STRESS TESTING Transition to DFAST compliance

WHITE PAPER STRESS TESTING Transition to DFAST compliance Abstract The objective of this document is to explain the challenges related to stress testing that arise when a Community Bank crosses $0 Billion in consolidated asset size. It explains the implications and recommends precise action points to overcome those challenges

Table of Contents. Introduction to Stress Testing 2.. Stress Testing Techniques 2.2. Timeline of regulatory mandates for Bank Stress Testing in the US 3 2. Current Stress Testing practices at Community Banks 4 2.. What if Analysis using Sensitivity Tables 5 2.2. Scenario Analysis using Top-down approach 6 2.3. Scenario Analysis using Bottom-up approach 6 3. DFAST stress testing requirements 6 3.. Overview of DFAST for mid-sized BHCs 7 3.2. Challenges arising in the areas of Data and Modelling 7 3.3. Key guidelines and their implications 9 4. Action points for Community Banks

. Introduction to Stress Testing The concept of Stress Testing in the US Banking Industry has been around for many years, but it has assumed greater importance since the Great Recession. Earlier, Stress Testing used to be just a prudent practice followed by mainly large-sized Bank Holding Companies (Above $50 Billion in consolidated asset size). But today, Stress Testing has become an enterprise-wide mandatory regulatory exercise that should be completed at least at an annual frequency by every mid-sized (above $0 Billion in consolidated asset size) and large-sized Bank Holding Company. Even the Community Banks ($0 Billion and below in consolidated asset size) are expected to conduct stress tests to analyze the potential impact of adverse market conditions on their loan portfolios. The primary objective of conducting stress tests is to assess the resiliency of a Banking Institution to adverse market conditions. The resiliency is measured through various Capital Adequacy and Leverage Ratios to check whether the Banking Institution is adequately capitalized to withstand credit, market, and operational risk losses that may arise under stressful macroeconomic conditions. The three most commonly used stress testing techniques are Scenario Analysis, Sensitivity Analysis and Reverse Stress Testing... Stress Testing Techniques Scenario Analysis is a type of stress testing which analyses the impact of historical or forward-looking scenarios on Capital Adequacy. A scenario could be an overall market condition, such as a period of recession, or it could even be just an event specific to a Banking Institution like an Internal Fraud. A scenario is generally defined using a set of macroeconomic variables whose values provide a coherent and logical narrative of a market condition. Scenarios can be applied to either an entire Banking Institution or to just a few of its sub-units. To conduct a Scenario Analysis, a Banking Institution must first determine the Risk Factors (macroeconomic variables) impacting its Balance Sheet and Income Statement, and the nature of relationship between them. This is achieved through development of empirical models Credit Loss Models, Prepayment Models, PPNR Models, ALM Models etc. Using these models, a Banking Institution can project the values of its Balance Sheet and Income Statement, and the corresponding Capital Adequacy Ratios under the given scenario. Scenario Analysis is the prescribed and mandatory stress testing method under DFAST and CCAR. Sensitivity Analysis is a type of Stress Testing which analyses the impact of stressing the values of one or more Risk Factors (macroeconomic variables) on Capital Adequacy. Sensitivity Analysis is generally performed to determine the most influential Risk Factors of different lines in Balance Sheet and Income Statement. Banking Institutions can also use the knowledge gained through Sensitivity Analysis to create new hypothetical scenarios to perform a comprehensive Scenario Analysis. It can also be used to determine the range of forecasts generated by different models used in Stress Testing. Reverse Stress Testing is used to determine the type of market events that could break the resilience of a Banking Institution. Under Reverse Stress Testing, an adverse outcome is assumed upfront and the values of a selected Risk Factor which can generate the target adverse outcome is determined later. It serves as a useful tool in the formulation of risk mitigation strategies. 2

.2. Timeline of regulatory mandates for Bank Stress Testing in the US Exhibit : Regulatory mandate for Stress Testing has evolved from being limited in scope to Large Bank Holding Companies to being applicable even to Community Banks Many regulatory mandates for US Bank Stress Testing have been issued in the aftermath of Great Recession. The first mandate to be issued was the Supervisory Capital Assessment Program (SCAP) which was conducted by the Federal Reserve Board and Thrift Supervisors in 2009. Under this program, the 9 largest Bank Holding Companies with consolidated asset sizes above $00 Billion were stress tested by the regulators. The regulators performed Scenario Analysis across two macroeconomic scenarios Baseline and More Adverse. These scenarios were defined using just three macroeconomic variables Real GDP, Civilian Unemployment Rate and House Price Index. The Federal Reserve Board launched the Comprehensive Capital Analysis and Review (CCAR), an annual stress testing exercise, to stress test all the large-sized BHCs in 20. The CCAR exercise effectively replaced the SCAP program. Under CCAR, the regulator conducts both quantitative and qualitative analysis of capital adequacy and capital planning process of all large-sized BHCs. The Federal Reserve Board collects loan and instrument level information from large-sized BHCs and then applies a Severely Adverse scenario to determine the impact on their Capital Adequacies. The results of CCAR exercise are published every year and failing this test will have serious consequences for a BHC as the regulator can impose restrictions on their capital spending. With the passage of Dodd-Frank Wall Street Reform and Consumer Protection Act, the Dodd-Frank Stress Testing Act (DFAST) came into existence in 202. The DFAST exercise is supervised by all three banking regulators in the US (FRB, OCC and FDIC) and it applies to both mid-sized and large-sized BHCs. The mid-sized BHCs need to conduct Scenario Analysis at an annual frequency across three supervisory scenarios Baseline, Adverse and Severely Adverse. On the other hand, the large-sized BHCs are 3

expected to conduct Scenario Analysis at a semi-annual frequency across not just the supervisory Baseline, Adverse, and Severely Adverse scenarios but also a Bank-specific Severely Adverse scenario which reflects its unique risks and vulnerabilities. In addition, the large-sized BHCs are also expected to submit loan-level information at monthly and quarterly frequencies. Though DFAST is light on qualitative analysis, inability to meet the minimum capital adequacy requirements would result in imposition of restrictions on capital spending of the BHCs by the regulator. To strengthen the risk management practices at Community Banks, the Office of the Comptroller of the Currency (OCC) issued Guidelines for Community Bank Stress Testing in 202. Unlike CCAR and DFAST, Community Banks need not conduct an enterprise-wide stress testing. The regulator neither mandates any specific stress testing techniques nor issues any scenarios for conducting stress tests. The Community Banks are mainly expected to understand the risk factors influencing their lending portfolios and quantify the risks arising due to concentration of credit. The regulator hasn t prescribed any mandatory stress testing reports for submission, but the regulator can quiz the Community Banks on their stress testing practices during ad hoc reviews. 2. Current Stress Testing practices at Community Banks The OCC does not endorse any specific stress testing method for Community Banks. However, the regulator expects the chosen approach for stress testing to commensurate with unique loan portfolio strategy, size, loan types, composition, operations, and management of the Community Bank. Accordingly, the practices followed by Community Banks vary widely from a single spreadsheet analysis to a more sophisticated model. Stress tests do not need to involve sophisticated analysis or third-party consultative support. Effective methods can range from a single spreadsheet analysis to a more sophisticated model, depending on portfolio risk and the complexity of the bank. Community banks may need to make only modest enhancements to existing risk management practices and techniques to ensure that potential adverse outcomes are appropriately considered - Excerpt from Guidelines issued by OCC on Community Bank Stress Testing Because of the absence of stringent guidelines on stress testing, most Community Banks conduct stress testing on only their most significant portfolios, identified based on asset concentrations and historical loss rates. Often, the stress testing exercise is limited to loan book, and in particular to CRE and Mortgage portfolios, which are its two biggest constituents. 4

Exhibit 2: Degree of stress testing practices in Community Banks varies from performing ad hoc sensitivity checks to scenario analysis using bottom-up approaches 2.. What if Analysis using Sensitivity Tables Most Community Banks in lower end of the asset spectrum use Sensitivity Tables developed using Industry Benchmark Data to determine movements in Loss Rates and Asset Valuations with respect to movements in Risk Factors. A Sensitivity Table is defined using any two Risk Factors and multiple Sensitivity Tables are used to comprehensively assess the impact of changes in values of Risk Factors. The Sensitivity Tables enable What if Analysis and provide forecasts corresponding to pre-defined movements in Risk Factors. But since each Sensitivity Table is defined using only two Risk Factors, the impact of simultaneous movements in more than two risk factors cannot be measured accurately without increasing the complexity of representation. Hence this technique cannot be employed to perform Scenario Analysis as required under DFAST. Exhibit 3: A sample Sensitivity Table shown below assesses movements in valuation of Office Space w.r.t. movements in Vacancy Rate and Rent per square foot Vacancy Rate 2% 3% 4% 5% 6% 7% 50 354 304 253 202 5 00 60 483 434 384 333 283 233 Rent per square foot (In USD) 70 80 62 74 564 694 55 646 464 595 45 547 366 499 90 870 824 777 726 679 632 00 2000 953 906 859 82 765 The sample Sensitivity Table shown under Exhibit 3, is useful to check the sensitivity of valuation of office space w.r.t. Vacancy Rate and Rent per square foot. However other Risk Factors such as Utility and/or Energy Costs, Maintenance Costs, and Marketing Costs may also be influencing the valuation of office space and an accurate representation of sensitivity would demand a 5-dimensional table and the complexity of representation will increase with increase in number of 5

Risk Factors. In addition, Sensitivity Tables are defined for discrete values of Risk Factors and hence if the Risk Factors assume values different from the ones specified in the Sensitivity Table, the value of the output cannot be measured accurately. 2.2. Scenario Analysis using Top-down approach Most Community Banks closer to $5 Billion in consolidated asset size conduct Scenario Analysis using a Top-down approach. In a Top-down approach, the forecasts for credit loss, revenue, expense, and valuations of assets and liabilities are determined at a portfolio level. This method is preferred by most Community Banks who neither possess sufficiently large internal database to develop empirical models required for conducting bottom-up Scenario Analysis nor have the budget to purchase industry benchmark models. To conduct stress tests, the Community Banks generally use historical adverse scenarios from the past which are relevant to their business. The loss rates and growth rates observed during those historical scenarios are used as proxies to forecast the values of selected lines in Balance Sheet and Income Statement. Despite the fact of results being inaccurate due to use of proxies, this method allows Community Banks to conduct an enterprise-wide stress testing and thereby prepares them for conducting DFAST in the future. 2.3. Scenario Analysis using Bottom-up approach A Bottom-up approach for Scenario Analysis is generally adopted by Community Banks which are closer to $0 Billion in consolidated asset size. Under this approach, Community Banks use Probability of Default (PD) Tables, Rating Transition Matrices, and Regression Models to forecast values at account or instrument level. These forecasted values are later aggregated to generate Balance Sheet and Income Statement under the scenario being tested. The PD Tables and the Rating Transition Matrices used for credit underwriting are re-used under stress testing for estimation of credit losses. However, to simulate a stressful condition, the PDs and probabilities of rating transitions are adjusted upwards. Most Banks use scalar multiplication factors, based on past experiences of adverse market conditions, for adjusting probabilities. The revenue and expense items are forecasted using the projections provided by the Finance Team. A suitable scalar multiplication factor is applied to adjust revenues and expenses under stressful scenarios. And valuations of assets and liabilities are estimated using cashflow models, which are part of a Bank s existing ALM system. The projections of losses, revenues, expenses, and valuations of assets and liabilities are later aggregated in a spreadsheet to determine the impact of the adverse scenario on capital adequacy. 3. DFAST stress testing requirements Once the average consolidated assets for the four most recent quarters of a Community Bank Holding Company crosses $0 Billion, the DFAST regulation becomes applicable. Once this asset threshold is crossed, a Community Bank has to mandatorily conduct enterprise-wide stress testing at an annual frequency. And if they are not already familiar with conducting stress tests, at least even at a portfolio or a business unit level, the journey towards DFAST compliance will become steep and stressful. 6

3.. Overview of DFAST for mid-sized BHCs The Federal Reserve Board makes annual release of three hypothetical scenarios Baseline, Adverse, and Severely Adverse, using national level macroeconomic and financial variables. In DFAST 207, these scenarios have been defined using 28 such variables, 6 of them corresponds to the US market and the remaining corresponds to the European Union, United Kingdom, Japan, and Developing Asia markets. Using these scenarios, all mid-sized BHCs must conduct stress tests and forecast their Charge-offs, Provisions, Pre-Provision Net Revenue (PPNR), Gains/ Losses on securities, Other than Temporary Impairment (OTTI) losses, Loan and lease balances, Allowances, Valuation of securities, Liabilities and Capital. The projections must be generated for a period of nine quarters (also called the planning horizon) and submitted in a Standard Template (FR Y-6) specified by the regulator. Overall, the FR Y-6 template captures 43 lines under Income Statement and 56 lines under Balance Sheet including three Capital Adequacy Ratios and one Leverage Ratio. To pass the stress test, BHCs must demonstrate that their Capital Adequacy and Leverage Ratios do not fall below the threshold levels during the entire planning horizon. Failure to demonstrate capital adequacy will result in imposition of restrictions on distribution of dividends and other capital investments. Exhibit 4: A DFAST solution must address challenges arising in the areas of Data Management, Model Risk Management, Scenario Design, Stress Testing Techniques, Reporting and Governance 3.2. Challenges arising in the areas of Data and Modelling A Community Bank embarking on the journey towards DFAST compliance must prioritize on addressing the challenges arising in the areas of Data and Modelling. The DFAST exercise is data-intensive and requires multiple statistical models to generate all the required forecasts. As the regulator expects BHCs to understand and submit all the relevant technical details related to modelling, relying on external help for data and modelling will only be a short-term solution. Hence 7

Community Banks must have a roadmap to develop in-house analytical expertise and become self-sufficient in their data requirements. An empirical model development requires a sufficiently large database, which may not be available with Community Banks for all products in their portfolio. In such circumstances, Community Banks should first identify their key products based on size and prioritize on developing empirical models for them. In cases where they lack sufficiently large internal database, subscriptions to industry databases should be secured. For generating forecasts corresponding to other non-key portfolios, Industry Benchmark Models can be used with required customization to commensurate with their unique risk characteristics. As a first step, BHCs should focus on developing various empirical models required for generating forecasts corresponding to Mortgage Loans, CRE Loans, Residential Mortgage-Backed Securities (RMBS) and Securities which are obligations of US Government Agencies/ State Governments as these together constitute the largest asset base of BHCs with consolidated asset size in the range of $ to $0 Billion. Exhibit 5: Mortgage and CRE loans constitute ~70% of loan books of BHCs with consolidated assets in the range of $ to $0 Billion Source: FR Y-9C reports corresponding to Q 207: Covers 55 BHCs Exhibit 6: RMBS and Obligations of US Government Agencies/ State Governments constitutes ~80% of securities portfolio of BHCs with consolidated assets in the range of $ to $0 Billion Source: FR Y-9C reports corresponding to Q 207: Covers 55 BHCs 8

3.3. Key guidelines and their implications Key Guidelines Implications Stress testing should be conducted at the BHC level Data coming from various source systems of multiple Banking Institutions within the holding company must be consolidated Scenario Analysis should be conducted for supervisory Baseline, Adverse, and Severely Adverse scenarios which are defined using just 28 national-level macroeconomic variables Relationships between those 28 national-level macroeconomic variables and any other metropolitan, regional, or national-level macroeconomic variables which influence financial statements must be determined The supervisory Adverse and Severely Adverse scenarios are hypothetical and not based on past observed scenarios Economic Response Models which quantify incremental changes to PDs, LGDs, or EADs under these economic scenarios would be required FR Y-6 report template providing forecasts of 43 lines under Balance Sheet and 56 lines under Income Statement for 9 quarters should be submitted annually Empirical models for estimating credit losses, allowances/ provisions, PPNR (Net Interest Income, Non-Interest Income, and Non-Interest Expense), Asset Valuations (HTM, AFS, and HFT securities), Interest Rate Risk (ALM cashflow models), Gains/ Losses in HTM and AFS securities and Other than Temporary Impairment (OTTI) losses would be required 9

Key Guidelines Implications A Gap Analysis should be conducted to determine reusability of already existing models, identify additional models required, assess availability of internal database for additional model development and obtain industry benchmark data where necessary Guidelines do not specify modelling techniques to be employed to forecast lines to be reported under FR Y-6 Models required and found to be unavailable should be either developed or procured from outside and customized to BHC s portfolio Stress testing solution should be seamlessly integrated with ALM and ALLL/CECL systems to minimize duplication of work and to maintain consistency across regulatory reporting Strong documentation on step-by-step process followed for DFAST, documentations on model development and validation should be prepared and maintained Documents providing details about DFAST process, modelling framework design, model development and validation will be checked by the regulator during audits Stress testing systems with strong governance mechanisms (Document repository, Configurable workflows, User access controls, Audit trails and Version controls) should be preferred to spreadsheet-based computations 0

4. Action points for Community Banks Implications Action Points Invest on implementing a strong Data Platform that can provide Single Extract Multiple Implementation capabilities Identify metropolitan, regional, and national-level macroeconomic variables influencing your financial statements Procure models to forecast the values of additional macroeconomic variables from Economic Research firms Procure Economic Response Models relevant to your portfolio from Industry Benchmark Data Providers Identify your key portfolio based on size and contribution to revenue Develop empirical models to forecast valuation, revenue, expense, and losses on your key portfolios Procure Industry Benchmark models to generate forecasts for your non-key portfolio Build interdependency between Balance Sheet and Income Statement items in your modelling framework (e.g.: Growth in outstanding balance of a loan product should commensurate with growth in its interest income) Proactively engage with regulators and domain experts to identify reusable models and additional models required

Implications Action Points Check whether new models are required for your key portfolio and wheth er you possess sufficiently large internal database for modelling Subscribe to relevant industry data feeds required for model development Invest on building robust interfaces between your ALM, ALLL/ CECL, and Stress Testing systems Procure ALLL/ CECL systems that are compatible with your Stress Testing systems Prioritize documentation of stress testing process, model development, and model validation Prepare documents for in-house developed models and secure docu ments for models procured from external sources Proactively engage with regulators to clearly understand documentation requirements Adopt good governance principles while defining step-by-step process for stress testing Procure stress testing systems which offer strong governance tools 2