessments, combining expert judgements from different business areas, should guide the identification of relevant scenarios.

Institutions should use reverse stress testing as a tool to gather insights into scenarios that involve combinations of solvency and liquidity stresses, where traditional modelling may fail to capture complex aspects from real situations. Institutions should use reverse stress testing to challenge their capital plans and liquidity plans. Where appropriate, institutions should identify and analyse situations that could aggravate a liquidity stress event and transform it into a solvency stress event, and vice versa, and eventually to a business failure. Institutions should endeavour to apply reverse stress testing in an integrated manner for risks to capital or liquidity with a view to improving the understanding and the management of related risks in extreme situations.

Recovery actions and recovery planning

Institutions should develop scenarios of severe macroeconomic and financial distress, varying in their severity (including system-wide events, legal entity-specific stress and group-wide stress), to be used in recovery plans under Article 5(6) of the Bank Recovery and Resolution Directive (BRRD) and EBA/GL/2014/06, and use specific reverse stress testing to develop ‘near-default’ scenarios (institution close to failure but no further) and as an input to inform and test the efficiency and effectiveness of their recovery actions and their recovery planning, and analyse sensitivities around corresponding assumptions. Such ‘near-default’ scenarios should identify and describe the point that would lead an institution’s or a group’s business model to become non-viable unless the recovery actions were successfully implemented. The scenarios should allow the estimation of results and the suitability of all the available recovery options. The terminology used in the description of recovery scenarios should help to determine which recovery options were tested under particular stress scenarios. The description should have a sufficient level of detail, through both a set of quantitative assumptions and a qualitative narrative, in order to determine whether or not the scenario is relevant for the institution and how severe it is. The events should be described in a logical sequence and the assumptions underlying the main drivers (e.g. net income, risk-weighted assets (RWAs), capital) should be laid down very clearly. The scenarios should also take into account a possible estimation of the cross-effects of executing different recovery plan options in the same stress scenario. The scenarios should also allow an understanding of how the events unfold by providing an appropriate timeline that makes it clear at which point in time certain actions will be developed (with implications for their credibility and feasibility). The purpose of this exercise is to test the effectiveness of the institution’s recovery options in restoring financial strength and viability when the institution comes under such severe stress.

Because of the different objectives of the two sets of reverse stress tests, the stress tests for ICAAP and ILAAP purposes and recovery planning should not be interlinked but compared with one another.

Institutions should use reverse stress testing to assist with the development, assessment and calibration of the ‘near-default’ scenarios used for recovery planning.

Institutions should use reverse stress testing to identify the risk factors and further understand and describe the scenarios that would result in ‘near default’, assessing effective recovery actions that can be credibly implemented, either in advance or as the risk factors or scenarios develop.

Reverse stress testing should contribute to the recovery plan scenarios by using a dynamic and quantitative scenario narrative, which should cover:

• a) the recovery triggers (i.e. at which point the institution would enact recovery actions in the hypothetical scenario);
• b) the recovery actions required and their expected effectiveness, including the method of assessing that effectiveness (i.e. indicators that should be monitored to conclude that no further action is required);
• c) the appropriate timing and process required for those recovery actions; and
• d) in the case of further stress, points (b) and (c) for the potential additional recovery actions required to address residual risks.