Stress-Test Scenarios: Preparing for the Unknown
Stress testing used to be something large banks did for the Federal Reserve's CCAR process. Today it is an expectation for institutions of every size — and the scenarios regulators want to see tested have grown significantly more complex than a simple rate shock.
The OCC's FY2025 Bank Supervision Operating Plan instructs examiners to evaluate whether institutions are stress-testing borrowers "most vulnerable to inflation and higher operating costs" — a deliberately forward-looking standard that requires scenario modeling, not just historical backtesting. Meanwhile, the NCUA's 2026 Supervisory Priorities Letter places interest rate risk and liquidity scenario analysis at the top of credit union examination priorities, with specific attention to how institutions respond when multiple adverse conditions emerge simultaneously.
Why Single-Variable Scenarios Are No Longer Enough
Traditional stress testing often focused on a single variable: what happens if rates rise 300 basis points? What happens if our largest borrower defaults? These exercises have value, but they create a false sense of preparedness. Real-world disruptions don't follow single-variable logic.
The Federal Reserve's supervisory framework — informed by successive crises including the 2008 financial crisis, the 2020 pandemic shock, and the 2023 bank stress events — has consistently moved toward multi-factor scenario modeling. The 2023 bank failures made clear that the interaction of interest rate sensitivity, concentrated deposit bases, and rapid information spread created a compounding dynamic that single-factor models missed entirely.
The Bank for International Settlements (BIS) has published extensively on the limitations of traditional stress testing frameworks, noting that correlation assumptions across risk categories tend to break down precisely during the stress events those models are meant to capture.
What Good Scenario Design Looks Like
Effective scenario planning begins with a realistic catalog of plausible adverse events — not worst-case fantasies, but credible stress conditions grounded in the institution's actual risk profile. The OCC provides a useful framework: scenarios should address "a full range of plausible interest rate scenarios," which means both rising and falling rate paths, with attention to the speed and duration of rate movements, not just the magnitude.
For credit unions, the NCUA has been specific: scenarios should address deposit runoff assumptions, loan maturity concentrations, and the impact of declining asset values on capital ratios — simultaneously. An institution that can model each of these in isolation but cannot show how they interact has not completed its stress testing program.
Beyond financial scenarios, the FFIEC's guidance and the OCC's operating plan now expect institutions to incorporate operational scenarios: a prolonged cyberattack, a critical vendor outage, or a geopolitical shock that disrupts supply chains and market conditions. The OCC explicitly instructs examiners to consider "geopolitical events that may have adverse financial, operational, and compliance implications" — meaning ERM programs need to connect macro-level external events to internal risk exposures.
Building the Scenario Library
A practical approach is to maintain a tiered scenario library organized by likelihood and severity:
Tier 1: High-probability, moderate-severity— scenarios that should inform quarterly risk reporting and are tied directly to concentration limits and appetite statements. Rate movement within a defined range, modest CRE value declines, deposit growth shortfalls.
Tier 2: Lower-probability, high-severity— the scenarios that test the institution's resilience rather than its normal operations. These are the events that should drive tabletop exercises, contingency funding plan updates, and capital planning conversations. Rapid rate reversal, significant CRE market dislocation, a critical vendor going offline.
Tier 3: Tail scenarios— low-probability, extreme-severity events that test the outer limits of the institution's capacity to survive and recover. These scenarios are less about prediction and more about identifying structural vulnerabilities.
Connecting Scenarios to Decisions
Regulators are clear that scenario results must connect to governance — not be filed as documentation. The Federal Reserve's supervisory framework, the OCC's operating plan, and the NCUA's priorities all point in the same direction: board and senior management should be able to demonstrate that stress results informed decisions about capital buffers, concentration limits, funding strategy, or operational investments.
A stress test that confirms the institution is fine and then gets filed is a missed opportunity. A stress test that surfaces a vulnerability and drives a documented board discussion about mitigation options is exactly what examiners are looking for.
Article References — Stress-Test Scenarios: Preparing for the Unknown
1. Office of the Comptroller of the Currency. Fiscal Year 2025 Bank Supervision Operating Plan. Washington, D.C.: OCC, October 2024. Available at:https://www.occ.gov/news-issuances/news-releases/2024/nr-occ-2024-111a.pdf
2. National Credit Union Administration. NCUA's 2026 Supervisory Priorities. Letter to Credit Unions, January 14, 2026. Available at:https://ncua.gov/regulation-supervision/letters-credit-unions-other-guidance/ncuas-2026-supervisory-priorities
3. Bank for International Settlements, Financial Stability Institute. 'Stress Testing — Executive Summary.' FSI Summaries. Basel: BIS. Available at:https://www.bis.org/fsi/fsisummaries/stress_testing.htm
4. Basel Committee on Banking Supervision. Principles for Sound Stress Testing Practices and Supervision. Basel: BIS, May 2009. (Final guidelines; consultative draft issued January 2009 as bcbs147.) Available at:https://www.bis.org/publ/bcbs155.pdf
5. Federal Deposit Insurance Corporation. 2025 Risk Review. Washington, D.C.: FDIC. Available at:https://www.fdic.gov/analysis/2025-risk-review.pdf