SR Letter 12-7 

Attachment 

1 

Board of Governors of the Federal Reserve System 

Federal Deposit Insurance Corporation 

Office of the Comptroller of the Currency 

Guidance on Stress Testing for Banking Organizations 

with Total Consolidated Assets of More Than $10 Billion 

May 14, 2012 

I. Introduction 

All banking organizations should have the capacity to understand fully their risks and the 

potential impact of stressful events and circumstances on their financial condition. The U.S. 

federal banking agencies have previously highlighted the use of stress testing as a means to 

better understand the range of a banking organization’s potential risk exposures.1 The 2007-

2009 financial crisis underscored the need for banking organizations to incorporate stress testing 

into their risk management practices, demonstrating that banking organizations unprepared for 

stressful events and circumstances can suffer acute threats to their financial condition and 

 

1 See, e.g., Supervision and Regulation Letter SR 10-6, OCC Bulletin 2010-13 or FDIC Financial Institution 

Letter (FIL) 13-2010, Interagency Policy Statement on Funding and Liquidity Risk Management (March 17, 

2010), available at http://www.federalreserve.gov/boarddocs/srletters/2010/sr1006.htm (hereinafter Funding and 

Liquidity Risk Management Policy Statement); Supervision and Regulation Letter SR 10-1, OCC Bulletin 2010-1 

or FDIC FIL-2-2010, Interagency Advisory on Interest Rate Risk (January 11, 2010), available at 

http://www.federalreserve.gov/boarddocs/srletters/2010/sr1001.htm (hereinafter Interest Rate Risk Advisory); 

Supervision and Regulation Letter SR 09-4, Applying Supervisory Guidance and Regulations on the Payment of 

Dividends, Stock Redemptions, and Stock Repurchases at Bank Holding Companies (revised March 27, 2009), 

available at http://www.federalreserve.gov/boarddocs/srletters/2009/SR0904.htm (hereinafter SR 09-04); 

Supervision and Regulation Letter SR 07-1, OCC Bulletin 2006-46 or FDIC FIL-104-2006, Interagency 

Guidance on Concentrations in Commercial Real Estate (January 4, 2007), available at 

http://www.federalreserve.gov/boarddocs/srletters/2007/SR0701.htm; Supervision and Regulation Letter SR 01-

4, OCC Bulletin 2001-6 or FDIC FIL-9-2001, Subprime Lending (January 31, 2001), available at 

http://www.federalreserve.gov/boarddocs/srletters/2001/SR0104.htm; Supervision and Regulation Letter SR 99-

18, Assessing Capital Adequacy in Relation to Risk at Large Banking Organizations and Others with Complex 

Risk Profiles (July 1, 1999), available at http://www.federalreserve.gov/boarddocs/srletters/1999/SR9918.htm 

(hereinafter SR 99-18); Supervisory Guidance: Supervisory Review Process of Capital Adequacy (Pillar 2) 

Related to the Implementation of the Basel II Advanced Capital Framework, 73 FR 44620 (July 31, 2008) 

(hereinafter Supervisory Review Process of Capital Adequacy); The Supervisory Capital Assessment Program: 

Overview of Results (May 7, 2009), available at 

http://www.federalreserve.gov/newsevents/press/bcreg/bcreg20090507a1.pdf; Comprehensive Capital Analysis 

and Review: Objectives and Overview (March 18, 2011), available at 

http://www.federalreserve.gov/newsevents/press/bcreg/bcreg20110318a1.pdf; and 12 CFR 225.8. 
SR Letter 12-7 

Attachment 

2 

viability.2 The Federal Reserve, the Office of the Comptroller of the Currency, and the Federal 

Deposit Insurance Corporation (collectively, the “agencies”) are issuing this guidance to 

emphasize the importance of stress testing as an ongoing risk management practice that supports 

banking organizations’ forward-looking assessment of risks and better equips them to address a 

range of adverse outcomes. 

This joint guidance is applicable to all institutions supervised by the agencies with more 

than $10 billion in total consolidated assets. Specifically, with respect to the OCC, these banking 

organizations include national banking associations, federal savings associations, and federal 

branches and agencies; with respect to the Board, these banking organizations include state 

member banks, bank holding companies, savings and loan holding companies, and all other 

institutions for which the Federal Reserve is the primary federal supervisor; with respect to the 

FDIC, these banking organizations include state nonmember banks, state savings associations 

and insured branches of foreign banks.3

 

The guidance does not apply to any supervised institution below the designated asset 

threshold. Certain other existing supervisory guidance that applies to all supervised institutions 

discusses the use of stress testing as a tool in certain aspects of risk management, such as for 

commercial real estate concentrations, liquidity risk management, and interest-rate risk 

management. However, no institution at or below $10 billion in total consolidated assets is 

subject to this final guidance. 

Building upon previously issued supervisory guidance that discusses the uses and merits 

of stress testing in specific areas of risk management, this guidance provides broad principles a 

banking organization should follow in conducting its stress testing activities, such as ensuring 

that those activities fit into the organization’s overall risk management program. The guidance 

outlines broad principles for a satisfactory stress testing framework and describes the manner in 

which stress testing should be employed as an integral component of risk management that is 

applicable at various levels of aggregation within a banking organization, as well as for 

contributing to capital and liquidity planning.4 While the guidance is not intended to provide 

detailed instructions for conducting stress testing for any particular risk or business area, the 

document describes several types of stress testing activities and how they may be most 

appropriately used by banking organizations. 

 

2

 The Dodd-Frank Wall Street Reform and Consumer Protection Act (Pub. L. 111-203, 124 Stat. 1376) requires 

financial organizations with more than $10 billion in total consolidated assets to conduct a stress test at least 

annually. See generally 12 U.S.C. 5365(i)(2). 

3

 Given the unique structure of U.S. branches and agencies of foreign banking organizations, the agencies recognize 

that certain aspects of this guidance may not apply to those U.S. branches and agencies (such as the portions related 

to capital stress testing) or may apply differently (such as the portions related to governance and controls). 

Supervisors can work with these entities on a case-by-case basis to identify the portions of the guidance that are 

most relevant for them. 

4

 While capital and liquidity stress tests may be among the most prominent, other types of stress testing exercises 

that use different metrics should be conducted. 
SR Letter 12-7 

Attachment 

3 

II. Overview of Stress Testing Framework 

For purposes of this guidance, stress testing refers to exercises used to conduct a forwardlooking assessment of the potential impact of various adverse events and circumstances on a 

banking organization. Stress testing occurs at various levels of aggregation, including on an 

enterprise-wide basis. As outlined in section IV, there are several approaches and applications 

for stress testing and a banking organization should consider the use of each in its stress testing 

framework. 

An effective stress testing framework provides a comprehensive, integrated, and forwardlooking set of activities for a banking organization to employ along with other practices in order 

to assist in the identification and measurement of its material risks and vulnerabilities, including 

those that may manifest themselves during stressful economic or financial environments, or arise 

from firm-specific adverse events. Such a framework should supplement other quantitative risk 

management practices, such as those that rely primarily on statistical estimates of risk or loss 

estimates based on historical data, as well as qualitative practices. In this manner, stress testing 

can assist in highlighting unidentified or under-assessed risk concentrations and 

interrelationships and their potential impact on the banking organization during times of stress.5 

A banking organization should develop and implement its stress testing framework in a 

manner commensurate with its size, complexity, business activities, and overall risk profile. Its 

stress testing framework should include clearly defined objectives, well-designed scenarios 

tailored to the banking organization’s business and risks, well-documented assumptions, sound 

methodologies to assess potential impact on the banking organization’s financial condition, 

informative management reports, ongoing and effective review of stress testing processes, and 

recommended actions based on stress test results. Stress testing should incorporate the use of 

high-quality data and appropriate assumptions about the performance of the institution under 

stress to ensure that the outputs are credible and can be used to support decision-making. 

Importantly, a banking organization should have a sound governance and control infrastructure 

with objective, critical review to ensure the stress testing framework is functioning as intended. 

A stress testing framework should allow a banking organization to conduct consistent, 

repeatable exercises that focus on its material exposures, activities, risks, and strategies, and also 

conduct ad hoc scenarios as needed. The framework should consider the impact of both firmspecific and systemic stress events and circumstances that are based on historical experience as 

well as on hypothetical occurrences that could have an adverse impact on a banking 

organization’s operations and financial condition. Banking organizations subject to this 

guidance should develop policies on reviewing and assessing the effectiveness of their stress 

testing frameworks, and use those policies at least annually to assess the effectiveness of their 

frameworks. Such assessments should help to ensure that stress testing coverage is 

comprehensive, tests are relevant and current, methodologies are sound, and results are properly 

considered. 

 

5

 For purposes of this guidance, the term “concentrations” refers to groups of exposures and/or activities that have 

the potential to produce losses large enough to bring about a material change in a banking organization’s risk profile 

or financial condition. 
SR Letter 12-7 

Attachment 

4 

 

III. General Stress Testing Principles 

A banking organization should develop and implement an effective stress testing 

framework as part of its broader risk management and governance processes. The framework 

should include several activities and exercises, and not just rely on any single test or type of test, 

since every stress test has limitations and relies on certain assumptions. 

The uses of a banking organization’s stress testing framework should include, but are not 

limited to, augmenting risk identification and measurement; estimating business line revenues 

and losses and informing business line strategies; identifying vulnerabilities, assessing the 

potential impact from those vulnerabilities, and identifying appropriate actions; assessing capital 

adequacy and enhancing capital planning; assessing liquidity adequacy and informing 

contingency funding plans; contributing to strategic planning; enabling senior management to 

better integrate strategy, risk management, and capital and liquidity planning decisions; and 

assisting with recovery and resolution planning. This section describes general principles that a 

banking organization should apply in implementing such a framework. 

Principle 1: A banking organization’s stress testing framework should include activities 

and exercises that are tailored to and sufficiently capture the banking organization’s exposures, 

activities, and risks. 

An effective stress testing framework covers a banking organization’s full set of material 

exposures, activities, and risks, whether on or off the balance sheet, based on effective 

enterprise-wide risk identification and assessment. Risks addressed in a firm’s stress testing 

framework may include (but are not limited to) credit, market, operational, interest-rate, 

liquidity, country, and strategic risk. The framework should also address non-contractual 

sources of risks, such as those related to a banking organization’s reputation. Appropriate 

coverage is important as stress testing results could give a false sense of comfort if certain 

portfolios, exposures, liabilities, or business line activities are not included. Stress testing 

exercises should be part of a banking organization’s regular risk identification and measurement 

activities. For example, in assessing credit risk a banking organization should evaluate the 

potential impact of adverse outcomes, such as an economic downturn or declining asset values, 

on the condition of its borrowers and counterparties, and on the value of any supporting 

collateral. As another example, in assessing interest-rate risk, banking organizations should 

analyze the effects of significant interest rate shocks or other yield-curve movements. 

An effective stress testing framework should be applied at various levels in the banking 

organization, such as business line, portfolio, and risk type, as well as on an enterprise-wide 

basis. In many cases, stress testing may be more effective at business line and portfolio levels, as 

a higher level of aggregation may cloud or underestimate the potential impact of adverse 

outcomes on a banking organization’s financial condition. In some cases, stress testing can also 

be applied to individual exposures or instruments. Each stress test should be tailored to the 

relevant level of aggregation, capturing critical risk drivers, internal and external influences, and 

other key considerations at the relevant level. 
SR Letter 12-7 

Attachment 

5 

Stress testing should capture the interplay among different exposures, activities, and risks 

and their combined effects. While stress testing several types of risks or business lines 

simultaneously may prove operationally challenging, a banking organization should aim to 

identify common risk drivers across risk types and business lines that can adversely affect its 

financial condition. Accordingly, stress tests should provide a banking organization with the 

ability to identify potential concentrations – including those that may not be readily observable 

during benign periods and whose sensitivity to a common set of factors is apparent only during 

times of stress – and to assess the impact of identified concentrations of exposures, activities, and 

risks within and across portfolios and business lines and on the organization as a whole. 

Stress testing should be tailored to the banking organization’s idiosyncrasies and specific 

business mix and include all major business lines and significant individual counterparties. For 

example, a banking organization that is geographically concentrated may determine that a certain 

segment of its business may be more adversely affected by shocks to economic activity at the 

state or local level than by a severe national recession. On the other hand, if the banking 

organization has significant global operations, it should consider scenarios that have an 

international component and stress conditions that could affect the different aspects of its 

operations in different ways, as well as conditions that could adversely affect all of its operations 

at the same time. 

A banking organization should use its stress testing framework to determine whether 

exposures, activities, and risks under normal and stressed conditions are aligned with the banking 

organization’s risk appetite.6

 A banking organization can use stress testing to help inform 

decisions about its strategic direction and/or risk appetite by better understanding the risks from 

its exposures or of engaging in certain business practices. For example, if a banking 

organization pursues a business strategy for a new or modified product, and the banking 

organization does not have long-standing experience with that product or lacks extensive data, 

the banking organization can use stress testing to identify the product’s potential downsides and 

unanticipated risks. Scenarios used in a banking organization’s stress tests should be relevant to 

the direction and strategy set by its board of directors, as well as sufficiently severe to be credible 

to internal and external stakeholders. 

 Principle 2: An effective stress testing framework employs multiple conceptually sound 

stress testing activities and approaches. 

All measures of risk, including stress tests, have an element of uncertainty due to 

assumptions, limitations, and other factors associated with using past performance measures and 

forward-looking estimates. Banking organizations should, therefore, use multiple stress testing 

activities and approaches (consistent with section IV), and ensure that each is conceptually 

 

6

 For purposes of this guidance, risk appetite is defined as the level and type of risk an organization is able and 

willing to assume in its exposures and business activities, given its business objectives and obligations to 

stakeholders. See Senior Supervisors Group, Observations on Developments in Risk Appetite Frameworks and IT 

Infrastructure (December 23, 2010), available at 

http://www.newyorkfed.org/newsevents/news/banking/2010/an101223.pdf.
SR Letter 12-7 

Attachment 

6 

sound. Stress tests usually vary in design and complexity, including the number of factors 

employed and the degree of stress applied. A banking organization should ensure that the 

complexity of any given test does not undermine its integrity, usefulness, or clarity. In some 

cases, relatively simple tests can be very useful and informative. 

Additionally, effective stress testing relies on high-quality input data and information to 

produce credible outcomes. A banking organization should ensure that it has readily available 

data and other information for the types of stress tests it uses, including key variables that drive 

performance. In addition, a banking organization should have appropriate management 

information systems (MIS) and data processes that enable it to collect, sort, aggregate, and 

update data and other information efficiently and reliably within business lines and across the 

banking organization for use in stress testing. If certain data and information are not current or 

not available, or if proxies are used, a banking organization should analyze the stress test outputs 

with an understanding of those data limitations. 

A banking organization should also document the assumptions used in its stress tests and 

note the degree of uncertainty that may be incorporated into the tools used for stress testing. In 

some cases, it may be appropriate to present and analyze test results not just in terms of point 

estimates, but also including the potential margin of error or statistical uncertainty around the 

estimates. Furthermore, almost all stress tests, including well-developed quantitative tests 

supported by high-quality data, employ a certain amount of expert or business judgment, and the 

role and impact of such judgment should be clearly documented. In some cases, when credible 

data are lacking and more quantitative tests are operationally challenging or in the early stages of 

development, a banking organization may choose to employ more qualitatively based tests, 

provided that the tests are properly documented and their assumptions are transparent. 

Regardless of the type of stress tests used, a banking organization should understand and clearly 

document all assumptions, uncertainties, and limitations, and provide that information to users of 

the stress testing results. 

Principle 3: An effective stress testing framework is forward-looking and flexible. 

A stress testing framework should be sufficiently dynamic and flexible to incorporate 

changes in a banking organization’s on- and off-balance-sheet activities, portfolio composition, 

asset quality, operating environment, business strategy, and other risks that may arise over time 

from firm-specific events, macroeconomic and financial market developments, or some 

combination of these events. A banking organization should also ensure that its MIS are capable 

of incorporating relatively rapid changes in exposures, activities, and risks. 

While stress testing should utilize available historical information, a banking organization 

should look beyond assumptions based only on historical data and challenge conventional 

assumptions. A banking organization should ensure that it is not constrained by past experience 

and that it considers multiple scenarios, even scenarios that have not occurred in the recent past 

or during the banking organization’s history. For example, a banking organization should not 

assume that if it has suffered no or minimal losses in a certain business line or product that such 

a pattern will continue. Structural changes in customer, product, and financial markets can 

present unprecedented situations for a banking organization. A banking organization with any 
SR Letter 12-7 

Attachment 

7 

type of significant concentration can be particularly vulnerable to rapid changes in economic and 

financial conditions and should try to identify and better understand the impact of those 

vulnerabilities in advance. For example, the risks related to residential mortgages were 

underestimated for a number of years leading up to the 2007-2009 financial crisis by a large 

number of banking organizations, and those risks eventually affected the banking organizations 

in a variety of ways. Effective stress testing can help a banking organization identify any such 

concentrations and help understand the potential impact of several key aspects of the business 

being exposed to common drivers. 

Stress testing should be conducted over various relevant time horizons to adequately 

capture both conditions that may materialize in the near term and adverse situations that take 

longer to develop. For example, when a banking organization stress tests a portfolio for market 

and credit risks simultaneously, it should consider that certain credit risk losses may take longer 

to materialize than market risk losses, and also that the severity and speed of mark-to-market 

losses may create significant vulnerabilities for the firm, even if a more fundamental analysis of 

how realized losses may play out over time seems to show less threatening results. A banking 

organization should carefully consider the incremental and cumulative effects of stress 

conditions, particularly with respect to potential interactions among exposures, activities, and 

risks and possible second-order or “knock-on” effects. 

In addition to conducting formal, routine stress tests, a banking organization should have 

the flexibility to conduct new or ad hoc stress tests in a timely manner to address rapidly 

emerging risks. These less routine tests usually can be conducted in a short amount of time and 

may be simpler and less extensive than a banking organization’s more formal, regular tests. 

However, for its ad hoc tests a banking organization should still have the capacity to bring 

together approximated information on risks, exposures, and activities and assess their impact. 

More broadly, a banking organization should continue updating and maintaining its stress 

testing framework in light of new risks, better understanding of the banking organization’s 

exposures and activities, new stress testing techniques, and any changes in its operating structure 

and environment. A banking organization’s stress testing development should be iterative, with 

ongoing adjustments and refinements to better calibrate the tests to provide current and relevant 

information. Banking organizations should document the ongoing development of their stress 

testing practices. 

Principle 4: Stress test results should be clear, actionable, well supported, and inform 

decision-making. 

Stress testing should incorporate measures that adequately and effectively convey results 

of the impact of adverse outcomes. Such measures may include, for example, changes to asset 

values, accounting and economic profit and loss, revenue streams, liquidity levels, cash flows, 

regulatory capital, risk-weighted assets, the loan loss allowance, internal capital estimates, levels 

of problem assets, breaches in covenants or key trigger levels, or other relevant measures. Stress 

test measures should be tailored to the type of test and the particular level at which the test is 

applied (for example, at the business line or risk level). Some stress tests may require using a 

range of measures to evaluate the full impact of certain events, such as a severe systemic event. 

In addition, all stress test results should be accompanied by descriptive and qualitative 
SR Letter 12-7 

Attachment 

8 

information (such as key assumptions and limitations) to allow users to interpret the exercises in 

context. The analysis and the process should be well documented so that stress testing processes 

can be replicated if need be. 

A banking organization should regularly communicate stress test results to appropriate 

levels within the banking organization to foster dialogue around stress testing, keep the board of 

directors, management, and staff apprised, and to inform stress testing approaches, results, and 

decisions in other areas of the banking organization. A banking organization should maintain an 

internal summary of test results to document at a high level the range of its stress testing 

activities and outcomes, as well as proposed follow-up actions. Regular review of stress test 

results can be an important part of a banking organization’s ability over time to track the impact 

of ongoing business activities, changes in exposures, varying economic conditions, and market 

movements on its financial condition. In addition, management should review stress testing 

activities on a regular basis to determine, among other things, the validity of the assumptions, the 

severity of tests, the robustness of the estimates, the performance of any underlying models, and 

the stability and reasonableness of the results. 

Stress test results should inform analysis and decision-making related to business 

strategies, limits, risk profile, and other aspects of risk management, consistent with the banking 

organization’s established risk appetite. A banking organization should review the results of its 

various stress tests with the strengths and limitations of each test in mind (consistent with 

Principle 2), determine which results should be given greater or lesser weight, analyze the 

combined impact of its tests, and then evaluate potential courses of action based on that analysis. 

A banking organization may decide to maintain its current course based on test results; indeed, 

the results of highly severe stress tests need not always indicate that immediate action has to be 

taken. Wherever possible, benchmarking or other comparative analysis should be used to 

evaluate the stress testing results relative to other tools and measures – both internal and external 

to the banking organization – to provide proper context and a check on results. 

 Principle 5: An organization’s stress testing framework should include strong governance 

and effective internal controls. 

Similar to other aspects of its risk management, a banking organization’s stress testing 

framework will be effective only if it is subject to strong governance and effective internal 

controls to ensure the framework is functioning as intended. Strong governance and effective 

internal controls help ensure that the framework contains core elements, from clearly defined 

stress testing objectives to recommended actions. Importantly, strong governance provides 

critical review of elements of the stress testing framework, especially regarding key assumptions, 

uncertainties, and limitations. A banking organization should ensure that the stress testing 

framework is not isolated within a banking organization’s risk management function, but is 

firmly integrated into business lines, capital and asset-liability committees, and other decisionmaking bodies. Along those lines, the board of directors and senior management should play 

key roles in ensuring strong governance and controls. The extent and sophistication of a banking 

organization’s governance over its stress testing framework should align with the extent and 

sophistication of that framework. Additional details regarding governance and controls of an 

organization’s stress testing framework are outlined in section VI. 
SR Letter 12-7 

Attachment 

9 

IV. Stress Testing Approaches and Applications 

This section discusses some general types of stress testing approaches and applications. 

For any type of stress test, banking organizations should indicate the specific purpose and the 

focus of the test. Defining the scope of a given stress test is also important, whether it applies at 

the portfolio, business line, risk type, or enterprise-wide level, or even just for an individual 

exposure or counterparty. Based on the purpose and scope of the test, different stress testing 

techniques are most useful. Thus, a banking organization should employ several approaches and 

applications; these might include scenario analysis, sensitivity analysis, enterprise-wide stress 

testing, and reverse stress testing. Consistent with Principle 1, banking organizations should 

apply these commensurate with their size, complexity, and business profile, and may not need to 

incorporate all of the details described below. Consistent with Principle 3, banking organizations 

should also recognize that stress testing approaches will evolve over time and they should update 

their practices as needed. 

Scenario Analysis 

Scenario analysis refers to a type of stress testing in which a banking organization applies 

historical or hypothetical scenarios to assess the impact of various events and circumstances, 

including extreme ones. Scenarios usually involve some kind of coherent, logical narrative or 

“story” as to why certain events and circumstances can occur and in which combination and 

order, such as a severe recession, failure of a major counterparty, loss of major clients, natural or 

man-made disaster, localized economic downturn, disruptions in funding or capital markets, or a 

sudden change in interest rates brought about by unfavorable inflation developments. Scenario 

analysis can be applied at various levels of the banking organization, such as within individual 

business lines to help identify factors that could harm those business lines most. 

Stress scenarios should reflect a banking organization’s unique vulnerabilities to factors 

that affect its exposures, activities, and risks. For example, if a banking organization is 

concentrated in a particular line of business, such as commercial real estate or residential 

mortgage lending, it would be appropriate to explore the impact of a downturn in those particular 

market segments. Similarly, a banking organization with lending concentrations to oil and gas 

companies should include scenarios related to the energy sector. Other relevant factors to be 

considered in scenario analysis relate to operational, reputational and legal risks to a banking 

organization, such as significant events of fraud or litigation, or a situation when a banking 

organization feels compelled to provide support to an affiliate or provide other types of noncontractual support to avoid reputational damage. Scenarios should be internally consistent and 

portray realistic outcomes based on underlying relationships among variables, and should include 

only those mitigating developments that are consistent with the scenario. Additionally, a 

banking organization should consider the best manner to try to capture combinations of stressful 

events and circumstances, including second-order and “knock-on” effects. Ultimately, a banking 

organization should select and design multiple scenarios that are relevant to its profile and make 

intuitive sense, use enough scenarios to explore the range of potential outcomes, and ensure that 

the scenarios continue to be timely and relevant. 
SR Letter 12-7 

Attachment 

10 

A banking organization may apply scenario analysis within the context of its existing risk 

measurement tools (e.g., the impact of a severe decline in market prices on a banking 

organization’s value-at-risk (VaR) measure) or use it as an alternative, supplemental measure. 

For instance, a banking organization may use scenario analysis to measure the impact of a severe 

financial market disturbance and compare those results to what is produced by its VaR or other 

measures. This type of scenario analysis should account for known shortcomings of other risk 

measurement practices. For example, market risk VaR models generally assume liquid markets 

with known prices. Scenario analysis could shed light on the effects of a breakdown in liquidity 

and of valuation difficulties. 

One of the key challenges with scenario analysis is to translate a scenario into balance 

sheet impact, changes in risk measures, potential losses, or other measures of adverse financial 

impact, which would vary depending on the test design and the type of scenario used. For some 

aspects of scenario analysis, banking organizations may use econometric or similar types of 

analysis to estimate a relationship between some underlying factors or drivers and risk estimates 

or loss projections based on a given data set, and then extrapolate to see the impact of more 

severe inputs. Care should be taken not to make assumptions that relationships from benign or 

mildly adverse times will hold during more severe times or that estimating such relationships is 

relatively straightforward. For example, linear relationships between risk drivers and losses may 

become nonlinear during times of stress. In addition, organizations should recognize that there 

can be multiple permutations of outcomes from just a few key risk drivers. 

Sensitivity Analysis 

Sensitivity analysis refers to a banking organization’s assessment of its exposures, 

activities, and risks when certain variables, parameters, and inputs are “stressed” or “shocked.” 

A key goal of sensitivity analysis is to test the impact of assumptions on outcomes. Generally, 

sensitivity analysis differs from scenario analysis in that it involves changing variables, 

parameters, or inputs without an explicit underlying reason or narrative, in order to explore what 

occurs under a range of inputs and at extreme or highly adverse levels. In this type of analysis a 

banking organization may realize, for example, that a given relationship is much more difficult to 

estimate at extreme levels. 

A banking organization may apply sensitivity analysis at various levels of aggregation to 

estimate the impact from a change in one or more key variables. The results may help a banking 

organization better understand the range of outcomes from some of its models, such as 

developing a distribution of output based on a variety of extreme inputs. For example, a banking 

organization may choose to calculate a range of changes to a structured security’s overall value 

using a range of different assumptions about the performance and linkage of underlying cash 

flows. Sensitivity analysis should be conducted periodically due to potential changes in a 

banking organization’s exposures, activities, operating environment, or the relationship of 

variables to one another. 

Sensitivity analysis can also help to assess a combined impact on a banking organization 

of several variables, parameters, factors, or drivers. For example, a banking organization could 

better understand the impact on its credit losses from a combined increase in default rates and a 

decrease in collateral values. A banking organization could also explore the impact of highly 
SR Letter 12-7 

Attachment 

11 

adverse capitalization rates, declines in net operating income, and reductions in collateral when 

evaluating its risks from commercial real estate exposures. Sensitivity analysis can be especially 

useful because it is not necessarily accompanied by a particular narrative or scenario; that is, 

sensitivity analysis can provide banking organizations more flexibility to explore the impact of 

potential stresses that they may not be able to capture in designed scenarios. Furthermore, 

banking organizations may decide to conduct sensitivity analysis of their scenarios, i.e., choosing 

different levels or paths of variables to understand the sensitivities of choices made during 

scenario design. For instance, banking organizations may decide to apply a few different 

interest-rate paths for a given scenario. 

Enterprise-Wide Stress Testing 

Enterprise-wide stress testing is an application of stress testing that involves assessing the 

impact of certain specified scenarios on the banking organization as a whole, particularly with 

regard to capital and liquidity. As is the case with scenario analysis more generally, enterprisewide stress testing involves robust scenario design and effective translation of scenarios into 

measures of impact. Enterprise-wide stress tests can help a banking organization in its efforts to 

assess the impact of its full set of risks under adverse events and circumstances, but should be 

supplemented with other stress tests and other risk measurement tools given inherent limitations 

in capturing all risks and all adverse outcomes in one test. 

Scenario design for enterprise-wide stress testing involves developing scenarios that 

affect the banking organization as a whole that stem from macroeconomic, market-wide, and/or 

firm-specific events. These scenarios should incorporate the potential simultaneous occurrence 

of both firm-specific and macroeconomic and market-wide events, considering system-wide 

interactions and feedback effects. For example, price shocks may lead to significant portfolio 

losses, rising funding gaps, a ratings downgrade, and diminished access to funding. In general, it 

is a good practice to consult with a large set of individuals within the banking organization – in 

various business lines, research and risk areas – to gain a wide perspective on how enterprisewide scenarios should be designed and to ensure that the scenarios capture the relevant aspects of 

the banking organization’s business and risks. Banking organizations should also conduct 

scenarios of varying severity to gauge the relative impact. At least some scenarios should be of 

sufficient severity to challenge the viability of the banking organization, and should include 

instantaneous market shocks and stressful periods of extended duration (e.g., not just a one or 

two-quarter shock after which conditions return to normal). 

Selection of scenario variables is important for enterprise-wide tests, because these 

variables generally serve as the link between the overall narrative of the scenario and tangible 

impact on the banking organization as a whole. For instance, in aiming to capture the combined 

impact of a severe recession and a financial market downturn, a banking organization may 

choose a set of variables such as changes in gross domestic product (GDP), unemployment rate, 

interest rates, stock market levels, or home price levels. However, particularly when assessing 

the impact on the whole banking organization, using a large number of variables can make a test 

more cumbersome and complicated – so a banking organization may also benefit from simpler 

scenarios or from those with fewer variables. Banking organizations should balance the 

comprehensiveness of contributing variables and tractability of the exercise. 
SR Letter 12-7 

Attachment 

12 

As with scenario analysis generally, translating scenarios into tangible effects on the 

banking organization as a whole presents certain challenges. A banking organization should 

identify appropriate and meaningful mechanisms for translating scenarios into relevant internal 

risk parameters that provide a firm-wide view of risks and understanding of how these risks are 

translated into loss estimates. Not all business areas are equally affected by a given scenario, and 

problems in one business area can have effects on other units. However, for an enterprise-wide 

test, assumptions across business lines and risk areas should remain constant for the chosen 

scenario, since the objective is to see how the banking organization as a whole will be affected 

by a common scenario. 

Reverse Stress Testing 

Reverse stress testing is a tool that allows a banking organization to assume a known 

adverse outcome, such as suffering a credit loss that breaches regulatory capital ratios or 

suffering severe liquidity constraints that render it unable to meet its obligations, and then 

deduce the types of events that could lead to such an outcome. This type of stress testing may 

help a banking organization to consider scenarios beyond its normal business expectations and 

see the impact of severe systemic effects on the banking organization. It also allows a banking 

organization to challenge common assumptions about its performance and expected mitigation 

strategies. 

Reverse stress testing helps to explore so-called “break the bank” situations, allowing a 

banking organization to set aside the issue of estimating the likelihood of severe events and to 

focus more on what kinds of events could threaten the viability of the banking organization. 

This type of stress testing also helps a banking organization evaluate the combined effect of 

several types of extreme events and circumstances that might threaten the survival of the banking 

organization, even if in isolation each of the effects might be manageable. For instance, reverse 

stress testing may help a banking organization recognize that a certain level of unemployment 

would have a severe impact on credit losses, that a market disturbance could create additional 

losses and result in rising funding costs, and that a firm-specific case of fraud would cause even 

further losses and reputational impact that could threaten a banking organization’s viability. In 

some cases, reverse stress tests could reveal to a banking organization that “breaking the bank” is 

not as remote an outcome as originally thought. 

Given the numerous potential threats to a banking organization’s viability, the 

organization should ensure that it focuses first on those scenarios that have the largest firm-wide 

impact, such as insolvency or illiquidity, but also on those that seem most imminent given the 

current environment. Focusing on the most prominent vulnerabilities helps a banking 

organization prioritize its choice of scenarios for reverse stress testing. However, a banking 

organization should also consider a wider range of possible scenarios that could jeopardize the 

viability of the banking organization, exploring what could represent potential blind spots. 

Reverse stress testing can highlight previously unacknowledged sources of risk that could be 

mitigated through enhanced risk management. 
SR Letter 12-7 

Attachment 

13 

V. Stress Testing for Assessing the Adequacy of Capital and Liquidity 

There are many uses of stress testing within banking organizations. Prominent among 

these are stress tests designed to assess the adequacy of capital and liquidity. Given the 

importance of capital and liquidity to a banking organization’s viability, stress testing should be 

applied in these two areas in particular, including an evaluation of the interaction between capital 

and liquidity and the potential for both to become impaired at the same time. Depletions and 

shortages of capital or liquidity can cause a banking organization to no longer perform 

effectively as a financial intermediary, be viewed by its counterparties as no longer viable, 

become insolvent, or diminish its capacity to meet legal and financial obligations. A banking 

organization’s capital and liquidity stress testing should consider how losses, earnings, cash 

flows, capital, and liquidity would be affected in an environment in which multiple risks 

manifest themselves at the same time, for example, an increase in credit losses during an adverse 

interest-rate environment. Additionally, banking organizations should recognize that at the end 

of the time horizon considered by a given stress test, they may still have substantial residual risks 

or problem exposures that may continue to pressure capital and liquidity resources. 

Stress testing for capital and liquidity adequacy should be conducted in coordination with 

a banking organization’s overall strategy and annual planning cycles. Results should be 

refreshed in the event of major strategic decisions, or other decisions that can materially impact 

capital or liquidity. Banking organizations should conduct stress testing for capital and liquidity 

adequacy periodically. 

Capital Stress Testing 

Capital stress testing results can serve as a useful tool to support a banking organization’s 

capital planning and corporate governance.7

 They may help a banking organization better 

understand its vulnerabilities and evaluate the impact of adverse outcomes on its capital position 

and ensure that the banking organization holds adequate capital given its business model, 

including the complexity of its activities and its risk profile. Capital stress testing complements a 

banking organization’s regulatory capital analysis8

 by providing a forward-looking assessment of 

capital adequacy, usually with a forecast horizon of at least two years (with the recognition that 

the effects of certain stress conditions could extend beyond two years for some stress tests), and 

highlighting the potential adverse effects on capital levels and ratios from risks not fully captured 

in regulatory capital requirements. It should also be used to help a banking organization assess 

the quality and composition of capital and its ability to absorb losses. Stress testing can aid 

 

7

 In this manner, stress testing can form an integral part of an organization’s internal capital adequacy process, 

consistent with supervisory standards outlined in SR 09-4, SR 99-18, and Supervisory Review Process of Capital 

Adequacy, supra note 12. 

8

 While savings and loan holding companies currently are not subject to consolidated regulatory leverage or riskbased capital requirements, a savings and loan holding company should have sufficient capital and an effective 

capital planning process, consistent with its overall risk profile and considering the size, scope, and complexity of its 

operations, to ensure the safe and sound operation of the company. See Supervision and Regulation Letter SR 11-

11, Supervision of Savings and Loan Holding Companies (July 21, 2011), available at 

http://www.federalreserve.gov/bankinforeg/srletters/sr1111.pdf. 
SR Letter 12-7 

Attachment 

14 

capital contingency planning by helping management identify exposures or risks in advance that 

would need to be reduced and actions that could be taken to bolster capital levels or otherwise 

maintain capital adequacy, as well as actions that in times of stress might not be possible – such 

as raising capital. 

Capital stress testing should include exercises that analyze the potential for changes in 

earnings, losses, reserves, and other potential effects on capital under a variety of stressful 

circumstances. Such testing should also capture any potential change in risk-weighted assets, the 

ability of capital to absorb losses, and any resulting impact on the banking organization’s capital 

ratios. It should include all relevant risk types and other factors that have a potential to affect 

capital adequacy, whether directly or indirectly, including firm-specific ones. A banking 

organization should also explore the potential for possible balance sheet expansion to put 

pressure on capital ratios and consider risk mitigation and capital preservation options, other than 

simply shrinking the balance sheet. Capital stress testing should assess the potential impact of a 

banking organization’s material subsidiaries suffering capital problems on their own – such as 

being unable to meet local country capital requirements – even if the consolidated banking 

organization is not encountering problems.9

 Where material relative to the banking 

organization's capital, counterparty exposures should also be included in capital stress testing. 

 

Enterprise-wide stress testing, as described in section IV, should be an integral part of a 

banking organization’s capital stress testing.10 Such enterprise-wide testing should include proforma estimates of not only potential losses and resources available to absorb losses, but also 

potential planned capital actions (such as dividends or share repurchases) that would affect the 

banking organization’s capital position, including regulatory and other capital ratios. There 

should also be consideration of the impact on the banking organization’s allowance for loan and 

lease losses and other relevant financial metrics. Even with very effective enterprise-wide tests, 

banking organizations should use capital stress testing in conjunction with other internal 

approaches (in addition to regulatory measures) for assessing capital adequacy, such as those that 

rely primarily on statistical estimates of risk or loss estimates based on historical data. 

Liquidity stress testing 

A banking organization should also conduct stress testing for liquidity adequacy.11 

Through such stress testing a banking organization can work to identify vulnerabilities related to 

liquidity adequacy in light of both firm-specific and market-wide stress events and 

circumstances. Effective stress testing helps a banking organization identify and quantify the 

depth, source, and degree of potential liquidity and funding strain and to analyze possible 

impacts on its cash flows, liquidity position, profitability, and other aspects of its financial 

condition over various time horizons. For example, stress testing can be used to explore 

 

9

 For regulated subsidiaries, stress testing activities should be fully consistent with the regulations and guidance of 

the relevant primary federal supervisor. 

10 The agencies expect that the stress test requirements in the Dodd-Frank Act for companies with more than $10 

billion in assets would be an integral part of this type of stress testing. 

11 See, Funding and Liquidity Risk Management Policy Statement and Interest Rate Risk Advisory, supra note 12. 
SR Letter 12-7 

Attachment 

15 

potential funding shortfalls, shortages in liquid assets, the inability to issue debt, exposure to 

possible deposit outflows, volatility in short-term brokered deposits, sensitivity of funding to a 

ratings downgrade, and the impact of reduced collateral values on borrowing capacity at the 

Federal Home Loan Banks, the Federal Reserve discount window, or other secured wholesale 

funding sources. 

Liquidity stress testing should explore the potential impact of adverse developments that 

may affect market and asset liquidity, including the freezing up of credit and funding markets, 

and the corresponding impact on the banking organization. Such tests can also help identify the 

conditions under which balance sheets might expand, thus creating additional funding needs 

(e.g., through accelerated drawdowns on unfunded commitments). These tests also help 

determine whether the banking organization has a sufficient liquidity buffer to meet various 

types of future liquidity demands under stressful conditions. In this regard, liquidity stress 

testing should be an integral part of the development and maintenance of a banking 

organization’s contingency funding planning. Liquidity stress testing should include enterprisewide tests as discussed in section IV, but should also be applied, as appropriate, at lower levels 

of the banking organization, and in particular should account for regulatory or supervisory 

restrictions on inter-affiliate funding and asset transfers. As with capital stress testing, banking 

organizations may need to conduct liquidity stress tests at both the consolidated and subsidiary 

level. In undertaking enterprise-wide liquidity tests banking organizations should make realistic 

assumptions as to the implications of liquidity stresses in one part of the banking organization on 

other parts. 

An effective stress testing framework should explore the potential for capital and 

liquidity problems to arise at the same time or exacerbate one another. For example, a banking 

organization in a stressed liquidity position is often required to take actions that have a negative 

direct or indirect capital impact (e.g., selling assets at a loss or incurring funding costs at above 

market rates to meet funding needs). A banking organization’s liquidity stress analysis should 

explore situations in which the banking organization may be operating with a capital position 

that exceeds regulatory minimums, but is nonetheless viewed within the financial markets or by 

its counterparties as being of questionable viability. Assessing the potential interaction of capital 

and liquidity can be challenging and may not be possible within a single stress test, so 

organizations should explore several avenues to assess that interaction. As with other 

applications of stress testing, for its capital and liquidity stress tests, it is beneficial for a banking 

organization to articulate clearly its objectives for a post-stress outcome, for instance to remain a 

viable financial market participant that is able to meet its existing and prospective obligations 

and commitments. In such cases, banking organizations would have to consider which measures 

of financial condition would need to be met on a post-stress basis to secure the confidence of 

counterparties and market participants. 

VI. Governance and Controls 

As noted under Principle 5, a banking organization’s stress testing framework will be 

effective only if it is subject to strong governance and controls to ensure the framework is 

functioning as intended. The extent and sophistication of a banking organization’s governance 
SR Letter 12-7 

Attachment 

16 

over its stress testing framework should align with the extent and sophistication of that 

framework. 

Governance over a banking organization’s stress testing framework rests with the 

banking organization’s board of directors and senior management. As part of their overall 

responsibilities, a banking organization’s board and senior management should establish a 

comprehensive, integrated and effective stress testing framework that fits into the broader risk 

management of the banking organization. While the board is ultimately responsible for ensuring 

that the banking organization has an effective stress testing framework, senior management 

generally has responsibility for implementing that framework. Senior management duties should 

include establishing adequate policies and procedures and ensuring compliance with those 

policies and procedures, assigning competent staff, overseeing stress test development and 

implementation, evaluating stress test results, reviewing any findings related to the functioning 

of stress test processes, and taking prompt remedial action where necessary. Senior 

management, directly and through relevant committees, also should be responsible for regularly 

reporting to the board on stress testing developments (including the process to design tests and 

develop scenarios) and on stress testing results (including from individual tests, where material), 

as well as on compliance with stress testing policy. Board members should actively evaluate and 

discuss this information, ensuring that the stress testing framework is in line with the banking 

organization’s risk appetite, overall strategy and business plans, and contingency plans, directing 

changes where appropriate. 

A banking organization should have written policies, approved and annually reviewed by 

the board, that direct and govern the implementation of the stress testing framework in a 

comprehensive manner. Policies, along with procedures to implement them, should: 

 Describe the overall purpose of stress testing activities; 

 Articulate consistent and sufficiently rigorous stress testing practices across the entire 

banking organization; 

 Indicate stress testing roles and responsibilities, including controls over external resources 

used for any part of stress testing (such as vendors and data providers); 

 Describe the frequency and priority with which stress testing activities should be conducted; 

 Indicate how stress test results are used, by whom, and outline instances in which remedial 

actions should be taken; and 

 Be reviewed and updated as necessary to ensure that stress testing practices remain 

appropriate and keep up to date with changes in market conditions, banking organization 

products and strategies, banking organization exposures and activities, the banking 

organization’s established risk appetite, and industry stress testing practices. 

A stress testing framework should incorporate validation or other type of independent 

review to ensure the integrity of stress testing processes and results, consistent with existing 

supervisory expectations.12 If a banking organization engages a third party vendor to support 

 

12 For validation of models and other quantitative tools used for stress testing, see OCC Bulletin 2011-12, 

Supervisory Guidance on Model Risk Management (April 4, 2011), available at http://www.occ.gov/news-
SR Letter 12-7 

Attachment 

17 

some or all of its stress testing activities, there should be appropriate controls in place to ensure 

that those externally developed systems and processes are sound, applied correctly, and 

appropriate for the banking organization’s risks, activities, and exposures. Additionally, senior 

management should be mindful of any potential inconsistencies, contradictions, or gaps among 

its stress tests and assess what actions should be taken as a result. Internal audit should also 

provide independent evaluation of the ongoing performance, integrity, and reliability of the stress 

testing framework. A banking organization should ensure that its stress tests are documented 

appropriately, including a description of the types of stress tests and methodologies used, key 

assumptions, results, and suggested actions. Senior management, in consultation with the board, 

should review stress testing activities and results with an appropriately critical eye and ensure 

that there is objective review of all stress testing processes. 

The results of stress testing analyses should facilitate decision-making by the board and 

senior management. Stress testing results should be used to inform the board about alignment of 

the banking organization’s risk profile with the board’s chosen risk appetite, as well as inform 

operating and strategic decisions. Stress testing results should be considered directly by the 

board and senior management for decisions relating to capital and liquidity adequacy, including 

capital contingency plans and contingency funding plans. Senior management, in consultation 

with the board, should ensure that the stress testing framework includes a sufficient range of 

stress testing activities applied at the appropriate levels of the banking organization (i.e., not just 

one enterprise-wide stress test). Sound governance also includes using stress testing to consider 

the effectiveness of a banking organization’s risk mitigation techniques for various risk types 

over their respective time horizons, such as to explore what could occur if expected mitigation 

techniques break down during stressful periods. 

VII. Conclusion 

A banking organization should use the principles laid out in this guidance to develop, 

implement, and maintain an effective stress testing framework. Such a framework should be 

adequately tailored to the banking organization’s size, complexity, risks, exposures, and 

activities. A key purpose of stress testing is to explore various types of possible outcomes, 

including rare and extreme events and circumstances, assess their impact on the banking 

organization, and then evaluate the boundaries up to which the banking organization plans to be 

able to withstand such outcomes. Stress testing may be particularly valuable during benign 

periods when other measures may not indicate emerging risks. 

While stress testing can provide valuable information regarding potential future outcomes, 

similar to any other risk management tool it has limitations and cannot provide absolute certainty 

regarding the implications of assumed events and impacts. Furthermore, management should 

ensure that stress testing activities are not constrained to reflect past experiences, but instead 

consider a broad range of possibilities. No single stress test can accurately estimate the impact 

of all stressful events and circumstances; therefore, a banking organization should understand 

 issuances/bulletins/2011/bulletin-2011-12a.pdf; or Supervision and Regulation Letter SR 11-7, Guidance on Model

Risk Management (April 4, 2011), available at http://www.federalreserve.gov/bankinforeg/srletters/sr1107.pdf. 
SR Letter 12-7 

Attachment 

18 

and account for stress testing limitations and uncertainties, and use stress tests in combination 

with other risk management tools to make informed risk management and business decisions.