Expert Analysis

Litigation News and Analysis • Legislation • Regulation • Expert Commentary

BANK & LENDER LIABILITYWestlaw Journal

VOLUME 18, ISSUE 25 / MAY 6, 2013

Stress Testing Under Dodd-Frank: Benefits, Challenges and RequirementsBy Shaheen Dil and Greggy Samonte Protiviti Inc.

The onset of the global recession in the late 2000s and subsequent systemic issues such as the European debt crisis highlighted the fact that adverse events, although unlikely, seriously threaten not only the financial health of large companies, but also that of their peers, stakeholders and possibly the economies of the countries within which they operate. The nature of these adverse events underscores the importance of risk management techniques, which provide insight into an institution’s financial and operational circumstances under stressed scenarios. The regulatory response to the financial crisis consisted of a multipronged approach: stress tests, tightened definitions of capital and tougher requirements for both capital and liquidity. This article will focus on the first requirement: stress testing under the Dodd-Frank Wall Street Reform and Consumer Protection Act, 124 Stat. 1376.

Company-wide stress testing, in the context of a financial institution, refers to a variety of techniques used to assess the vulnerability of the institution and its components within realistic and probable scenarios to extreme and highly unlikely adverse scenarios, called “stress scenarios.” Under Section 165 of the Dodd-Frank, in October 2012, financial regulators from the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System and the Federal Deposit Insurance Corp. issued the final supervisory rules for company-wide stress testing. The final Dodd-Frank rules mandate company-run stress testing on the largest U.S. banks and set deadlines for the submission of stress-test results to the OCC and Fed.

REGULATORY REQUIREMENTS

Dodd-Frank stress-testing requirements vary between large banks with total assets exceeding $50 billion and smaller banks with assets between $10 billion and $50 billion.

Requirements for banks with total assets exceeding $50 billion

• AnnualDodd-Frankstresstestsofrevenues,losses,reservesandcapitalratiosbased on three different scenarios (baseline, adverse and severely adverse) jointly provided by the OCC and Fed.

WESTLAW JOURNAL BANK & LENDER LIABILITY

2 ©2013 Thomson Reuters

• SubmissionofDodd-Frankstress-testresultstotheOCCandtheFed.

• PublicdisclosureofDodd-Frankstress-testresultsundertheseverelyadversescenario.

• EstablishmentandmaintenanceofaninternalcontrolframeworktoensurethatDodd-Frank stress-testing processes are effective.

• Amid-cyclestresstestwithaminimumofthreescenarios—baseline,adverseandseverelyadverse—thataredevelopedbythebankitselfandarerelevanttothe bank’s business activities and risk exposures.

• Theright,reservedbyregulators,torequireadditionalscenariosiftheinternallydeveloped scenarios are deemed insufficient.

• Publicdisclosureofthemid-cyclestresstestsundertheseverelyadversescenario.

• Largerbanksmustmeetallthecyclerequirementscommencingin2013.

Requirements for banks with assets between $10 billion and $50 billion

• AnnualDodd-Frankstresstestsofrevenues,losses,reservesandcapitalratiosbased on three different scenarios (baseline, adverse and severely adverse) jointly provided by the OCC and Fed.

• SubmissionofDodd-Frankstress-testresultstotheOCCandFed.

• PublicdisclosureofDodd-Frankstress-testresultsundertheseverelyadversescenario.

• EstablishmentandmaintenanceofaninternalcontrolframeworktoensurethatDodd-Frank stress-testing processes are effective.

• Bankswithsignificant tradingactivitiesmaybe required to includeaglobal-market shock component in both the adverse and severely adverse scenarios.

• Asmallerbankthat isasubsidiaryofalargerbank($50billionormore)that isparticipating in the Dodd-Frank stress test may not be required to submit its own stress-test results if it is sufficiently covered in the parent company’s stress-test report.

• TheannualcycleofsmallerbankscommencesinNovember2013.

Adverse events, although unlikely, seriously threaten not only the financial health of large companies, but also that of their peers, stakeholders and possibly the economies of the countries within which they operate.

VOLUME18•ISSUE25•MAY6,2013

3©2013 Thomson Reuters

VALUE GAINED THROUGH STRESS TESTING

Stress testing is primarily a risk management tool that supports decision making. Therefore, implementing an effective stress-testing framework provides incremental value to an institution above and beyond regulatory compliance. The added incremental value includes:

• Anenhancedriskmanagementframeworkthroughincreasedaware-nessandunderstanding of adverse events (“black swan” events) and the impact of systemic risk.

• Optimizedcapitallevelsthroughmoreaccuratecalculationsofeconomiccapitalwithin a range of expected and unexpected scenarios.

• Enhanceddecision-makingcapabilitiesthroughaconsistentflowofinformation;in addition to risk management and capital adequacy, this can also be applied to decisions involving incom-plete information, such as new and emerging markets and product development.

HOW TO COMPLY

Smaller financial institutions ($10 billion or less) may find it expensive to comply with the new stress-testing requirements, since they may need to invest in building new capabilities. Larger banks already possess many of these capabilities, and therefore they may not require significant investments to construct a fully compliant stress-testing framework. This is because most large U.S. banks with assets exceeding $50 billion have already participated in supervisory stress-testing requirements set by the Comprehensive Capital Analysis and Review in November 2011.

The key to implementing a compliant stress-testing framework in a cost-efficient manner for both large and small banks is a strong risk management framework and alignment among the various functions that must work together to perform the stress tests—generallyrisk,finance,treasury,technologyandthelinesofbusiness.

4 KEY STEPS IN CONSTRUCTING AND IMPLEMENTING AN EFFECTIVE STRESS-TESTING FRAMEWORK

An effective stress-testing framework requires a strong governance structure, an effective and appropriately validated set of models, an agreed-upon set of relevant scenarios and a robust aggregation process. With this kind of framework, results can be used in a bank’s capital and liquidity planning process. For those institutions that are just beginning this undertaking, or for those looking to enhance their current stress-testing capabilities, we recommend a four-step approach: Establish a stress-testing governance structure, develop models, validate the models, and aggregate and use the results.

1. Establish a stress-testing governance structure

Develop policies, procedures and processes that clearly describe the management reporting structure, key roles and responsibilities and deliverables.

Determine the set of all applicable regulatory requirements. Each participating bank should create an inventory of all portfolios and income sources that make significant contributions to stress-test reporting requirements and contents.

Stress-testing requirements vary between large banks with total assets exceeding $50 billion and smaller banks with assets between $10 billion and $50 billion.

WESTLAW JOURNAL BANK & LENDER LIABILITY

4 ©2013 Thomson Reuters

Align the stress-testing framework with the risk management framework. This includes the development of stress-testing requirements and policies, full collaborationamongrisk,financeandlinesofbusiness—ensuringadequatesupportfromseniormanagementand theboard ofdirectors—anddetermining training,communication and integration requirements.

Assign responsibilities. Typically, the stress-testing exercise will be conducted by aquantitativegroupwithinthebankorwithineachportfolio; thisgroupmaybeamodel development or back office unit, depending on the approach chosen by the institution. Other business units, such as model validation and audit, can assist in ensuring that the framework and the methodologies supporting it are sound, well-documented and compliant.

2. Develop models

Create a model inventory for existing company models that can be stress tested, and identify portfolios for which stress-testing models need to be developed.

Set guidelines for the selection of data inputs.

Develop the stress-testing models. Common approaches for stress-testing models include:

• Bottom-upapproaches:Stressscenariosaffecttransaction-leveldata,suchasindividual loans, directly or indirectly. Transaction-level stress-test results are then aggregated for stress-test reports.

• Top-downapproaches:Stressscenariosaffectaggregateddata,suchastotalinvestment commercial real estate loans, directly or indirectly.

Stress testing is primarily a risk management tool that supports decision making.

VOLUME18•ISSUE25•MAY6,2013

5©2013 Thomson Reuters

• Hybridapproaches:Thesearebasedonacombinationoftop-downandbottom-up approaches, with the use of various approaches for different segments of a portfolio.

Develop model documentation concurrently with model development.

3. Validate the models

Validate and audit stress-testing models against regulatory requirements, as well as company policies and procedures. The key components to be validated include:

• Modelgovernance.

• Datacollectionandquality.

• Assumptions.

• Modeltheoryandtechniques.

• Modelimplementationandtesting.

• Reportinganduse.

Communicate and confirm the results of the model validation to appropriate internal stakeholders.

Take corrective action to resolve all critical findings from step one.

WESTLAW JOURNAL BANK & LENDER LIABILITY

6 ©2013 Thomson Reuters

4. Aggregate and use the results

Develop an aggregation and reporting process to collect stress-test results and ensure that regulatory reports are prepared, reviewed and submitted in an orderly and timely manner.

Integrate stress-test results within the capital adequacy and liquidity risk manage-ment processes.

CHALLENGES

First-time participants, especially banks with assets of $10 billion to $50 billion, may face significant resource requirements to meet implementation and reporting deadlines. In particular, banks with inadequate risk management frameworks to facilitate such an implementation may be dependent on external consultants and advisors to develop and validate stress-testing models. Key challenges, from a time and resource perspective, include the following:

• Ensuringadequateunderstandingofcomplexstress-testingmodelsbyseniormanagement and the board of directors, who are responsible for governing and overseeing the stress-testing process.

• Preparingadequate levelsofdocumentation for the stress-testingprocess,including policies, procedures, user’s guides and documentation of the model.

• Ensuringthatstress-testingmodelsareindependentlyandadequatelyvalidated.

An effective stress-testing framework requires a strong governance structure, an effective and appropriately validated set of models, an agreed-upon set of relevant scenarios and a robust aggregation process.

VOLUME18•ISSUE25•MAY6,2013

7©2013 Thomson Reuters

©2013 Thomson Reuters. This publication was created to provide you with accurate and authoritative information concern-ing the subject matter covered, however it may not necessarily have been prepared by persons licensed to practice law in a particular jurisdiction. The publisher is not engaged in rendering legal or other professional advice, and this publication is not a substitute for the advice of an attorney. If you require legal or other expert advice, you should seek the services of a competent attorney or other professional. For subscription information, please visit www.West.Thomson.com.

Shaheen Dil (L) is a managing director in the New York office of Protiviti Inc., a leading provider of independent internal audit and business and technology risk consulting services. She is responsible for the company’s model risk practice and capital management activities. She can be reached at shaheen.dil@protiviti.com. Greggy Samonte (R) is a senior consultant in the model risk and capital managementpracticeatProtiviti’sNewYorkoffice. Hecanbe reachedatgreggy.samonte@protiviti.com.

In addition, each participating bank will face model-related challenges when constructing and validating stress-testing models. Many banks faced these challengespriortotheintroductionofstress-testingrequirements;thismayfurtherexacerbate the detrimental effects of these issues on the accuracy and predictive power of existing models. The model-related challenges include:

• Banksmaynothavesufficientdatainappropriateformatstoconstructrobuststress-testing models. Substitute approaches, such as the use of external data orinterpolationfrominternaldata,mayneedtobeused;theseapproachescoulddraw more regulatory scrutiny.

• Banksmayalso facemodelandparameter risks, including theconstructionof models that are not conceptually or theoretically sound, incorrect model implementation and incorrect model usage.

In Protiviti’s work with many financial insti-tutions, we have noted 10 top issues that banks face in developing, implementing, validating and effectively using stress-testing models and frameworks to comply with regulatory requirements:

CONCLUSION

Tomaximizetheincrementalvalueofstresstesting,managementmustrecognizeitas an important component of the company’s risk management framework instead of a stand-alone regulatory requirement. Therefore, the focus should be on ensuring that stress testing is consistent with company risk management and implementing the stress-testing framework correctly. Overall, firms should evaluate the regulatory requirements within their institution’s capabilities, complexities and risk appetite to develop a program that will work for them.