Guidelines on institutions stress testing (EBA-GL-2018-04)

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING EBA/GL/2018/04 19 July 2018 Final Report Guidelines on institutions’ stress testing

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Contents Executive summary 3 Background and rationale 5 Guidelines 8

Compliance and reporting obligations 10
Subject matter, scope and definitions 11
Implementation 17
Institutions’ stress testing 18
4.1 Stress testing programme 18
4.2 Governance aspects of stress testing 20
4.3 Data infrastructure 22
4.4 Stress testing scope and coverage 23
4.5 Proportionality 25
4.6 Stress testing types 26
4.7 Individual risk areas 34
4.8 Application of stress testing programmes 47
Accompanying documents 51
5.1 Draft cost-benefit analysis/impact assessment 51
5.2 Feedback on the public consultation 55

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Executive summary These guidelines aim to achieve convergence of the practices followed by institutions for stress testing across the EU. They provide detailed guidance to be complied with by institutions when designing and conducting a stress testing programme/framework. The EBA issues these guidelines to update and replace the Committee of European Banking Supervisors (CEBS) Guidelines on stress testing (GL32), which will be repealed after the revised guidelines have entered into force. These guidelines take into account the conclusions of the peer review of the implementation of GL32. The guidelines establish and develop the following concepts: the taxonomy of stress testing; the description of types ofstresstest exercises; the reverse stresstesting processfor both regularstress testing and recovery planning purposes; and additional issues that have gained importance in the stress testing programme and need to be incorporated and properly defined, such as conductrelated risk and litigation costs, foreign exchange risk, interaction between solvency stresstests and liquidity stress tests, business models and data aggregation. These guidelinesrecognise the principle of proportionality (see section 4.5) in both the quantitative and the qualitative aspects of stress testing: small and less complex institutions may focus more on the qualitative aspects while more sophisticated stress testing techniques are required of larger or more complex institutions. Stress testing requires a certain frequency to be a meaningful part of an institution’s risk management framework. Such frequency should be determined having regard not only to the scope and type of the stress test but also to the nature, scale, size and complexity of the institution’s activities (proportionality principle), among other aspects. Moreover, regarding scope and coverage, stress tests should capture risks at various levels in an institution. In this regard, according to the proportionality principle, the scope ofstresstestingmay vary from simple portfolio level sensitivity or individual risk level analyses to comprehensive institution-wide scenario stress testing. The EBA launched a first consultation on its draft guidelines during the first quarter of 2016 and received 12 responses to the draft guidelines. The EBA assessed all the main arguments presented in the responses, with a view to deciding on whether or not amendments were required before issuing the final guidelines. The result of this assessment is presented in an extensive feedback
section.
In April 2017, the EBA issued a roadmap outlining its plans to update the common European framework for the supervisory review and evaluation process (SREP) in 2017-2018. Given the close links between Pillar 2 Guidance (P2G) and wider aspects of supervisory stress testing (e.g. the specification of what forms of supervisory stress testing can be used to set or update P2G), the revision of the SREP guidelines also incorporated elements from the first draft of the stress testing guidelines, in particular section 5, ‘Supervisory assessment of institutions stress testing’; section 6, ‘Supervisory stress testing’; and section 7, ‘Use of quantitative results for capital adequacy assessment purposes’, which were also reviewed to reflect comments received in the public

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING consultation. This approach was intended to ensure consistent coverage and the use of various aspects of supervisory stress testing in SREP, which is also an intention of Article 100 of the Capital Requirements Directive (CRD). Next steps The guidelines were published for a three-month public consultation, which ended in February 2018. They incorporate the outcomes of the consultation and will be translated into the official EU languages and published on the EBA website. The deadline for competent authorities to report whether or not they comply with the guidelines will be two months after the publication of the translations. The application date will be in 2019.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Background and rationale The EBA is mandated to foster sound and effective supervision across the EU arising from the requirements specified in Directive 2013/36/EU and more generally from its obligations under its founding regulation (Regulation (EU) No 1093/2010, the EBA Regulation). The relevant provisions legally supporting the issuance of the revised guidelines are the provisions of
Article 16 of the EBA Regulation and the relevant principles set out in Regulation (EU) No 575/2013
and Directive 2013/36/EU.
Article 16 of Regulation (EU) No 1093/2010 provides that the EBA shall, with a view to establishing
consistent, efficient and effective supervisory practices within the European System of Financial Supervision (ESFS), and to ensuring the common, uniform and consistent application of Union law, issue guidelines and recommendations addressed to competent authorities or financial institutions. Institutions are required to take a forward-looking view in their risk management, strategic planning, capital planning and liquidity planning as part of their internal capital adequacy assessment process (ICAAP) required by Article 73 of Directive 2013/36/EU. One of the tools that institutions can use to facilitate this forward-looking perspective in risk management is stress testing. Since 2010, when the CEBS Guidelines on stress testing (GL32) were issued, there have been a number of developments in stress testing with regard to its methodologies and usage. The financial crisis and several negative eventsin the financialsectorsince 2010 have highlighted significant lessonsin relation to stress testing practices. Supervisory expectations in relation to institutions’ stress testing practices have changed in light of this recent experience both within and beyond the EU. Several important conclusions were drawn from the 2013 EBA peer review on the implementation of the stress testing guidelines. The aim of the peer review performed by the EBA was to assess and compare the effectiveness of the supervisory activitiesrelated to the review of credit institutions’ own stresstesting programmes/frameworks across the EU, as well as the implementation of related provisions by competent authorities1. In particular the results of the peer review suggested that all competent authorities’ organisational and resource models had benefits; however, irrespective of the model, dedicated technical experts in stress testing should have been involved. Competent authorities have often focused on the largest institutions in their respective jurisdictions, and devoted far less attention to other institutions. Very few competent authorities required reverse stress testing, and, when they did, it was often only as part of recovery planning. Moreover, the incorporation of the outcomes of stress testing into the supervisory review and evaluation process (SREP) and the joint decision process on institution-specific prudential requirements for cross-border groups was handled differently across jurisdictions. Many of the competent authorities assessments have shown evidence of substantial work on top-down stress testing, from both a micro- and a macroprudential perspective. For example, in many instances, competent authorities observed thatstresstesting was notsufficiently integrated into the institutions’ risk management frameworks orsenior management decision-making. In general, where stress testing was used, scenarios continued to be insufficiently severe. In other

1 https://www.eba.europa.eu/-/eba-publishes-peer-review-on-the-implementation-of-the-stress-testing-guidelines

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING instances, competent authorities observed that risk concentrations and feedback effects were not considered by institutions in a meaningful fashion. These guidelines aim to address deficiencies identified in the EBA peer review, and will assist institutions in understanding the supervisory expectations of appropriate stress testing governance and infrastructure, and also cover the use ofstresstesting as a risk management tool. These guidelines are designed to identify the relevant building blocks required for an effective stress testing programme, from simple sensitivity analysis on single risk factors or portfolios to complex macroeconomic scenario stress testing on an institution-wide basis. While institutions’ stress testing is a risk management tool that has been used for a long time, there remains substantial ambiguity and overlap in several terms and definitions. These guidelines, therefore, provide a taxonomy. In addition, in recent years, some issues have gained importance in stress testing programmes and need to be incorporated and properly defined, such as the role of reverse stress testing in recovery planning. Moreover, new individual risk categories are covered. Furthermore, business models, data aggregation, the links between solvency stress tests and liquidity stress tests, and other concepts have been updated, as GL32, issued in 2010, have become outdated and do not reflect best industry practices. The institutions’ stress testing section focuses on the overarching principles of governance including:
(a) stress testing governance structures and their use, including the application of the SREP guidelines on the internal governance of stress testing; (b) data infrastructure, in particular data aggregation capabilities and reporting practices; (c) stress testing scope and coverage, taking into account a multilayered approach, from simple portfolio level and individual risk level stress testing to comprehensive institution-wide stress testing; (d) possible methodologies considering the importance of undertaking both simple sensitivity analyses and more complex scenario stresstesting and the severity ofscenarios, and highlighting the importance of qualitative and quantitative approaches to reverse stress testing; (e) a range of, non-exhaustive, individual risk categories that should be taken into account in relation to stress testing with the aim of enhancing risk management and capital planning and liquidity processes; and (f) the application of stress testing programmes, including in relation to the interaction between the outputs of stress tests and management actions and the application for recovery and resolution purposes, and the use of stress tests to assess the viability of an institution’s capital plan in adverse circumstances in the context of ICAAP and the internal liquidity adequacy assessment process (ILAAP). The principle of proportionality applies to all aspects of these guidelines, including the methodology, as well as the frequency and the degree of detail of the stress tests. These guidelines also recognise the principle of proportionality by describing both quantitative and qualitative aspects ofstresstesting. Examples of proportionality are provided in some sections in relation to applying these guidelines to institutions of different natures, sizes, complexities and business models, as appropriate. The proportionality principle is invoked in these guidelines to discuss the level of sophistication of the stress testing methodologies, practices and infrastructure required in relation to the size, structure and internal organisation (also taking into account the nature, scope and complexity of activities) of an institution. In addition, competent authorities should apply the guidelines taking into account the

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING principle of proportionality, for example by taking into account the SREP category to which an institution belongs. Thus, these guidelines are applicable in their entirety to Category 1 (systemically important) institutions. Category 2 (less or non-systemic) institutions’ compliance with the guidelines depends on their nature, scale and size, and the features and complexity of their activities; particular attention is paid to their domestic or cross-border activities, and the simple or multiple business line nature of their activities, characteristics that need to be reflected in their stress testing. For Category 3 and 4 institutions(small and medium-sized institutions), the guidance provided in these guidelines must be followed to the extent that it is proportionate and relevant to their activities, resources and the risk posed to the financial system. The scope of stress testing for these institutions reflects the reduced scope of their activities and the limited risk to the system overall. Proportionality criteria should also apply to portfolio level stress tests based on the complexity and relative size of the portfolio under consideration. To decide which portfolios need portfolio stresstests, the overall risk situation should also be taken into account. Nevertheless, no portfolio can be left out when assessing the overall risk situation or conducting a combined stress test, as relatively small risks in less important portfolios may amount to an important risk when addressing the whole institution. Parent institutions(including EU parents) are expected to implement these guidelines and set up stress testing programmes covering their own consolidated level and, where applicable, material entities and/or business lines subject to the principles of proportionality, materiality and relevance.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Guidelines

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING EBA/GL/2018/04 19 July 2018 Guidelines on institutions’ stress testing

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING

Compliance and reporting
obligations
Status of these guidelines
This document contains guidelines issued pursuant to Article 16 of Regulation (EU)
No 1093/20102
. In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and financial institutions must make every effort to comply with the guidelines.
Guidelines set out the EBA’s view of appropriate supervisory practices within the European
System of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at institutions. Reporting requirements
In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must
notify the EBA that they comply or intend to comply with these guidelines, or otherwise give reasons for non-compliance, by ([dd.mm.yyyy]). In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be non-compliant. Notifications should be sent by submitting the form available on the EBA website to compliance@eba.europa.eu with the reference ‘EBA/GL/201x/xx’. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to the EBA.
Notifications will be published on the EBA website, in line with Article 16(3).

2 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12).

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
2. Subject matter, scope and definitions
Subject matter and scope of application
5. These guidelines aim to provide common organisational requirements, methodologies and
processes for the performance of stress testing by institutions, taking into account capital adequacy and risk management, as part of their risk management processes (‘institutions’ stress testing’).
6. Within the context of groups, these guidelines also apply to institutions participating in a
particular stress testing exercise in accordance with the perimeter of application of that particular stress testing exercise and the level of application set out in Articles 108 and 109 of Directive 2013/36/EU.
7. The terms ‘institution’ and ‘institution-specific’ shall be deemed to refer to an institution on a
solo basis, or to the parent institution in a given perimeter of application of a particular stress testing exercise or to the parent institution in a Member State or to the EU parent institution on the basis of the relevant consolidated situation as referred to in Article 4(1)(47) of Regulation (EU) No 575/2013. Addressees
8. These guidelines are addressed to competent authorities and institutions as defined in point (i)
of Article 4(2) of Regulation (EU) No 1093/2010 and to financial institutions as defined in
Article 4(1) of Regulation (EU) No 1093/2010 which are also institutions in accordance with
point 3 of Article 4(1) of Regulation (EU) No 575/2013.
Definitions/taxonomy
9. Unless otherwise specified, terms used and defined in Regulation (EU) No 575/2013 and in
Directive 2013/36/EU have the same meaning in these guidelines. In addition, for the purposes of these guidelines, the following definitions apply:
(1) Solvency stress test means the assessment of the impact of certain developments, including macro- or microeconomic scenarios, on the overall capital position of an institution, including on its minimum or additional own funds requirements, by means of projecting the institution’s capital resources and requirements, highlighting the institution’s vulnerabilities and assessing its

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING capacity to absorb losses and the impact on its solvency position. (2) Liquidity stress test means the assessment of the impact of certain developments, including macro- or microeconomic scenarios, from a funding and liquidity perspective and shocks on the overall liquidity position of an institution, including on its minimum or additional requirements. (3) Bottom-up stress test means a (solvency or liquidity) stress test with all of the following characteristics:
i. it is carried out by institutions using their own
internally developed models;
ii. it is based on the institution’s own assumptions or
scenarios, with possible conservative constrains by authorities;
iii. it is based on the institution’s own data and potentially
high level of data granularity, with possible use of external data for some additional information; and
iv. it concerns particular portfolios or the institution as a
whole, producing detailed results on the potential impact of exposure concentrations, institution linkages and contagion probabilities to the institution’s loss rates. (4) Top-down stress test means a (solvency or liquidity) stress test with all of the following characteristics:
i. it is carried out by competent authorities or
macroprudential authorities;
ii. it is based on general or systemic (macroprudential)
assumptions or scenarios designed by competent or macroprudential authorities and applicable to all relevant institutions;
iii. competent authorities or macroprudential authorities
manage the process and calculate the results with less

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING involvement of the institutions than in the case of the bottom-up stress test;
iv. it is based mostly on aggregate institution data and
less detailed information, depending on the assumptions of the stress test, or sometimes based on more detailed institution data if deemed necessary by authorities; and
v. it enables a uniform and a common framework and
comparative assessment of the impact of a given stress testing exercise across institutions. (5) Static balance sheet assumption means a methodological assumption according to which the impact of the stress test scenarios is to be measured on the assumption of a ‘constant balance sheet’ and of an ‘unchanged or stable business model’ throughout the projection period, enhancing the comparability of the results across institutions, thereby:
i. prohibiting from taking into account, for the
calculation of the impact of the scenarios, changes in the assets and liabilities of the institution that derive, indicatively, from management actions, increases or work-outs of existing lending or differences in maturities or other characteristics of these assets or liabilities (despite the application of the stress test methodology, which might lead to changes in the size and the composition of the balance sheet, and particularly the capital base, over the projection period, due to, for example, new defaults, impairments, increases of stock or value adjustments of financial assets); and
ii. permitting the inclusion of new assets and liabilities as
far as these new items bear the same main characteristics (maturities, risk profiles, etc.) with the excluded ones. (6) Dynamic balance sheet assumption means a methodological assumption according to which the impact of the stress test scenario is to be measured on the possibility of a non-constant balance sheet and of an evolving business model throughout the projection period. Under the

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING dynamic balance sheet assumption, the outcome of the stress test reflects a combination of the scenario imposed and the responsive actions taken by the management reducing the comparability of the results across institutions. The extent of responsive actions taken by the management may be constrained or unconstrained (e.g. interventions planned from the start and independent from the scenario and/or conditional on the stress test scenario). (7) Portfolio level stress test means a stress test of individual or several portfolios with the focus on the implications of the shocks from a single risk factor or multiple risk factors. (8) Sensitivity analysis means a stress test that measures the potential impact of a specific single risk factor or simple multi-risk factors, affecting capital or liquidity, to a particular portfolio or to the institution as a whole. (9) Scenario analysis means the assessment of the resilience of an institution or of a portfolio to a given scenario that comprises a set of risk factors, which should have all of the following characteristics:
i. they are aligned in an internally consistent way;
ii. the risk factors forming the relevant set presuppose
the simultaneous occurrence of forward-looking events covering a range of risks and business areas; and
iii. the set of risk factors also aim to reveal, to the
maximum extent possible, the nature of linked risks across portfolios and across time, system-wide interactions and feedback effects. (10) Reverse stress test means an institution stress test that starts from the identification of the pre-defined outcome (e.g. points at which an institution business model becomes unviable, or at which the institution can be considered as failing or likely to fail in the meaning of Article 32 of Directive 2014/59/EU) and then explores scenarios and circumstances that might cause this to occur. Reverse stress testing should have one or more of the following characteristics:

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
i. it is used as a risk management tool aimed at
increasing the institution’s awareness of its vulnerabilities by means of the institution explicitly identifying and assessing the scenarios (or a combination of scenarios) that result in a pre-defined outcome;
ii. the institution decides on the kind and timing
(triggering events) of management or other actions necessary for both (a) rectifying business failures or other problems; and (b) aligning its risk appetite with the actual risks revealed by the reverse stress testing;
iii. specific reverse stress testing can be also applied in
the context of recovery planning (e.g. reverse stress tests applied in a wider context can be used to inform a recovery plan stress test by identifying the conditions under which the recovery might need to be planned). (11) Second-round or feedback effects means the spillover effects (the nature of feedback effects is not limited to macroeconomic effects) caused by the responses of individual institutions to an external original shock, which – in aggregate – generally amplify (it may also mitigate) such an original shock, thereby causing an additional negative feedback loop. (12) Severity of scenario means the degree of severity of the assumptions or the deterioration of the scenario (from baseline to an adverse scenario) expressed in terms of the underlying macroeconomic and financial variables (or any other assumptions). The greater the severity of the scenario, in general, the larger the impact of the stress test on the institution, thereby determining the actual severity of the stress test. (13) Plausibility of scenario means the degree to which a scenario can be regarded as likely to materialise in respect of the consistency of the relationship of that scenario with the current macroeconomic and financial variables, the support of the scenario by a coherent narrative and the backing of the scenario by probability distribution and historical experiences. Plausibility is not restricted to historical

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING experiences, and hence expert judgements that take into account changing risk environments (e.g. observed structural breaks) and stress events that were observed in similar risk environments outside the institution’s own direct historical experience should play a key role. It is also possible to use simulative methods (e.g. Monte Carlo simulations). (14) Anchor scenario means a type of scenario usually designed by a competent authority to set the severity standard for a particular stress test, which is imposed on institutions, either as the scenario that should be applied in the stress test or as a severity benchmark for the development of the institution’s own scenarios. (15) Risk data aggregation means defining, gathering and processing risk data according to the institution’s risk reporting requirements to enable the institution to measure its performance against its risk tolerance/appetite. This includes sorting, merging or breaking down sets of data. (16) Data infrastructure means physical and organisational structures and facilities to build and maintain data and information technology (IT) architecture to support the institution’s risk data aggregation and internal policy on risk reporting.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
3. Implementation
Date of application
10. These guidelines apply from 01 January 2019.
Repeal
11. The following guidelines are repealed with effect from the date of publication of these
guidelines in all EU official languages.

CEBS Guidelines on stress testing (GL32)3

3 https://www.eba.europa.eu/documents/10180/16094/ST_Guidelines.pdf

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
4. Institutions’ stress testing
4.1 Stress testing programme
12. Institutions should have in place a stress testing programme that should cover at least the
following:
a) the types of stress testing and their main objectives and applications; b) the frequency of the different stress testing exercises; c) the internal governance arrangements including well-defined, transparent and consistent lines of responsibility and procedures; d) in the case of a group, the scope of the entities included and the coverage (e.g. risk types and portfolios) of the stress tests; e) the relevant data infrastructure; f) the methodological details, including models used and possible links between liquidity stress tests and solvency stress tests, namely the magnitude of such dynamic interactions and the capture of feedback effects; g) the range of assumptions, including business and managerial, and remedial actions envisaged for each stress test.
13. Parent institutions in a Member State and EU parent institutions should also develop a group
stress testing programme to be approved and monitored by the management body and implemented by their senior management in the context of their centralised risk management policy. A group stress testing programme should include and address, to the extent appropriate, all institutions subject to prudential consolidation.
14. The institutions within the scope of prudential consolidation should, when establishing their
individual stress testing programmes, take into account the relevant group stress testing programme.
15. Institutions should also include reverse stress testing and reverse stress testing scenarios in
their stress testing programmes.
16. Institutions should ensure that their stress testing programmes are workable and feasible and
that they inform decision-making at all appropriate management levels about all existing and potential material risks.
17. Institutions should regularly assess their stress testing programmes to determine their
effectiveness and robustness, and should update them as appropriate. The assessment should be made on at least an annual basis and on the basis of both a quantitative and a qualitative analysis, and should fully reflect the changing external and internal conditions. Institutions

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING should ensure that the frequency of assessments takes into account the frequency of the corresponding stress test applications.
18. Institutions should ensure that their quantitative analysis in accordance with the previous
paragraph includes sound quantitative tests as backtesting tools to validate the assumptions, parameters and results of stress testing models (e.g. credit risk models, market risk models, pre-provision net revenue models). Institutions should ensure that their qualitative analysis in accordance with the previous paragraph is based on expert judgements or benchmarking assessments.
19. When assessing the stress testing programme, the institution shall consider at least the
following:
a) the effectiveness of the programme in meeting its intended purposes; b) the need for improvements; c) the identified risk factors, definitions and reasoning for relevant scenarios, model assumptions and the sensitivity of results to these assumptions, as well as the role of expert judgement to ensure that it is accompanied by sound analysis; d) the model performance, including its performance on out-of-sample data, i.e. on data that was not used for model development; e) how to incorporate possible solvency-liquidity adverse loops; f) the adequacy of possible interlinkages between solvency stress tests and liquidity stress tests; g) feedback received from competent authorities in the context of their supervisory or other stress tests; h) the adequacy of the data infrastructure (systems implementation and data quality); i) the proper level of involvement of senior management and the management body; j) all assumptions including business and/or managerial assumptions, and management actions envisaged, based on the purpose, type and result of the stress testing, including an assessment of the feasibility of management actions in stress situations and a changing business environment; and k) the adequacy of the relevant documentation.
20. The institution’s stress testing programme should be appropriately documented for all types of
stress tests carried out at the single risk type and/or portfolio level, as well as the firm-wide level. Documentation should cover at least:
a) the stress testing approach; b) the possible interlinkages between solvency stress tests and liquidity stress tests, namely a mapping between the deterioration on capital position (solvency) and ability to issue commercial paper and bonds (liquidity), macro-driven probabilities of default shifts

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING (solvency) and the implied rating migration of banks unencumbered assets and the effect on collateral deposited at the relevant central bank (liquidity), the increase in expected non-performing loans (solvency) and the reduction in expected inflows from loan repayments or from non-financial corporation bonds (liquidity), or a possible liquidity gap (liquidity) and asset fire sales (solvency), and an increase in funding costs (liquidity) and P&L effects (solvency); c) the roles and responsibilities as determined in the internal policy, specifying the roles for the second and third lines of defence, and processes for at least the performance of the stress testing programme; d) a description of the entire process of designing, approving, performing, monitoring the performance and periodically assessing the stress testing programme and its outcomes; e) a description of the processes for evaluating stress test outcomes, including details of areas that require manual or human judgemental in some parts, and also of the process for using the results for informing management actions and the strategy of the institution; and f) a description and inventory of the relevant IT applications used for stress testing (and where a central inventory exists, reference can be made to it).
21. The stress testing programme should be challenged across the organisation, for instance by the
risk committee and internal auditors. Business units not responsible for the design and application of the programme and/or non-involved external experts should play a key role in the assessment of this process, taking into account the relevant expertise for specific subjects.
22. Institutions should ensure, both for the initial design and for the assessment of the stress
testing programme, that an effective dialogue has taken place with the involvement of experts from all business areas of the institution and that the programme and its updates have been properly reviewed by the senior management4 and management body of the institution, who are also responsible for monitoring its execution and oversight.
4.2 Governance aspects of stress testing
23. The management body should approve5 the stress testing programme of the institution and
oversee its implementation and performance.
24. Without prejudice to the requirement under Article 91(1) of Directive 2013/36/EU 6 that
members of the management body must have at all times sufficient knowledge, skills and experience to perform their duties, the institution should ensure that their management body

4 See also Title II, section 1, of the EBA Guidelines on Internal Governance. 5 See also Title II, section 1, of the EBA Guidelines on Internal Governance. 6 See also Title III, section 8, of the Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING is able to fully understand the impact of stress events on the overall risk profile of the institution.
25. The management body should understand the material aspects of the stress testing
programme to be able to:
(a) actively engage in discussions with stress testing committees of the institutions, where applicable, or with senior management or external consultants involved in stress testing; (b) challenge key modelling assumptions, the scenario selection and the assumptions underlying the stress tests in general; and (c) decide on the necessary management actions and discuss them with the competent authorities.
26. The stress testing programme should be executed in accordance with the relevant internal
policies and procedures of the institution. The management body of the institution should ensure that clear responsibilities and sufficient resources (e.g. skilled human resources and information technology systems) are assigned and allocated for the execution of the programme.
27. Institutions should ensure that all elements of the stress testing programme, including its
assessment, are appropriately documented and regularly updated, where relevant, in the internal policies and procedures.
28. Institutions should ensure that the stress testing programme is effectively communicated
across business lines and managements levels, with a view to raising awareness, improving risk culture and instigating discussions on existing and potential risks as well as on possible management actions.
29. The stress testing programme should be an integral part of an institution’s risk management
framework (including in the context of the internal capacity adequacy assessment process (ICAAP) and internal liquidity adequacy assessment process (ILAAP)). Stress tests should support different business decisions and processes as well as strategic planning, including capital and liquidity planning. The decisions should take into account the shortcomings, limitations and vulnerabilities during stress testing.
30. The management body should take the outcomes of the stress tests into account, in particular
with regard to identified limitations, vulnerabilities and shortcomings detected, when setting the institutions strategy and when making all relevant decisions affecting capital, liquidity, recovery and resolution planning.
31. The outputs of stress tests (quantitative and qualitative) should be used as inputsto the process
of establishing an institution’s risk appetite and limits. Furthermore, they should act as a planning tool to determine the effectiveness of new and existing business strategies and their impact on the use of capital. To enable that, the essential outputs from a stress testing exercise should be implied losses, capital and liquidity requirements, as well as available capital and liquidity.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
32. To be a meaningful part of the risk management system of an institution, stress tests should be
undertaken with appropriate frequency. This frequency should be determined having regard to the scope and type of the stress test, the nature, scale, size and complexity of the institution (proportionality principle), portfolio characteristics as well as changes in the macroeconomic environment or the institution’s business activities.
4.3 Data infrastructure
33. Institutions should ensure that the stress testing programme is supported by an adequate data
infrastructure.
34. To ensure that a proper data infrastructure has been put in place, institutions, including those
that are not global systemically important institutions (G-SIIs), should endeavour to also refer, to the extent appropriate, to the principles for effective risk data aggregation and risk reporting of the Basel Committee on Banking Supervision7 .
35. Institutions should ensure that their data infrastructure has the capacity to capture the
extensive data needs of their stress testing programme and that they have in place mechanisms to ensure their continuing ability to conduct stress testing as planned in accordance with the programme.
36. Institutions should ensure that the data infrastructure allows for both flexibility and
appropriate levels of quality and control.
37. Institutions should ensure that their data infrastructure is proportionate to their size,
complexity, and risk and business profile, and allows for the performance of stress tests covering all material risks that the institution is exposed to.
38. Institutions should devote sufficient human, financial and material resources to guarantee the
effective development and maintenance of their data infrastructure, including information technology systems.
39. Institutions should also consider stress testing data infrastructure as part of their overall
information technology infrastructure and should give adequate consideration to business continuity planning, the identification of long-term investments and other IT processes. Data aggregation capabilities for stress testing purposes
40. Institutions should maintain and keep up-to-date accurate and reliable risk data to conduct
reliable stress tests and should also have in place a dedicated process for aggregating and producing such data.

7 http://www.bis.org/publ/bcbs239.pdf

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
41. Institutions should ensure that their aggregation of risk data is characterised by accuracy and
integrity, completeness, timeliness and adaptability.
42. Institutions should ensure that data are aggregated on a largely automated basis so as to
minimise the probability of error. In particular, a thorough reconciliation and controls system should be in place.
43. Institutions should have the capacity to guarantee the completeness of risk data. For that
purpose, institutions should ensure that risk data also fully capture off-balance-sheet risks and are easily attainable at any level of the institution. Materiality, in terms of existent and potential risk, should be factored in.
44. Institutions should be able to produce aggregated risk information on a timely basis to meet all
reporting requirements throughout the process of stress testing following different quality assurance and challenge stages; for that purpose, institutions should develop an efficient structure that ensures timeliness.
45. Institutions should be able to generate aggregate data to meet a broad range of on-demand
requests arising both from internal needs in the institution and externally from supervisory queries. Reporting practices for stress testing purposes
46. Institutions should ensure that their risk reporting process:
a) is completely supported by data aggregation capabilities; b) accurately and precisely conveys aggregated risk data and reflects risk in an exact manner; c) covers all material risks and, in particular, allows the identification of emerging vulnerabilities that could potentially be further assessed even in the same stress testing exercise; d) offers or is able to offer additional information regarding main assumptions, tolerance levels or caveats; and e) communicates information in a clear and concise manner including meaningful information tailored to the needs of the recipients.
4.4 Stress testing scope and coverage
4.4.1 General requirements
47. Stress tests should take into account all types of material risk having regard to both the on- and
off-balance-sheet assets and liabilities of an institution including relevant structured entities.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
48. Stress tests should capture risks at various levels in an institution. In this regard, according to
the proportionality principle, the scope of stress testing may vary from simple portfolio level sensitivity or individual risk level analyses to comprehensive institution-wide scenario stress testing.
49. Stress tests should take into account changes in correlations between risk types and risk factors,
at individual entity and at a group-wide level. They should also take into account that correlations tend to increase during times of economic or financial distress and that case-bycase analyses of how certain correlations behave in certain scenarios are required.
4.4.2 Portfolio and individual risk level stress testing
50. Institutions should perform stress tests on an individual portfolio basis, covering all risk types
that affect these portfolios, using both sensitivity and scenario analyses. Institutions should also identify risk factors and their adequate level of stress, wherever possible, at the level of an individual portfolio.
51. Institutions should ensure that they stress test portfolios and business lines or units to identify
intra- and inter-risk concentrations – i.e. concentrations of common risk factors within and across risk types (including contagion effects).
52. In particular, when considering inter-risk concentrations, institutions should aggregate across
risk types notably market and credit risk, to gain a better understanding of their potential risk concentrations in a stress situation. Institutions should identify potential links between exposures that could be risky during periods of economic or financial distress, as well as question assumptions about dependencies and correlations between risk types in a stress situation.
4.4.3 Institution-wide stress testing
53. In order to deliver a complete and holistic picture of the institution’s risks, in addition to stress
tests on the level of single entities, stress testing should also be conducted at the group level and across portfolios and individual risk types.
54. It should be taken into account that:
a) risks at the institution-wide level may not be well reflected by a simple aggregation of stress tests on portfolios, individual risk areas or business units of the group; b) correlations, offsetting of individual exposures and concentrations may lead to either the double counting of risks or to an underestimation of the impact of stressed risk factors; and c) specific group risks may arise at the institution-wide level and, therefore, institutions should ensure that all material risks and their corresponding risk factors are also identified at an institution-wide level; when looking at risks at an institution-wide level, particular attention should be paid to risk concentrations on a holistic basis.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
55. A group or an institution that is internationally active should also perform stress tests at the
level of business units in specific geographical regions or business sectors or business lines to account for differing risk factors in different businesses and regions.
4.5 Proportionality
56. In accordance with the principle of proportionality, an institution’s stress testing programme
should be consistent with its individual risk profile and business model.
57. Institutions should take into account their size and internal organisation, and the nature, scale
and complexity of their activities when developing and implementing a stress testing programme. Significant institutions and more complex institutions, including at consolidated level, should have more sophisticated stress testing programmes, while small and less complex institutions and groups (consolidated level) may implement simpler stress testing programmes.
58. For the purpose of the application of the principle of proportionality and in order to ensure an
appropriate implementation of the requirements, the following criteria should be taken into account by institutions and competent authorities:
a) the size in terms of the balance-sheet total or the quantity of assets held by the institution or its subsidiaries within the scope of prudential consolidation; b) the geographical presence of the institution and the size of its operations in each jurisdiction; c) the legal form and whether or not the institution is part of group and, if so, the proportionality assessment performed for the group; d) whether the institution is listed or not; e) whether or not the institution is authorised to use internal models for the measurement of capital requirements (e.g. the internal ratings-based (IRB) approach); f) the type of authorised activity and services (e.g. loans and deposits, investment banking); g) the underlying business model and strategy, the nature and complexity of the business activities, and the organisational structure; h) the risk strategy, risk appetite and actual risk profile of the institution, also taking into account the result of the annual capital adequacy assessment; i) the ownership structure and funding structure of the institution; j) the type of clients (e.g. retail, corporate, institutional, small businesses, public entity) and the complexity of the products or contracts; k) the outsourced processes, services and activities and their distribution channels; l) the existing information technology systems, including IT continuity systems and outsourcing arrangements in this area, e.g. cloud computing.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
4.6 Stress testing types
4.6.1 General requirements
59. The specific design, complexity and level of detail of the stress test methodologies should be
appropriate to the institution’s nature, scale and size, as well as the complexity and riskiness of its business activities. It should take into account the strategy and business model as well as the portfolio characteristics of the institution.
60. Institutions should take into account the stage within the economic cycle when designing stress
test methodologies, including the scenario and the need for possible management actions.
61. Institutions should identify appropriate, meaningful and robust mechanisms for translating risk
factors into relevant internal risk parameters (probability of default (PD), loss given default (LGD), write-offs, fair value haircuts, etc.) that provide an institution and a group view of risks.
62. The link between stressed risk factors and the risk parameters not only should be based on
institutional historical experience and analysis, but should be supplemented, where available and appropriate, with benchmarks from external sources and, when possible, from supervisory guidance.
63. Because of the complexity involved in modelling hypothetical and macroeconomic-based risk
factors/scenarios, institutions should be aware of the model risk involved and ensure that the following have been performed when setting those factors/scenarios:
a) a regular and sufficiently conservative expert review of the model’s assumptions and mechanics has been performed and a conservative modelling approach to account for model risk has been followed; b) a sufficient degree of conservatism as appropriate has been applied when making assumptions that are difficult to measure in a quantitative way (e.g. diversification, exponential growth projected, fees projected, forward-looking management views) but may have an impact on the model’s outputs (e.g. the outputs of pre-provision net revenue modelsshould be based on sufficientstatisticalsupport as well as business considerations); and c) the dependencies and sensitivities of the results on the assumptions have been acknowledged and their impact is assessed on a regular basis.
64. Shortcomings of models and mechanisms that link risk factors with losses or increased risk
parameters should be understood, communicated clearly and taken into account when interpreting results. Models should take into account the interactions between solvency and funding liquidity and funding costs in order to not systemically and significantly underestimate the impact of a shock. Where possible, results for different modelling approaches should be compared (e.g. for pre-provision net revenue models, a comparison between the model used and other possible approaches and the rationale for their rejection should be available). These

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING links should be based on robust statistical models. However, if data availability or quality or structural breaks in historical data do not allow for meaningful estimates (e.g. for pre-provision net revenue models, it is necessary to have historical data covering an interest rate cycle and a business cycle, as well as information on changes in business strategy and organisation structure), quantitative analyses should be supported with qualitative expert judgements. Even where the underlying modelling process is robust, expert judgement should play a role in challenging model outputs.
65. Institutions should assess possible non-linear interactions between risk factors and stressed
risk parameters.
4.6.2 Sensitivity analysis
66. Institutions should conduct sensitivity analyses at the level of individual exposures, portfolios
or business units, institution wide, and for specific risk types, proportionate to their complexity. Institutions should assess at which aggregation level sensitivity analyses are meaningful or even feasible. The use of expert judgements should be clarified in detail whenever applicable.
67. Institutions should identify relevant risk factors at various levels of application of prudential
requirements and across different portfolios, business units and geographical locations. Institutions should ensure that all relevant types of risk factors are covered, including macroeconomic and macrofinancial variables, statistical aspects of risk parameters (such as the volatility of PD parameters) and idiosyncratic factors such as operational risks.
68. Institutions should define the risk factors identified using different degrees of severity as an
important step in their analysis to reveal nonlinearities and threshold effects, i.e. critical values of risk factors beyond which stress responses accelerate.
69. Where there are uncertainties about the robustness of the estimated dependency between
macroeconomic/macrofinancial risk factors and risk parameters or there is a need to validate the results of more comprehensive scenario analyses, institutions should endeavour to ensure that sensitivity analyses are also carried out by stressing statistical aspects of portfolio risk parameters according to historical distributions supplemented by hypothetical assumptions (e.g. with respect to future volatilities).
70. Single risk factor analyses should be supplemented by simple multi-risk factor analyses, where
a combined occurrence is assumed, without necessarily defining a scenario.
71. Institutions should maintain a list of the risk factors identified.
4.6.3 Scenario analysis
72. Institutions should ensure that scenario analyses are a core part of their stress testing
programmes.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
73. The design of the stress test scenarios should not only be based on historical events, but should
also consider hypothetical scenarios based on non-historical events. Institutions should ensure that scenario designs are forward-looking and take into account systematic and institutionspecific changes in the present and foreseeable future. For that purpose, institutions should endeavour to have recourse to external data from similar risk environments relevant for institutions with similar business models. Institutions should use data that are relevant and available. Relevant data may be internal and/or external and incorporate benchmarking and supervisory guidance.
74. A range of scenarios should be considered to encompass different events and degrees of
severity when meaningful and feasible.
75. Institutions should ensure that their stress test scenarios meet at least the following
requirements:
a) address the main risk factors that the institution may be exposed to; in this regard, the results obtained from single risk factor analyses, which aim to provide information about the sensitivity towards single risk factors, should be used to identify scenarios that include a stress of a combined set of highly plausible risk factors; no material risk factor should be left unstressed or unconsidered; b) address major institution-specific vulnerabilities, deriving from the regional and sectoral characteristics of an institution, as well as its specific product or business line exposures and funding policies: concentration and correlation risks, both of an intra- and of an inter– risk type, should be identified a priori; c) include a coherent narrative for the scenario, covering all main risk factors as well as their (forward-looking) development on the basis of multiple trigger events(i.e. monetary policy, financial sector developments, commodity prices, political events and natural disasters); institutions should ensure that the scenario narrative is plausible and non-contradictory when assuming the co-movement of risk factors and the corresponding reaction of market participants; and, where certain risk factors are excluded from the scenario narrative, institutions should ensure that this exclusion is fully justified and documented; d) are internally coherent, so as to ensure that the identified risk factors behave consistently with other risk factors in a stress event and that they contain explicit estimates and assumptions on the dependence structure among the main underlying risk factors; importantly, co-movements in risk factors that may appear contradictory should be explored to identify new sensitivities; e) take into account innovation and more specifically technological developments or sophisticated financial products without disregarding their interaction with more traditional products; and f) ensure that stressed risk factors translate into internally consistent risk parameters.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
76. Institutions should determine the time horizon of stress testing in accordance with the aim of
the exercise, the characteristics of the portfolio of the institution such as its maturity and liquidity of the stressed positions, where applicable, as well as the risk profile. Solvency stress testing and liquidity stress testing require different time horizons and scenarios.
77. Institutions should ensure that:
a) stress tests explicitly take into account dynamic interdependences, e.g. among economic regions and among economic sectors, including the financial sector; b) the overall scenario takes into account system-wide dynamics, e.g. closure of certain markets, and risk concentrations in a whole asset class (e.g. mortgages); and c) adverse feedback dynamics, caused by factors such as interactions among valuations, losses and margining requirements, are covered.
78. Institutions should make qualitative assessments of second-round or feedback effects of stress
at the individual level, where appropriate and in particular if no robust quantitative estimates can be established. For instance, an individual institution might create some price or volume adjustments to take into account some strategic effects (e.g. the level of lending strategy) and respond endogenously to the scenario.
4.6.4 Severity of scenarios
79. Institutions should ensure that stress testing is based on severe but plausible scenarios and the
degree of severity should reflect the purpose of the stress test. To that end, stress tests should be:
a) meaningful in terms of addressing relevant risks to the institution with a view to promoting the stability of the institution under adverse conditions and, in the case of systemically important banks, also the financial system at all points in the economic cycle and over market fluctuations including funding markets; and b) consistently applied across the institution, recognising that the impact of identical scenarios is not necessarily severe for all business lines.
80. Institutions should ensure that various degrees of severity are considered for both sensitivity
analysis and scenario stress testing covering at least one severe economic downturn for the assessment of capital adequacy and capital planning purposes.
81. Institutions should ensure that severity is set taking into account the specific vulnerabilities of
each institution to a given scenario on the basis of its business model (e.g. exposed to international markets). Institutions should develop their own scenarios and should not be dependent on scenarios from the supervisors. When assessing the severity of a scenario, the institution should be aware of the dynamics of risk environments and of experiences of institutions with similar business models.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
82. Institutions should ensure that their scenarios assess absolute and relative changes of risk
factors. In an absolute scenario, the degree of severity should be a direct change of the risk factor and not depend on the current level. In a relative scenario, the degree of severity should depend on the current level and economic situation (e.g. GDP growth decreases by 2%, i.e. a relative change to the absolute level). For example, will a 2% negative relative change in GDP from a starting point with a substantial positive output gap (i.e. current GDP is substantially above the structural GDP) not necessarily lead to a severe stress effect on GDP in absolute/level terms. Likewise, the worse the current economic situation at the outset the more severe the stress of a relative scenario. Institutions should ensure that their choice of the scenario is sufficiently severe in both relative and absolute terms. Both the choice and its impact on the degree of severity should be justified and documented.
83. For assessing the appropriate degree of severity of scenarios, institutions should also compare
them with the scenarios outlined in their reverse stress testing, considering specific implications of the reverse stress test design for the scenario’s plausibility.
4.6.5 Reverse stress testing
Requirements
84. Institutions should perform adequate reverse stress tests as part of the stress testing
programme, sharing the same governance, an effective infrastructure and quality standards, and to complement other types of stress testing, taking into account the nature, size, scale and complexity of their business activities and risks. Small and less complex institutions may focus more on the qualitative aspects of reverse stress testing while more sophisticated reverse stress testing techniques are required of larger or more complex institutions. The reverse stress testing should be clearly defined in terms of responsibilities and resources allocated and should be supported by an infrastructure that is suitable and flexible and by written policies and procedures. Reverse stress testing should be carried out regularly by all types of institutions and at the same level of application as ICAAP and ILAAP (e.g. institution wide and covering all relevant risk types).
85. Institutions should include scenarios identified through the reverse stress testing to
complement the range of stress test scenarios they undertake and, for comparison purposes, in order to assess the overall severity, allowing the identification of severe but still plausible scenarios. Reverse stress testing should be useful for assessing the severity of scenarios for ICAAP and ILAAP stress tests. The severity of reverse stress testing scenarios can also be assessed by comparing it to, inter alia, historical or other supervisory and publicly available scenarios.
86. In carrying out their reverse stress tests, institutions should also consider whether failure of
one or more of their major counterparties or a significant market disruption arising from the failure of a major market participant (in a separate or combined manner) would cause the predefined outcome.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Use of reverse stress testing
87. Institutions should use reverse stress testing as a regular risk management tool in order to
improve their awareness of current and potential vulnerabilities, providing added value to institutions’ risk management. The principle of proportionality applies to all aspects of the use of reverse stress testing. Institutions should also consider that the pre-defined outcome of reverse stress testing can be produced by circumstances other than the circumstance analysed in the stress test.
88. As part of their business planning and risk management, institutions should use reverse stress
testing to understand the viability and sustainability of their business models and strategies, as well as to identify circumstances where they might be failing or likely to fail within the meaning of Article 32 of Directive 2014/59/EU. It is important that institutions identify indicators that provide alerts when a scenario turns into reality. To that end, institutions should:
a) identify the pre-defined outcome to be tested (e.g. of a business model becoming unviable); b) identify possible adverse circumstances that would expose them to severe vulnerabilities and cause the pre-defined outcome; c) assess (depending on the institution’s size, as well as the nature, scale, complexity and riskiness of its business activities) the likelihood of events included in the scenarios leading to the pre-defined outcome; and d) adopt effective arrangements, processes,systems or other measuresto prevent or mitigate identified risks and vulnerabilities.
89. Institutions should use reverse stress testing in planning and decision-making and to challenge
their business models and strategies in order to identify and analyse what could possibly cause their business models to become unviable, such as the assessment of both the ability to generate returns over the following months and the sustainability of the strategy to generate returns over a longer period based on strategic plans and financial forecasts. The engagement of the management body and senior management throughout the process is expected.
90. Where reverse stress testing reveals that an institution’s risk of business model failure is
unacceptably high and inconsistent with its risk appetite, the institution should plan measures to prevent or mitigate such risk, taking into account the time that the institution should have to react to these events and implement those measures. As part of these measures, the institution should consider if changes to its business model are required. These measures derived from reverse stress testing, including any changes to the institution’s business plan, should be documented in detail in the institution’s ICAAP documentation.
91. Institutions with particular business models, e.g. investment firms, should use reverse stress
testing to explore their vulnerabilities to extreme events, in particular where their risks are not sufficiently captured by more traditional (e.g. solvency and liquidity) stress scenarios based on macroeconomic shocks.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
92. Institutions using internal models for credit risk, counterparty credit risk and market risk, when
carrying out reverse stress testing in accordance with Articles 177, 290(8) and 368(1)(g) of Regulation (EU) No 575/2013, should endeavour to identify severe, but plausible, scenarios that could result in significant adverse outcomes and potentially challenge an institution’s overall viability. Institutions should see these reverse stress tests as an essential complement to their internal models for calculating capital requirements and as a regular risk management tool for revealing the possible inadequacies of these internal models. In severe stress scenarios, even though this should not necessarily be taken as an indication that the modelling of the inputs into the IRB formula are inadequate, model risk will increase and may lead to a breakdown in the model’s predictability.
93. Institutions should perform qualitative analyses in developing a well-defined narrative of the
reverse stress testing and a clear understanding of its feedback and non-linear effects, taking into account the dynamics of risk, and combinations of and interactions between and across risk types. When developing a well-defined narrative, an institution should consider external exogenous events such as economic events, an industry crash, political events, litigation cases and natural events, as well as risk factors such as operational risks, concentration and correlations, reputational risks and loss of confidence, and combinations of these events and factors. The proper engagement of the management body of the institution in the discussions of the narrative is fundamental, taking into account possible specific vulnerabilities and the impact on the whole institution.
94. Institutions should perform quantitative and more sophisticated analyses, taking into account
the institution’s size as well as the nature, scale, complexity and riskiness of its business activities, in setting out specific loss levels or other negative impacts on its capital, liquidity (e.g. the access to funding, in particular to increases in funding costs) or overall financial position. Institutions should work backwards in a quantitative manner to identify the risk factors, and the required amplitude of changes, that could cause such a loss or negative impact (e.g. defining the appropriate loss level or some other measure of interest on the balance sheet of the financial institution such as capital ratios or funding resources). Institutions should understand and document in detail the drivers of risk (e.g. outputting the exact factor draws that had the most impact on the portfolio tail region), the key business lines and a clear and consistent narrative around weaknesses and the corresponding scenarios (e.g. about the underlying assumptions and sensitivity of the results to those assumptions over time) that cause the pre-defined outcomes and the events chain and the likely flow through (e.g. the most important factors may be mapped to macroeconomic variables according to the combinations for a given target loss/capital in a portfolio), identifying hidden vulnerabilities (e.g. hidden correlations and concentrations) and overlapping effects.
95. Institutions should, where appropriate, use sensitivity analyses as a starting point for reverse
stress testing, e.g. shifting one or more relevant parameters to some extreme to reach predefined outcomes. An institution should consider various reverse sensitivity analyses for credit risk (e.g. how many large customers would have to go into default before the loss absorbing capital is lost), market risk, liquidity risk (e.g. stress on deposits in the retail sector and

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING circumstances that would empty the institution’s liquidity reserves) and operational risk, among other risks, and a combination analysis where all risks are covered simultaneously. However, an institution should not primarily use a sensitivity analysis and simple metrics to identify the scenario relevant for the reverse stress test. The qualitative analysis should lead to the identification of the relevant scenario, combining expert judgement from different business areas, as thinking might be the most effective way to prevent a business model failure. A joint stressing of all relevant risk parameters using statistical aspects (e.g. volatility of risk factors consistent with historical observations supplemented with hypothetical but plausible assumptions) should be developed. The plausibility of the parameter shifts required to reach the pre-defined outcome gives a first idea about possible vulnerabilities in the institution. To assess the plausibility, historical (multivariate) probability distributions – adjusted, where deemed necessary, according to expert judgements – should, inter alia, be applied. Qualitative analyses and assessments, combining expert judgements from different business areas, should guide the identification of relevant scenarios.
96. Institutions should use reverse stress testing as a tool to gather insights into scenarios that
involve combinations of solvency and liquidity stresses, where traditional modelling may fail to capture complex aspects from real situations. Institutions should use reverse stress testing to challenge their capital plans and liquidity plans. Where appropriate, institutions should identify and analyse situations that could aggravate a liquidity stress event and transform it into a solvency stress event, and vice versa, and eventually to a business failure. Institutions should endeavour to apply reverse stress testing in an integrated manner for risksto capital or liquidity with a view to improving the understanding and the management of related risks in extreme situations. Recovery actions and recovery planning
97. Institutions should develop scenarios of severe macroeconomic and financial distress, varying
in their severity (including system-wide events, legal entity-specific stress and group-wide stress), to be used in recovery plans under Article 5(6) of the Bank Recovery and Resolution Directive (BRRD) and EBA/GL/2014/06, and use specific reverse stress testing to develop ‘neardefault’ scenarios (institution close to failure but no further) and as an input to inform and test the efficiency and effectiveness of their recovery actions and their recovery planning, and analyse sensitivities around corresponding assumptions. Such ‘near-default’ scenarios should identify and describe the point that would lead an institution’s or a group’s business model to become non-viable unless the recovery actions were successfully implemented. The scenarios should allow the estimation of results and the suitability of all the available recovery options. The terminology used in the description of recovery scenarios should help to determine which recovery options were tested under particular stress scenarios. The description should have a sufficient level of detail, through both a set of quantitative assumptions and a qualitative narrative, in order to determine whether or not the scenario is relevant for the institution and how severe it is. The events should be described in a logical sequence and the assumptions underlying the main drivers (e.g. net income, risk-weighted assets (RWAs), capital) should be laid down very clearly. The scenarios should also take into account a possible estimation of the

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING cross-effects of executing different recovery plan options in the same stress scenario. The scenarios should also allow an understanding of how the events unfold by providing an appropriate timeline that makes it clear at which point in time certain actions will be developed (with implications for their credibility and feasibility). The purpose of this exercise is to test the effectiveness of the institution’s recovery options in restoring financial strength and viability when the institution comes under such severe stress.
98. Because of the different objectives of the two sets of reverse stress tests, the stress tests for
ICAAP and ILAAP purposes and recovery planning should not be interlinked but compared with one another.
99. Institutions should use reverse stress testing to assist with the development, assessment and
calibration of the ‘near-default’ scenarios used for recovery planning.
100. Institutions should use reverse stress testing to identify the risk factors and further
understand and describe the scenarios that would result in ‘near default’, assessing effective recovery actions that can be credibly implemented, either in advance or as the risk factors or scenarios develop.
101. Reverse stress testing should contribute to the recovery plan scenarios by using a dynamic
and quantitative scenario narrative, which should cover:
a) the recovery triggers (i.e. at which point the institution would enact recovery actions in the hypothetical scenario); b) the recovery actions required and their expected effectiveness, including the method of assessing that effectiveness (i.e. indicators that should be monitored to conclude that no further action is required); c) the appropriate timing and process required for those recovery actions; and d) in the case of further stress, points (b) and (c) for the potential additional recovery actions required to address residual risks.
4.7 Individual risk areas
102. Institutions should ensure that the stress testing of individual risk is proportional to the
nature, size and complexity of the business and risks.
103. Institutions should take into account, at the individual level, the impact of second-round
effects in the individual risk for stress testing.
4.7.1 Credit and counterparty risks
104. Institutions should analyse at least:
a) a borrower’s ability to repay their obligations, e.g. the PD;

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING b) the recovery rate in the event of a borrower defaulting including the deterioration of the collateral values or credit worthiness of the guarantee provider, e.g. the LGD; and c) the size and dynamics of credit exposure, including the effect of undrawn commitments from borrowers, e.g. the exposure at default (EAD).
105. Institutions should ensure that their institution-wide credit risk stress tests cover all their
positions in their banking and trading book, including hedging positions and central clearing house exposures.
106. Institutions should endeavour to determine specific risk factors and set out, on a
preliminary basis, how these factors can affect their total credit risk losses and capital requirements. Institutions should endeavour to make that determination on an exposure class by exposure class basis (e.g. factors relevant to mortgages may be different from those relevant to corporate asset classes).
107. Institutions should ensure that credit risk is assessed at various levels of shock scenarios,
from simple sensitivity analyses to institution-wide stress tests, or to group-wide stress tests, in particular:
a) market-wide shock scenarios (e.g. a sharp slowdown of the economy that affects portfolio quality for all of the creditors); b) counterparty-specific and idiosyncratic shock scenarios (e.g. bankruptcy of the largest bank creditor); c) sector-specific and region-specific shock scenarios; and d) a combination of the above.
108. Institutions should subject risk factors to sensitivity analyses, which in turn should provide
quantitative background information for the design of scenarios.
109. Institutions should apply different time horizons when applying their stress scenarios. The
time horizon should range from overnight (one-off effects) up to longer terms (e.g. a creeping economic downturn).
110. When stress testing financial collateral values, institutions should identify conditions that
would adversely affect the realisable value of their collateral positions including deterioration in the credit quality of collateral issuers or market illiquidity.
111. In the design of scenarios, institutions should consider the impact of stress events on other
risk types, e.g. liquidity risk and market risk and the possibility of spillovers between institutions.
112. Institutions should quantify the impact of the scenario in terms of credit losses (i.e.
provisions), risk exposures, income and own funds requirements. In addition, institutions should be able to quantify such impacts by relevant segments/portfolios.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
113. Institutions should consider, wherever possible, the following relevant parameters: PD,
LGD, EAD, expected loss (EL) and risk exposure amount, and the impact on credit losses and own funds requirements.
114. For the estimation of future losses in stress tests, institutions should, where appropriate,
rely on credit risk parameters different from the ones applied in the calculation of capital requirements, which are usually through-the-cycle or hybrid parameters (a combination of through-the-cycle and point-in-time parameters) for PD and under downturn conditions for LGD. In particular, institutions should, where relevant, apply estimates based on point-in-time parameters in accordance with the severity of the scenario for the purpose of estimating credit losses.
115. For the computation of EAD, an institution should also consider a credit conversion factor
(CCF) and, in particular, the effect of the institution’s legal capacity to unilaterally cancel undrawn amounts of committed credit facilities especially in stressed conditions.
116. Institutions should apply, to the extent appropriate, credit risk internal model approaches
that challenge historical relations and data, and simulations of credit quality migrations among categories of exposures to provide an estimate of losses.
117. When assessing their risk to leveraged counterparties or shadow banking entities,
institutions should take into account risk concentrations and they should not presume the existence of collateral or continuous re-margining agreements, which may not be available in case of severe market shocks. Institutions should endeavour to capture such correlated tail risks adequately.
4.7.2 Securitisation
118. Institutions should take into account securitisation risks that arise from structured credit
products, usually created by repackaging the cash flow from a pool of assets into various tranches or asset-backed securities, taking into account the different positions that institutions can have in the securitisation process, by acting as originator, sponsor or investor.
119. Institutions should ensure that the stress testing of securitised assets addresses the credit
risk of the underlying pool of assets, including the default risk, the possibly non-linear and dynamic default correlations as well as the evolution of the collateral values. Institutions should take into account all relevant information with regard to the specific structure of each securitisation, such as the seniority of the tranche, the thickness of the tranche, credit enhancements and granularity, expressed in terms of the effective number of exposures.
120. The sensitivity to systemic market effects, affecting, for example, liquidity dry-outs or
increasing asset correlations, on all levels of the structured product should be carefully taken into account. In addition, the effect of reputational risks, resulting in, for example, funding issues, should be assessed.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
121. Stress tests should address all relevant contractual arrangements, the potential impact of
embedded triggers (e.g. early amortisation provisions), the leverage of the securitisation structure and the liquidity/funding risks arising from the structure (i.e. cash-flow mismatches and prepayment conditions including in relation to interest rate changes).
122. Scenarios should also consider the default of one or more of the contractual counterparties
involved in the securitisation structure, especially of those acting as guarantors of certain tranches.
123. If the institution relies on external ratings to assess the risk of securitised products, the
external ratings should be critically reviewed and scenarios stressing the ratings including the rating classes’ specific impairment rates should be assessed, e.g. by stressing (historical) rating transition matrices.
124. When designing the stress testing approach, institutions should consider the following:
a) the impacts of stress tests for structured credit products will materialise on the level of the asset pool in increased defaults (or PDs and LGDs, where applicable) and hence increased expected loss/impairment rates and regulatory capital requirements (as well as increased probabilities for downgrades) should be expected during shocks; and b) that further impacts may arise from decreases in the net cash flow, increases in trading losses and value adjustments, or from the deterioration of regulatory metrics such as the net stable funding ratio.
4.7.3 Market risk
125. Institutions should take into account market risk, notably risks derived from losses resulting
from adverse changes in the value of positions arising from movements in market prices across commodity, credit, equity, foreign exchange and interest rate risk factors. Interest rate risks in trading book positions should be considered by institutions as a component of market risk.
126. Institutions should conduct stress tests for their positions in financial instruments in trading
and fair value reported in other comprehensive income (FVOCI) portfolios (i.e. accounting terms to classify financial assets), including securitisation instruments/positions and covered bonds. These stress tests should be undertaken as part of institution-wide stress testing as well as for market risk management and calculation purposes.
127. Institutions should apply a range of severe but plausible scenarios for all positions referred
to in the previous paragraph, e.g. exceptional changes in market prices, shortages of liquidity in the markets and the defaulting of large market participants. Dependencies and correlations between different markets and, consequently, adverse changes in correlations should, where appropriate, also be taken into account and factored in. The impact on accounting credit value adjustment (CVA) and on reserves related to institutions’ portfolios (e.g. reserves for liquidity, for modelling uncertainties) should be taken into account equally in stress tests. Market risk reserve stress testing should be substantiated.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
128. When calibrating these stress tests, institutions should take into account at least the nature
and characteristics of their portfolios and related financial instruments (e.g. vanilla/exotic products, liquidity, maturity), their trading strategies, and the possibility of, associated cost of and potential time involved in hedging out or managing risks under severe market conditions.
129. As instruments and trading strategies change over time, institutions should ensure that
their stress tests evolve to accommodate those changes.
130. Institutions should develop an appropriate approach to capturing the underestimation of
tail risk by historical data (fat tails) where applicable, e.g. by applying severe hypothetical scenarios, and, where risk is assessed against percentile confidence levels, should consider tail events beyond those confidence levels.
131. Institutions should in particular:
a) assess the consequences of major market disturbances and identify plausible situations that could entail extraordinarily high losses, which should, where appropriate, also include events with a low probability for all main risk types, especially the various components of market risks; for portfolio level stress tests, the effects of adverse changes to correlations might be explored; and mitigating effects of management actions may be taken into account if they are based on plausible assumptions about market liquidity; and b) have in place a list of the measures containing limits and other possible actions taken to reduce risks and preserve own funds; in particular, limits on exchange rate, interest rate, equity price and commodity price risks set by institutions should, where appropriate, be taken into account against the results of the stress testing calculations.
4.7.4 Operational risk
132. Institutions should be aware that relevant risk parameters related to operational risk may
derive from inadequate or failed internal processes, people and systems, including legal risks, or from external events, and may affect all products and activities within the institution.
133. In order to stress relevant risk parameters, institutions should use the profit and loss (P&L)
effect of operational losses as the main metric. Any intrinsic impact caused by the operational risk event should be considered as an operational risk loss (e.g. intrinsic impacts from opportunity costs, or internal costs such as overtime/bonuses, etc., where they relate to an operational risk event). In addition, and only for the purpose of stress testing, any loss of future earnings caused by operational risk events (excluding second-line effects on the macroeconomic environment) should be included. At least the institutions under the advanced measurement approach (AMA) should also take these losses into account as they flow into the internal loss database to calculate the additional capital requirements. When using historical data, external data or scenarios as inputs for both P&L and RWA projections, institutions should take into account and avoid possible double-counting effects on the input side.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
134. As operational losses may induce second-round effects (i.e. reputational risk), in order to
account for such effects, the operational risk stress testing programme should be thoroughly integrated into the institution-wide stress test and should include interconnections with liquidity and own funds requirements. Institutions should analyse at least:
a) the exposure of the institution to activities and its associated risk culture and past record of operational losses, with a focus on the level and change in losses and gross income in the past few years; b) the business environment, including geographical locations, in which the institution operates and macroeconomic conditions; c) the evolution in headcount and in balance-sheet size and complexity over the past few years, including structural changes due to corporate events such as mergers and acquisitions; d) changes to significant elements of the information technology infrastructure; e) the degree and orientation of incentivising in compensation schemes; f) the complexity of processes and procedures, products and information technology systems; g) the extent of outsourcing, with regard to the concentration risk associated with all outsourcing arrangements and external market infrastructures; and h) the vulnerability of modelling risk, especially in areas related to the trading of financial instruments, risk measurement and management, and capital allocation.
135. Idiosyncratic risk factors should also be explored and used as inputs for scenario design.
Indicatively, institutions under the AMA should stress their business environment and internal control factors (BEICFs).
136. Institutions should consider the interactions of, and individual exposures to, such
idiosyncratic risk factors in determining their operational risk exposure.
137. Institutions should analyse carefully the possible interaction of operational risk losses with
credit and market risks.
138. The analysis of the stress test events should involve expert judgement, to include at least
low-frequency high-severity events.
139. Institutions should design severe but plausible stress events. Assumptions may differ from
assumptions used in credit and market risk stress scenarios. When an institution expands its business in the local or in the international markets through mergers and acquisitions, the design of new products or a new business line, the severe but plausible stress test scenarios should be based on expert judgement to overcome the possible lack of historical information.
140. Institutions should build their stress testing programme based on both internal and
external data, while analysing carefully:

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING a) the use of scaling factors (e.g. in a situation where external data were scaled down, the scaling may be reduced) and the possible need for additional impacts stemming from changing scaling factors in a stress situation; and b) the criteria for determining the relevance of data (e.g. data on a large loss considered not relevant may be used within the stress test, in addition to Capital Requirements Regulation (CRR) requirements).
4.7.5 Conduct-related risk and associated litigation costs
141. Institutions should take into account that conduct-related risk, as part of legal risk under
the scope of operational risk, arises because of the current or prospective risk of losses from the inappropriate supply of financial services and the associated litigation costs, including cases of wilful or negligent misconduct.
142. In their stress testing, institutions should assess the relevance and significance of the
following exposures to conduct-related risk and associated litigation costs:
a) the mis-selling of products, in both the retail and the wholesale markets; b) the pushed cross-selling of products to retail customers, such as packaged bank accounts or add-on products that customers do not need; c) conflicts of interest in conducting business; d) the manipulation of benchmark interest rates, foreign exchange rates or any other financial instruments or indices to enhance an institution’s profits; e) unfair barriers to switching financial products during their lifetime and/or to switching financial service providers; f) poorly designed distribution channels that may result in conflicts of interest with false incentives; g) unfair automatic renewals of products or exit penalties; and h) the unfair processing of customer complaints.
143. When measuring conduct-related risk, institutions should consider (a) the uncertainty
around provisions or expected losses originating from conduct-related events; and (b) extreme losses associated with tail risks (unexpected losses). Institutions should assess their capital needs under such events and scenarios and should also take into account the reputational effect of conduct losses. In principle, expected losses from known conduct-related issues should be covered by provisions and included in the P&L account, whereas unexpected losses are quantified and covered by capital requirements from the institution. The possible excess of amounts after projection of stressed conduct losses should be included in the institution’s assessment of potential capital needs.
144. In order to capture the risk that the provisions are insufficient or timely inconsistent,
institutions should assess expected losses from conduct-related risk in excess of existing

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING accounting provisions and factor these into their projections. Where appropriate, institutions should assess whether or not future profits will be sufficient to cover these additional losses or costs in the scenarios and incorporate this information into their capital plans.
145. Institutions should collect and analyse quantitative and qualitative information about the
extent of their business in relevant, vulnerable areas. Institutions should also provide information to support material assumptions underlying their estimates of conduct-related costs.
146. In rare cases where an institution is unable to provide an estimate for an individual material
conduct-related risk because of the extent of uncertainty, the institution should clarify that this is the case and provide evidence and assumptions supporting its assessment.
147. Stress testing should also, where appropriate, be used to assess extreme losses associated
with tail risks (unexpected losses) and whether or not additional capital should be held under Pillar 2.
148. Institutions should form a view on the unexpected losses that may originate from conductrelated events based on a combination of:
a) judgement; b) historical loss experience (e.g. the institution’s largest conduct-related loss over the past five years); c) the level of expected annual loss for conduct-related risk; d) conduct-related scenarios where potential exposures over a shorter time horizon (e.g. five years) are considered; and e) losses experienced by similar entities or by entities in similar situations (e.g. in cases of litigation costs).
4.7.6 Liquidity risk
149. Institutions should take into account that liquidity or funding risks arise when an institution
is not able to meet current and future cash flows.
150. Institutions should take into account that liquidity or funding risks encompass:
a) short- to medium-term liquidity risks; and b) funding risks.
151. Institutions should analyse and measure themselves against risk factors relating to both
asset- and liability-related items, as well as to off-balance-sheet commitments as defined in the EBA Guidelines on the supervisory review and evaluation process (SREP).
152. Institutions’ analysis of risk factors should take into account, but should not be limited to:

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING a) the impact of macroeconomic conditions, e.g. the impact of interest rate shocks on contingent cash flows; b) the currency of assets and liabilities including off-balance-sheet items, to reflect convertibility risk and possible disruptions in the access to foreign exchange markets; c) the location of liquidity needs and available funds, intragroup liquidity transactions and the risk of constraints for the transfer of funds between jurisdictions or group entities; d) actions that the institution may take to preserve its reputation or franchise (e.g. the early repayment of callable liabilities); e) the internalisation of risks related to specific activities, as in the case of prime brokerage where symmetry, to a certain extent, might be required between the lending side and the borrowing side of securities, i.e. customer long positions are funded using the proceeds from customer short trades. Such symmetry is subject to counterparties’ behaviour and is therefore sensitive to reputational risk. In the event of such risk, it may trigger the unwinding of trades that would unexpectedly leave the institution with securities on its balance sheet, along with the need to fund them; f) the vulnerabilities within the funding term structure due to external, internal or contractual events; g) realistic run-off rates under normal conditions that accelerate in stressed times; h) concentration in funding; and i) estimates of future balance-sheet growth.
153. Institutions should subject these risk factors to sensitivity analyses which in turn should
provide the appropriate quantitative background information for the design of scenarios.
154. Institutions should apply the following three types of stress scenarios: an idiosyncratic
scenario, a market-wide scenario and a combination of the two. As idiosyncratic stress scenario should assume institution-specific events (e.g. a rating downgrade, the default of the largest funding counterparty, a loss of market access, a loss of currency convertibility, the default of the counterparty providing the largest inflows), whereas a market-wide stress scenario should assume an impact on a group of institutions or the financial sector as a whole (e.g. a deterioration in funding market conditions or the macroeconomic environment, or rating downgrades of countries in which the institution operates).
155. Institutions should design different time horizons in their stress testing: the time horizons
should range from overnight up to at least 12 months; there should also be separate stress tests relating to intraday liquidity risks. The time horizon should display, for example, a short acute phase of stress (up to 30 days in order to cover such periods without having to change the business model) followed by a longer period of less acute but more prolonged stress (between 3 and 12 months).

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
156. Institutions should combine the stress of the short- to medium-term liquidity risk with a
stress of funding risk, considering a time horizon of at least 12 months.
157. Institutions should design a set of adverse behavioural assumptions for customers including
depositors, other providers of funds and counterparties for each different scenario and time horizon.
158. In the design of scenarios, institutions should consider the impact of stress events for other
risk types, e.g. credit risk losses and reputational risk events, on their liquidity position, and the possibility of an impact of fire sales from other institutions (e.g. spillovers) or from their own liquidity buffer on the market-to-market value of other assets they hold.
159. The main methodology used for calculating the magnitude of the impact should be the net
cash flow profile. For each scenario, at each stress level, the institution identifies cash inflows and outflows that are projected for each future time period and the resulting net cash flows. Institutions should consider the lowest cumulative point of net cash flows within the time period assessed in each given scenario.
160. Institutions should extend the analysis, if appropriate, to other metrics, such as:
a) liquidity ratios and other metrics used in the framework, which should include, but may not be limited to, supervisory liquidity ratios and metrics, in particular the liquidity coverage ratio and net stable funding ratio; b) their available liquidity buffer, over and above the ratios referred to above, and other counterbalancing measures, i.e. their counterbalancing capacity, for each stress scenario; the stress testing of this metric should be accompanied by an assessment of the impact on the proportion and nature of encumbered assets; c) the survival horizon of the institution as derived from its counterbalancing capacity, i.e. the institution’s ability to hold, or have access to, excess liquidity over short-term, mediumterm and long-term time horizons in response to stress scenarios as defined in the EBA Guidelines on common procedures and methodologies for SREP, and stressed cash flows, taken jointly, before and after the impact of counterbalancing measures; d) solvency and profitability.
161. When applying the different stress scenarios, institutions should assess and highlight
counterbalancing effects provided by central banks (monetary policy) and adopt a conservative approach.
162. Liquidity stress test metrics should include, if appropriate and in particular for at least all
material currencies, a granularity per currency to allow the analysis of currency-specific assumptions in scenarios (e.g. volatility in exchange rates or currency mismatches).
163. Institutions should, where appropriate, integrate liquidity stress test in their institutionwide stress tests, and take into account differences in the time periods covered in liquidity

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING stress tests from those covered in institution-wide solvency stress tests. At a minimum, institutions should assess the impact of increasing funding costs on P&L. Institutions should take into account that linking funding costs to solvency position may influence the quality of the liquidity stress test, namely a too slow deterioration in liquidity.
4.7.7 Interest rate risk from non-trading activities
164. This section is without prejudice to the EBA Guidelines on interest rate risk arising from
non-trading activities.
165. Stress tests should support and be an integral part of the interest rate risk in the banking
book (IRRBB) internal management system.
166. The interest rate scenarios used for stress testing purposes, including for the purposes of
the application of Article 98(5) of Directive 2013/36/EU for the interest rate risk arising from the non-trading activities, should be adequate to identify all material interest rate risks, e.g. gap risk, basis risk and option risk.
167. Institutions should ensure that the tests referred to in the previous paragraph are not only
based on a simple parallel shift but that they consider movements and changes in the shape of the yield curves in their scenario analyses.
168. Institutions should consider the following elements:
a) the spread risk, which arises from reference rates mismatching between time-matched funding and investments; and b) early termination risks included in contracts with an embedded option, which might force the institution into a new transaction on less favourable terms.
169. Institutions should be aware of potential indirect interest rate effects triggering losses
elsewhere (e.g. that a pass-through onto lending rates could trigger further credit risk losses because of a deterioration in customers’ ability to pay).
170. Where less complex financial instruments are employed, institutions should calculate the
effect of a shock using sensitivity analysis (without the identification of the origin of the shock, and by means of the simple application of the shock to the portfolio). Where an institution uses more complex financial instruments on which the shock has multiple and indirect effects, it should use more advanced approaches with specific definitions of the adverse (stress) situations reflecting relevant idiosyncratic risks.
4.7.8 Concentration risk
171. Stress testing should be a key tool in the identification of concentration risk, as it allows
institutions to identify interdependencies between exposures, which may only become apparent in stressed conditions as well as hidden concentrations.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
172. In assessing this risk in their stress testing programmes, institutions should take into
account the credit risk of each exposure but also consider the additional sources of risks arising from the similar behaviour of certain exposures (i.e. higher correlation). These additional sources of risk under analysis should cover, but not be limited, to the following:
a) the single-name concentrations (i.e. client or group of connected clients as defined in
Article 4(39) of Regulation (EU) No 575/2013);
b) the sectoral concentrations; c) the geographical concentrations; d) the product concentrations; and e) the collateral and guarantee concentrations.
173. In stress testing, especially institution-wide and including group stress testing, institutions
should assess concentration risk considering on- and off-balance-sheet exposures, as well as banking, trading and hedging positions.
174. Stress tests should take into account changes in the business environment that may occur
and that would lead to the materialisation of concentration risk. In particular, stress tests should consider unusual but plausible changes in correlations between various types of risk factors as well as extreme and unusual changes in risk parameters, going beyond single risk factors, to look at scenarios that take account of interrelated risk factors and that feature not only first-round but also feedback effects.
175. The way in which concentrated exposures perform in response to the same risk factors
should be factored into the stress tests, including the risk of additional short-term losses as a result of concentrated exposures across the retail and corporate credit books or across different entities in a group.
176. Institutions should consider the impact on trading books from exposures to a single risk
factor or from multiple risk factors that are correlated.
177. In order to assess the ex ante level of concentration risk and/or impact of the scenario on
the concentration level, institutions should, where appropriate, consider more or less complex indicators, for instance the Herfindahl-Hirschman Index (HHI) and Gini coefficients.
178. Institutions should consider the potential existence of overlaps between different
concentration sources. Institutions should not simply sum risk impacts but also put in place aggregation methods that consider the underlying drivers.
4.7.9 Foreign exchange lending risk
179. Institutions should take into account that foreign exchange lending risk:
a) may arise from the unhedged borrower’s (i.e. retail and as small and medium-sized enterprise-SME borrowers without a natural or financial hedge that are exposed to a

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING currency mismatch between the loan currency and the hedge currency, as defined in EBA/GL/2014/13) inability to service debt denominated in currencies other than the currency of the Member State in which the institution has been authorised; b) is related to pure credit and foreign exchange market risk; c) is characterised by a non-linear relationship of credit and foreign exchange market risk components; d) is influenced by the general exchange rate risk; and e) may arise from conduct-related risk.
180. In their stress testing programmes, institutions should take into account foreign exchange
lending risk affecting credit facilities in the asset side of their balance sheet and its multiple sources of risk, taking into account that the debtor’s inability to repay its debt may originate from:
a) risks related to the debtor’s internal source of income; b) risksrelated to the economic situation in the country in which the currency is denominated; and c) foreign exchange risk.
181. Institutions should consider, when designing or implementing their stress test scenarios,
that foreign exchange lending risk impacts may arise from the increase in both the outstanding value of debt and the flow of payments to service such debt, as well as an increase in the outstanding value of debt compared with the value of collateral assets denominated in the domestic currency.
182. Institutions should develop stress scenarios by changing different parameters to allow
them to forecast foreign exchange credit portfolio performances in different cases, such as:
a) assuming the exchange rate appreciation of the host currency by a predetermined percentage; b) assuming a shift in the foreign exchange interest rate by a predetermined percentage point; or c) combining both of the above.
183. In order to assess potential vulnerability, institutions should be able to demonstrate
additional credit risk losses stemming from foreign exchange lending risk separate from the credit risk losses and risk exposure amounts resulting from the impact of the scenario on credit risk factors.
184. When stress testing the foreign exchange lending risk, institutions should take into account
at least:

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING a) the type of exchange rate regime and how this could impact on the evolution of the foreign exchange rate between domestic and foreign currencies; b) the sensitivity impact of exchange rate movements on a borrower’s credit rating/score and debt servicing capacity; c) the potential concentration of lending activity in a single foreign currency or in a limited number of highly correlated foreign currencies; d) the potential concentration of lending activity in some specific sectors of the economy, in the country currency, that have a core business in foreign currency countries or markets and the corresponding evolution of such sectors highly correlated with foreign currencies; and e) the ability to secure financing for this type of portfolio; for institutions applying internal models for the calculation of credit risk capital requirements, the additional risk related to lending in foreign exchange currencies should be reflected in higher risk weights of such assets, and the non-exhaustive list of variables used in the models should include interest rates disparities, loan-to-value (LTV) ratios, currency cross correlation and volatility.
185. Institutions should take into account possible significant weaknesses that may be built into
internal models with a possible underestimation of currency depreciation in relation to the client’s ability to service its debt, taking into account the following indicative elements:
a) monetary policies during a crisis period are often focused on stimulating the real economy by significantly decreasing reference interest rates, with potentially misleading information from internal models regarding these indirect effects; and b) currency appreciation may be partially offset by falling interest rates and this may cause an underestimation of risk related to foreign exchange lending because, in zero interest rate environments, such a trade-off may not be possible in the long term.
186. While assessing the potential impact of foreign exchange lending on profitability in a
certain scenario, institutions should, where appropriate, include the legal regime and the relevant jurisdiction, which may force institutions to denominate foreign exchange lending in the domestic currency at exchange rates significantly below market ones.
4.8 Application of stress testing programmes
4.8.1 Stress testing for ICAAP/ILAAP purposes
187. As part of ICAAP and ILAAP, institutions should ensure that they have enough capital and
liquidity resources to cover for the risks that institutions are, or might be, exposed to, and ensure the appropriate allocation of capital and liquidity resources across the entities of an institution over the economic cycle. This assessment should be reflected in the capital and liquidity plans that institutions should submit to the competent authorities as part of their ICAAP and ILAAP information and as part of the group risk assessment and liquidity profiles.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
188. Furthermore, by means of stress testing, institutions should evaluate the reliability of their
capital plans under stress conditions to ensure that they meet the capital requirements applicable to them. Any evaluation of capital plan reliability under stressed conditions should take into consideration scenario severity and occurrence probability. Institutions should also test the reliability of their liquidity plans to ensure that they can meet liabilities as they fall due under stress conditions. Institutions should assess the level of transferability of capital and liquidity resources in stressed conditions and consider any possible impediments, including legal, organisational and operational impediments. Institutions should, where appropriate, recognise that certain elements of capital requirements, as well as the liquidity buffers, may be used in stressed conditions (e.g. elements of the combined buffer requirements as specified in
Chapter 4 of Title VII of Directive 2013/36/EU).
189. In addition to the general requirements related to institutions’ stress testing programmes
specified in these guidelines, stress tests used for ICAAP/ILAAP purposes should meet the following specific requirements:
a) institutions should cover all material risk categories (and sub-categories) that the institutions are exposed to with regard to both on- and off-balance-sheet assets and liabilities in relation to all material portfolios or sectors/geographies, including relevant structured entities; b) a range of scenarios should be considered including at least an adverse economic scenario that is severe but plausible, such as a severe economic downturn and/or a market-wide and idiosyncratic shock to liquidity; c) ICAAP and ILAAP stress testing should be performed through comprehensive institutionwide stress testing and reflect all entities for which ICAAPs or ILAAPs are required; d) ICAAP and ILAAP stress tests should cover the same forward-looking period as the institution’s ICAAP and ILAAP, respectively, and be updated at least as regularly as the ICAAP and ILAAP; ICAAP stress tests should cover a period of at least two years.
190. ICAAP and ILAAP stress tests should be consistent with the risk appetite and overall strategy
(i.e. including the business strategy) of the institution. Institutions should demonstrate a clear link between their risk appetite, their business strategy, and their ICAAP and ILAAP stress tests. In particular, institutions should assess their capital and liquidity plans, and any internal capital planning, including management capital buffers, consistent with their stated risk appetite and strategy, and overall internal capital needs, and rebuild their liquidity positions after using liquidity buffers to meet their liabilities during a stress period.
191. Furthermore, in their ICAAP stress test, institutions should assess their ability to stay above
applicable regulatory and supervisory capital requirements (e.g. total SREP capital requirements-TSCR) in stressed conditions.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
192. When doing solvency stress tests for the purposes of ICAAP, institutions should also
consider the impact of scenarios on the institution’s leverage ratio as well as eligible liabilities held for the purposes of minimum requirements for eligible liabilities (MREL).
193. Supervisory stress testing conducted pursuant to Article 100 of Directive 2013/36/EU or
the scenarios or assumptions prescribed to an institution as a result of supervisory challenges and assessments of institutions’ own stress tests should not be seen as replacing the obligations of institutions to carry out stress tests as part of their ICAAPs and ILAAPs.
4.8.2 Management actions
194. Institutions should identify credible management actions addressing the outputs of stress
tests and aimed at ensuring their ongoing solvency through the stressed scenario.
195. Institutions should consider a broad range of management actions (including within the
liquidity contingency plans) against a range of plausible stressed conditions with a focus on at least one severe but plausible scenario.
196. To assess possible responses to a stressed situation, institutions should identify the credible
actions that are most relevant and when they would have to take them. Institutions should take into account that some management actions are required immediately and others are contingent on specific events happening, in which case clearly defined triggers for action should be identified beforehand. Management actions should be consistent with stated strategies and policies, for example in the context of stated dividend 8 policies. Institutions should be conservative about their ability to take mitigating management actions, recognising the possible impact of the stressed scenarios on other markets.
197. Institutions should explain the qualitative and quantitative impacts of the stress before and
after mitigating management actions. The impact before management actions should include assumptions about strategy, growth and associated revenue, but exclude management actions that would not be available in a stress event such as winding down a business line or raising capital.
198. Acceptable management actions will be subject to the guidance and judgement of
competent authorities, and might include the following:
a) the review of internal risk appetite and risk limits; b) the review of the use of risk mitigation techniques; c) the revision of policies,such asthose that relate to liquidity and funding or capital adequacy; d) the reduction of distributions to shareholders; e) the changes in the overall strategy and business plan and risk appetite; and f) the raising of capital or funding.

8 For example, see Article 141 CRD (maximum distributable amount).

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
199. Anticipated management actions differentiated by scenario and adjusted to the severity of
the scenario should be documented. Institutions should take into consideration the reduction of the efficiency as a consequence of extremely severe stress situations. In the ICAAP and ILAAP information they must provide to the competent authorities, institutions should also explain management actions already taken based on the results of stress tests.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
5. Accompanying documents
5.1 Draft cost-benefit analysis/impact assessment
Article 16 of Regulation (EU) No 1093/2010 provides the EBA with the responsibility to establish
consistent, efficient and effective supervisory practices, within the European System of Financial Supervision (ESFS), to ensure the common, uniform and consistent application of Union law, and to issue guidelines and recommendations addressed to competent authorities or financial institutions. More specifically, the EBA is mandated by Article 100(2) of Directive 2013/36/EU to foster sound and effective supervision across the EU arising from the requirements set out, while Article 107 of the same Directive stipulates that the EBA needs to assess the information provided by competent authorities for the purposes of developing consistency in the supervisory review and evaluation process (SREP). These legal provisions empower the EBA to issue guidelines that ensure that competent authorities use common methodologies when conducting their annual supervisory stress testing tasks. The following sections of the impact assessment focus on justifying the decision for the specific provisions in the updated version of the Guidelines on institutions’ stress testing, and also on estimating the costs and benefits for institutions arising from the full implementation and ongoing application of the guidelines. It is noteworthy that the impact assessment quantifies the net impact from the full implementation of the guidelines, implying that the costs and benefits from the actual implementation of the guidelines arising from the exercise of a national discretion will be proportionate to the level of implementation in each Member State, i.e. Member States that do not fully implement the guidelines will incur less costs but will also benefit less from the advantages of the full implementation. A. Problem identification In 2010, the CEBS, the predecessor of the EBA, issued Guidelines on stress testing (GL32). Since then, there have been several de facto changes in conducting stress testing which relate to its coverage and usage and related methodologies. The recent financial crisis and the several negative events in the banking sector have highlighted significant lessons in relation to stress testing practices and have triggered changes in the conduct of stress testing. Aligning with international practices, EU supervisory bodies expect institutions to develop more advanced and up-to-date stress testing practices in light of this recent experience. The EBA has also derived important conclusions from the 2013 EBA peer review on the implementation of the stress testing guidelines. The EBA performed the peer review to assess and compare the effectiveness of supervisory activities related to the review of credit institutions’ own stress testing programmes across the EU, as well as the level of implementation of the guidelines

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING by competent authorities 9 . Although the peer review concluded that all of the competent authorities’ organisational and resource models have their own advantages, the involvement of dedicated technical experts in stress testing was not sufficient, irrespective of the model in question. The peer review also demonstrated that competent authorities often focus on stress testing the largest institutions and devote far less attention to other institutions in their jurisdictions. Only a few competent authorities required reverse stress testing, and when they did, it was often only as
part of recovery planning. In addition, there is vast diversity across jurisdictions on how competent
authorities incorporate the outcome of stress testing into the SREP. Finally, in many instances, competent authorities observed that stress testing is still not sufficiently integrated into institutions’ risk management frameworks or senior management decision-making processes. Where stress testing is used, the severity of scenarios is still not sufficient to address extreme adverse economic and financial conditions. B. Policy objectives These guidelines aim to achieve convergence of the practices followed by institutions and competent authorities for stress testing across the EU. They provide detailed guidance with which the institutions should comply when designing and conducting a stress testing programme, addressing at the same time the deficiencies identified by the EBA as part of the peer review. They also provide guidance with a view to ensuring the convergence of institutions’ stress testing in the context of the SREP performed by competent authorities. To achieve this objective, the impact assessment should identify whether or not the relevant building blocks, required for an effective stress testing programme of the different approaches (spanning from a simple sensitivity analysis of single risk factors or portfolios to complex macroeconomic scenario stress testing on an institution-wide basis), provide a reasonable tradeoff between the costs and benefits involved in their full implementation and ongoing application.
C. Baseline scenario
The best approach for achieving the convergence of practices followed by institutions for stress testing across the EU has been discussed since the previous guidelines were issued in 2010, in close cooperation with competent authorities, at several fora and during the EU-wide stress test exercises. The EBA has drafted the updated Guidelines on stress testing to ensure consistency with the EBA Guidelines on common procedures and methodologies for SREP. Although it is expected that, even in the absence of regulatory intervention, supervisors and institutions would ensure this consistency anyway, the regulatory intervention (stress testing guidelines) is expected to enhance the harmonisation of prudential supervision and will speed up

9 https://www.eba.europa.eu/-/eba-publishes-peer-review-on-the-implementation-of-the-stress-testing-guidelines

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING the compliance of supervisors and institutions with the suggested standards, making such harmonisation feasible at an earlier stage. D. Options considered While drafting the stresstesting guidelines, EBA staff and competent authorities considered several options that could be included in the final provisions. Option 1: ‘do nothing’ (i.e. do not draft updated guidelines) This option implies that institutions carry out stress tests by relying on current practices without receiving any additional guidance in writing. Despite the fact that most of these practices have been agreed between the competent authorities and the EBA, the explicit scope of different approaches for the conduct of stress testing by institutions is missing. Furthermore, there are links between stress testing exercises and other forms of prudential supervision (SREP) that have not yet been completely established in order to ensure consistency and could improve prudential supervision. The use of these links and ensuring consistency should be thoroughly explained to institutions. The ‘do nothing’ option would imply non-negligible operational costs for institutions, as there would be excessive communication between institutions, competent authorities and the EBA, and the risk of the inconsistent application of stress testing methodologies and subsequently the inconsistent application ofthe EBA Guidelines on common procedures and methodologiesfor SREP. Moreover, oral communication of updates on best practices to the competent authorities – although stress testing still seemingly relies on GL32, dating from 2010 – entails a level of reputational risk for institutions and supervisors alike. Option 2: review GL32 and provide guidance to ensure the convergence of supervisory stress testing in the context of the SREP performed by competent authorities. The main reasons for improving the existing guidelines are the following: (a) to address the followup from the 2013 peer review; (b) the SREP guidelines need supporting guidelines, specifically in relation to stress testing; and (c) the lessons learned from the 2014 EU-wide stress test should be put into practice. In particular, there is a need for a clear taxonomy on stress testing; and a need to understand the range of potential supervisory stress tests (to have an informed discussion about where is best to pitch the EBA stress tests vis à vis other supervisory stress tests). Although in principle the guidelines remain largely valid, some areasrequire attention, namely data infrastructure; reverse stress testing; new individual risks (conduct-related risk and foreign exchange lending risk); operational risk (conduct-related risk and cyber risk); and the use of the outcome for capital adequacy assessment purposes (the general coverage of the SREP needs to be updated to reflect the new SREP guidelines). In addition, other areas can be also reviewed, namely individual risk areas as
part of the body of the guidelines (i.e. no longer in the annexes; e.g. liquidity

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING risk); institution techniques for assessing the impact of macroeconomic scenarios; and transparency in stress testing and associated outcomes. E. Cost-benefit analysis The principle of proportionality applies to all aspects of stress testing, including methodology, frequency, discrimination between qualitative and quantitative assessment, and the level of details of the conduct of stress testing. The cost-benefit analysis has also followed the principle of proportionality, e.g. an institution that is currently required by the supervisor to conduct a less sophisticated approach, because of the nature of its products or its small size, will be allowed to follow the same approach in the future, while institutions that do not currently apply certain stress testing practices, as recommended by the guidelines, will be assumed to follow an approach that is more appropriate for their size, business model and the nature of their financial products. The cost-benefit analysis assessed the net monetary impact of the operational changes proposed for implementation in relation to the current operational costs relating to the conduct of stress testing. The net impact on capital requirements, implied by the implementation of the current guidelines, cannot be precisely assessed; however, it is expected to be close to zero when quantifying it as a percentage of the total operational cost of a bank. Option 1 Benefits: the benefits for the institution are expected to be zero. Costs: the institutions would face increasing costs, arising from unnecessary oral communication to seek clarifications on best practices for stress testing and their relation with other tools for prudential supervision (SREP guidelines). The magnitude of these costs would be low. Net impact (benefits minus costs): negative (low). Option 2 Benefits: the transparency of the current stress testing practices would enhance the confidence of institutions and make the conduct of stress testing more effective and efficient. Although these benefits are not directly observable, not precisely measurable and will be spread over time, they are not negligible and cannot be ignored. The magnitude of the benefits would be low. Costs: there is no cost for the institutions in relation to the review of the existing guidelines, as it only clarifies what practices the institutions should have been applying and in many cases what practices they already apply. There would be costs in the event of miscommunications or misunderstandings. The magnitude of the costs would be negligible and only related to initial requests for clarifications, which the institutions may request from the supervisors. This may take some time, which, when converted to monetary terms, implies some negligible cost. Net impact (benefits minus costs): positive (low).

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING F. Preferred option The cost-benefit analysis in section E indicates that option 1 should be excluded as it produces a negative net impact. The cost-benefit analysis, enhanced by the qualitative assessment in section D, indicates that option 2 should be proposed for implementation, i.e. the review of GL32 to ensure the convergence of practices followed by institutions and competent authorities for stress testing across the EU, linking these practices with other tools for prudential supervision (SREP). Following the principle of proportionality, these guidelines are applicable in their entirety to Category 1 institutions, asthese are the systemically important institutions. Category 2 institutions, or non-systemic medium- to large-sized institutions, are required to follow those parts of the guidelines that are relevant to their institutions and to a level that reflects the complexity of their activities. These institutions can operate domestically or have sizable cross-border activities and may operate in different business lines, which needs to be reflected in the stress testing. For Category 3 and 4 institutions, which include small and medium-sized institutions, the expectation is that they will follow the guidelines to the extent that is proportionate and relevant to their activities, resources and the risk posed to the financial system. The scope of stress testing for these institutions is therefore limited, reflecting the reduced scope of their activities and the limited risk to the system overall. Nonetheless, the assessment of the cost-benefit analysis above assumes that institutions of Category 3 and 4 will also conduct stress testing exercises according to the proportional (for their size and nature) implementation of the guidelines. If these institutions do not conductstresstesting and/or do not follow the guidelines, the cost and net impact of option 3 will be reduced proportionally, although this reduction is expected to be marginal and not expected to affect the magnitude of the net impact because of the simplicity of the models that these institutions are assumed to apply. Having taking into account the above assumptions, it is estimated that the total net benefit of implementing the guidelines, albeit low, could be allocated among the various categories of institutions as follows:
Category 1 (approximation in % of the total net impact): 57% (or 4/7); Category 2 (approximation in % of the total net impact): 29% (or 2/7); Categories 3 and 4 (approximation in % of the total net impact): 14% (or 1/7).
5.2 Feedback on the public consultation
The EBA publicly consulted on the draft proposal on Guidelines on institutions’ stress testing contained in this paper.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING The consultation period lasted for three months and ended on 31 January 2018. Thirteen responses were received, of which 10 were published on the EBA website. The previous consultation period also lasted for three months and ended on 18 March 2016. Twelve responses were received, of which 11 were published on the EBA website. This section presents the comments arising from both consultations, the analyses and discussions triggered by these comments, and the actions taken to address them if deemed necessary. Changes to the draft guidelines were incorporated as a result of the responses received during the public consultations.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Summary of responses to two public consultations and the EBA’s analysis General comments Ultimate application date of the guidelines One respondent noted that it is important that supervisors do not underestimate the efforts that will have to be made by banks to implement and ensure compliance with these guidelines. In particular, some firms may need to undergo internal reorganisations in terms of their stress testing functions and/or create internal oversight functions. These changes will require a certain period of time and this must be reflected in the ultimate application date of the guidelines. Moreover, given that institutions should endeavour to comply with Basel Committee on Banking Supervision (BCBS) principles for effective risk data aggregation and risk reporting , but that these principles will be in place after the stress testing guidelines, a grandfathering period to comply with the application of these guidelines would be welcome. Another respondent mentioned that the timeline of the implementation of the guidelines on stress testing and supervisory stress testing seems too ambitious. The respondent believes that the fourth quarter of 2016, the currently foreseen starting date of the guidelines’ application as communicated by the EBA, is too early a start date for the application of the entire guidelines and would not leave enough time for banking entities to adjust to the new guidelines. In this context, it would be advisable to apply a phased approach differentiating which aspects of The guidelines were published in December 2015 for a threemonth public consultation, which ended in 18 March 2016. They have been then finalised based on the outcomes of the consultation and will be translated into the official EU languages and published on the EBA website. The deadline for competent authorities to report whether or they comply with the guidelines will be two months after the publication of the translations. The EBA aims to finalise the proposed guidelines during 2018, taking into account the comments received during the second public consultation. As currently foreseen, the application date will be in 2019. The previous guidelines (GL32) published in 2010 remain largely valid. The EBA understands the challenges involved in the further development of stress testing programmes based on best practices and that this will go beyond the status quo for many institutions. The EBA recognises that institutions, after the application date, will continue to develop and enhance their systems and processes to meet supervisory expectations. The EBA does not see a need to split the requirements into several implementation phases. The flexibility of implementation should be maintained by taking into account proportionality principles and the corresponding assessments of competent authorities. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING the guidelines would have to be implemented by the end of 2016 and which could implemented at a later stage. This is particularly important given the high number of stress test exercises and other regulatory requirements scheduled in 2016, such as the EBA stress test and the supervisory review and evaluation process (SREP)-related stress test. Another respondent mentioned that a two-month implementation period is too short for such a comprehensive stress testing programme. Another respondent mentioned that the EBA draft guidelines on stress testing contain a number of suggestions that could contribute to the further development of banks’ internal stress tests. At the same time, the guidelines are too detailed and too prescriptive in many cases and unduly reduce the amount of discretion and freedom essential in stress testing and thus cannot be applied flexibly enough. In some areas, the ideas appear to be guided too much by best practice and too little by the status quo of European banks. While supervisory proposals going beyond the status quo are, in principle, necessary and sensible for the further development of stress testing programmes in the medium term, they should not be prescribed as mandatory and relevant for SREP assessment from the fourth quarter of
2016. Further in-depth discussion with the industry on the
direction that this further development should take would be advisable. Institutions should be given enough time to further develop their stress testing internally through adequate implementation periods, since the new requirements go beyond the CEBS Guidelines on stress testing (GL32). The respondent therefore suggests making a distinction, as far as possible, in all areas of the guidelines

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING between requirements that have to be complied with, at a minimum (‘at least’), by the end of 2016 and further requirements. For these further requirements, staggered, gradual implementation over a period of several years should be specified. When setting the requirements that have to be complied with, at a minimum, from the end of 2016, it should be borne in mind that a large number of parallel stress testing requirements are currently set at national and international level (e.g. the EBA 2016 stress test, the SREP exercise, the internal capacity adequacy assessment process (ICAAP) and the internal liquidity adequacy assessment process (ILAAP)). Another respondent mentioned that banks might be required to undertake quite significant internal adjustments from both the organisational and the methodological development points of view (especially given the focus placed on some core aspects such as correlation, concentration and second-order effects, as well as the treatment of model risk). Therefore, the respondent would favour either a gradual phase-in of the guidelines or a later date of application than that currently envisaged. Proportionality One respondent mentioned that the current draft guidelines do not seem to consistently capture proportionality principles, since some abstracts in the guidelines would specifically mention proportionality considerations while others would not. To solve any uncertainty arising from this inconsistency, it would be helpful to explicitly emphasise the principle of proportionality under part 4 of the draft guidelines instead of having it only mentioned in part 1, the executive summary. The respondent would like to stress that proportionality considerations should apply not only to The principle of proportionality is mentioned not only in the Executive summary, but also in the Background and rationale and Institutions’ stress testing, including under Governance aspects of stress testing; Stress testing scope and coverage; etc.. The principle of proportionality is recognised and applies to all aspects of these guidelines, including the methodology, as well as the frequency and the degree of detail of the stress tests. The Background and rationale section and part 4 – Institutions’ stress testing — contain very clear statements on proportionality and No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING small banks but also to large banks that have very low risk profiles, for instance as is the case for promotional banks involved in the financing of low risk areas including social housing, municipalities, SMEs and export credits. Two respondents proposed that the guidelines could have specific risk area materiality thresholds for institutions that are required to apply the guidelines to stress testing each individual risk area. The first respondent is concerned that developing a comprehensive stress testing framework for risk areas to which a firm has immaterial exposure would be overly burdensome and provide little or no risk management information. The other respondent is concerned that, by definition, this could mean that Category 2 institutions could end up doing much the same as Category 1 institutions. Another respondent mentioned that despite the fact that the principle of proportionality has been integrated into the draft guidelines on several occasions, the respondent sometimes gets the impression that the methods for these stress tests have a wide scope and the tasks are relatively prolonged and complicated, with the potential for large faults. Thus, small banks might have a hard time fulfilling these requirements. The principle of proportionality could be used to an even greater extent in the guidelines. Another respondent mentioned that, as guidelines under Pillar 2, the entire stress testing guidelines should be applied with the principle of proportionality in mind. This is not always made clear enough in the wording of the guidelines, however. For example, some sections (2, 3 and 4) contain a proportionality proviso, others do not. In contrast, the Background and rationale section (pp. 6-8) accompanying the idea is to concentrate this subject at the beginning of the guidelines, recognising that proportionality is applicable to all aspects of these guidelines, in a similar way to other EBA guidelines, instead of repeating the same concept many times throughout the guidelines. These guidelines recognise the principle of proportionality by describing both quantitative and qualitative aspects of stress testing: small and less complex institutions may focus more on the qualitative aspects while larger or more complex institutions will require more sophisticated stress testing techniques. Moreover, regarding scope and coverage, stress tests should capture risks at various levels in an institution. In this regard, according to the proportionality principle, the scope of stress testing may vary from simple portfolio level sensitivity or individual risk level analyses to comprehensive institution-wide scenario stress testing. Furthermore, the proportionality principle is invoked in these guidelines to discuss the level of sophistication of the stress testing methodologies, practices and infrastructure required in relation to the size, structure and internal organisation (also taking
into account the nature, scope and complexity of activities) of an institution, always in connection with the SREP category to which that institution belongs.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING the guidelines contains a very clear statement on how proportionality could play out in smaller financial institutions. The respondent therefore suggested incorporating this section into the wording of the actual guidelines (from p. 10). Paragraph 57, too, contains an important statement on proportionality, which would gain in value by being applied to the guidelines as a whole. Another respondent asked how proportionality of institutions is defined (asset size, market capitalisation, etc.) and what forms the basis of the proportionality principle. Submission of information by institutions One respondent mentions that institutions are subject to multiple annual requirements (supervisory stress tests; ICAAP; ILAAP; recovery and resolution plans; business model analysis; and other ad hoc stress test requirements (e.g. in relation to Brexit)). The lack of an integrated supervisory approach in relation to the set of requirements creates the risk of overlap and inefficiencies in information submissions. Institutions will gain in efficiency if recovery planning, supervisory stress testing, institution stress testing and ICAAP/ILAAP are all integrated and consolidated in one unique submission. The EBA considers that general considerations regarding supervisory reporting and submission processes for different purposes do not fall within the scope of the guidelines. No change. Impacts of the changing prudential framework One respondent mentioned that the publication of this guidance by the EBA will be after the commencement of the 2016 EU-wide stress testing exercise and during a period of uncertainty regarding the overall direction of the prudential regulatory framework. The respondent urged the EBA to pause to reflect upon how this might affect the guidance. Another respondent mentioned that the requirements on stress testing for operational risk are formulated for all banks equally irrespectively of the approach applied to These guidelines do not prescribe the methodologies for supervisory stress tests and, more specifically, do not set the detailed methodologies for the stress tests conducted by the EBA in cooperation with other competent authorities. For the requirements on stress testing for operational risk, see the EBA analysis in section 4.7.4. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING assess the exposure to operational risk. In view of the recent debates of the BCBS regarding operational risks and the ongoing BCBS work streams on the standardised approach for operational risk, all stress testing considerations regarding operational risks should be dealt with at a later stage once the BCBS proposals and EU legislation have been harmonised. By doing so, additional adjustments could be avoided and a level playing field would be guaranteed. Operational risk and conduct-related risk and associated litigation costs Two respondents mentioned that the requirements on stress testing for operational risk and conduct-related risk are formulated separately, although conduct-related risk is included in the scope of operational risk as a part of legal risk. It is not clear why parts of the scope of operational risk should be considered separately for stress testing purposes and how such results should be integrated in the bank-wide stress testing scenarios. The separation of the scope for the quantitative assessment would also pose a particular challenge for banks using the advanced measurement approach (AMA) for operational risk because the relevant losses resulting from the legal risk or conduct-related risk events are considered within the AMA models often being developed and calibrated for the full scope of operational risk losses. Therefore, further clarification on regulators’ expectations regarding the structure of stress tests for operational risk would be highly appreciated. As it stands now, many requirements formulated in the consultation paper (e.g. the requirements of items 132 and 140) represent general requirements on the operational risk management process or the risk inventory process. Such requirements should be included in the operational risk management guidelines or general guidelines on ICAAP and Conduct-related risk is part of operational risk. For the purposes of the calculation of capital requirement, institutions do not calculate individual capital requirements for different subcategories. An institution can also follow this approach for stress testing. Nevertheless, if an institution follows a less sophisticated approach in Pillar 2, it might decide to or might be obligated to provide a more risk sensitive approach in Pillar 2 or in stress testing. In this case, an institution can decide to calculate either a combined impact or two individual impacts. The main purpose of section 4.7.5 is not to separate conductrelated risk from operational risk, as described in section 4.7.4, but to stress the importance of this sub-category. With regard to the perceived redundancy between several items and ICAAP requirements, the EBA believes that the requirements are not a repetition. In several aspects, they extend the perspective of stress testing beyond the persspective applied for Pillar 1 or for ICAAP. If certain aspects are repeated, this simply supports the
overall presentation of expectations within the stress test.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING should be excluded from the Guidelines on institutions’ stress testing (being part of ICAAP). Pre-provision net revenue (PPNR) One respondent mentions that the guidelines provide brief coverage on net interest income (NII) stress testing modelling. The EBA’s expectations on how to stress test PPNR items would be useful. The EBA considers that in a stress test exercise capital is negatively affected as the result of, for instance, credit rating migrations, a reduction of net interest margins or trading losses. Competent authorities should have access to the details of the institution’s main assumptions and risk drivers and should challenge these, also based on supervisory stress tests. The EBA considers that providing additional details on NII stress testing modelling could be useful. Paragraph 64 changed to provide additional details. Foreign exchange (FX) risk One respondent mentions that FX exposures and the associated risks have not been included in the guidelines, even though some institutions are exposed to these risks and already include the following in their stress testing:

investments in subsidiaries, branches and associates, the
functional currencies of which are currencies other than the currency of shareholder equity, and other qualifying liabilities used to calculate the overall capital ratio;
risk-weighted assets (RWAs) calculated in the functional
currencies, which are currencies other than the currency of shareholder equity, and other qualifying liabilities used to calculate to the overall capital ratio. Movement in the FX rate has an impact upon Common Equity Tier 1 (CET1) and overall capital ratio. The respondent believes that it may be helpful to include this in the guidelines to alert institutions to these risks, taking into account any hedging and or management actions. The guidelines establish and develop additional issues that have gained importance in the stress testing programme and need to be incorporated and properly defined, such as FX lending risk with a respective new section, in addition to other individual risk areas. Guidance on direct FX risk is developed throughout several parts (market risk, conduct-related risks and associated litigation costs, liquidity risk). No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Overlaps of guidelines One respondent mentioned that in order to avoid deviating requirements from different guidelines, any potential overlap of frameworks should be ruled out. The respondent strongly recommends separating general requirements on risk management frameworks from specific stress testing guidelines. For example, stress testing guidelines for operational risk (paragraph 132), conduct-related risk (paragraph 140) and recovery planning (paragraph 99) include general requirements for operational risk management processes. Such requirements should be removed from the stress testing guidelines to ensure a consistent risk management framework. The guidelines (paragraph 132) mention that, as operational losses may induce second-round effects (i.e. reputational risk), in order to account for such effects, the operational risk stress testing programme should be thoroughly integrated into the institution-wide stress test and should include interconnections with liquidity and own funds requirements. In addition, the guidelines (paragraph 140) mention that, in their stress testing, institutions should assess the relevance and significance of exposures to conduct-related risk and associated litigation costs (providing several examples to take into account in stress tests). Moreover, the guidelines (paragraph 99) mention that reverse stress testing should contribute to the recovery plan scenarios by using a dynamic and quantitative scenario narrative (providing examples of types of narratives that are necessary). Therefore, the paragraphs are not general requirements but specific to stress testing, despite some possible overlaps with risk management requirements. No change. Stress testing definition One respondent mentions that it cannot find an overall definition of the objective of stress testing. Another respondent mentioned that it is surprised that the taxonomy lacks a definition of the key term ‘stress test’. Such a definition should be included because various national supervisors have drafted their own definitions of a ‘stress test’. This definition should also make clear where stress scenarios stand in relation to the implicitly or explicitly used scenarios in ‘regular’ risk measurement. This question basically concerns all types of risk, but can be illustrated particularly well by taking operational risk as an example:
institutions that use the AMA must use scenario analyses as an element in the calculation of their own funds requirements. Where do stress scenarios for operational risk Stress testing is already defined throughout the Capital Requirements Regulation (CRR) – Stress tests used in assessment of capital adequacy (CRR, Part three, Title II, Chapter 3, section 6, sub-section 1, Article 177; CRR, Part three, Title II, Chapter 6,
section 6, Article 290; etc.).
The objective of stress testing is also defined throughout the guidelines for different types of stress tests, along with the corresponding definitions (e.g. solvency stress tests, liquidity stress tests, reverse stress tests) and generally based on the need to assess the resilience of institutions and banking systems to shocks and to challenge associated capital/liquidity positions. The guidelines mention several aspects that clearly define, among other issues, the objectives of stress testing, such as risk No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING stand in relation to AMA scenarios (when it comes to the frequency of occurrence, level of loss parameters, etc.)? management tools; the assessment of the resilience of institutions and banking systems; sets of specified changes in risk factors, corresponding to extreme but plausible events; scenario testing and sensitivity testing; risk models and associated assumptions; etc. These guidelines set out specific requirements for operational risk with dedicated sections for individual risk areas. Taxonomy – top-down stress tests and bottom-up stress test definitions One respondent mentioned that, in terms of stress testing techniques, institutions have a repertoire of stress testing approaches. A ‘bottom-up’ approach requires a high degree of data granularity and model segmentation, but simple ‘top-down’ approaches are also used, e.g. to respond to senior management requests for the rapid analysis of a fastemerging event. Institutions will at times employ a combination of approaches, taking into account materiality and proportionality. It would be beneficial for the guidelines to acknowledge that this is good practice. The respondent would prefer the generally accepted segmentation to be defined as ‘Institutional stress test’ and ‘Supervisory stress test’ to differentiate the scope. These guidelines provide a clear taxonomy precisely because there remains substantial ambiguity and overlap in several terms and definitions. The guidelines’ definition of ‘Bottom-up stress test’ sets out that this type of stress test is carried out by the institution. A ‘Topdown stress test’ is carried out by the competent authority or the macroprudential authority. These definitions have always been used at the EU level, for instance in the context of EU-wide stress test exercises. The same definitions apply to many competent authorities around the world, so current practices were taken into account. Institutions should use the guidelines’ definitions in communications with the competent authorities or the macroprudential authorities in order to provide a harmonised language that is not ambiguous instead of internal definitions developed by institutions. No change. Taxonomy – static balance sheet assumption and dynamic balance sheet assumption definitions On respondent mentioned that the assumptions are not truly ‘static’, in the sense that the balance sheet is constant through the projection period. The guidelines’ definition sets out the details of what changes are permitted and not permitted, what results institutions must include and exclude in specific types of stress test. The ‘static’ stress test is simply a specific stress test with a specific set of forwardThe guidelines refer to ‘static balance sheet’ as a methodological assumption according to which the impact of the stress test scenarios is to be measured on the basis of a hypothesised ‘constant balance sheet’ and an ‘unchanged or stable business
model’ throughout the projection period, enhancing the comparability of the results across institutions. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING looking scenarios. Equally, an institution may conduct stress tests with restrictions on the projected evolution of the balance sheet and so may not be dynamic in all respects. The respondent would prefer that the term and definition ‘static balance sheet assumption’ be replaced with the term ‘EBA assumptions’, and that ‘dynamic balance sheet assumption’ be replaced with the term ‘institutional assumptions’. The guidelines refer to ‘dynamic balance sheet’ as a methodological assumption according to which the impact of the stress test scenario is to be measured based on the possibility of a ‘non-constant balance sheet’ and an ‘evolving business model’ throughout the projection period. The EBA agrees that an institution may conduct stress tests with restrictions on the projected evolution of the balance sheet and so may not be dynamic in all respects. However, this does not change the main characteristics that define both terms. Taxonomy – reverse stress test One respondent mentioned that it does not agree that, as stated under Definitions/taxonomy, point (10), sub-point iii, it is the responsibility of ‘the institution to decide on the kind and timing (triggering events) of management or other actions necessary both for rectifying business failures or of other problems and for aligning its risk appetite with the actual risks revealed by the reverse stress testing’. The respondent considers that management have a duty to consider the risk appetite but not necessarily align it to the results of the stress test. The respondent considers that the actions to be taken in resolution (failure) are the competent authorities’ responsibility. The same respondent also mentioned that, rather than state in point (10), sub-point iv, that ‘specific reverse stress testing can be also applied in the context of recovery planning’, it would make more sense to explain that reverse stress testing should be seen as an analytical technique and that it is therefore separate from recovery stress testing and resolution planning, but can be used to inform a recovery The guidelines mention that a reverse stress test is an institution stress test that starts from the identification of the pre-defined outcome (e.g. the point at which an institution business model becomes unviable, or at which the institution can be considered as failing or likely to fail within the meaning of Article 32 of Directive 2014/59/EU) and then explores scenarios and circumstances that might cause this to occur. Reverse stress testing has all of the following characteristics:
i. it is used as a risk management tool aimed at
increasing the institution’s awareness of its vulnerabilities by means of the institution explicitly identifying and assessing the scenarios (or combination of scenarios) that result in a pre-defined outcome;
ii. the institution estimates the likelihood of
these scenarios occurring;
iii. the institution decides on the kind and timing
(triggering events) of management or other actions necessary both for rectifying business failures or of other problems and for aligning Point (10) changed to clarify both the alignment with risk appetite and the use of reverse stress testing.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING plan stress test by identifying the conditions under which the recovery might need to be planned. Two respondents mentioned that sub-points i to iv are all attributable to reverse tests. However, this is questionable, and it would be preferable if ‘one or more’ could be used instead of ‘all’. its risk appetite with the actual risks revealed by the reverse stress testing;
iv. specific reverse stress testing can be also
applied in the context of recovery planning.
The EBA considers that it is the responsibility of the institution to decide (not necessarily a duty) on how to align its risk appetite with the actual risks revealed by the reverse stress testing. The sentence has been clarified by separating the items. The EBA considers that the definition presents a separation between reverse stress testing used in a wider context (e.g. risk assessment tool) and reverse stress testing used in specific contexts (e.g. recovery planning). The EBA considers that the definition could be clarified by mentioning that reverse stress tests applied in a wider context can be used to inform a recovery plan stress test by identifying the conditions under which the recovery might need to be planned. In addition, the items regarding characteristics can be one or more and the sentence has been changed accordingly. Taxonomy – secondround or feedback effects One respondent would appreciate clarification related to the guidance on the exact nature of feedback effects. The respondent currently considers macroeconomic feedback effects in scenario design and would welcome confirmation of the EBA’s intent in this area. The respondent would also like to highlight that the assessment of ‘spillover effects caused by the responses of individual institutions to an external shock’ does not seem feasible for an isolated institution. The respondent would expect such effects to be covered as part of the supervisory stress test. The guidelines mention that second-round or feedback effects refer to the spillover effects caused by the responses of individual institutions to an external original shock, which – in aggregate – generally amplify (or may also mitigate) such an original shock, thereby causing an additional negative feedback loop. The nature of feedback effects is not limited to macroeconomic effects. The EBA considers that the definition could be clarified by mentioning that the nature of feedback effects is not limited to macroeconomic effects. Paragraph 9, point (11), changed to clarify that spillover effects generally amplify the original shock (it may also mitigate). Paragraphs 76 and 101 changed to

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Two respondents mentioned that second-round or feedback effects generally lead to an intensification of the original shock. The respondent would assume, however, that a reduction of the original shock may also occur, and therefore suggests that the wording be adjusted accordingly. Another respondent mentioned the need to provide a clearer definition (and examples) of the somewhat overlapping terms ‘correlation’, ‘concentration’ and ‘second-round effects’ (as mentioned in paragraphs 101, 109, 132 and 156) and indications on how the guidelines expect them to be treated. In particular, would a quantitative treatment of second-round effects not be too prone to model risk to be of use? Another respondent mentioned that it would be helpful to provide an example of second-round or feedback effects. The EBA considers that spillover effects, at individual level, should be taken into account. The guidelines mention that institutions should make qualitative assessments of second-round or feedback effects of stress where appropriate and should take into account the impact of second-round effects in the individual risk for stress testing. The EBA considers that the corresponding paragraphs for institutions could be clarified by mentioning that the assessment is at individual level, i.e. not at aggregate level, and by providing an example. The EBA does not provide information on how the second-round effects should be treated by individual institutions (mentioning the use of qualitative assessments where appropriate, therefore reducing possible model risk) to avoid being too prescriptive. clarify that it is at individual level. Paragraph 12 Stress testing programme One respondent mentioned that it would be beneficial to provide some specific detailed examples of how to tackle the dynamic loop between liquidity stress tests and solvency stress tests. The guidelines mention that Institutions should have in place a stress testing programme that should cover at least, among other aspects, f) the methodological details, including models used and possible links between liquidity stress tests and solvency stress tests, namely the respective magnitude of such dynamic interaction and the capture of feedback effects. The EBA considers that the guidelines need to allow a sufficient degree of discretion (not providing specific detailed examples) with regard to possible links between liquidity stress tests and solvency stress tests and their dynamic interactions. No change. Paragraph 15 Stress testing programme One respondent asked the EBA to clarify the use of ‘respective scenarios’. Institutions should also include reverse stress testing and the respective scenarios (of the reverse stress testing) in their stress Paragraph 15 changed to provide

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING testing programme. The EBA considers that the sentence could be clarified by adding ‘reverse stress testing scenarios’. additional clarification. Paragraph 17 Annual review of institutions’ stress testing programmes One respondent considers it important to clarify who delivers the review and how the effectiveness of stress testing is measured. The guidelines mention that institutions should regularly assess their stress testing programme to determine its effectiveness, robustness and should update it as appropriate. The assessment should be made at least on an annual basis, on the basis both of a quantitative and a qualitative analysis and should fully reflect the changing external and internal conditions. The guidelines also indicate that institutions should ensure that their quantitative analysis includes sound backtesting tools to validate the assumptions, parameters and results of stress testing models; institutions should ensure that their qualitative analysis has recourse to expert judgements or benchmarking assessments. Therefore, the reviews and corresponding effectiveness and robustness are expected to be assessed through sound and independent backtesting tools, expert judgements or benchmarking assessments, with the same requirements used in other reviews developed by institutions. No change. Paragraph 18 Stress testing programme – backtesting Two respondents mentioned that the quantitative ‘backtesting’ of stress scenarios, in the case of the occurrence of extremely rare incidents, is difficult, so the term ‘plausibility of assumptions’ seems more appropriate in this context. The guidelines indicate that institutions should ensure that their quantitative analysis in accordance with the previous paragraph includes sound backtesting tools to validate the assumptions, parameters and results of stress testing models; institutions should ensure that their qualitative analysis in accordance with the previous paragraph has recourse to expert judgements or benchmarking assessments. The EBA considers that, in general, quantitative analysis should include sound backtesting tools to validate the assumptions, parameters and results of stress testing models. In cases of extremely rare incidents, the plausibility of assumptions can also No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING be covered by qualitative analysis (see the second part of paragraph 18) if well justified by the institution. Paragraph 20 (previously paragraph 21) Stress testing programme – documentation Two respondents mentioned that while the requirements of the stress test programme documentation are considered valid, it would still be important to give enough scope for flexibility when carrying out case-based stress tests. However, the very detailed documentation, as specified under paragraph 21, may have a counterproductive effect. These two respondents mentioned that it is, therefore, recommended that institutions are given more freedom and a broader scope for case-based stress tests. One of the respondents also mentioned that it should be made clear in paragraph 21, point d), that only IT applications that are used additionally and exclusively for stress testing should be included. Where a central inventory exists, reference can be made to it. Another respondent mentioned that there is also a concern that properly and thoroughly documenting all aspects of all types of stress tests within the programme might represent an enormous and partially redundant task. Some indications relating to the form the documentation of the stress test programme should take might be helpful in this respect. The respondent believes that if supervisory expectations are for a sort of single ‘Stress Test Book’, where policies, procedures and methodologies supporting all stress test types at all levels are covered, a concept similar to that of the Readers’ Manual recently introduced in the EBA draft guidelines on ICAAP/ILAAP information collected for SREP purposes might prove beneficial. One respondent mentioned that the significant granularity as well as the comprehensiveness of the guidelines – which The guidelines mention that institutions’ stress testing programmes should be appropriately documented. Documentation should cover at least: (a) the stress testing approach; (b) the roles and responsibilities as determined in the internal policy and processes for at least the performance of the stress testing programme; (c) a description of the entire process of designing, approving, performing, monitoring the performance and periodically assessing the stress testing programme and its outcomes; (d) a description of the processes for evaluating stress testing outcomes, including details of areas with manual or judgemental parts, also of the process for using the results for informing management actions and the strategy of the institution; and (e) a description and inventory of the relevant IT applications used for stress testing. The stress testing programme should cover and document all types of stress tests carried out at the single risk type and/or portfolio level as well as firm-wide exercises. Case-based stress tests are difficult to define and should be considered as other stress test exercises. The EBA considers
that the paragraph could be clarified. Ifstress tests carried out at the first level of analysis are an integral
part of risk management and are detailed in the corresponding
risk management frameworks, the documentation regarding the stress testing programme can make clear references to such information from other sources. The same is applicable to firmwide stress tests carried out in ICAAP/ILAAP and in the recovery plan process. Paragraph 20 (previously paragraph 21) changed to clarify that documentation covers all types of stress tests with a description of the relevant IT applications used for stress testing.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING cover stress tests at all levels of the organisation – require both some clearer indications of what the scope and the depth of the stress test programme should be (especially for Category 1 banks) and some careful coordination with other supervisory requests. The same respondent asked if the programme should cover and document all types of stress tests carried out at the single risk type and/or portfolio level as well as firm-wide exercises or should it just focus on the latter. Stress tests carried out at the first level of analysis are generally an integral part of risk management so that measurement of the various individual risk types and their related policies, procedures and methodologies are therefore detailed in the corresponding risk management frameworks. Would encompassing them within the stress test programme not represent just a duplication? At the other end of the spectrum, firm-wide stress tests largely overlap with the stress tests carried out as part of ICAAP/ILAAP and in the recovery plan process and as such they also represent a risk of consistency and duplication. The EBA considers that all relevant IT applications should be described and not only IT applications that are used additionally and exclusively for stress testing. There are always important links that are not exclusive for stress testing that need to be mentioned or referenced in the documentation on the stress testing programme. Paragraph 21 Stress testing programme – business units One respondent noted that the consultation requires that business units not responsible for the design and application of the programme and/or non-involved external experts should play a key role in the challenging process of the stress testing programme. The respondent understands that the stress testing programme should be reviewed by all internal control units, such as the internal audit unit. These areas are considered independent from those that are responsible for the development of the stress testing programme. However, it would make no sense to involve areas that do not have any technical expertise with respect to the design of stress testing in this assessment process. In that vein, the respondent recommends that EBA clarify exactly what it The guidelines mention that the stress testing programme should be challenged across the organisation. Business units not responsible for the design and application of the programme and/or non-involved external experts should play a key role in the assessment of this process. The intention to involve business units not responsible for the design and application of the programme is based on the need for an independent process to challenge different subjects. The EBA understands that not only the internal audit unit but also other business units should challenge the process. A stress testing programme is transversal to the organisation. The challenge is not Paragraph 21 changed to
clarify that other business units should challenge the process throughout taking into account the relevant expertise for specific subjects.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING means by units not responsible for the design and application of the programme and non-involved external experts. In addition, that those areas that must be involved in the assessment process should be those that show significant expertise should be specified. Another respondent mentioned that the key role of the business units when challenging the stress testing programme, as stated in paragraph 22, appears unfeasible, especially as it hardly seems realistic that, as first lines of defence, individual business units could scrutinise overriding issues in their entirety. This requirement should be amended. Another respondent noted that paragraph 22 mentions the key role of non-involved external experts in the yearly assessment of the stress testing programme and paragraph 61 makes reference to the expert review of models’ assumptions. The respondent asks if an independent external review of all aspects of the programme is required or whether this could equally be performed by internal control or audit functions. only about the design of the stress testing programme but about the different subjects of a programme. It is not necessary to have an independent external review if the institution believes that the necessary challenge could be performed equally well by business units not responsible for the design and application of the stress testing programme or by internal control or audit functions. Nevertheless, the paragraph could be clarified in order to take into account the relevant expertise for specific subjects and not expertise about stress testing programmes. Paragraph 23 Governance aspects of stress testing – involvement of management body One respondent mentioned that while the management body will stipulate scenarios and have key results reported to it, its full involvement in the design and implementation of a stress testing programme is not practicable for large and complex institutions. The involvement of the management body should be inversely proportionate to the size of an institution: the larger the institution, the more the stress testing programme will be delegated to senior management and committees. The definition of ‘management body’ The guidelines mention that institutions should ensure that their management body has the ultimate responsibility for approving the stress testing programme of the institution and monitoring its performance. The term ‘management body’ is already defined in other regulatory products. The guidelines do not mention the need for full involvement regarding implementation. The guidelines mention, among other issues, that the management body of the institutions should ensure that clear responsibilities and resources are assigned for the execution of the programme. This includes, for instance, the No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING should therefore also cover dedicated stress testing committees. delegation of implementation to senior management and stress testing committees. Paragraph 25 (previously paragraph 26) Governance aspects of stress testing – discussion of necessary management actions with the competent authorities Two respondents mentioned that according to paragraph 26, management actions should be discussed with the relevant supervisor. However, it should be clarified that, in this regard, the management body must be in the position to only explain such ‘actions’, and that these do not need to be approved ex ante by the supervisor. One respondent asked why external consultants responsible for stress testing are mentioned. It considers that this is irrelevant with regard to the subject of these guidelines. The guidelines mention that institutions should ensure that their management body holds an understanding of the material aspects of the stress testing programme that enables it to: (a) actively engage in discussions with stress testing committees of the institutions, where applicable, or with senior management or external consultants responsible for stress testing; (b) challenge key modelling assumptions, the scenario selection and the assumptions underlying the stress tests in general; and (c) decide on the necessary management actions and discuss them with the competent authorities. The guidelines mention that the management body of an institution should hold an understanding of the material aspects of the stress testing programme that enables it to decide on the necessary management actions and discuss them with the competent authorities, without mentioning possible ex ante approval. The EBA does not consider the reference to external consultants responsible for stress testing irrelevant when referring to governance and management body responsibilities. No change. Paragraph 31 Outputs of stress tests as an input to an institution’s risk appetite and limits One respondent mentioned that this paragraph could be clarified to better distinguish the expectations in terms of inputs and outputs of stress tests. One respondent mentioned that the purely quantitative use of the outputs would be neither appropriate nor easy to implement. It advocated the use of qualitative outputs as additional inputs for risk appetite and limits. The guidelines mention that the outputs of stress tests should be used as inputs to the process of establishing an institution’s risk appetite and limits. The EBA considers that a reference to qualitative outputs could be added. Paragraph 31 changed to clarify that both quantitative and qualitative outputs should be used.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Paragraph 34 Data infrastructure – adequate One respondent mentioned that it would much prefer a revision of thissection to state three things: (a) confirmation that the EBA agrees with BCBS239 and regards it as binding for institutions and supervisors; (b) clarification of where compliance is not required; and (c)supplementary guidance. The guidelines mention that an institution should ensure that its stress testing programme is supported by an adequate infrastructure. The EBA considers that the intention is to refer to BCBS239 as a reference of best practices to which banks are expected to adhere and the requirements in this section extract high level applications to stress testing. Compliance with BCBS239 is out of the scope of these guidelines. No change. Paragraph 34 (previously paragraph 35) Data infrastructure – data aggregation and risk reporting Two respondents mentioned that paragraph 35 makes reference to the BCBS principles for effective risk data aggregation and risk reporting. However, the scope of application of these BCBS principles is restricted to systemically important banks (SIBs). Other institutions do not need to take this into account and this should be made clear in the text. The guidelines mention that, to ensure that a proper data infrastructure has been put in place, institutions should endeavour to also refer, to the extent appropriate, to BCBS principles for effective risk data aggregation and risk reporting. This also applies to other institutions with the appropriate degree of proportionality and not only to SIBs. The EBA considers that the paragraph could be clarified. Paragraph 34 (previously paragraph 35) changed to clarify that this also applies to other institutions (i.e. non-SIBs). Paragraph 46 (previously paragraph 47) Data infrastructure – reporting practices for stress testing purposes Two respondents mentioned that, according to paragraph 47(b), the institutions should make sure that the results of the stress test reflect the banking risks ‘in an exact manner’. According to the respondent, this is not possible for either risk measurement under normal market conditions or risk measurement under stress conditions, because each quantitative risk assessment is individual and subjective to a certain extent. It is therefore suggested that this passage be removed. The guidelines mention that institutions should ensure that their risk reporting process: (a) is completely supported by data aggregation capabilities; (b) accurately and precisely conveys aggregated risk data and reflects risk in an exact manner; (c) covers all material risks and, in particular, allows the identification of emerging vulnerabilities that could potentially be further assessed even in the same stress testing exercise; (d) offers or is able to offer additional information regarding main assumptions, tolerance levels, or caveats; and (e) communicates information in a clear and
concise manner including meaningful information tailored to the needs of the recipients. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING The fact that stress test data are estimations does not preclude them from being reported accurately in terms of risk aggregation. Paragraph 47 Stress testing scope and coverage – general requirements (off-balance-sheet assets) One respondent asked what materiality level is expected for off-balance-sheet items. The guidelines mention that stress tests should take into account all the material risk types and cover both on- and off-balancesheet assets and liabilities of an institution including relevant structured entities. Institutions should ensure that risk data also fully capture offbalance-sheet risks and are easily attainable at any level of the institution. Materiality, in terms of current and potential risk, should be factored in, without an expected specific level. No change. Paragraph 49 (previously paragraph 50) Stress testing scope and coverage – general requirements (correlations) One respondent noted that correlations that tend to increase during times of economic or financial distress might happen and might not happen. The respondent thinks it would be better to phrase the guidance as ‘during times of economic or financial distress institutions should take into account that correlations may be different to those currently or historically observed’. Two respondents disagreed that correlations tend to increase during times of stress and need to be analysed on a case-by-case basis. Another respondent mentioned ‘How does the requirement to specifically consider risk factors’ correlations (and their changes, paragraph 50) in the stress test programme tie in with the indication that these would not be taken into account by supervisors when assessing the ICAAP results?’ The guidelines mention that stress tests should also take into account that correlations tend (i.e. not always but in general) to increase during times of economic or financial distress. The EBA agrees that correlations may be different from those currently or historically observed; however, it prefers to emphasise that correlations tend to increase during times of economic or financial distress rather than mentioning that correlations may be different. A reference mentioning the need for case-by-case analyses of how certain correlations behave in certain scenarios could be added. There are several indications suggesting that correlations should be taken into account. Paragraph 49 changed to clarify that case-by-case analyses should be used.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Paragraph 50 (previously paragraph 51) Stress testing scope and coverage – portfolio and individual risk level stress testing One respondent mentioned the need to limit stress testing to ‘material’ risks. One respondent mentioned that the paragraph seems to suggest that the individual portfolio level corresponds to the business unit level. The guidelines do not specify the regulatory expectations with respect to individual portfolio level stress testing. The respondent would therefore welcome further clarification of this definition, as well as the specific regulatory expectations in this area. The guidelines mention that institutions should perform stress tests on an individual portfolio level basis, covering all risk types that affect these portfolios, using both sensitivity and scenario analyses. The EBA considers that institutions should not limit stress testing to material risks, as this may risk excluding one of the possible purposes of the stress tests, i.e. the identification of potentially underestimated (and non-material) risks. Institutions should also identify risk factors and their adequate level of stress, wherever possible, at the level of an individual portfolio. The guidelines also provide a definition in the taxonomy mentioning that a portfolio level stress test is a stress test of individual or several portfolios with the focus on the implications of the shocks from a single risk factor or multiple risk factors. Stress tests should capture risks at various levels in an institution. In this regard, according to the proportionality principle, the scope of stress testing may vary from simple portfolio level sensitivity or individual risk level analyses to comprehensive institution-wide scenario stress testing. See the section on portfolio and individual risk level stress testing for more details. No change. Paragraph 53 (previously paragraph 54) Stress testing scope and coverage – Institution-wide stress testing (group level) One respondent mentioned that paragraph 54 calls for stress testing also at group level. For complex institutions, this imposes a considerable burden. The requirement should thus be confined to entities whose risks are material in a group context. This is also in line with the supervisory assessment under paragraph 221. Such entities are also covered at individual level. One respondent requested more details and examples. Item (b) (i.e. correlations, offsetting of individual exposures and concentrations may lead to either the double counting of The guidelines mention that, in order to deliver a complete and holistic picture of the institution’s risks, in addition to stress tests on the level of single entities, stress testing should also be conducted at the group level and across portfolios and individual risk types. The guidelines also mention that it should be taken into account that (a) risks at the institution-wide level may not be well reflected
by a simple aggregation of stress tests on portfolios, individual risk areas or business units of the group; (b) correlations, offsetting of No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING risks or to an underestimation of the impact of stressed risk factors) could be removed and developed in a new paragraph. individual exposures and concentrations may lead to either the double counting of risks or to an underestimation of the impact of stressed risk factors; and (c) specific group risks may arise at the institution-wide level and, therefore, institutions should ensure that all material risks and their corresponding risk factors are also to be identified at an institution-wide level; when looking at risks at an institution-wide level, particular attention should be paid to risk concentrations on a holistic basis. The EBA considers that the requirement is not confined to entities whose risks are material in a group context. The group stress testing programme should include and address, to the extent appropriate, all institutions subject to consolidation (paragraph 14). The EBA considers that item (b) needs to continue to be part of the current paragraph. The EBA considers that the guidelines need to allow a sufficient degree of discretion (not providing specific detailed examples) with regard to possible correlations, offsetting of individual exposures and concentrations. Paragraph 55 Stress testing scope and coverage – institution-wide stress testing (group level) One respondent mentioned that a list of priorities should be given, as the application of a stress testing programme to business lines and sectors requires an overhaul in information systems. The guidelines mention that a group or an institution that is internationally active should also perform stress tests at the level of business units in specific geographical regions or business sectors or business lines to account for differing risk factors in different businesses and regions. Possible third-country legal restrictions on bank secrecy should be considered by the institution beforehand. The EBA considers that the guidelines need to allow a sufficient degree of discretion and that a list of priorities is not necessary. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Paragraph 59 Stress testing types – General requirements One respondent mentioned that the general treatment of the stress test types, out of the context of the specific individual risks, does not signal clearly what the supervisory expectations are with respect to the use of the various stress test techniques. The respondent has the following question:
‘specifically, is it expected that both sensitivity analysis and scenario analysis are used at all stress testing levels and for all risk types?’ The respondent mentioned that if this were the case, it would seem an inappropriate requirement, as certain types of analyses are better suited to certain types of risks (e.g. sensitivity analysis is a common practice for market risk and IRR, but not for other risks such as credit risk). The guidelines mention that the specific design, complexity and level of detail of the stress test methodologies should be appropriate to the institution’s size and complexity and should take into account the strategy and business model, as well as models and portfolio characteristics of the institution. The guidelines also mention that institutions should conduct sensitivity analyses at the level of individual exposures, portfolios or business units, institution wide, and for specific risk types as proportionate to their complexity. The EBA considers that institutions should assess at which aggregation level sensitivity analyses are meaningful or even feasible. So, it is not expected that both sensitivity analysis and scenario analysis are used at all stress testing levels and for all risk types, unless meaningful, feasible and appropriate for the institution’s complexity and the type of risks. No change. Paragraph 62 Stress testing types – benchmarks from external sources One respondent mentioned that the guidelines should clarify exactly which external sources it refers to. The guidelines mention that the link between stressed risk factors and the risk parameters should not only be based on institutional historical experience and analysis, but should be supplemented by benchmarks from external sources and when possible from supervisory guidance. The EBA considers that it is overly prescriptive to express specific external sources. Nevertheless, the paragraph could be clarified to refer that such a possibility should be used when available. Paragraph 62 changed to clarify that benchmarks from external sources should be used when available. Paragraph 64 Stress testing types – shortcomings of models One respondent mentioned that the guidelines indicate that ‘shortcomings of models’ should ideally be compared with alternative modelling approaches. According to the respondent, in practice, this would require banks to develop and implement alternative models for virtually all material The guidelines mention that the shortcomings of models and mechanisms that link risk factors with losses or increased risk parameters should be understood, communicated clearly and taken into account when interpreting results. Where possible, results for different modelling approaches should be compared. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING risk models. The respondent considers this requirement to be unnecessarily burdensome and would suggest deleting this requirement. The links should be based on robust statistical models. However, if data availability or quality or structural breaks in historical data do not allow for meaningful estimates, quantitative analyses should be supported with qualitative expert judgements. The EBA considers, and it is mentioned in the guidelines, that the results should be compared whenever possible. In addition, the guidelines also mention alternatives such as qualitative expert judgement. Paragraph 66 Sensitivity analysis – impact of nonlinearities One respondent mentioned that the guidelines are too prescriptive. The respondent suggested the following text:
‘institutions should identify the impact of nonlinearities, and threshold effects in their portfolio’. The guidelines mention that institutions should assess possible non-linear interactions between risk factors and stressed risk parameters. The EBA considers that the current draft is sufficiently flexible on how to assess the impact. No change. Paragraph 66 Sensitivity analysis – group level One respondent mentioned that it supports the requirement to use sensitivity analysis at the risk type and the portfolio level; however, it considers that it will be a challenge to perform a sensitivity analysis at group level taking into account that such an analysis requires the use of various models and risk engines across all risk types. The respondent would therefore appreciate it if institutions were permitted to decide at which aggregation level sensitivity analyses would be meaningful or even feasible. Another respondent mentioned that sensitivity analyses have to be performed at the level of individual exposures and portfolios, and institution wide (paragraph 64). In addition, different degrees of severity should be calculated. The required sensitivity analyses would thus be multiplied if different degrees of severity have to be analysed at several levels. In addition, there are multi-risk factor analyses, The guidelines mention that institutions should conduct sensitivity analyses at the level of individual exposures, portfolios or business units and institution wide, and for specific risk types as proportionate to their complexity. The paragraph could be clarified by mentioning that institutions should assess at which aggregation level sensitivity analyses are meaningful or even feasible. Paragraph 66 changed to clarify sensitivity analysis at group level.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING although these are not for defining stress scenarios (paragraph 68). If different degrees of severity and different levels are to be considered here, too, the number of analyses required would increase many times over. Paragraph 68 Sensitivity analysis – changes in correlations One respondent mentioned that the guidelines imply that there are thresholds – cliff effects – beyond which correlations and risks change in a stepped way or the slope of the changes may be broken. The respondent mentioned that it is possible that changes in correlation and risk profiles could occur for other reasons without changes in the severity of a scenario. The guidelines mention that the institutions should define the risk factors identified using different degrees of severity as an important step in their analysis to reveal nonlinearities and threshold effects, i.e. critical values of risk factors beyond which stress responses accelerate. The EBA considers that, in the context of sensitivity analysis, the usage of different degrees of severity, which is not restricted to the scenario, is essential in order to take into account the effect of nonlinearities. Other sources of nonlinearities are expected to be considered when carrying out the analysis at different degrees of severity. No change. Paragraph 69 Sensitivity analysis – use of statistical aspects One respondent mentioned that, within the existing portfolio of risk for an institution, there will be material risk for which it is not possible to determine a probability distribution that can be modelled. In fact it is likely that the BCBS will soon issue guidance on portfolios that it does not think can be modelled. The respondent acknowledged the recognition of the use of expert judgement (paragraph 93), but recommends that the EBA review its guidance with regard to the dependency on statistical probability distributions to assess the plausibility of scenarios. The guidelines mention that, where there are uncertainties about the robustness of estimated dependency between macroeconomic/macrofinancial risk factors and risk parameters or a need to validate the results of more comprehensive scenario analyses, institutions should endeavour to ensure that sensitivity analyses are also carried out by stressing statistical aspects of portfolio risk parameters according to historical distributions supplemented by hypothetical assumptions (e.g. with respect to future volatilities). As acknowledged by the respondent, the guidelines recognise the use of expert judgement (e.g. paragraph 93). Paragraph 69 changed to clarify the possible use of expert judgement.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING The EBA considers that paragraph 67 could clarify the possible use of expert judgement. The institution should provide details whenever applicable. Paragraph 73 (previously paragraph 71) Scenario analysis – use of data One respondent mentioned that the guidelines are too prescriptive in terms of what data should be used and should provide instead the direction ‘to use data that is relevant and available. Relevant data may be internal and/or external and incorporate benchmarking and supervisory guidance’. The respondent mentioned that the guidelines presume that each institution can identify another institution with similar risks and similar business models and that this would require an in-depth knowledge of competitors and their plans. The respondent mentions that this is an unrealistic assumption and places an expectation that may be unachievable. The respondent encourages the EBA to review this guidance. Two respondents mentioned that, according to paragraph 71, external data should also be included in the analysis – where possible – as part of the scenario analysis. The respondent doubts, however, that it is possible to obtain external data from a bank with a ‘similar risk environment’ and ‘similar business model’. This usually involves strictly confidential data, so this requirement should be deleted. The guidelines mention that the design of the stress test scenarios should not only be based on historical events, but should also consider hypothetical scenarios, based on non-historical events. Institutions should ensure that scenario designs are forwardlooking and take into account systematic and institution-specific changes in the present and foreseeable future. For that purpose, institutions should endeavour to have recourse to external data from similar risk environments relevant for institutions with similar business models. The EBA considers that the paragraph could be clarified by mentioning that data that are relevant and available should be used. Relevant data may be internal and/or external and incorporate benchmarking and supervisory guidance. Paragraph 73 (previously paragraph 71) changed to provide clarification regarding the use of data. Paragraph 74 (previously paragraph 72) One respondent mentioned that sensitivity analyses have to be performed at the level of individual exposures, portfolios and institution wide (paragraph 64). In addition, different degrees of severity should be calculated. The required sensitivity analyses would thus be multiplied if different The paragraph could be clarified by mentioning that institutions should consider a range of scenarios encompassing different events and degrees of severity when meaningful or even feasible. Paragraph 74 (previously paragraph 72) changed to provide clarification

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Scenario analysis – range of scenarios degrees of severity have to be analysed at several levels. In addition, there are multi-risk factor analyses, although these are not for defining stress scenarios (paragraph 68). If different degrees of severity and different levels are to be considered here, too, the number of analyses required would increase many times over. One respondent mentioned that the requirements for stress test scenarios will increase the number of analyses many times over if, again, different events and degrees of severity are to be considered (paragraph 72). regarding the range of scenarios to be considered when meaningful or even feasible. Paragraph 75 (previously paragraph 73) Scenario analysis – requirements One respondent mentioned that if the guidelines consider it necessary to clarify the scope of a plausible scenario, it would be preferable if the word ‘non-paradoxical’ could be replaced with an antonym of ‘paradoxical’ such as ‘easy’, ‘simple’, ‘clear’, ‘discernible’, ‘evident’ or ‘homogeneous’, all of which are easier to understand. Two respondents mentioned that according to paragraph 73, the scenarios should at least have characteristics as listed under (a) to (f). The characteristic listed under (e) in particular is far too ambitious (innovation, technological developments, sophisticated financial products), and should therefore not come into force by the end of 2016. The guidelines mention that institutions should ensure that their stress test scenarios meet at least the following requirements among others: (c) include a coherent narrative for the scenario, covering all relevant risk factors as well as their (forward-looking) development on the basis of multiple trigger events (i.e. monetary policy, financial sector developments, commodity prices, political events and natural disasters); institutions should ensure that the narrative scenario is plausible and non-paradoxical when assuming the co-movement of risk factors and the corresponding reaction of market participants; and, where certain risk factors are excluded from the narrative scenario, institutions should ensure that this exclusion is fully justified and documented; (…). The EBA considers that the paragraph could be clarified by using the synonymous word ‘non-contradictory’ for ‘non-paradoxical’. Regarding item (e), the guidelines mention that institutions should ensure that their stress test scenarios take into account innovation and more specifically technological developments or sophisticated financial products without disregarding their interaction with more traditional products. Paragraph 75 (previously paragraph 73) changed to provide clarification regarding one term.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING The EBA considers that it is not too ambitious that stress test scenarios take into account innovation, technological developments and sophisticated financial products. The EBA understands the challenges with regard to the further development of stress testing programmes based on best practices and that these go beyond the status quo for many institutions. The EBA recognises that institutions after the application date will continue to develop and enhance their systems and processes to meet supervisory expectations. The EBA does not see a need to split the requirements into several implementation phases. The flexibility of implementation should be maintained by taking into account proportionality principles and the corresponding assessment of competent authorities. Paragraph 75 Scenario requirements One respondent mentioned that, for item (a), the use of the terms ‘main risk factors’, ‘material risk factor’ and ‘relevant risk factors’ should be clarified. One respondent asked if the material risk factors should be identified under the internal risk cartography. The guidelines mention that institutions should ensure that their stress test scenarios meet, at least, among other aspects, the following requirement:
a) address the main risk factors that the institution may be exposed to; in this regard, the results obtained from single risk factor analyses, which aim to provide information about the sensitivity towards single risk factors, should be used to identify scenarios that include a stress of a combined set of highly plausible risk factors; no material risk factor should be left unstressed or unconsidered; (…). The EBA considers that the term ‘relevant risk factors’ could be changed to ‘main risk factors’. The EBA considers that the identification of material risk factors is a natural consequence of the mentioned requirements. In addition, institutions could provide more details if they consider such information (e.g. identification under the internal risk cartography) necessary. Paragraph 75 changed to provide clarification regarding one term.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Paragraph 79 (previously paragraph 77) Severity of scenarios – concept One respondent mentioned that it considers that inclusion of the qualification ‘exceptional’ to be unnecessary. Another respondent noted that the guidelines cover several types of stress testing with different degrees of severity (e.g. ICAAP/ILAAP stress tests; reverse stress testing; supervisory stress tests). Concepts of severity and plausibility of scenarios are included but not quantified objectively. Two respondents mentioned that the degree of severity of the stress test is defined in paragraph 9(12): Severity of scenario. However, there is no uniform system with which to determine the degree of severity. Because of the qualitative nature of the stress test, it is questionable as to whether a uniform assessment scheme can exist. The degree of severity of the stress test is therefore only measurable and comparable to a limited extent. In order to prevent the risk of the unfair treatment of institutions arising, more accurate information on the degree of severity would be useful. One respondent mentioned that, in paragraph 77(a), it is expected that the analysis of the stability of the financial system will be included in the scenario analysis. However, the respondent considers this rather to be a duty of the supervisor, and not of the bank. In addition, the respondent considers that it would be difficult to meet the requirements, because of insufficient or missing data. According to the respondent, this passage should therefore be removed. The guidelines mention that institutions should ensure that stress testing is based on exceptional but plausible events with an adequate degree of severity. For that purpose, stress tests should be: (a) meaningful in terms of providing the appropriate type of information with a view to promoting the stability of the institution and, when relevant, the financial system at all points in the economic cycle and over market fluctuations including funding markets; and (b) consistently applied across the institution, recognising that identical scenarios are not necessarily severe for all business lines. The EBA considers that the inclusion of the qualification ‘exceptional’ is necessary to express the type of events of a scenario and the corresponding severity; however, it could be changed to the word ‘severe’. The EBA considers that the taxonomy provides definitions for both severity and plausibility (and also anchor scenarios). Several requirements are provided to assess the level of severity. The degree of deterioration of the scenario (from baseline to adverse scenario) should be expressed in terms of the underlying macroeconomic and financial variables (or any other assumptions). The greater the severity of the scenario, in general, the larger the impact of the stress test on the institution, thereby determining the actual severity of the stress test. Given the different purposes
and types of stress testing, the level of severity is not quantified objectively but presented throughout by the use and assessment of several requirements (e.g. the reference to possible anchor scenarios usually designed by a competent authority to set the severity standard for a particular stress test; the use of a range of scenarios encompassing different Paragraph 79 (previously paragraph 77) changed to provide clarification regarding one term.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING events and degrees of severity, covering at least one severe economic downturn; awareness of the dynamics of risk environments and of experiences of institutions with similar business models; in an absolute scenario the degree of severity should not depend on the current economic situation (e.g. GDP growth is set to decrease by 2%); in a relative scenario, the degree of severity should depend on the current economic situation (e.g. GDP growth decreases by 2%]. The EBA considers that the analysis of the stability of the financial system should be included in the scenario analysis and that it is a duty of an institution and not only a duty of a competent authority. Paragraph 80 Severity of scenarios – severe economic downturn One respondent mentioned that the guidelines should clarify the features of the downturn scenario. In particular, it is necessary to clearly define the aspects that would differentiate the downturn scenario from the adverse scenarios already considered in the stress testing programme. It is worth noting that a downturn scenario of low likelihood would be of limited usefulness to management. The guidelines mention that institutions should ensure that various degrees of severity are considered for both sensitivity analysis and scenario stress testing covering at least one severe economic downturn for the assessment of capital adequacy and capital planning purposes. A severe economic downturn appears through many dimensions of an economic system and it is out of the scope of the guidelines to describe all the possible features. No change. Paragraph 82 (previously paragraph 80) Severity of scenarios – assessment of absolute or relative changes in risk factors Two respondents mentioned that, in paragraph 80, it is indicated that it is permitted to focus on the current economic situation in only relative scenarios, not in absolute scenarios. This differentiation is hard to understand, and should be discontinued. It is helpful to consider the current situation for both types, so as to assess the severity of the scenario. Another respondent mentioned scenarios are normally set taking into account current economic conditions and The guidelines mention that institutions should ensure that their scenarios assess absolute or relative changes in risk factors. In an absolute scenario, the degree of severity should not depend on the current economic situation (e.g. GDP growth is set to –2%). In a relative scenario, the degree of severity should depend on the current economic situation (e.g. GDP growth decreases by 2%). In that case, the worse the current economic situation the more severe the stress of a relative scenario. Institutions should ensure that their choice of the scenario is sufficiently severe in both Paragraph 82 (previously paragraph 80) changed to provide clarification regarding absolute or relative changes in risk factors.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING therefore asked ‘what does it mean that the choice of scenarios should be sufficiently severe both in relative and in absolute terms? Could an example be provided?’ relative and absolute terms. Both the choice and its impact on the degree of severity should be justified and documented. The paragraph refers to absolute or relative changes of risk factors. For relative scenarios, the variations (e.g. growth decreases by 2%) are dependent on the current level and economic situation (i.e. it should be a relative change applied to the absolute level of the risk factor). For absolute scenarios, the variation should be a direct change of the absolute level of the risk factor. The EBA considers that the paragraph could be clarified. Paragraph 84 Reverse stress testing – requirements, general use, and use for recovery actions and planning One respondent mentioned that it would be clearer to have separate sections on (a) recovery plan stress testing (neardefault), ideally cross-referring to specific details in other papers, and (b) general guidance on reverse stress testing as a stress testing technique. This in turn would result in definitions for the scope of recovery plan stress testing and reverse stress testing more generally. The guidelines mention that reverse stress testing should be used in a wider context, i.e. not only for recovery and resolution planning. The guidelines on reverse stress testing are organised into three sections. The first section presents the requirements more generally. The second section presents the use of this type of institution stress test in a more general way. The third section presents reverse stress testing and its specific uses for recovery actions and recovery planning, i.e. in a more specific way. The definitions and scope of reverse stress testing are already defined in the taxonomy section. No change. Paragraph 85 (previously paragraph 83 Reverse stress testing – use to complement Two respondents mentioned that the use of reverse stress tests to determine the severity of ICAAP and ILAAP scenarios does not seem feasible. In the overall context, it is reasonable to use reverse scenarios as plausibility instruments. The determination of the severity, however, should be carried out based on risk appetite, as well as the The guidelines mention that institutions should include scenarios identified through the reverse stress tests to complement (not to determine) the range of stress test scenarios they undertake and for comparison purposes, in order to assess the overall severity, allowing the identification of severe but still plausible scenarios. Reverse stress testing should be useful for setting the severity of scenarios for ICAAP and ILAAP stress tests. The severity of reverse Paragraph 85 (previously paragraph 83 changed to provide clarification regarding useful ways of assessing

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING the severity of ICAAP and ILAAP coherent scenario specification, which is comprehensible for the management. stress testing scenarios can also be assessed by comparing it to, inter alia, historical or other supervisory and publicly available scenarios. The guidelines mention that scenarios identified through reverse stress tests are used as complementary/additional information for comparison purposes and that reverse stress testing is a useful way of assessing the severity of scenarios. The EBA considers that the guidelines need to allow a sufficient degree of discretion when comparing the stress tests for ICAAP/ILAAP purposes and recovery planning, for instance regarding the metrics to consider and the level of the applied shock considered acceptable. The EBA considers that the paragraph could be clarified to mention useful methods of assessment, considering the specific implications of the reverse stress test design on the scenario plausibility. the severity of scenarios (as a complement and comparison). Paragraph 87 Reverse stress testing – use Two respondents noted that, so far, reverse stress testing has largely been applied within the context of only recovery and resolution planning. One respondent is somewhat cautious about its wider deployment in practice, as the potentially infinite number of degrees of freedom that are available when constructing a scenario that would lead to the point of the non-viability of a firm creates a significant degree of complexity to manage. This applies in particular to pan-EU and international banks that have a high degree of diversification across countries, customer types and product types. The development of multiple scenarios and the non-linear causal relationships that can occur in a reverse stress testing environment can The principle of proportionality is recognised and applies to all aspects of these guidelines, including reverse stress testing, ensuring that it is proportional to the nature, size and complexity of an institution’s business and risks. The EBA provides several incentives for the use of reverse stress testing in a wider context, i.e. not only for recovery and resolution planning. An institution should consider reverse stress testing not only as part of its stress testing programme but also as a regular risk management tool, carried out regularly by all types of institutions and at the same level of application as ICAAP and ILAAP (e.g. institution-wide and covering all relevant risk types), sharing the same governance and quality standards and to complement other types of stress testing. Paragraph 87 changed to provide clarification regarding the principle of proportionality.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING become difficult to manage and, importantly, the outcomes may be difficult to interpret. Another respondent recommends developing reverse stress testing in the context of recovery planning rather than considering it as a regular risk management tool. Another respondent mentioned that reverse stress testing can be part of a bank’s regular stress testing process; however, it is solely used to inform management about a firm’s key vulnerabilities. The respondent mentioned that reverse stress testing should not be used to inform contingency planning and should not affect business and capital decisions, since these processes are based on very different assumptions and perimeters. Specifically, for institutions with adequate capitalisation, reverse stress tests may result in rather implausible scenarios which are of limited use for bank steering. The intentions of the guidelines ‘to … increase the institution’s awareness of its vulnerabilities’ and to ‘understand the viability and sustainability of their business models and strategies’ are equally achieved by the more plausible near-default scenarios as part of the recovery planning process. The respondent would therefore appreciate more flexibility in this regard and for the use of reverse stress scenarios not to be overemphasised. Another respondent mentioned that the role of reverse stress testing seems overrated despite the fact that this practice has shown limitations in the context of recovery planning. For banking entities disposing of a high level of capitalisation, stress testing built up on ‘near-default scenarios’ could lead to distorted results and would imply a lower credibility of the actual stress testing exercise. The The EBA considers that the guidelines allow a sufficient degree of discretion when performing stress testing. The degree of freedom that is available when constructing a scenario for reverse stress testing should be seen as an advantage of this type of stress test. Institutions should include scenarios identified through the reverse stress tests to complement the range of stress test scenarios they undertake and for comparison purposes in order to assess overall severity, allowing the identification of severe but still plausible scenarios. As part of regular risk management, it is important that institutions identify measures that provide alerts when a scenario turns into reality. Therefore, the existence of multiple scenarios and their non-linear causal relationships, despite possible difficulties in interpretation, should be identified by institutions and taken into account as complementary information.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING respondent considers that it would be important to leave enough flexibility for banking institutions in the design, planning and implementation of the stress testing. Another respondent mentioned that the role of stress tests is strengthened significantly in the present consultation paper, although stress tests displayed evident weaknesses in recovery planning. In the case of well- to very-wellcapitalised institutions, reverse stress tests or near-default scenarios produced scenarios of little relevance in management terms. There is, moreover, the danger of nonacceptance of stress testing results. The targets communicated in the consultation paper (such as identifying current and potential vulnerabilities, identifying business model and business strategy risk or assessing the sustainability of business models) can be achieved just as well through the use of ‘severe but still plausible scenarios’. The respondent believes that institutions should be allowed some degree of discretion when performing stress testing. Another respondent welcomed, in principle, linking reverse stress testing and recovery planning scenarios. Reverse stress testing is always performed at individual institution level under these guidelines. In the case of recovery planning, institutions that belong to an institutional protection scheme are given the option of conducting recovery planning at individual institution level or at institutional protection scheme level. It should therefore be ensured that this option for institutions belonging to an institutional protection scheme is not impaired by linking recovery planning and reverse stress testing. Paragraph 88 Two respondents mentioned that paragraph 86 states that institutions must identify measures that trigger an alarm as The guidelines mention that, as part of their business planning and risk management, institutions should use reverse stress test to No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING (previously paragraph 86) Reverse stress testing – use soon as a scenario becomes reality. This potentially too onedimensional approach is difficult to comprehend, especially since scenarios never unfold exactly as expected. Reference to the recovery indicators to be developed as part of the recovery plans would be more useful. Another respondent mentioned that it would appreciate further clarification on what the regulator expects on reverse stress testing, i.e. hurdle rates, etc. understand the viability and sustainability of their business models and strategies, as well as to identify situations in which they might be considered failing or likely to fail within the meaning of Article 32 of Directive 2014/59/EU. It is important that institutions identify measures that provide alerts when a scenario turns into reality. To that end, institutions should: (a)identify the pre-defined outcome to be tested (e.g. of a business model becoming unviable); (b) identify possible adverse circumstances that would expose them to severe vulnerabilities and cause the pre-defined outcome; (c) assess (depending on the institution’s size, as well as the nature, scale, complexity and riskiness of its business activities) the likelihood that events included in the scenarios leading to the pre-defined outcome; and (d) adopt effective arrangements, processes, systems or other measures to prevent or mitigate identified risks and vulnerabilities. The paragraph is general and applies not only to recovery planning. The EBA considers that the paragraph already includes possible recovery indicators, among other indicators. The EBA considers that the guidelines need to allow a sufficient degree of discretion when performing reverse stress testing, for instance with regard to hurdle rates, etc. Paragraph 92 (previously paragraph 90) Reverse stress testing – internal models One respondent noted that in a number of paragraphs the guidelines state that stress testing should be used as a risk management tool for revealing the possible inadequacies of internal models. In severe stress scenarios, the respondent agreesthat model risk will increase and may lead to a breakdown in the model’s predictability. But this should not necessarily be taken as an indication that the modelling of the inputs in the The guidelines mention that institutions using internal models for credit risk, counterparty credit risk and market risk, when carrying out reverse stress testing in accordance with Articles 290(8) and 368(1)(g) of Regulation (EU) No 575/2013, should endeavour to identify severe, but plausible, scenarios that could result in significant adverse outcomes and potentially challenge institutions’ overall viability. Institutions should see these reverse stress tests as an essential complement to their internal models Paragraph 92 (previously paragraph 90 changed to provide clarification regarding both CRR and model risk.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING internal ratings-based (IRB) formula is inadequate. The respondent suggests that the guidelines could be re-drafted to reflect this. The EBA in that paragraph also references Article 290(8) CRR in support of this requirement. The respondent encourages the EBA to review the guidance to ensure that it is aligned with the CRR. Another respondent mentioned that paragraph 90 correctly states that reverse stress tests should be seen as complementing the internal models used to calculate capital requirements. It also states that they are designed to reveal inadequacies of these internal models. The respondent does not understand this. These models are not normally developed on the assumption of a stress situation, i.e. under fundamentally different environmental conditions. Validation of these internal models on a stress test basis is not possible. The requirement should be deleted. for the calculation of capital requirements and as a regular risk management tool for revealing the possible inadequacies of these internal models. The EBA agrees that this should not necessarily be taken as an indication that the modelling of the inputs in the IRB formula is inadequate. The EBA considers that the paragraph could be clarified to take into account that, in severe stress scenarios, even if not necessarily taken as an indication that the modelling of the inputs in the IRB formula is inadequate, model risk will increase and may lead to a breakdown in the model’s predictability. The EBA considers that Article 177 of the CRR – Requirements for the IRB approach, Stress tests used in the assessment of capital adequacy – could also be mentioned to support the requirement. Paragraph 94 Reverse stress testing – quantitative analysis Two respondents mentioned that the requirements for the quantitative ‘reverse engineering’ of the specifically required stress parameters sometimes appear to be too theoretical, and do not necessarily add any additional insight. It would however be more practical and more comprehensible for the management if a certain number of alternative scenarios were shown, which cover the target loss. It would thus be reasonable to refrain from the requirement for a quantitative calculation. The guidelines mention that institutions should perform a quantitative and more sophisticated analysis, taking into account the institution’s size as well as the nature, scale, complexity and riskiness of its business activities, in setting out specific loss levels or other negative impacts on its capital, liquidity (e.g. the access to funding, in particular to increases on funding costs) or overall financial position. Institutions should work backwards in a quantitative manner to identify the risk factors, and the required amplitude of changes, that could cause such a loss or negative impact. The EBA considers that the guidelines allow a sufficient degree of discretion when performing reverse stress
testing. The guidelines mention that institutions should, where appropriate, use No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING sensitivity analysis as a starting point for reverse stress testing, e.g. shifting one or more relevant parameters to some extreme to reach pre-defined outcomes. However, institutions should not use sensitivity analysis to identify the scenario relevant for the reverse stress test. The qualitative analysis should lead to the scenario, combining expert judgement from different business areas, as thinking might be the most effective way of preventing a business model failure. A joint stressing of all relevant risk parameters using their statistical aspects (e.g. volatility of risk factors consistent with historical observations supplemented with hypothetical but plausible assumptions) should be developed. The plausibility of the required parameter shifts to reach the pre-defined outcome gives a first idea about possible vulnerabilities in the institution. To assess the plausibility, historical (multivariate) probability distributions – adjusted, where deemed necessary, according to expert judgements – should, among others, be applied. Qualitative analyses and assessments, combining expert judgements from different business areas, should guide the identification of relevant scenarios. The EBA provides several incentives for the use of reverse stress testing based on quantitative and qualitative analyses. Paragraph 95 Reverse stress testing – sensitivity analysis One respondent mentioned that it is unclear why a sensitivity analysis should be performed as a starting point for reverse stress testing in particular if it should not be used to find the relevant scenario. The guidelines mention that institutions should, where appropriate, use sensitivity analysis as a starting point for reverse stress testing, e.g. shifting one or more relevant parameters to some extreme to reach pre-defined outcomes. However, institutions should not use sensitivity analysis to find the scenario relevant for the reverse stress test. The qualitative analysis should lead to the scenario, combining expert judgement from different business areas, as thinking might be the most effective way to avoid a business model failure. A joint stressing of all relevant risk No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING parameters using their statistical aspects (e.g. volatility of risk factors consistent with historical observations supplemented with hypothetical but plausible assumptions) should be developed. The plausibility of the required parameter shifts to reach the predefined outcome gives a first idea about possible vulnerabilities in the institution. To assess the plausibility historical (multivariate) probability distributions – adjusted, where deemed necessary, according to expert judgements – should among others be applied. Qualitative analyses and assessments, combining expert judgements from different business areas, should guide the identification of relevant scenarios. The guidelines mention the use of sensitivity analysis only where appropriate and provide an example, namely to test relevant parameters. This allows a sufficient degree of discretion when performing reverse stress testing. Finding a relevant scenario can be a different part of the process. Paragraph 96 Reverse stress testing – scenarios that combine solvency and liquidity stress tests One respondent mentioned that the guidelines should provide more precision on those required scenarios that combine solvency and liquidity stress tests and define with more clarity those situations that can aggravate a liquidity stress event and transform it into a solvency stress event, and vice versa, and eventually to a business failure. The guidelines mention that institutions should use reverse stress testing as a tool to gather insights into scenarios that involve combinations of solvency and liquidity stress events, where traditional modelling may fail to capture complex aspects of real situations. Where appropriate, institutions should identify and analyse situations that can aggravate a liquidity stress event and transform it into a solvency stress event, and vice versa, and eventually to a business failure. Institutions should endeavour to apply reverse stress testing in an integrated manner for risks to capital or liquidity with a view to improving the understanding and the management of related risks in extreme situations. The EBA considers that the guidelines need to allow a sufficient degree of discretion when performing reverse stress testing, for No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING instance with regard to the combination of solvency and liquidity stress tests. Paragraphs 97 to 101 Reverse stress testing – Recovery actions and recovery planning (use) One respondent mentioned that, because of the required severity for reverse stress testing, this approach leads by definition to scenarios with low probability of occurrence, which may be less credible and less appropriate for testing the recovery plan. Recovery planning should thus primarily rely on the most relevant ‘near-default’ scenarios, as they ensure a proper balance between severity, consistency with the institution’s strategy and business model, and, finally, more credibility. In addition, it is not clear why reverse stress testing should be required to fulfil the expectations regarding a recovery plan as outlined in paragraph 99. This could be fully achieved within the regular recovery planning framework. Two respondents mentioned that the overall classification, i.e. the relationship between ICAAP stress test (or regular scenarios) versus inverse scenarios versus recovery planning scenarios and their interaction during calibration, seems unclear. The guidelines mention that institutions should use reverse stress testing to assist with the development, assessment and calibration of the ‘near-default’ scenarios used for recovery planning. Institutions should use reverse stress testing to identify the risk factors and further understand and describe the scenarios that would result in ‘near default’, assessing effective recovery actions that can be credibly implemented, either in advance or as the risk factors or scenarios develop. Reverse stress testing should contribute to the recovery plan scenarios by using a dynamic and quantitative scenario narrative: (a) the recovery triggers (i.e. at which point the institution would enact recovery actions in the hypothetical scenario); (b) the recovery actions required and their expected effectiveness, including the method of assessing that effectiveness (i.e. indicators that should be monitored to conclude that no further action is required); (c) the appropriate timing and process required for those recovery actions; and (d) in the case of further stress, points (b) and (c) for the potential additional recovery actions required to address residual risks. Given that the aim of a recovery plan is to prove the capacity to restore the viability of an institution, these scenarios should be designed as ‘near-default’ situations, i.e. they should bring an institution close to failure but no further. This element should be taken into consideration when considering, for example, using reverse stress testing to identify the most appropriate scenarios. See the EBA Guidelines on the range of scenarios to be used in recovery plans for additional details (e.g. the BRRD). No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING The EBA provides several incentives for the use of reverse stress testing. Institutions should consider reverse stress testing as a regular risk management tool, carried out regularly by all types of institutions. At the same time, the EBA allows a sufficient degree of discretion when performing reverse stress testing. For instance, as part of regular risk management, it is important that institutions identify measures that provide alerts in the context of recovery planning and recovery indicators, when a scenario turns into reality. Paragraph 98 (previously paragraph 96) Reverse stress testing – recovery actions and recovery planning – ICAAP/ILAAP Two respondents mentioned that, according to paragraph 96, stress tests for ICAAP and ILAAP purposes, as well as recovery planning, should not be combined, but should however be comparable. In terms of content, in paragraph 96 there appears to be a contradiction in the requirement that stress scenarios and ICAAP/ILAAP stress tests should not be interlinked, since this is asked for in other parts of the draft guidelines (i.e. paragraph 224). The respondent mentioned that the ban on interlinking should be removed. Another respondent mentioned that given that paragraph 96 implies the necessity of two sets of reverse stress test respectively for ICAAP/ILAAP purposes and for recovery planning, more detailed explanations as to how reverse stress tests should be engineered for ICAAP purposes would be welcome: what are the pre-defined outcomes that should be targeted/tested? The guidelines mention that, because of the different objectives of the two sets of reverse stress tests, the stress tests for ICAAP and ILAAP purposes and recovery planning should not be interlinked but compared with one another. The guidelines also mention, regarding supervisory stress testing, that competent authorities should also use the scenarios and outcomes of supervisory stress tests as additional sources of information in the assessment of institutions’ recovery plans, in particular when assessing the choice and severity of scenarios and assumptions used by the institution. In this assessment, the supervisory stress tests scenarios should, where appropriate and in particular where they satisfy the conditions set out in the EBA Guidelines on the range of scenarios to be used in recovery plans, be used as a reference point for the assessment of the institution’s own scenarios and assumptions. If a competent authority identifies deficiencies in the scenarios or assumptions by the institution for the purposes of recovery planning, it should, where appropriate, in addition to requiring the institution to modify their own scenarios, demand that the institution use the supervisory stress testing scenarios and assumptions. When assessing the appropriateness of such a demand, competent authorities should take all relevant factors into account, paying particular attention No
change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING to whether or not institutions have failed to incorporate systemwide events into their recovery planning. The EBA considers that there is no contradiction. The guidelines refer to comparisons, additional sources of information and reference points for assessments. At the same time, the guidelines need to allow a sufficient degree of discretion when performing reverse stress testing for both purposes. Paragraph 101 (previously paragraph 99(d)) Recovery actions and recovery planning – residual risks Two respondents mentioned that the paragraph requires ‘additional recovery actions to address residual risks’. Stress scenarios for recovery planning follow the ‘near-default’ criterion, i.e. they are severe enough that the institution can restore capital and liquidity only by carrying out all realisable, private recovery measures available. Hence, by definition, there will be no further recovery measures available. The respondent therefore suggests withdrawing paragraph 99(d). The EBA considers that reverse stress testing should contribute to the recovery plan scenarios by using a dynamic and quantitative scenario narrative, taking into account the following: (a) the recovery triggers (i.e. at which point the institution would enact recovery actions in the hypothetical scenario); (b) the recovery actions required and their expected effectiveness, including the method of assessing that effectiveness (i.e. indicators that should be monitored to conclude that no further action is required); (c) the appropriate timing and process required for those recovery actions; and (d) in the case of further stress, points (b) and (c) for the potential additional recovery actions required to address residual risks. In a dynamic setting, the EBA considers that residual risks may exist and may not be totally covered, so further recovery measures may be available during the process. No change. Paragraph 102 Time series –credit risk and operational risk One respondent mentioned that it seems that there is the underlying assumption that lengthy time series will always be available and that all loss projection calculations, assumptions and outcomes will be comparable with these historical observations. The respondent cautions that this may not always be the case and it is important to note that The EBA considers that institutions should ensure that the stress testing of individual risk is proportional to the nature, size and complexity of the business and risks. In addition, institutions should consider, wherever possible, the use of quantitative analysis. For instance, relevant parameters No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING when data are available they may well not cover more than 10 years of history. The respondent is therefore of the opinion that the guidelines should provide more room for expert-based parameter setting. This could, for example, be done by defining guidelines for setting these expert-based parameters. such as probability of default (PD), loss given default (LGD) and exposure at default (EAD), expected loss (EL) and risk exposure amount and the impact on credit losses and own funds requirements should be taken into account wherever possible. Moreover, for the estimation of future losses, institutions should, where appropriate, rely on credit risk parameters different from the parameters applied in the calculation of capital requirements, which are usually through-the-cycle (TTC) for PD and under downturn conditions for LGD. In particular, institutions should, where relevant, apply estimates based on point-in-time parameters in accordance with the severity of the scenario for the purpose of estimating credit losses. Therefore, that lengthy time series will always be available is not assumed as part of the guidelines and quantitative analysis and empirical evidence are considered only where possible and historical relationships and data should be challenged as well (and based on the principle of proportionality), as mentioned in several paragraphs. For instance, regarding operational risk, the use of expert judgement to overcome a possible lack of historical information is mentioned (paragraph 137). When an institution expands its business in the local or in the international market through mergers and acquisitions, the design of new products or the development of new business line, the severe but plausible stress test scenarios should be based on expert judgement to overcome the possible lack of historical information. For instance, for credit risk, institutions should apply, to the extent appropriate, credit risk internal model approaches that challenge historical relationships and data, and simulations of credit quality migrations among categories of exposures to provide an estimate of losses (paragraph 115).

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Paragraph 105 Credit and counterparty risk – central clearing house exposures One respondent mentioned that the risk from central clearing houses is not included. The respondent believes that it is appropriate for exposure to these exchanges to be highlighted on the basis that they pose a systemic risk that an institution may find it very difficult to mitigate in severe stress conditions given the need for mandatory clearing through these exchanges. The EBA considers that the paragraph could be clarified to mention also central clearing house exposures. Paragraph 105 changed to provide clarification regarding central clearing house exposures. Paragraph 107 (previously paragraph 105) Credit and counterparty risk – sensitivity analysis One respondent mentioned that credit risk stress testing should encompass everything from simple sensitivity analyses to stress scenarios (paragraph 105). It should be performed both at different levels – market wide, counterparty specific and sector specific – or at a combination of these levels and with different time horizons (paragraph 107). In the process, the numerous sensitivity analyses required under paragraph 64 ff. of the draft guidelines must be considered. The guidelines mention that institutions should ensure that credit risk is assessed at various levels of shock scenarios from simple sensitivity analyses to institution-wide stress tests, or to groupwide stress tests, in particular: (a) market-wide shock scenarios (e.g. a sharp slowdown of the economy that affects portfolio quality for all of the creditors); (b) counterparty-specific and idiosyncratic shock scenarios (e.g. bankruptcy of the largest bank creditor); (c) sector specific and region specific shock scenarios; and (d) a combination of the above. Institutions should subject risk factors to sensitivity analyses, which in turn should provide quantitative background information for the design of scenarios. Institutions should apply different time horizons when applying their stress scenarios. The time horizon should range from overnight (one-off effect) up to longer terms (e.g. a creeping economic downturn). The EBA considers that sensitivity analysis is taken into account and expressed. No change. Paragraph 114 Two respondents mentioned that the requirement recommends, for the estimation of future losses, applying TTC parameters for RWA calculations. The respondent The guidelines state clearly that institutions should, where relevant, apply estimates based on point-in-time parameters as follows:
Paragraph 114 changed to provide

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING (previously paragraph 112) Credit and counterparty risk – TTC PD and downturn LGD would welcome clarification in the final guidelines of whether or not the regulatory view is to establish two PD parameters sets within banks for stress testing in line with the EBA/ECB stress testing methodology: point-in-time parameters for profit and loss (P&L)/accounting and TTC parameters for capital requirements. Two respondents mentioned that, in paragraph 112, it is assumed that PDs used for the calculation of capital requirements are ‘usually’ TTC PDs. This is not the case, as in many ratings systems there are also mixed systems of pointin-time and TTCs. The insertion regarding PDs is misleading and should be removed. For the estimation of future losses in stress tests, institutions should, where appropriate, rely on credit risk parameters different from the ones applied in the calculation of capital requirements, which are usually TTC or hybrid parameters (TTC and point-in-time) for PD and under downturn conditions for LGD. In particular, institutions should, where relevant, apply estimates based on point-in-time parameters in accordance with the severity of the scenario for the purpose of estimating credit losses. The methodology of the supervisory EBA EU-wide stress test is independent from these guidelines. additional clarification. Paragraph 115 Credit and counterparty risk – legal capacity to unilaterally cancel undrawn amounts of committed credit facilities One respondent recommended the exclusion in the guidelines of a comment on the unilateral cancellation of undrawn amounts of committed credit facilities, given that this might have a significant reputational risk effect. The respondent is of the view that any unilateral actions from an institution in stressed conditions should be considered through the institution’s recovery planning efforts. The guidelines mention that, for the computation of EAD, institutions should also consider a credit conversion factor (CCF) and, in particular, the effect of the institution’s legal capacity to unilaterally cancel undrawn amounts of committed credit facilities especially in stressed conditions. The guidelines do not recommend the use of unilateral actions; on the contrary, they recommend that institutions consider the potential negative effects of this possible legal capacity. No change. Paragraph 116 (previously paragraph 114) Credit and counterparty risk – use of models One respondent mentioned that the guidelines could make it clearer that paragraph 114 refers to the use of models under conditions for extreme stress. The guidelines mention that institutions should apply, to the extent appropriate, credit risk internal model approaches that challenge historical relationships and data, and simulations of credit quality migrations among categories of exposures to provide an estimate of losses. The EBA considers that the paragraph does not refer only
to the use of models under conditions for extreme stress. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Paragraphs 119, 120 and 122 (previously paragraphs 117, 119 and 120) Securitisation One respondent mentioned that the requirements in paragraphs 117, 119 and 120 are overly prescriptive. The stress testing of factors such as collateral values and credit enhancements does not necessarily generate price shocks similar to historically observed movements. The respondent therefore proposes that the requirements are amended to allow banks flexibility on the factors that are considered in the stress testing of securitisation risk. The EBA considers that the stress testing of securitised assets and the reference to the evolution of collateral values is not overly prescriptive. Institutions should ensure that the stress testing of securitised assets addresses the credit risk of the underlying pool of assets, including the default risk, the possibly non-linear and dynamic default correlations as well as the evolution of the collateral values. Institutions should take into account all relevant information with regard to the specific structure of each securitisation, such as the seniority of the tranche, the thickness of the tranche, credit enhancements and granularity, expressed in terms of the effective number of exposures. Addressing the credit risk, the evolution of the collateral values and taking into account all relevant information with regard to credit enhancements does not necessarily mean stress testing such factors and the guidelines already provide enough flexibility to institutions. No change. Paragraph 120 Securitisation – liquidity dry-out Two respondents noted that liquidity dry-out is not likely to be a factor when securitisation facilities are funded on balance, reducing any reputational risk issues. Most stress test models use macroeconomic indicators (e.g. GDP, unemployment) to project stress default rates, which are in turn used to project a stressed PD. Potential liquidity issues (as seen through market spread volatility) are taken into account, as there is often a correlation between The guidelines mention that the sensitivity to systemic market effects, affecting, for example, liquidity dry-outs or increasing asset correlations, on all levels of the structured product should be carefully taken into account. In addition, the effect of reputational risks, resulting in, for example, funding issues, should be assessed. The liquidity dry-outs are mentioned as only a possible example. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING macroeconomic indicators (e.g. GDP) and market spread levels. One of the respondents above also mentioned that, in the trading book, liquidity risks are captured through market risk management stress tests. Test scenarios are based on periods of stressed market conditions and are applied to the current securitisation portfolio. Finally, liquidity horizons are included in the analysis. Paragraph 124 (previously paragraph 122) Securitisation – different capital regimes One respondent proposed that the EBA review the requirements in paragraph 122 to consider the different capital regimes applicable to institutions. The capital held by firms against securitisation assets under the standardised capital regime is conservative even under severe stress scenarios such as instantaneous shocks based on 2008 and 2011 market conditions. The guidelines mention that, when designing the stress testing approach, institutions should consider the following: (a) the impacts of stress tests for structured credit products will materialise on the level of the asset pool in increased PDs and LGDs and hence increased expected loss/impairment rates and regulatory capital (as well as increased probabilities for downgrades) should be expected during shocks; and (b) that further impacts may arise from decreases in the net cash flow, increases in trading losses and value adjustments, or from the deterioration of regulatory metrics such as the net stable funding ratio. The paragraph could be changed to clarify that the EBA considers different capital regimes applicable to institutions. Paragraph 124 (previously paragraph 122) changed to clarify that the EBA considers different capital regimes applicable to institutions. Paragraphs 125 and Market risk – IRRBB Two respondents suggested that it be clarified in the guidelines that market risk is defined as being limited to the trading book. In the respondents’ view, interest rate risk in the banking book should be excluded from the definition of market risk for the purposes of the proposed guidelines and therefore exclusively covered in section 4.6.7. In addition, the applicability of the guidelines in respect of paragraph 124 is not clear. It would be helpful for the The guidelines mention that institutions should take into account market risk, notably risks derived from losses resulting from adverse changes in the value of positions arising from movements in market prices across commodity, credit, equity, FX and interest rates risk factors. Interest rate risks in trading book positions should be considered by institutions as a component of market risk. Interest rate risk in the banking book is also considered as a component of market risk. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING guidelines to clarify whether or not these should be captured within market risk. In the respondents’ view, it is not clear whether interest rate risk on available-for-sale (AFS) positions in the banking book would be covered by
section 4.6.3 or not. The two respondents would welcome
clarification of these articles about the exact scope of application.
The guidelines also mention that institutions should conduct stress tests for their positions in financial instruments in the trading and AFS portfolios (i.e. accounting terms to classify financial assets), including securitisation instruments/positions and covered bonds. These stress tests should be undertaken as
part of institution-wide stress testing as well as for market risk
management and calculation purposes.
Paragraph 129
Market risk – reserves
One respondent asked for better clarification regarding reserves related to portfolios (e.g. for liquidity, for modelling uncertainties). The guidelines mention that institutions should apply a range of severe but plausible scenarios for all positions referred to in the previous paragraph, e.g. exceptional changes in market prices, shortages of liquidity in the markets or defaults of large market participants. Dependencies and correlations between different markets and, consequently, adverse changes in correlations should, where appropriate, also be taken into account and factored in. The impact on accounting CVA and on reserves related to institutions’ portfolios (e.g. reserves for liquidity, for modelling uncertainties) should be taken into account equally in their stress tests. The EBA considers that the paragraph could be clarified by adding that market risk reserve stress testing should be substantiated. Paragraph 129 changed to clarify the previous text. Paragraph 130 (previously paragraph 128) Market risk – fat tail risk Two respondents mentioned that paragraph 128 demands that ‘fat tail risk issues’ in particular should be taken into account, as part of the stress test. While this is reasonable in general, it should be added that institutions are obliged to do this only if non-stressed value at risk (VaR) and IRC (if determined) are in a position to take fat tails into account in an appropriate manner. The guidelines mention that institutions should take into account that the main weaknesses of the VaR models relate to the noncapturing or the underestimation of tail risk by historical data (fat tails). To capture fat tails, institutions should apply severe hypothetical scenarios. Where risk is assessed against possible time horizons and percentile confidence levels, institutions should consider tail events beyond those confidence levels. The EBA considers that the paragraph could be clarified by mentioning that institutions should develop an appropriate Paragraph 130 (previously paragraph 128) changed to clarify the previous text.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING approach to capturing fat tails, e.g. by applying severe hypothetical scenarios, and, where risk is assessed against percentile confidence levels, should consider tail events beyond those confidence levels. Paragraph 132 Operational risk – sensitivity analysis and risk One respondent mentioned that, in some institutions, operational risk stress testing (ORST) methodology leverages operational risk capital scenarios’ internal models, which are used for ICAAP/Pillar 2 capital. The effect of possible changes on the Standardised Measurement Approach (Basel Committee consultation in
2016) – if implemented – is that internal models of
operational risk will no longer be permitted for Pillar 1 calculations of the minimum capital requirement. The consequence may be a more prescriptive and less risk sensitive approach to the stress testing of operational risk. The respondent welcomed receiving EBA confirmation that the ‘risk sensitiveness’ of an institution’s stress testing from an operational risk perspective may remain unchanged. Another respondent recommended extending the consultation period to ensure proper consideration of the latest developments in the area of operational risk. The guidelines define a sensitivity analysis as a stress test that measures the potential impact of a specific single risk factor or simple multi-risk factors, affecting capital or liquidity, on a particular portfolio or on the institution as a whole. Operational risk is included and estimations should include risk sensitivity for stress testing purposes wherever appropriate. The guidelines apply to all institutions, including institutions that do not apply a very risk-sensitive approach, i.e. non-AMA institutions, are required to design a risk-sensitive stress test. If in the future the AMA is no longer in place, i.e. all institutions apply an approach that has a limited level of risk sensitivity, the stress test requirement will still remain in place for all institutions. The current guidelines might require further adoption after a new Basel regime is incorporated into EU law and endorsed, but a delay of the work on these guidelines should not be considered a viable solution. No change. Paragraph 133 Operational risk – use of historical data One respondent noted that the use of historical data or external data as inputs might be misleading and create double counting if they are used for both P&L and RWA projections. The guidelines indicate that, in order to stress relevant risk parameters, institutions should use the P&L effect of operational losses as the main metric and distinguish between economic loss and the loss of future earnings. Moreover, the guidelines also state that the analysis of the stress test events should involve expert judgement, at least in the case of low-frequency high-severity events. When an institution expands its business in the local or in the international market Paragraph 133 changed, adding caution with regard to the possible double-counting effect.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING through mergers and acquisitions, the design of new products or the development of a new business line, the severe but plausible stress test scenarios should be based on expert judgement to overcome the possible lack of historical information. Therefore, historical data and external data are only considered some of the possible information that could be used. Nevertheless, given the possible misuse of data and doublecounting effect if used for both P&L and RWA projections, the guidelines could mention this aspect accordingly. Paragraph 133 Operational risk – P&L impact Two respondents mentioned that, for operational risk events to have a P&L impact, they need to have an effect on the general ledger. Neither near misses (loss amount = 0) nor loss of future earnings (which are difficult to trace back to particular operational risk events) would qualify as causing any impact on the general ledger and thus would be difficult to quantify. Therefore, they cannot be qualified as being operational risk losses with P&L impacts. One respondent mentioned that the term ‘economic loss’ is not nearly defined in the context of operational risk loss even for AMA banks. From the respondent point of view, ‘near misses’ and ‘losses of future revenues’ are not mandatory elements of operational risk loss data collection. Such elements of operational risk losses may be collected for operational risk management purposes by AMA banks and are not included in the scope of operational risk loss for the calculation of capital requirements for operational risk (except for material uncollected revenues, as referred to in
Article 28, point (e), of the final draft regulatory technical
standards (RTS) on the specification of the assessment methodology). A new regulatory requirement to consider The guidelines mention that, in order to stress relevant risk parameters, institutions should use the P&L effect of operational losses as the main metric. But this should not limit the effect to the P&L effect; the economic loss of an asset might be higher than its book value. The paragraph could be clarified regarding near misses and loss of future earnings. The draft RTS on AMA consulted on in 2014 and published in 2015 explain that data on near misses are to be collected as well as data on, for example, operational gains. This is in line with the current expectations of European supervisors. Since these data are collected, it should not be an additional burden. The institutions should use the flagged positions as additional data points for the stress test calculation. The only additional burden would be a second set of calculations, but since the data collection is the more labour-intensive element, the additional calculation should be the only, limited, additional burden on IT capacity. Paragraph 133 changed to provide clarification regarding near misses and loss of future earnings.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING such elements for stress testing purposes would require significant efforts from banks to extend their loss data collection and to adjust or at least re-calibrate AMA models in order to accommodate new elements. Paragraph 133 Double-counting effects One respondent asked if the double-counting effects refer to the inputs (in which case it would be understandable) or to the P&L and RWA projections (in which case a P&L effect would also affect the RWAs). The guidelines mention that, when using historical data, external data or scenarios as inputs for both P&L and RWA projections, institutions should take into account and avoid possible doublecounting effects. The paragraph could be changed by adding ‘on the input side’. Paragraph 133 changed to provide additional clarification. Paragraph 134 Operational risk – second-round effects One respondent mentioned that the relationship between the business activities, the losses incurred by operational risks and the gross income that is to be analysed represents a new requirement. The respondent assumes that the implementation of this requirement could have a major impact on IT systems. One respondent mentioned that it should be pointed out that the presumed linkage between the development of employee numbers, the balance-sheet total and the operational risks is not considered appropriate. Further explanations of the required analysis of the so-called ‘complexity’, the required analysis of ‘changes to significant elements of the IT infrastructure’, the required analysis of the ‘complexity of processes and procedures, products and the IT system’, and the required analysis of ‘the susceptibility to model risks’ would be very helpful. One respondent asked if the provisions of paragraph 132 mean that the P&L effect of the factors listed in points (a) to The guidelines mention that, as operational losses may induce second-round effects (i.e. reputational risk), in order to account for such effects, the operational risk stress testing programme should be thoroughly integrated into the institution-wide stress test and should include interconnections with liquidity and own funds requirements. Institutions should analyse at least: (a) the exposure of the institution to activities and its associated risk culture and past record of operational losses, with a focus on the level and change in losses and gross income in the past few years; (b) the business environment, including geographical locations in which the institution operates and macroeconomic conditions; (c) the evolution in headcount and in balance-sheet size and complexity over the past few years, including structural changes due to corporate events such as mergers and acquisitions; (d) changes to significant elements of the information technology infrastructure; (e) the degree and orientation of incentivising in compensation schemes; (f) the complexity of processes and procedures, products and
information technology systems; (g) the extent of outsourcing, with regard to the concentration risk associated with all outsourcing arrangements; and (h) the vulnerability of modelling risk, especially in the areas related to Paragraph 134 changed to provide clarification.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING (h) should be assessed. Is a quantitative assessment with respect to internal capital expected from AMA banks? Considering the number and scope of risk factors to be at least considered under the operational risk stress testing programme, the respondent requested clarification of whether or not any quantitative stress test assessment for purely macroeconomic scenarios (e.g. downturn scenarios for market and credit risks) should also be considered mandatory for operational risk stress testing. the trading of financial instruments, risk measurement and management, and capital allocation. The previous guidelines (GL32) published in 2010 remain largely valid. The EBA understands the challenges related to the further development of stress testing programmes based on best practices and that they go beyond the status quo for many institutions. The guidelines mention that institutions should analyse at least the factors listed in items (a) to (h), so these factors need to be assessed. The stress test would not have to come up with specific effects for each of the factors, but these factors should at least be considered when determining the potential effect of a stress situation. The institution should try to assess its vulnerabilities and loss potentials, and, wherever required, it should take a forwardlooking approach and it should try to assess foreseeable changes to the potentials. Institutions do not have to quantify each item, but if a relevant risk is encountered, a more detailed quantification should be done. For instance: (a) the change to significant elements of the information technology infrastructure are usually potential risks during the phase of change while its benefits are only relevant in the long term, Not all changes represent a significant effect on the exposure, but if the IT infrastructure is moved from one location to another (e.g. a different country) or if the fundamental programs or platforms are changed this might present a risk in the short term; (b) in addition to the size of an institution, its complexity is a significant driver of risk; for instance, an institution that operates in multiple jurisdictions or trades not only in standardised products but also

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING in self-design specialised products should assume a higher risk profile, and changes to these points might be considered additional risk potentials; (c) changes to the model usually create a model risk in the short term, but since changes to the model are predictable, an institution should be aware of a phase of increased risk. Institutions that apply internal models for pricing or capital requirement calculation might suffer from losses due to errors in the design or application of the model. Especially if an institution uses an increased number of models or uses models for an increased share of its business, the institution might suffer losses, if the model is not adequately equipped for the stress situation. The EBA recognises that institutions after the application date will continue to develop and enhance their systems and processes to meet supervisory expectations. The flexibility of implementation should be maintained by taking into account proportionality principles and the corresponding assessment of competent authorities. The EBA considers that the possible linkage between the development of employee numbers, the balance-sheet total and the operational risks is appropriate. Analysis from the supervisory as well as the industry side has shown a strong link between the size of an institution and its operational risk (especially with regard to the loss frequency). An increase in business size is therefore considered a good indicator of future risk potential. Institutions should be aware that business size might be calculated in different ways: based on the balance sheet, P&L, number of employees, etc. Double counting should be avoided (e.g. theoretically, a bank increases its business volume by 50% from one year to another, but without changing its business or other parameters, it should not double or triple count the increase in balance sheet, P&L and employees). But banks should also

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING consider that rapid changes in business size in either direction might create operational risk in the short term. Any comparison of this kind should be done only within a welldefined peer group or within a timeline of one institution. Paragraph 135 (previously paragraphs 133 and 134) Operational risk – idiosyncratic risk factors and business environment and internal control factors Two respondents mentioned that there is uncertainty as regards how to stress test ‘business environment and internal control factors’ (BEICFs) if indicators are used in a purely qualitative manner or show only a potential change in risks. Clarification would also be helpful with regard to what is meant by ‘such risk factors’ in the requirement in paragraph 134 to ‘consider the interactions of and individual exposures to such risk factors’. Does it mean the idiosyncratic risk factors referred to in paragraph 133 or other factors? The guidelines mention that idiosyncratic risk factors should also be explored and used as inputs for scenario design. Indicatively, institutions under the AMA should stress their BEICFs. The stressing of BEICFs depends on the way in which BEICFs are designed. Even if BEICFs are used only as indicators, the institution can stress them, e.g. that a high number or all BEICFs indicate problems (i.e. as a ‘traffic-light’ system) and that a high number of or all scenarios need to be adapted. The guidelines mention that institutions should consider the interactions of, and individual exposures to, such risk factors in determining their operational risk exposure. The factors mentioned at the beginning of paragraph 134 refer to idiosyncratic risk factors in the previous paragraph. The BEICFs at the end of the paragraph refer to Article 322(2)(b) CRR. Paragraph 135 changed to clarify that refer to idiosyncratic risk factor. Paragraph 137 Operational risk – interaction of operational risk losses with credit and market risks One respondent mentioned that regarding the analysis of a possible interrelation between losses from operational risks, credit risks and market risks, there is uncertainty as to whether a quantitative analysis of correlations or a qualitative analysis of causalities should be carried out. An explanation would be helpful here. The guidelines mention that institutions should analyse carefully the possible interaction of operational risk losses with credit and market risks. The EBA considers that the guidelines need to allow a sufficient degree of discretion when institutions analyse the interaction of operational risk losses with credit and market risks. While institutions should be aware that boundary losses (CR-OpR) should not be considered in a stress test directly, second-round No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING effects though interrelations and causalities have to be considered. When detected and when significant, interrelations between risk categories have to have an impact on the quantitative outcome of the stress test. Interaction and effect transmission between different risk categories might vary widely in accordance with the business model and the structure of the institution. The EBA does not therefore provide any additional explanation or allow a greater degree of discretion in this area. Paragraph 138 (previously paragraph 136) Operational risk – low-frequency highseverity events One respondent mentioned that the scenario analysis is a mandatory element of an AMA model. Can the requirement in paragraph 136 be seen as fulfilled by banks applying the AMA for the calculation of their own funds requirements if stress testing is performed using the same model? The guidelines mention that the analysis of the stress test events should involve expert judgement, to include at least lowfrequency high-severity events. The AMA model provides a curve of quantiles under normal conditions. Depending on the parameters of the model, a very high quantile of the normal curve cannot also be considered a point on the stress curve. So, even while the same tool might be used, it has to be judged individually if the AMA in its normal setting provides adequate results. When the AMA model can be applied to provide results from the scenario analysis, the institution should verify that the results from the scenario analysis are in line with the stress test scenarios. Details might need to be adapted. No change. Paragraph 139 (previously paragraph 137) Operational risk – assumptions Two respondents mentioned that paragraph 137 refers to risk type-specific stress tests. An explanation of how these are embedded in the overall context of stress testing would therefore be useful. If different assumptions from those in market and credit stress scenarios are used for operational The guidelines mention that institutions should design severe but plausible stress event scenarios. Assumptions may differ from the assumptions used in credit and market risk stress scenarios. When an institution expands its business in the local or in the international markets through mergers and acquisitions, the design of new products or the development of a new business No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING risk stress testing, will the results still have to be integrated into bank-wide macroeconomic stress scenarios? line, the severe but plausible stress test scenarios should be based on expert judgement to overcome the possible lack of historical information. The guidelines mention that assumptions may differ, but do not mention that they always differ. In the overall context of stress testing, in which results have to be integrated into bank-wide macroeconomic stress scenarios, the assumptions are not expected to differ from assumptions used in credit and market risk stress scenarios. Paragraph 140 Operational risk – AMA Two respondents noted that, according to
Article 322(4) CRR, institutions using the AMA shall
determine and use relevant external data. With regard to point (a) of this paragraph, the respondent assumes that the guideline does not require additional impacts stemming from changing scaling factors in the stress situation to be considered. However, the respondent would welcome clarification in order to prevent false assumptions. The formulation of point (b) gives the impression that firms should also use external data which, even in stress situations, are not relevant for the bank’s business model. This requirement would thus be misleading in the context of the CRR. The respondent therefore suggests the removal of the following text ‘e.g. large loss data considered not to be relevant may be used within the stress test’. Another respondent mentioned the need for a level playing field and awareness of the different requirements for AMA and non-AMA institutions within the stress testing guidelines. As part of the AMA model (Article 322 of the CRR), institutions already comply with several articles (see Articles 136, 137, 140, 143 and 146) with regard to The guidelines mention that institutions should build their stress testing programmes based on both internal and external data, while analysing carefully: (a) the use of scaling factors (e.g. in a situation where external data were scaled down, the scaling may be reduced); and (b) the criteria for determining the relevance of data (e.g. data on a large loss considered not relevant may be used within the stress test). The paragraph could be changed to clarify the possible need to assess additional impacts stemming from changing scaling factors in stress situations and the use of large loss data within the stress test in addition to CRR requirements. Whenever the AMA already requiresthe inclusion of internal data, external data, scenarios or BEICFs the institution might have to adapt this for the stress testing. The institution might want to design the stress test in such a way that it provides the delta to the already included elements or that the original data are excluded when the modified data are included. Double counting of the same information should be avoided. Paragraph 140 changed to provide clarification regarding scaling factors and use of data.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING calculations of their own funds requirements through the integration of operational risk scenarios. In order to avoid double counting, the respondent suggested that these risk scenarios fulfil the function of the required stress events and analysis of exposures. The respondent also mentioned the increased burden. The requirements for loss data collection in stress testing go beyond the currently existing requirements for operational risk. Compliance with these would impose a considerable implementation burden. On its own, the AMA scenario should not be considered a stress scenario (this also applies to the market risk, where a VaR and a higher stress VaR are calculated). The stress test requirements are an additional burden on the institution, since stress testing examines a different angle from operational risk analysis. While the most burdensome element of a risk-sensitive operational risk analysis (the data collection) can be used for an AMA and for stress testing, specific modifications are necessary. Scenarios and BEICFs might be modified as well, as a collection of ‘loss of future profits’ is established by the stress testing. The EBA recognises that institutions after the application date will continue to develop and enhance their systems and processes to meet supervisory expectations. The flexibility of implementation should be maintained by taking into account proportionality principles and the corresponding assessment of competent authorities. Paragraph 141 Conduct-related risk and associated litigation costs – scope One respondent mentioned that, according to Article 252 of the SREP guidelines, conduct-related risk (section 4.6.5) is included in the scope of operational risk (section 4.6.4), and therefore, suitable standards are necessary. The guidelines mention that institutions should take into account that conduct-related risk, as part of the legal risk under the scope of operational risk, arises because of the current or prospective risk of losses from the inappropriate supply of financial services and the associated litigation costs, including cases of wilful or negligent misconduct. The use of a separate section is only to highlight the importance of conduct-related risk in the context of stress testing programmes (see the Executive summary of the guidelines). It is mentioned in paragraph 141 that conduct-related risk is part of the legal risk under the scope of operational risk. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Paragraph 141 Conduct-related risk, as part of the legal risk under the scope of operational risk One respondent proposed that the words ‘as part of the legal risk’ be deleted because it should be up to the institutions to define the hierarchy of risks. The guidelines mention that institutions should take into account that conduct-related risk, as part of the legal risk under the scope of operational risk, arises because of the current or prospective risk of losses from the inappropriate supply of financial services and the associated litigation costs, including cases of wilful or negligent misconduct. The EBA does not promote a specific structure in the management of risk within an institution and, in the EBA’s view, neither does this text. Nevertheless, the EBA should be allowed to indicate how conduct-related risk is included in the hierarchy of risks. No change. Paragraph 142 Conduct-related risk and associated litigation costs One respondent mentioned that it is unclear whether an approximate evaluation of loss data is sufficient for assessing the relevance and significance of the exposures listed or whether a separate quantitative or qualitative analysis is required for each exposure. The respondent requested clarification. The guidelines mention that, in their stress testing, institutions should assess the relevance and significance of the following exposures to conduct-related risk and associated litigation costs:
(a) the mis-selling of products, in both the retail and the wholesale markets; (b) the pushed cross-selling of products to retail customers, such as packaged bank accounts or add-on products that customers do not need; (c) conflicts of interest in conducting business; (d) the manipulation of benchmark interest rates, FX rates or any other financial instruments or indices to enhance the institution’s profits; (e) unfair barriers to switching financial products during their lifetime and/or to switching financial service providers; (f) poorly designed distribution channels that may result in conflicts of interest with false incentives; (g) unfair automatic renewals of products or exit penalties; and (h) the unfair processing of customer complaints. The EBA considers that the guidelines need to allow a sufficient degree of discretion when institutions analyse exposures to conduct-related risk and associated litigation costs. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING While, in general, no separate numbers need to be provided for all exposures, the institution should have a good idea of the main drivers. If an institution can come up with a way of determining the overall exposure without defining sub-exposures, it is sufficient to provide these overall numbers. However, if some individual sub-exposures are deemed relevant, they should be determined more granularly and included in the data reported. Paragraph 143 Conduct-related risk and associated litigation costs – projection of stressed conduct losses One respondent mentioned that this paragraph is not quite in line with accounting policy if ‘expected losses’ is intended to mean the statistical probability-weighted concept. There is a recognition threshold of ‘more likely than not’ that needs to be met before a provision needs to be considered. The respondent believes that IAS 37 covers this. For the guidelines, the respondent would suggest replacing the final text with ‘projected stressed conduct losses in excess of amounts provided for should be included in the bank’s assessment of potential capital needs’. Another respondent mentioned that it should be clearly stated that the requirements specified in this paragraph are addressed to banks that do not use an internal model for computing stress tests for operational risk. Another respondent requested clarification on how reputational loss, which is to be explicitly separated from operational risk and not assessed quantitatively, should be taken into account. The guidelines mention that, when measuring conduct-related risk, institutions should consider (a) the uncertainty around provisions or expected losses originating from conduct-related events; and (b) extreme losses associated with tail risks (unexpected losses). Institutions should assess their capital needs under such events and scenarios and should also take into account the reputational effect of conduct losses. In principle, expected losses from known conduct-related issues should be covered by provisions and included in the P&L account. Nevertheless, the operational risk requirements allow a deviation from the ‘more likely than not’ separator and promote the inclusion of losses earlier or on a higher level, the unexpected losses are quantified and covered by capital requirements from the institution. The paragraph could be changed to clarify the last sentence by adding that the possible excess amounts after the projection of stressed conduct-related losses should be included in the institution’s assessment of potential capital needs. The EBA considers that the paragraph does not apply only to banks that do not use an internal model for computing stress tests for operational risk. Nevertheless, the EBA considers that the Paragraph 143 changed to provide clarification regarding the projection of stressed conduct losses.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING requirements for conduct-related risk stress testing are basically covered by institutions applying an internal model for operational risk. However, in the same way that section 4.7.4 Operational risk might need some fine tuning, section 4.7.5 might also require some adaptations. Reputational loss is a separate risk category from operational risk, but reputational risks can be a consequence of different risks (including operational risk) as expressed throughout the guidelines. If relevant, reputational risk should be included in ICAAP and the stress test as an individual risk category or within the limits of regulatory discretion and added to one of the other categories – deviating from the Pillar 1 definitions. Paragraph 144 (previously paragraph 142) Conduct-related risk and associated litigation costs – insufficient provisions One respondent observed that paragraph 142 includes the requirement to assess the impact of changes in the expected future conduct-related risk losses to be covered by capital and the capital plan. While the respondent does not disagree with this requirement, the respondent believes that this is a general principle that covers all risks, and conduct-related risk is no different from any other risks. The respondent believes that this point is made elsewhere in the CP and if the EBA considers it necessary to state this requirement that it should do so within the general guidelines earlier in the CP. Another respondent mentioned that, as is known, future losses are duly covered by means of provisioning under accounting rules. The respondent does not consider it appropriate to assess expected losses in excess of existing accounting provisions and factor these into projections. The guidelines mention that, in order to capture the risk that the provisions are insufficient or timely inconsistent, institutions should assess expected losses from conduct-related risk in excess of existing accounting provisions and factor these into their projections. Where appropriate, institutions should assess whether or not future profits will be sufficient to cover these additional losses or costs in the scenarios and incorporate this information into their capital plans. This requirement is mentioned to highlight the importance of the link between the possible expected losses from conduct-related risk – as part of the legal risk under the scope of operational risk – in excess of existing accounting provisions and the possible need to assess future profits to cover these additional losses or costs. In addition, it is also important to mention that such information should be clearly mentioned in institutions’ capital plans. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Paragraph 144 Conduct-related risk – future losses and provisioning One respondent mentioned that future losses are duly covered by means of provisioning under accounting rules. Nonetheless, the respondent does not consider it appropriate to assess expected losses in excess of existing accounting provisions and factor these into projections. The guidelines mention that in order to capture the risk that the provisions are insufficient or timely inconsistent, institutions should assess expected losses from conduct-related risk in excess of existing accounting provisions and factor these into their projections. Where appropriate, institutions should assess whether or not future profits will be sufficient to cover these additional losses or costs in the scenarios and incorporate this information into their capital plans. In general, it would be appreciated if the provisioning in accounting and operational risk databases were to run in parallel. Unfortunately, the EBA has observed that accounting provisions are often only created shortly before the end of the fiscal year (this is not always sufficient for operational risk management purposes) and accounting rules often require provisions only if the probability of a loss is above 50%. A potential litigation loss of EUR 1 billion with a probability of 45% can be rejected in some accounting systems, but should be included in risk management. Additional supporting reasons are the continuous underestimation of litigation loss potentials and risks and the reluctance to account for losses especially in Anglo-Saxon litigation cases until a settlement is final. No change. Paragraph 146 (previously paragraph 144) Conduct-related risk and associated litigation costs – estimate for an One respondent mentioned that paragraph 144 stipulates requirements for an institution’s ICAAP. These requirements do not directly refer to an institution’s stress testing programme or processes and should therefore be excluded. Another respondent mentioned that this point should be limited to material risks, i.e. only risks above a certain threshold, so that only the material events are documented. There should also be an option to dispense with the The guidelines mention that in rare cases where an institution is unable to provide an estimate for an individual conduct-related risk because of the extent of uncertainty, institutions should clarify that this is the case and provide evidence and assumptions supporting their assessment as part of their ICAAP. The EBA considers that the paragraph provides guidance for rare cases. In general, an institution should be able to provide a Paragraph 146 (previously paragraph 144) changed to provide clarification.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING individual conductrelated risk disclosure of figures if this is legally disadvantageous (e.g. because it could be viewed as an admission of guilt). quantification on at least a best-effort basis The paragraph could be clarified by deleting ‘as part of their ICAAP’. The EBA considers that the word ‘material’ could be added. Paragraph 151 Liquidity risk – risk factors Two respondents noted that they would welcome clarification as to whether or not the list of risk factors specified in this paragraph serves as a list of liquidity risk drivers for firms to measure themselves against. The guidelines mention that institutions should analyse risk factors relating to both asset- and liability-related items, as well as to off-balance-sheet commitments, and that comprise, but are not limited to (with several examples): (a) retail deposit run-offs; (b) secured and unsecured wholesale funding; (c) contingent cash flows/off-balance-sheet items; (d) encumbrance and marketability of assets; and (e) credit pipelines. The paragraph could be changed to clarify that institutions should analyse and measure themselves against risk factors. Paragraph 151 changed to provide clarification regarding risk factors. Paragraph 153 Liquidity risk – sensitivity analyses Two respondents mentioned that it is not clear from the paragraph what this requirement entails. The respondent would welcome clarification of whether or not the paragraph sets out the approach for selecting liquidity risk drivers. The guidelines mention that institutions should subject these risk factors to sensitivity analyses which in turn should provide the appropriate quantitative background information for the design of scenarios. The paragraph specifies the need for sensitivity analysis and scenario selection. The EBA considers that the guidelines need to allow a sufficient degree of discretion when institutions set out the approach to selecting liquidity risk factors. No change. Paragraph 152 Liquidity risk – interest rate shocks One respondent mentioned that ‘material’ should be added to interest rate shocks. The guidelines mention that institutions’ analysis of risk factors should take into account, but should not be limited to (among other aspects): (a) the impact of macroeconomic conditions, e.g. the impact of interest rates shocks on contingent cash flows. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING The EBA considers that it is necessary to cover interest rate shocks in general, not only material shocks. Paragraph 152 Liquidity risk – currency risk One respondent mentioned that only ‘significant’ currencies should be considered. The guidelines mention that institutions’ analysis of risk factors should take into account, but should not be limited to (among other aspects): (b) the currency of assets and liabilities including off-balance-sheet items, to reflect convertibility risk and possible disruptions in the access to FX markets. The EBA considers that it is necessary to cover currency risk in general, not only significant currencies. No change. Paragraph 155 Liquidity risk – time horizons Two respondents would welcome further clarification on the requirement related to time horizons for the institution’s stress testing. The paragraph should clarify whether the EBA’s expectation is for all internal stress tests to include more prolonged stress assumptions or whether this is a general requirement that can be implemented in relation to specific risks where prolonged time horizons would add value to the stress testing results. Another respondent asked whether or not, given the requirement of paragraphs 153 and 154 of a liquidity risk stress test covering a time horizon of up to at least 12 months, the stress should affect the net stable funding ratio as well. The guidelines mention that institutions should design different time horizons in their stress testing: the time horizons should range from overnight up to at least 12 months; there should also be separate stress tests relating to intraday liquidity risk. The time horizon should display, for example, a short acute phase of stress (up to 30 days in order to cover such periods without having to change the business model) followed by a longer period of less acute but more prolonged stress (between 3 and 12 months). The paragraph states the different time horizons and does not call for all internal stress tests to include more prolonged assumptions. No change. Paragraph 155 Liquidity risk – time horizons Two respondents asked if this paragraph relates to the runoff of term liabilities (e.g. capital markets) beyond the 8- week horizon. The guidelines mention that institutions should combine the stress of the short- to medium-term liquidity risk with a stress of funding risk, considering a time horizon of at least 12 months. Funding risk is defined in the Guidelines on common procedures and methodologies for the SREP. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING Paragraph 158 Liquidity risk – design of scenarios Two respondents mentioned that liquidity stress is usually triggered by another stress event (e.g. large loss, fraud), which will be described in the stress test. It would be helpful if the guidelines could provide some practical guidance with respect to the exact implementation of this paragraph. Would a scenario description that includes the applicable risk types for the liquidity stress suffice? The guidelines mention that in the design of scenarios, institutions should consider the impact of stress events for other risk types, e.g. credit risk losses and reputational risk events, on their liquidity position, and the possibility of spillovers between institutions. No change. Paragraph 159 Liquidity risk – frequency of the predicted net cash flows Two respondents mentioned that they would welcome further clarity related to the frequency of the predicted net cash flows to ensure appropriate application. One of the respondents asked if the intention of this paragraph is to ensure that the frequency of future cash flow predictions is daily for the entire stress period foreseen in the scenario. The guidelines mention that the main methodology used for calculating the magnitude of the impact should be the net cash flow profile. For each scenario, at each stress level, the institution identifies cash inflows and outflows that are projected for each future time period and the resulting net cash flows. Institutions should consider the lowest cumulative point of net cash flows within the time period assessed in each given scenario. The EBA considers that the guidelines need to allow a sufficient degree of discretion and should not set out specific requirements regarding the frequency of cash flows, since these should be determined based on individual portfolio and business model characteristics. No change. Paragraph 160 (previously paragraph 158) Liquidity risk – solvency and profitability One respondent mentioned that it would welcome further guidance in relation to point (d) of this paragraph to clarify how the liquidity stress tests are linked and/or integrated with the capital stress tests when assessing solvency/profitability. Another respondent noted that paragraph 158(d) mentions the ‘survival horizon’ and asked if an example of the computation of this metric could be provided? The guidelines mention that institutions should extend the analysis, if appropriate, to other metrics, such as: (a) liquidity ratios and other metrics used in the framework should include, but may not be limited to, supervisory liquidity ratios and metrics, in particular the liquidity coverage ratio and net stable funding ratio; (b) their available liquidity buffer, over and above the ratios referred to above, and other counterbalancing measures, i.e. their counterbalancing capacity, for each stress scenario. Stress testing of this metric should be accompanied by
an assessment of the impact on the proportion and nature of encumbered assets; (c) the survival horizon of the institution as derived from its No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING counterbalancing capacity, i.e. the institution’s ability to hold, or have access to, excess liquidity over short-term, medium-term and long-term time horizons in response to stress scenarios as defined in the EBA Guidelines on common procedures and methodologies for SREP, and stressed cash flows, taken jointly, before and after the impact of counterbalancing measures; and (d) solvency and profitability. Paragraph 161 (previously paragraph 159) Liquidity risk – counterbalancing effects provided by central banks (monetary policy) One respondent mentioned that it would welcome more clarity about the EBA’s definition of central bank effects. Another respondent mentioned that it would welcome clarity regarding the definition of the counterbalancing effects provided by central banks (monetary policy). Is this a reference to quantitative easing or a reference to day-to-day central bank facilities and facilities? Another respondent mentioned that the requirement to take into account central bank interventions (paragraph 159) should be better specified, so as to make clear what assumptions will be deemed acceptable. The guidelines mention that when applying the different stress scenarios, institutions should assess and highlight counterbalancing effects provided by central banks (monetary policy) and adopt a conservative approach. The EBA considers that it is not a reference to any particular instrument or action from central banks but a reference to all possible instruments in general. In addition, it is out of the scope of these guidelines to define acceptable assumptions of institutions. No change. Paragraph 162 Liquidity risk – currencies Two respondents suggested aligning the guidelines with the liquidity coverage ratio delegated act to include all material currencies. The guidelines mention that liquidity stress test metrics should, if appropriate, include a granularity per currency to allow the analysis of currency-specific assumptions in scenarios (e.g. volatility in exchange rates or currency mismatches). The paragraph could be clarified in order to include all material currencies. Paragraph 162 changed to provide clarification regarding currencies. Paragraph 164 Interest rate risk from non-trading activities One respondent mentioned that more details are expected about the requirements concerning NII and EVE measurements. The guidelines mention that the section is without prejudice to EBA Guidelines on interest rate risk arising from non-trading activities. See the EBA Guidelines on interest rate risk arising from No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING non-trading activities for additional details regarding the requirements concerning NII and EVE measurements. Paragraph 168 Interest rate risk from non-trading activities – spread risk and option/behavioural risks Two respondents mentioned that this paragraph requires both a qualitative and a quantitative clarification, in particular with respect to spread risk. The two respondents would also welcome more information on how option/behavioural risks need to be stressed. The guidelines mention that institutions should consider the following elements: (a) the spread risk, which arises from reference rate mismatching between time-matched funding and investments; (b) early termination risks included in contracts with an embedded option, which might force the institution into a new transaction on less favourable terms. No change. Paragraph 169 Interest rate risk from non-trading activities – second order effects Two respondents mentioned that they would welcome further guidance on the expectations of which second-order effects need to be covered and how they should be calculated (in particular with respect to correlation risks). The guidelines mention that institutions should be aware of potential indirect interest rate effects triggering losses elsewhere (e.g. that a pass-through onto lending rates could trigger further credit risk losses because of a deterioration in customers’ ability to pay). The EBA considers that which second-round effects need to be covered is sufficiently clearly stated in this paragraph. In general, as stated in paragraph 101, the EBA expects second-round effects to be considered to the extent possible. No change. Paragraph 170 (previously paragraph 168) Interest rate risk from non-trading activities – complex financial instruments Two respondents suggested adding a more detailed description of ‘less complex’ and ‘more complex’ financial instruments. Another respondent asked if the wording of paragraph 168 could be clarified, as it would seem to envisage different types of IRR stress tests for different types of instruments. The guidelines mention that, where less complex financial instruments are employed, institutions should calculate the effect of a shock using sensitivity analysis (without the identification of the origin of the shock, and by means of the simple application of the shock to the portfolio). Where an institution uses more complex financial instruments on which the shock has multiple and indirect effects, it should use more advanced approaches with specific definitions of the adverse (stress) situations reflecting relevant idiosyncratic risks. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING The EBA considers that the guidelines need to allow a sufficient degree of discretion and that it is not the aim of the guidelines to provide an exhaustive list of instruments. Paragraph 171 Concentration risk Two respondents mentioned that it would be helpful to specify in the guidelines that concentration risk elements are captured as part of the Pillar 2 process and not as a standalone stress testing category. The guidelines mention that stress testing should be a key tool in the identification of concentration risk, as it allows institutions to identify interdependencies between exposures, which may only become apparent in stressed conditions as well as hidden concentrations. The EBA considers that concentration risk elements are expected to be considered part of the stress testing programme/framework, since it can be a major source of vulnerability, and not only captured as part of the Pillar 2 process. Paragraph 171 changed to provide clarification regarding concentration risk. Paragraph 174 (previously paragraph 172) Concentration risk – changes in the business environment One respondent mentioned that, with regard to concentration risk, correlations between risk factors are to be increased and extreme changes in risk parameters are to be stressed, taking into account second-round effects in the process (paragraph 172). Such deliverables can only be computed on a statistically uncertain basis and do not lead to more acceptance of stress testing among decision-makers in institutions. The guidelines mention that stress tests should take into account changes in the business environment that may occur and that would lead to the materialisation of concentration risk. In particular, stress tests should consider unusual but plausible changes in correlations between various types of risk factors as well as extreme and unusual changes in risk parameters, going beyond single risk factors, to look at scenarios that take account of interrelated risk factors and that feature not only first round but also feedback effects. The EBA considers that the paragraph is clear and that institutions have the opportunity to demonstrate the quality and limitations of the calculations when taking into account changes in the business environment that may occur and that would lead to the materialisation of concentration risk. No change. Paragraph 177 One respondent mentioned that the mention of specific concentration risk indicators in paragraph 175 (HerfindahlThe guidelines mention that in order to assess the ex ante level of concentration risk and/or impact of the scenario on the No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING (previously paragraph 175) Concentration risk – indicators Hirschman Index (HHI) and Gini coefficients) puts pressure on institutions to justify themselves if they do not use these indicators. It would be better to not mention any indicators here. These indicators should, at any rate, only be mentioned as possible aids to analysis and not specified in the form of an exhaustive list. Furthermore, the respondent stated that established indicators such as marginal VaR are appropriate and adequate for capturing concentration risk in credit risk. concentration level, institutions should, where appropriate, consider more or less complex measures, for instance the HHI and Gini coefficients. The EBA considers that the concentration risk indicators mentioned in the paragraph are just examples of possible indicators that may contribute to the analysis (not an exhaustive list). Paragraph 179 FX lending risk – unhedged borrower Two respondentssuggested that the definition of ‘unhedged borrower’ in the FX lending risk area be aligned with the definition of the final EBA GL/2013/02. One of the respondents above also suggested to allow for a materiality threshold to determine whether FX lending risk is relevant for an institution. Another respondent mentioned that FX lending to ‘unhedged borrowers’ should be confined expressly to retail clients and SMEs (similar to paragraph 2 of the Guidelines on capital measures for foreign currency lending to unhedged borrowers under the SREP of 20 December 2103). The respondent mentions also that the implementation of the Guidelines on capital measures for foreign currency lending to unhedged borrowers under the SREP (paragraph 9) is required from a materiality threshold of 10%: ‘These guidelines apply on an institution-by-institution basis wherever the following threshold of materiality is met:
Loans denominated in foreign currency to unhedged borrowers constitute at least 10 % of an institution’s total loan book (total loans to non-financial corporations and households), where such total loan book constitutes at least 25 % of the institution’s total assets.’ Only once this The guidelines mention that institutions should take into account that FX lending risk: (a) may arise from the unhedged borrower’s inability to service debt denominated in currencies other than the currency of the Member State in which the institution has been authorised; (b) is related to pure credit and FX market risk; (c) is characterised by a non-linear relationship of credit and FX market risk components; (d) is influenced by the general exchange rate risk; and (e) may arise from conduct-related risk. The EBA GL/2013/02 was repealed with effect from 1 January 2016. However the concept was included in EBA/GL/2014/13. The EBA considers that the paragraph could be clarified to specify that ‘unhedged borrower’ means ‘retail and SME borrowers without a natural or financial hedge which are exposed to a currency mismatch between the loan currency and the hedge currency’, as defined in EBA/GL/2014/13. The EBA considers that the guidelines need to allow a sufficient degree of discretion when institutions set out the materiality to determine whether FX lending risk is relevant for institutions, so no minimum threshold is defined. Paragraph 179 changed to provide clarification regarding the definition of ‘unhedged borrower’.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING threshold is exceeded do significantly expanded risk management requirements – stress testing, for example – apply. In respondent views, this materiality threshold should be taken into account in the present consultation paper. The respondent believesthis is necessary to ensure uniformity in the treatment of FX lending to unhedged borrowers under the SREP. Paragraph 184 (previously paragraph 182) FX lending risk – items to take into account One respondent understands that the intention behind the guidance on this matter is in light of certain experiences by certain institutions in some countries. The respondent is of the opinion that these matters are best dealt within the modelling of the input values, PD, LGD, EaD and thus the guidelines on these matters should be incorporated where appropriate in other RTS. Two respondents mentioned that according to paragraph 182(e) IRB approach models should reflect FX risks by increased risk weights. The respondent mentioned that such a requirement would need to be formulated in the CRR rather than in a stress guideline and should be deleted in the guidelines given that CRR is not addressing this requirement. The guidelines mention that when stress testing the FX lending risk, institutions should take into account at least: (a) the type of exchange rate regime and how this could impact on the evolution of the FX rate between domestic and foreign currencies; (b) the sensitivity impact of exchange rate movements on the borrower’s credit rating/score and debt servicing capacity; (c) the potential concentrations of lending activity in a single foreign currency or in a limited number of highly correlated foreign currencies; (d) the potential concentrations of lending activity in some specific sectors of the economy, in the country currency, and the corresponding evolution of such sectors highly correlated with foreign currencies; and (e) the ability to secure financing for this type of portfolio. For institutions applying internal models for the calculation of credit risk capital requirements, the additional risk related to lending in FX currencies should be reflected in higher risk weights of such assets. The non-exhaustive list of variables used in the models should include interest rates disparities, loan LTV, currency cross correlation and volatility. The EBA considers that some items could, indeed, possibly be dealt with within the modelling areas. However, the guidelines need to mention these items in a broader way, and not just as specifically incorporated through modelling and risk parameters such as PD, LGDs, EADs, etc. Among many reasons, many No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING institutions do not use internal models for all the possible items, and the principle of proportionality should also be considered. The EBA considers that, regardless of the implications for institutions applying internal models and calculating credit risk capital requirements, the additional risk related to lending in FX currencies should also be reflected in the results of stress testing (e.g. additional losses). Paragraph 186 (previously paragraph 184) FX lending risk – legal regime and respective jurisdiction One respondent considers that paragraph 184 requires an institution to make a judgement on all jurisdictions in which it has an obligor with an exposure to currencies other than the local currency. This even requires a judgement on each Member State of the EU as well as G20 countries, etc. The respondent considers that this is an unreasonable burden on an institution. It may be helpful for the guidelines to clarify that this standard applies to only countries with fixed/pegged exchange rate policies. The guidelines mention that, while assessing the potential impact of FX lending on profitability in a certain scenario, institutions should, where appropriate, include the legal regime and the relevant jurisdiction, which may force institutions to denominate FX lending into domestic currency at exchange rates significantly below market ones. The EBA considers that the paragraph already mentions that the inclusion of the legal regime and the relevant jurisdiction should be done only where appropriate. The EBA considers that paragraph 184 does not require an institution to make a judgement on all jurisdictions in which it has an obligor with an exposure to currencies, but only where appropriate. No change. Paragraph 187 Application of stress testing programmes – stress testing for ICAAP/ILAAP purposes One respondent mentioned that the requirement would appear to be to conduct stress tests in which liquidity and capital stresses interact and may result in feedback loops. The respondent is of the opinion that this adds a level of complexity to the stress testing exercise. The guidelines appear to acknowledge in paragraph 96 that ‘Due to the different objectives of the two sets of reversed stress tests the stress tests for ICAAP and ILAAP purposes The guidelines mention that, as part of ICAAP and ILAAP, institutions should ensure that they have enough capital and liquidity resources to cover for the risks that institutions are, or might be, exposed to, and ensure the appropriate allocation of capital and liquidity resources across the entities of an institution over the economic cycle. This assessment should be reflected in the capital and liquidity plans that institutions should submit to the competent authorities as part of their ICAAP and ILAAP information. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING and recovery planning should not be interlinked but compared to one another. ‘ Although the respondent agrees with the guidelines that recovery planning and reverse stress testing for ICAAP and ILAAP purposes should not be interlinked, the respondent encourages a review of the guidelines with respect to the mixing of ICAAP and ILAAP as set out in section 4.8.1. – Application of stress testing programmes. The respondent’s preference is for the EBA to provide guidance for institutions on how to develop consistent scenarios that stress liquidity and capital separately and then to assess the overall impact. This may allow an assessment of where vulnerabilities may be. One respondent mentioned that it would appreciate a rephrasing of this paragraph to restrict legal entity stress requirements to the most significant entities only. Global SIBs in particular face having: (a) many legal entities; and (b) entities that do not operate under the consolidated group regime but operate under the local regulatory framework. As a consequence, a simple breakdown of group level stress results into results for all legal entities is not only tedious but does not generate the locally required metrics. The respondent would suggest that the EBA reconsider this requirement. The EBA considers that the section 4.8.1., Stress testing for ICAAP/ILAAP purposes, does not require stress tests to be conducted in which liquidity and capital stresses interact and may result in feedback loops. The section does not mention any need for interlinkage between ICAAP and ILAAP to estimate corresponding impacts. The principle of proportionality is recognised and applies to all aspects of these guidelines, including the methodology, as well as the frequency and the degree of detail of the stress tests. The Background and rationale section and Part 4 – Institutions’ stress testing – contain very clear statements on proportionality instead of restricting the guidelines to the most significant entities only. Paragraph 188 Appropriate degree of severity of scenarios Two respondents mentioned that any evaluation of the capital plan reliability under stress conditions should take into account scenario severity and occurrence probability and that assessing planned capital requirements based on scenarios with extremely low probability of occurrence should be avoided. The EBA considers that additional clarification could be added by mentioning that the evaluation of the capital plan reliability under stressed conditions should take into consideration scenario severity and occurrence probability. Paragraph 188 changed to provide clarification regarding the evaluation of the

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING capital plan reliability. Paragraph 189 (previously paragraph 187) Application of stress testing programmes – stress testing for ICAAP/ILAAP purposes One respondent mentioned that paragraph 187 creates uncertainty around the exact application, given that internal stress testing models for material risks and sub-categories vary by institution. The respondent would suggest adding some wording in the guidelines in order to ensure that firms can continue to apply their internal stress testing methodology. Another respondent mentioned that paragraph 187, point (c), for globally active institutions that also have to use ICAAP in the APAC region, the requirement to perform ‘comprehensive institution-wide stress testing … reflecting all entities’ poses considerable problems. The APAC ICAAP is, as has been demonstrated, locally subject to other rules that are not compatible with the European approach. Should European and APAC rules not be aligned, the respondent requested deletion of this paragraph. The same respondent mentioned that, in paragraph 187, point (d), a minimum period for ICAAP stress tests makes no sense because the ICAAP should cover all overarching scenarios, in addition to those with a rapid impact. At best, a requirement to at least assess a scenario with a minimum duration of two years makes sense. In addition, it should be explained how the two-year time horizon is to be understood. Does it mean a rolling period of two years from the date on which the stress test is set up, the next two accounting reference dates, or the earliest future accounting reference date that is more than two years after the date of the stress test? The guidelines mention that, in addition to the general requirements related to institutions’ stress testing programmes specified in these guidelines, stress tests used for ICAAP/ILAAP purposes should meet the following specific requirements: (a) institutions should cover all material risk categories (and subcategories) that the institutions are exposed to with regard to both on- and off-balance-sheet assets and liabilities in relation to all material portfolios or sectors/geographies, including relevant structured entities; (b) a range of scenarios should be considered including at least an adverse economic scenario that is severe but plausible, such as a severe economic downturn and/or a market wide and idiosyncratic shock to liquidity; (c) ICAAP and ILAAP stress testing should be performed through comprehensive institution-wide stress testing and reflect all entities for which ICAAPs or ILAAPs are required; (d) ICAAP and ILAAP stress tests should cover the same forward-looking period as the institution’s ICAAP and ILAAP, respectively, and be updated at least as regularly as the ICAAP and ILAAP; ICAAP stress tests should cover a period of at least two years. The previous guidelines (GL32) published in 2010 remain largely valid. The EBA understands the
challenges in relation to the further development of stress testing programmes based on best practices and that these go beyond the status quo for many institutions. The EBA recognises that institutions after the application date will continue to develop and enhance their systems and processes to meet supervisory expectations. The institutions will apply their No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING internal stress testing methodology according to supervisory expectations. These guidelines aim to achieve convergence of the practices followed by institutions and competent authorities for stress testing across the EU and are not subject locally to other rules that are not compatible with the EU approach. The EBA considers that the guidelines need to allow a sufficient degree of discretion with regard to the implementation of the two-year time horizon. Paragraph 189 Stress tests used for ICAAP/ILAAP purposes – specific requirements One respondent mentioned that a clarification of ‘relevant structured entities’ and ‘material risk categories’ should be provided. The guidelines mention that, in addition to the general requirements related to institutions’ stress testing programmes specified in these guidelines, stress tests used for ICAAP/ILAAP purposes should meet the following specific requirements (among other aspects): (a) institutions should cover all material risk categories (and sub-categories) that the institutions are exposed to with regard to both on- and off-balance-sheet assets and liabilities in relation to all material portfolios or sectors/geographies, including relevant structured entities; (…). The EBA considers that relevant structured entities and material risk categories, in terms of current and potential risks, should be factored in, without an expected specific level. No change. Paragraph 189 Stress tests used for ICAAP/ILAAP purposes – specific requirements Two respondents mentioned that the frequency of stress tests is not clear (paragraphs 32 and 189). The guidelines mention that, in addition to the general requirements related to institutions’ stress testing programmes specified in these guidelines, stress tests used for ICAAP/ILAAP purposes should meet the following specific requirements (among other aspects): (d) ICAAP and ILAAP stress tests should cover the same forward-looking period as the institution’s ICAAP and ILAAP, No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING respectively, and be updated at least as regularly as the ICAAP and ILAAP; ICAAP stress tests should cover a period of at least two years. The requirement to cover a period of at least two years is only for ICAAP purposes. Paragraph 197 (previously paragraph 195) Application of stress testing programmes – management actions One respondent mentioned that the large number of stress tests will again be increased many times over if the impact of stress testing before and after management actions has to be explained (paragraph 195). The guidelines mention that institutions should explain the qualitative and quantitative impacts of the stress before and after mitigating management actions. The impact before management actions should include assumptions about strategy, growth and associated revenue, but exclude management actions that would not be available in a stress situation such as winding down a business line or raising capital. The previous guidelines (GL32) published in 2010 remain largely valid. The EBA understands the challenges with regard to the further development of stress testing programmes based on best practices and that these go beyond the status quo for many institutions. Comprehensive explanations of the impacts are not necessarily linked to the number of stress tests. No change. Paragraph 198 Management actions – credible management actions One respondent mentioned that what a credible management action is should be clarified. The guidelines mention that acceptable management actions will be subject to the guidance and judgement of competent authorities, and might include the following: (a) the review of internal risk limits; (b) the review of the use of risk mitigation techniques; (c) the revision of policies, such as those that relate to liquidity and funding or capital adequacy; (d) the reduction of distributions to shareholders; (e) the changes in the overall strategy and business plan and risk appetite; and (f) the raising of capital or funding. No change.

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING To assess possible responses to a stressed situation, institutions should identify the credible actions that are most relevant and when they would have to take them. Institutions should take into account that some management actions are required immediately and others are contingent on specific events happening, in which case clearly defined triggers for action should be identified beforehand. Management actions should be consistent with stated strategies and policies, for example in the context of stated dividend policies. Institutions should be conservative with regard to their ability to take mitigating management actions recognising the possible impact of the stressed scenarios on other markets. The EBA considers that it is not necessary to provide more details regarding the meaning of credible management actions. Responses were received in two public consultations on the draft guidelines on institutions’ stress testing from:

Association for Financial Markets in Europe (AFME)
Austrian Economic Chamber
BNP Paribas (BNPP)
British Bankers’ Association (BBA)
Building Societies Association (BSA)
Deutsche Bank (DB)
Euroclear
European Banking Federation (EBF)
European Federation of Building Societies (EFBS)
Finance Denmark
French Banking Federation (FBF)
German Banking Industry Committee (GBIC)
Intesa Sanpaolo
Italian Banking Association

FINAL REPORT ON GUIDELINES ON INSTITUTIONS’ STRESS TESTING
15) Nationwide Building Society (Nationwide)
16) Portuguese Banking Association (APB)
17) Santander
18) State Street Bank & Trust
19) Swedish Bankers’ Association (SBA)
20) UniCredit
21) EBA Banking Stakeholder Group (BSG)
In addition, four confidential responses were submitted.

Guidelines on institutions stress testing (EBA-GL-2018-04)

Lineage: In force