Basel Committee on Banking Supervision

Stress testing is a critical element of risk management for banks and a core tool for banking supervisors and macroprudential authorities. Stress testing is integral to banks’ risk management and banking supervision, as it: (i) alerts bank management and supervisory authorities to unexpected adverse outcomes arising from a wide range of risks; and (ii) provides an indication to banks and supervisory authorities of the financial resources that might be needed to absorb losses should large shocks occur.

The following terms are used throughout this chapter and have the meaning given below:

1. Adverse (stress) scenario: a set of economic and financial conditions (significantly more negative than a baseline scenario) which is designed to stress the financial performance of a financial system, sector, institution, portfolio or product (reflecting severe but plausible conditions). The design of the adverse scenario depends on the purpose of the test, availability of data and the time horizon chosen.
2. Capital hurdle rate: the amount of capital requirements, in terms of capital adequacy ratios or leverage ratios, which is acceptable to supervisors, regulators, risk managers, or investors, after considering the impact projected by the stress testing exercise. The capital hurdle rate may be set at the regulatory minimum or higher, and it may also include additional surcharges and buffers, depending on the context and goals of the exercise. Capital hurdle rates do not typically have to be uniform for all scenarios or institutions.
3. Feedback (second-round) effects: Feedback or second-round effects are shocks resulting from the transmission of initial shocks from institutions to parts of the real economy and also to the financial sector itself.
4. Model overlays: modifications of modelled outcomes based on the use of expert judgement, alternative models, or other quantitative analysis.
5. Reverse stress test: the process of assessing a pre-defined adverse outcome for an institution, such as a breach of regulatory ratios, insolvency or illiquidity, and identifying possible scenarios that could lead to such adverse outcome. A reverse stress test helps to understand underlying risks and vulnerabilities in institutions’ businesses and products that pose a threat to its viability and helps to identify scenarios that could threaten resilience.
6. Stress testing practices: include a range of methodologies from sensitivity analysis to more complex scenario analysis (including enterprise-wide stress tests) and reverse stress testing.

The principles which follow are set at a high level so that they may be applicable across different banks and jurisdictions, remain relevant as stress testing practices evolve over time, and be used by jurisdictions to guide all elements of a sound stress testing framework.

The Basel Committee expects that, for internationally active banks, stress testing is embedded as a critical component of sound risk management and supervisory oversight and that such stress testing considers the substance of these principles. Therefore, the principles are formulated with a view towards application to large, internationally active banks and to supervisory and other relevant financial authorities in Basel Committee member jurisdictions. These principles could also be applied to smaller banks and authorities in all jurisdictions on a proportionate basis.

Each principle is followed by a short description of considerations that are relevant for both banks and for authorities. This description is followed by two additional sets of points applicable to either, as relevant:

1. Additional points for banks: These cover additional points with relevance to (a) banks’ own internal stress testing activities, and (b) their participation in bank-run supervisory stress tests.
2. Additional points for authorities: These cover additional points with relevance to (a) supervisor-run stress tests, and (b) the authorities’ role in bank-run supervisory stress tests. They also cover the role of authorities in their oversight of banks’ internal stress testing activities.

Principle 1: Stress testing frameworks should have clearly articulated and formally adopted objectives

Stress testing frameworks should be designed to meet clear objectives that are documented and approved at the board level of the organisation, or an appropriately senior-level governance body. The objectives should be the basis for setting out the framework’s requirements and expectations and should be consistent with the bank’s or supervisory authority’s risk management framework and its overall governance structure.

Staff involved in the implementation of stress testing frameworks should have a clear understanding of the framework’s objectives, as this will help to guide any discretionary or judgmental elements.

Additional points for banks

For banks’ internal stress testing frameworks, the relevant high-level objectives should be aligned with the bank’s risk appetite and risk management framework, and may relate, for example, to the use of stress tests to inform capital and liquidity planning or to their role as an integral element of risk management.

Additional points for authorities

For authorities, relevant high-level objectives may relate to, for example: (i) assessing the adequacy of levels of capital or liquidity of supervised banks; (ii) fostering banks’ own stress testing and risk management capabilities; (iii) supporting other supervisory activities (eg on-site inspections, further in‑depth analysis); (iv) providing a quantitative assessment of banks’ risk profiles, both for individual banks and for the banking system in aggregate; or (v) contributing to market confidence or strengthening market discipline. Authorities should communicate the intended objectives/use of stress testing results to participating banks in advance of the exercise.

Principle 2: Stress testing frameworks should include an effective governance structure

Stress testing frameworks should include an effective governance structure that is clear, comprehensive and documented. This should specify the roles and responsibilities of senior management, oversight bodies and those responsible for the ongoing operation of the stress testing framework. This governance framework should identify all key stakeholders and ensure a full and consistent oversight and monitoring of the actions taken at the different stages of the stress testing process.

Roles and responsibilities should be specified for all aspects of the stress testing framework, including scenario development and approval, model development and validation, reporting and challenge of results and the use of stress test outputs. The roles of the second and third lines of defence should be specified (eg risk management and compliance, and internal audit, respectively). Policies and procedures should cover all aspects of the stress testing framework, be clearly documented, kept up‑to‑date and be approved by the board of directors and/or senior management.

The stress testing framework should ensure collaboration between all necessary stakeholders, including appropriate communication of the stress testing assumptions, methodologies, scenarios and results to stakeholders. The engagement structure should facilitate credible challenge of the stress testing framework (both at senior and technical expert levels) including assumptions, methodologies, scenarios and results, the assessment of its ongoing performance and effectiveness, and the remediation of gaps identified by key stakeholders.

For banks’ internal stress testing frameworks, all aspects of the governance arrangements should be specified by the bank, subject to compliance with international best practices including the Basel Committee’s Corporate governance principles for banks.1 The bank’s board of directorsshould have the ultimate responsibility for the overall stress testing framework, including the oversight of the framework. The development and implementation of the stress testing framework may be delegated to senior management or a stress testing committee. The board, or an appropriately senior-level governance body, is expected to have an understanding of the material aspects of the stress testing framework that enables it to actively engage in discussions with senior management or senior experts that are responsible for stress testing and challenge key modelling assumptions, the scenario selection and the assumptions underlying the stress tests.

For bank-run supervisory stress tests, banks should document the governance arrangements that specify their own specific roles in these exercises. For example, relevant responsibilities likely relate to data quality control, interactions with supervisory authorities on interpretative issues, and modelling choices where these are not specified by the authority.

The bank functions that should be engaged in each stress testing exercise depend on a number of factors, including the objectives of the framework, or particular stress test, the type of stress test (bank‑wide vs more targeted), whether it is an internal stress test or a bank-run supervisory exercise, and the specific structure of the bank itself. Examples of bank functions that are likely to be relevant include economics, risk, finance, strategy and the front-line businesses.

Authorities should ensure that a comprehensive governance structure for all aspects of the authority’s stress testing framework is formulated by key stakeholders. The process should document a delineation of the roles for all relevant participants in the stress testing framework, inter-department (agency) coordination, and the nature and frequency of the communication of the results.

Stress testing often involves multiple units within the authority. The governance structure should guide alignment between macroprudential and microprudential functions (eg such alignment could be in terms of scenario development, data-sharing, data validation and the use of outputs from all stress testing exercises).

As a forward-looking risk management tool, stress testing constitutes a key input into banks’ and authorities’ activities related to risk identification, monitoring and assessment. As such, stress testing should also contribute to formulating and pursuing strategic and policy objectives.

When using the results of stress tests, banks and authorities should have a clear understanding of their key assumptions and limitations, for instance in terms of scenario relevance, risk coverage and model risk.

Stress tests should be undertaken regularly to be a meaningful risk management tool. While ad hoc stress tests may be performed for specific reasons, generally stress tests should be undertaken according to a defined schedule. The appropriate frequency will depend on several factors, including the objectives of the stress testing framework, the scope of the stress test, the size and complexity of the bank or banking sector, and changes in the macroeconomic environment.

Banks should ensure that stress testing results, and any other relevant findings, are effectively used in accordance with the objectives and internal policies and procedures of the stress testing framework. These uses should provide insight to the board and senior management, to inform key decisions in the direction and management of the bank. For that purpose, the stress test results should be reported to the board of directors and senior management on a regular basis, at relevant levels of aggregation. The reports should include the main modelling and scenario assumptions as well as any significant limitations.

Results of stress tests should, where appropriate, inform banks’ calibration of risk appetite and limits, financial and capital planning, liquidity and funding risk assessment, contingency planning and recovery and resolution planning. For instance, internal stress tests should support banks’ internal capital adequacy assessments and their internal assessments of liquidity adequacy. Moreover, stress testing results should be used, where appropriate, to support portfolio management, new trade/product approval processes and to inform other corporate decision-making processes such as the evaluation of strategic options.

Stress tests should be critically evaluated by authorities and properly integrated in their supervisory and/or financial stability programmes, to be used along with other available analytical and/or policy instruments.

Authorities may use stress testing results as one of the inputs for the supervisory process. For instance, quantitative and qualitative outcomes of stress tests should help to identify risks and vulnerabilities to which banks may be exposed, assess banks’ capital and liquidity adequacy, and, where appropriate, inform reviews of banks’ internal governance and risk management arrangements. Stress tests are generally designed to quantify and inform the understanding of risks and as a result may, depending on the objectives, involve hurdle rates/thresholds. When authorities use stress tests to assess banks’ capital and liquidity adequacy (eg through Pillar 2), they should also consider the appropriate supervisory responses to any deficiencies that are identified. These may include expectations for additional capital, risk reduction, or enhanced risk management, depending on the authority’s supervisory approach.

Where appropriate, authorities may also use stress testing outcomes for macroprudential purposes, such as to:

1. identify and assess risks and vulnerabilities at systemic level, possibly including additional sources of stress (eg feedback/second-round effects);
2. quantify the capital needs at systemic level during a time of crisis; and
3. inform the calibration of macroprudential policies and instruments.

Where management actions are part of the bank’s supervisory stress testing submissions, authorities should consider whether the proposed actions are part of, or consistent with, the banks’ other strategic plans (such as recovery plans).

Stress testing frameworks should capture material and relevant risks, as determined by a sound risk identification process. The risk identification process should include a comprehensive assessment of risks, which may include those deriving from both on- and off-balance sheet exposures, earnings vulnerabilities, operational risks, and other factors that could affect the solvency or liquidity position of the bank (or banks in the case of supervisory stress tests).

Stress test scenarios should be designed to capture material and relevant risks identified in the risk identification process and key variables within each scenario should be internally consistent. A narrative should articulate how the scenario captures the risks. If certain material and relevant risks are excluded from the scenarios, their exclusion should be explained and documented. The scenarios should be sufficiently severe and varied, given the objective of the exercise, to provide a meaningful test of banks’ resilience. That is, the scenarios should be sufficiently severe but plausible.

The scenarios and sensitivities used in stress tests should be reviewed periodically to ensure that they remain relevant. Consideration should be given to historical events and hypothetical future events that account for new information and emerging risks in the present and foreseeable future. Scenarios not based on historical events and empirically observed relationships may be warranted for some or all risks if new or heightened vulnerabilities are identified, or if historical data do not contain a severe crisis episode. The scenarios and the sensitivities should also consider the current macroeconomic and financial environment.

The scenarios and sensitivities that banks use for their internal stress tests should not be limited to those used in prescribed supervisory stress tests, although benchmarking to supervisory stress tests can be a useful exercise. Banks should ensure that scenarios are tailored to their businesses and address their bank‑specific vulnerabilities. Reverse stress tests explore scenarios that could potentially lead banks to fail and thus can be useful in helping banks to identify their core vulnerabilities. In designing their own scenarios, banks should carefully determine the characteristics of each scenario, such as the severity of the stress and the types of risks that are considered, so that they reflect the board’s risk appetite and objectives. This design process must be transparent to internal and relevant external stakeholders (such as the banks’ supervisors).

Banks should conduct their internal stress tests at relevant levels of their organisation (eg at a portfolio level, a business unit level, or at a firm-wide level (consolidation, solo or sub‑consolidated)), consistent with the objectives of the stress testing framework. When looking at risks at a bank-wide level, particular attention should be paid to risk concentrations. The bank’s strategic orientation and its economic environment should likewise be considered when defining the stress test’s scope and scenarios.

When developing stress test scenarios, authorities should consider specific features or vulnerabilities of individual banks (eg their risk profiles and business models) and/or the banking sector as a whole. To the extent possible, they should also consider emerging risks if these are relevant to the objective of the stress test. Authorities may also consider developments in banks’ internal scenarios and sensitivity analyses.

Given the objectives of a particular exercise, authorities should evaluate whether common scenarios could be applicable to the whole banking sector or whether tailored scenarios for specific parts of the banking sector would be more appropriate.

Stress testing frameworks should have organisational structures that are adequate to meet their objectives. Governance processes should ensure the adequacy of resourcing for stress testing, including ensuring that the resources have the appropriate skill sets to execute the framework. Resourcing decisions should reflect that stress tests have become more sophisticated over time, increasing the need for specialised staff, systems and IT infrastructure.

Processes to ensure resources have the appropriate skill sets could include building the skills of internal staff, ensuring knowledge transfer to internal staff, as well as hiring personnel with specialised stress testing skills. The set of skills typically required includes (but are not limited to) expertise in liquidity risk, credit risk, market risk, capital rules, financial accounting, modelling and project management.

Banks should ensure effective policies and internal controls are in place to govern systems and processes used in both their own internal stress testing exercise, and their participation in bank-run supervisory exercises.

Banks that adopt centralised approaches to their stress testing activities should ensure that governance systems are in place to facilitate insights from business lines, such as how their portfolios will be impacted by the stress scenarios. Banks that adopt decentralised approaches should have group level policies, procedures and controls to ensure that there is sufficient consistency in how stress scenarios are translated into impacts that can be aggregated to give a coherent view of risks the bank is facing.

If services supplied by third parties are used by banks to supplement internal resources, policies and procedures should establish appropriate due diligence, oversight and control consistent with sound third-party risk management (see also ORR30).

Both bank-run and supervisor-run supervisory stress tests can be resource-intensive, requiring specialised staff, systems and IT infrastructure. Authorities should ensure that resources and the organisational structure are adequate given the complexity of the exercises. For example, authorities should consider the resources needed to interact with the banks that participate in the exercises, eg processes and infrastructure to address clarifying questions from banks, interacting with banks to check data quality/discrepancies, and providing feedback to banks on the results of the exercises.

For risks to be identified and the results of stress tests to be reliable, the data used should be accurate and complete, and available at a sufficiently granular level and in a timely manner. The granularity of the data should align with the objectives of the stress test (see also Principle 7).

Both banks and authorities should have in place a robust data infrastructure capable of retrieving, processing, and reporting information used in stress tests to ensure that the information is of adequate quality to meet the objectives of the stress testing framework. Processes should be in place to address any identified material information deficiencies.

The infrastructure capabilities of banks should be flexible enough to retrieve data for use in both internal stress tests and the bank’s involvement in any bank-run supervisory stress tests. Where appropriate, banks should ensure consistency of data sources, processing, and aggregation across their stress tests. Banks should ensure the data they produce for stress testing purposes are coherent with their overall risk management framework.

Banks should collect, quality-assure, and maintain historical data relevant for their internal stress testing frameworks. Banks should ensure that they are able to accurately integrate data associated with mergers and acquisitions with their historical data set.

The BCBS Principles for effective risk data aggregation and risk reporting2 should guide banks in building up, revising and improving their capabilities in the use of data to enhance their ability to identify and manage bank-wide risks. In particular, banks’ risk data aggregation capabilities should be (i) subject to strong governance arrangements; (ii) supported by an adequate data architecture and IT infrastructure; and (iii) capable of capturing and aggregating all material risk data across the banking group.

The infrastructure should be sufficiently flexible to allow for targeted or ad hoc stress tests in times of rapidly changing market conditions and to meet on-demand requests arising from both internal needs and externally from supervisory queries.

Authorities should leverage, to the extent possible, data already provided by banks to authorities, such as through banks’ regular supervisory reporting. Authorities should ensure consistency of data sources to the extent possible when aggregating data within supervisory stress tests, or across multiple stress tests.

Authorities should review and foster improvement of banks’ data quality and risk data aggregation capabilities as part of their ongoing supervision.

The models and methodologies used to derive stress estimates and impacts should fit the purpose and intended use of the stress tests. This implies:

1. the need to adequately define at the modelling stage the coverage, segmentation and granularity of the data and types of risk in line with the objectives of the stress test framework;
2. the level of sophistication of the models should be appropriate for both the objectives of the exercise and the type and materiality of the portfolios being monitored using the models; and
3. the models and methodologies used for stress tests should be well justified and documented.

Sound model development requires the collaboration of different experts. The model developers should engage with stakeholders to gain insights into the risks being modelled and to identify the business objectives, business drivers, risk factors and other associated business information that are relevant given the objectives of the stress testing framework (eg market, product or portfolio types, nature and materiality of risk exposures). The modelling choices and calibration decisions should consider the interactions between different risk types, as well as the linkages among models. In this regard, the links between solvency and liquidity stresses should be considered. The collaboration of model developers and stakeholders is particularly important for bank-wide stress testing to ensure the inclusion of all material risks and a sound aggregation of results.

Stress tests employ a certain amount of expert judgment, including assumptions within a model or methodology. In some cases, model overlays are appropriate. Like the models, these overlays or expert judgments should be well justified, documented and subject to credible challenge (including, where appropriate, validation and/or independent review).

The mix of a bank’s business lines, its strategy, the risk characteristics of its activities/exposures and the objective of the stress testing exercise should guide the development of appropriate models. Banks should consider a range of methodologies to quantify the stress impacts, ranging from, for instance, point‑in‑time static approaches to more sophisticated dynamic simulations that reflect future business activities and management actions.

Banks should ensure that adequate model inventory and model management processes are in place for their stress testing activities, including a robust model validation function. The documentation of models used for stress testing, including performance testing, should be maintained and made available to senior management and other internal and external stakeholders, such as supervisors.

Authorities that use stress testing to achieve microprudential objectives should review and challenge banks’ model outputs, eg via review of backtesting results or peer benchmarking. They can use their own assessment criteria and, through their supervisory process, can require banks to improve their modelling and model governance procedures where needed. As part of that evaluation process, authorities may develop their own models for benchmarking or challenge purposes.

Where authorities have macroprudential objectives, their models may incorporate cross-bank features such as system-wide feedback or contagion.

Regular review and challenge are key steps in the stress testing process for both banks and authorities. They are critical to improving the reliability of stress test results, aiding an understanding of their limitations, identifying areas where the stress testing approach should be improved and ensuring that the stress test results are being used in a way that is consistent with the framework’s objectives. Such reviews should provide coverage of all aspects of the stress testing framework on a periodic basis and should be used to ensure that stress testing frameworks are maintained and regularly updated.

Challenge during a stress test exercise should occur at multiple points and at multiple levels within the bank. Reviews should include a validation and other types of independent review of the key individual components of the stress testing process, such as review of the methodologies and scenario assumptions, and estimations of the stressed losses, revenues and liquidity forecasts. It is expected that this review would include an assessment of the overall adequacy of the exercise, eg backtesting or other benchmark comparison, and an analysis of the sensitivity of the results to the assumptions.

Challenge from the business areas of the assumptions and the plausibility of outcomes relative to market experience benefits the interpretation of results and ensures the stress test is not a pure statistical or hypothetical exercise.

When bank-wide stress tests are used to inform strategic business decisions that may affect the financial health of the institution, the board of the bank or an appropriately senior-level governance body should provide challenge to the processes, assumptions (eg scenarios and sensitivities), and outcomes of the stress test.3

As with any critical management process at a bank, the independent audit function should regularly review the bank’s stress testing framework and its implementation, both for internal stress testing exercises, and for the bank’s role in any bank-run supervisory exercise. Such reviews should be comprehensive and provide feedback on areas of improvement for the bank.

When authorities use the results of a stress test for purposes within their remit, there should be an internal challenge process within the authority to gain comfort in the assumptions driving the outcomes and the results themselves, and to duly consider model limitations and risk. This applies regardless of whether or not the stress test was conducted using bank estimates.

Authorities should regularly review banks’ internal stress testing frameworks. Supervisors should examine the stress testing results as part of their review of the internal capital adequacy assessment process (ICAAP) and the liquidity risk management of banks. In particular, supervisors should consider whether the frameworks appropriately capture all material risks areas, and consider the results of forward‑looking stress testing exercises as part of assessing the adequacy of the bank’s capital and liquidity.

Authorities should also review other aspects of banks’ stress tests, such as whether they conform to their stated objectives and the governance arrangements. Supervisors should require management to address any material deficiencies that are identified in the stress testing framework, including cases where the results of stress tests are not adequately considered in the bank’s decision-making process.

Communication of stress testing activities across relevant internal and external stakeholders can have benefits for both banks and supervisors. Sharing of results can, where appropriate, provide important perspectives on risks that would not otherwise be available to an individual bank or authority.

Disclosure of stress test results, whether by banks or authorities, can help to improve market discipline and provide confidence in the resilience of the banking sector to identified stresses. Banks and authorities that choose to disclose stress test results should carefully consider ways to ensure that market participants understand the data that are disclosed, including their limitations and the assumptions on which they are based. The stress test’s objectives and the framework may also be disclosed where banks and authorities opt for such disclosure. This will help to reduce the risk that market participants draw ill‑informed conclusions about the resilience of banks.

Banks should have processes to support regular communication and coordination between group-level stress testing functions and individual banking subsidiaries or other relevant legal entities (whether within or across a jurisdiction).

Banking groups should be able to aggregate and report stress test results across legal entities within the group. In addition, they should seek to establish consistent stress testing approaches across these entities, both within and across jurisdictions.

Where appropriate, authorities should foster transparency in stress testing processes and results and establish processes to communicate and coordinate stress testing activities with other domestic authorities, such as supervisory authorities, the central bank, resolution authorities and, where relevant, market conduct regulators.

Constructive dialogue between authorities and with the banking industry can help provide deeper insights into industry-level vulnerabilities and help in the conduct of the exercise, improving the quality of final stress test results.

Communication across jurisdictions includes both the sharing of stress test results among home and host supervisors of internationally active banks, subject to applicable legal constraints, as well as the international coordination and collaboration of stress testing activities across jurisdictions where this is likely to yield useful synergies. The Basel Committee’s Principles for effective supervisory colleges4 specifically encourage the sharing of stress testing information within supervisory colleges. More generally, authorities should also consider scope for greater cross-border collaboration on stress testing where feasible, such as through common scenarios and sharing of better practices.