CAPITAL—Federal Reserve Guidance on Supervisory Assessment of Capital Planning and Positions for LISCC Firms and Large and Complex Firms

This guidance provides the Federal Reserve’s core capital planning expectations for firms subject to the Large Institution Supervision Coordinating Committee¹ (LISCC) framework and other large and complex firms, building upon the capital planning requirements included in the Board’s capital plan rule and stress test rules. This guidance outlines capital planning expectations² for these firms in the following areas:

Further, this guidance provides detailed supervisory expectations on a firm’s capital planning process in the following appendices:

This guidance applies to U.S. bank holding companies and intermediate holding companies of foreign banking organizations that are either: (i) subject to the LISCC framework (referred to as a “LISCC Firm”) or (ii) have total consolidated assets of $250 billion or more or consolidated total on-balance sheet foreign exposure of $10 billion or more (referred to in this guidance as a “Large and Complex Firm”).³⁴ The guidance is effective immediately for bank holding companies that are subject to the capital plan rule as of January 1, 2016. The guidance will become effective for intermediate holding companies beginning on January 1, 2017, which is the date on which the capital plan rule applies to these firms.

The Federal Reserve has different expectations for sound capital planning and capital adequacy depending on the size, scope of operations, activities, and systemic importance of a firm. Concurrently with issuance of this guidance, the Federal Reserve is issuing separate guidance for U.S. bank holding companies and intermediate holding companies that have total consolidated assets of at least $50 billion but less than $250 billion, have consolidated total on-balance sheet foreign exposure of less than $10 billion, and are not otherwise subject to the LISCC framework (referred to as a “Large and Noncomplex Firm”). This separate guidance clarifies that expectations for LISCC Firms and Large and Complex Firms are higher than the expectations for Large and Noncomplex Firms.

Within the group of firms subject to this guidance, the Federal Reserve has significantly heightened expectations for the LISCC Firms. This guidance sets forth only minimum expectations, and LISCC Firms are consistently expected to exceed those minimum standards and have the most sophisticated, comprehensive, and robust capital planning practices for all of their portfolios and activities.

Sound capital planning for any firm begins with adherence to all applicable rules and regulations relating to capital adequacy. Three Federal Reserve regulations form the basis of the regulatory framework for capital positions and capital planning:

Regulation Q establishes minimum capital requirements and overall capital adequacy standards for Federal Reserve-regulated institutions. Among other things, Regulation YY establishes capital stress testing requirements for bank holding companies with total consolidated assets of $50 billion or more, including requirements to participate in the Federal Reserve’s annual supervisory stress test and conduct their own internal capital stress tests. The capital plan rule establishes general capital planning requirements for a bank holding company with total consolidated assets of $50 billion or more and requires a bank holding company to develop an annual capital plan that is approved by its board of directors.

This guidance provides the Federal Reserve’s core capital planning expectations for firms subject to this guidance, building upon the capital planning requirements in the Federal Reserve’s capital plan rule and stress test rules.⁵

Capital is central to a firm’s ability to absorb unexpected losses and continue to lend to creditworthy businesses and consumers. A firm’s capital planning processes are critical to its financial strength and resiliency. At LISCC Firms and Large and Complex Firms, sound capital planning is also critical to the stability and effective functioning of the U.S. financial system.

SR letter 12-17/CA letter 12-14, “Consolidated Supervision Framework for Large Financial Institutions,” outlines core expectations for sound capital planning for bank holding companies with total consolidated assets of $50 billion or more. This capital planning and positions guidance provides additional details around the Federal Reserve’s core capital planning expectations for LISCC Firms and Large and Complex Firms, building on the capital planning requirements included in the capital plan rule and the Board’s stress test rules.⁶ A firm should maintain a sound capital planning process on an ongoing basis, including in between submissions of its annual capital plan.⁷

The Federal Reserve expects a firm to have sound governance over its capital planning process. In general, senior management should establish the capital planning process and the board of directors should review and periodically approve that process.

A firm’s board of directors is ultimately responsible and accountable for the firm’s capital-related decisions and for capital planning. The firm’s capital planning should be consistent with the strategy and risk appetite set by the board and with the firm’s risk levels, including how risks at the firm may emerge and evolve under stress. The board must annually review and approve the firm’s capital plan.⁸

The board should direct senior management to provide a briefing on their assessment of the firm’s capital adequacy at least quarterly, and whenever economic, financial, or firm-specific conditions warrant a more frequent update. The briefing should describe whether current capital levels and planned capital distributions remain appropriate and consistent with capital goals (see section III.D, “Capital Policy”). In their briefing, senior management should also highlight for the board any problem areas related to capital planning identified by senior management, internal audit, or supervisors.

The board should hold senior management accountable for providing sufficient information on the firm’s material risks and exposures to inform board decisions on capital adequacy and actions, including capital distributions. Information provided to the board should be clear, accurate, and timely. The board should direct senior management to provide this information at least quarterly and whenever economic, financial, or firm-specific conditions warrant a more frequent update. The information presented to the board should include consideration of a number of factors, such as:

After receiving the information, the board should be in a position to understand the major drivers of the firm’s projections under a range of conditions, including baseline and stress scenarios.

The board should direct senior management to provide information about the firm’s estimation approaches, model overlays, and assessments of model performance (see Appendix A: Use of Models and Other Estimation Approaches; Appendix B: Model Overlays; and Appendix C: Use of Benchmark Models in the Capital Planning Process). The board should also receive information about uncertainties around projections of capital needs or limitations within the firm’s capital planning process to understand the impact of these weaknesses on the process. This information should include key assumptions and the analysis of sensitivity of a firm’s projections to changes in the assumptions (see Appendix D: Sensitivity Analysis and Assumptions Management). The board should incorporate uncertainties in projections and limitations in the firm’s capital planning process into its decisions on capital adequacy and capital actions. It should also review and approve mitigating steps to address capital planning process weaknesses.

The board should direct senior management to establish sound controls for the entire capital planning process. The board should approve policies related to capital planning, and review them annually. The board should also approve capital planning activities and strategies. The board of directors should maintain an accurate record of its meetings pertaining to the firm’s capital planning process.

Senior management should direct staff to implement board-approved capital policies, capital planning activities, and strategies in an effective manner. Senior management should make informed recommendations to the board regarding the firm’s capital planning and capital adequacy, including post-stress capital goals and capital distribution decisions. Senior management’s proposed capital goals and capital distributions should have analytical support and take into account the expectations of important stakeholders, including share holders, rating agencies, counterparties, depositors, creditors, and supervisors.

Senior management should design and oversee the implementation of the firm’s capital planning process; identify and assess material risks and use appropriate firm-specific scenarios in the firm’s stress test; monitor and assess capital planning practices to identify limitations and uncertainties and develop remediation plans; understand key assumptions used throughout a firm’s capital planning process and assess the sensitivity of the firm’s projections to those assumptions (see Appendix D: Sensitivity Analysis and Assumptions Management); and review the capital planning process at least quarterly.

Senior management should establish a process for independent review of the firm’s capital planning process, including the elements outlined in this guidance. The independent review process should be designed to identify the weaknesses and limitations of the capital planning process and the potential impact of those weaknesses on the process. Senior management should also develop remediation plans for any identified weaknesses affecting the reliability of capital planning results. Both the specific identified weaknesses and the remediation plans should be reported to the board of directors in a timely manner.

A firm should have a risk-management infrastructure that appropriately identifies, measures, and assesses material risks and provides a strong foundation for capital planning.⁹ This risk-management infrastructure should be supported by comprehensive policies and procedures, clear and well-established roles and responsibilities, and strong and independent internal controls. In addition, the risk-management infrastructure should be built upon sound information technology and management information systems. The Federal Reserve’s supervisory assessment of the sufficiency of a firm’s capital planning process will depend in large part on the effectiveness of the firm’s risk-management infrastructure and the strength of its process to identify unique risks under normal and stressful conditions, as well as on the strength of its overall governance and internal control processes.

A firm’s risk-identification process should include a comprehensive assessment of risks stemming from its unique business activities and associated exposures. The assessment should include on-balance sheet assets and liabilities, off-balance sheet exposures, vulnerability of the firm’s earnings, and other major firm-specific determinants of capital adequacy under normal and stressed conditions. This assessment should also capture those risks that only materialize or become apparent under stressful conditions.

The specifics of the risk-identification process will differ across firms given differences in organizational structure, business activities, and size and complexity of operations. However, the risk-identification process at all firms subject to this guidance should be dynamic, inclusive, and comprehensive, and drive the firm’s capital adequacy analysis. A firm should:

A firm should be able to demonstrate how material risks are accounted for in its capital planning process. For risks not well captured by scenario analysis, the firm should clearly articulate how the risks are otherwise captured and addressed in the capital planning process and factored into decisions about capital needs and distributions. The firm should also be able to identify risks that may be difficult to quantify and explain how these risks are addressed in the capital planning process. The firm should appropriately segment risks beyond generic categories such as credit risk, market risk, and operational risk.

The Federal Reserve expects a firm to seek input from multiple stakeholders across the organization (for example, senior management, finance and risk professionals, front office and line-of-business leadership) in identifying its material risks. In addition, a firm should update its risk assessment at least quarterly to reflect changes in exposures, business activities, and its broader operating environment.

A firm should have a sound risk-measurement process that informs senior management about the size and risk characteristics of exposures and business activities under both normal and stressful operating conditions. A firm is generally expected to use quantitative approaches supported by expert judgment, as appropriate, for risk measurement.

Identified weaknesses, limitations, biases, and assumptions in the firm’s risk-measurement processes should be assessed for their potential impact on the integrity of a firm’s capital planning process (see Appendix D: Sensitivity Analysis and Assumptions Management). A firm should have a process in place for determining materiality in the context of material risk identification and capital planning. This process should include a sound analysis of relevant quantitative and qualitative considerations, including, but not limited to, the firm’s risk profile, size, and complexity, and their effects on the firm’s projected regulatory capital ratios in stressed scenarios.¹⁰

A firm should identify how and where its material risks are accounted for within the capital planning process. The firm should be able to specify material risks that are captured in its scenario design, the approaches used to estimate the impact on capital, and the risk drivers associated with each material risk.

As part of its risk-measurement processes, a firm should identify and measure risk that is inherent to its business practices and closely assess the reliability of assumptions about risk reduction resulting from risk transfer or risk mitigation techniques (see Appendix D: Sensitivity Analysis and Assumptions Management). Specifically, the firm should critically assess the enforceability and effectiveness of any guarantees, netting, and collateral agreements. Assumptions about accessibility and valuation of collateral exposures should also be closely reviewed for reliability given the likelihood that asset values will change rapidly in a stressed market.

A firm should have a sound internal control framework that helps ensure that all aspects of the capital planning process are functioning as designed and result in sound assessments of the firm’s capital needs. The framework should include:

A firm’s internal control framework should support its entire capital planning process, including: the sufficiency of and adherence to policies and procedures; risk identification, measurement, and management practices and systems used to produce input data; and the models, management overlays, and other methods used to generate inputs to post-stress capital estimates. Any part of the capital planning process that relies on manual procedures should receive heightened attention. The internal control framework should also assess the aggregation and reporting process used to produce reports to senior management and to the board of directors and the process used to support capital adequacy recommendations to the board.

In addition, the control framework should include an evaluation of the firm’s process for integrating the separate components of the capital planning process at the enterprise-wide level.

A firm should have policies and procedures that support consistent and repeatable capital planning processes.¹¹ Policies and procedures should describe the capital planning process in a manner that informs internal and external stakeholders of the firm’s expectations for internal practices, documentation, and business line controls. The firm’s documentation should be sufficient to provide relevant information to those making decisions about capital actions. The documentation should also allow parties unfamiliar with a process or model to understand generally how it operates, as well as its main limitations, key assumptions, and uncertainties.

Policies and procedures should also clearly identify roles and responsibilities of staff involved in capital planning and provide accountability for those responsible for the capital planning process. A firm should also have an established process for policy exceptions. Such exceptions should be approved by the appropriate level of management based upon the gravity of the exception. Policies and procedures should reflect the firm’s current practices, and be reviewed and updated as appropriate, but at least annually. A firm should maintain evidence that management and staff are adhering to policies and procedures in practice.

A firm’s documentation should cover key aspects of its capital planning process, including its risk-identification, measurement and management practices and infrastructure; methods to estimate inputs to post-stress capital ratios; the process used to aggregate estimates and project capital needs; the process for making capital decisions; and governance and internal control practices. A firm’s capital planning documentation should include detailed information to enable independent review of key assumptions, stress testing outputs, and capital action recommendations.

Models used in the capital planning process should be reviewed for suitability for their intended uses. A firm should give particular consideration to the validity of models used for calculating post-stress capital positions. In particular, models designed for ongoing business activities may be inappropriate for estimating losses, revenue, and expenses under stressed conditions. If a firm identifies weaknesses or uncertainties in a model, the firm should make adjustments to model output if the findings would otherwise result in the material understatement of capital needs (see Appendix B: Model Overlays). If the deficiencies are critical, the firm should restrict the use of the model, apply overlays, or avoid using the model entirely.

A firm should independently validate or otherwise conduct effective challenge of models used in internal capital planning, consistent with supervisory guidance on model risk management.¹² The model review and validation process should include an evaluation of conceptual soundness of models and ongoing monitoring of the model performance. The firm’s validation staff should have the necessary technical competencies, sufficient stature within the organization, and appropriate independence from model developers and business areas to provide a critical and unbiased evaluation of the estimation approaches.

A firm should maintain an inventory of all estimation approaches used in the capital planning process, including models used to produce projections or estimates used by the models that generate final loss, revenue, expense, and capital projections.¹³ Material models should receive greater attention (see Appendix C: Use of Benchmark Models in the Capital Planning Process).¹⁴ The intensity and frequency of validation work should be a function of the importance of those models in generating estimates of post-stress capital.

Not all models can be fully validated prior to use in capital planning. However, a firm should conduct a conceptual soundness review of all models prior to their use in capital planning. If such a conceptual soundness review is not possible, the absence of that review should be made transparent to users of model output and the firm should determine whether the use of compensating controls (such as conservative adjustments) are warranted.

Further, a firm should treat output from models for which there are model risk-management shortcomings with caution. In addition, a firm should have compensating controls for known model uncertainties and apply well supported conservative adjustments to model results, as appropriate.

A firm should ensure that benchmark or challenger models that contribute to post-stress capital estimates or are otherwise used explicitly in the capital planning process are identified and subject to validation (see Appendix C: Use of Benchmark Models in the Capital Planning Process).

A firm should have internal controls that ensure the integrity of reported results and that make certain the firm is identifying, documenting, reviewing, and tracking all material changes to the capital planning process and its components. The firm should ensure that such controls exist at all levels of the capital planning process. Specific controls should ensure:

Many of the processes used to assess capital adequacy, including models, data, and management information systems, are tightly integrated and interdependent. As a result, a firm should ensure consistent change control oversight across the entire firm, in line with existing supervisory guidance.¹⁵ A firm should establish and maintain a policy describing minimum internal control standards for managing change in capital planning process policies and procedures, model development, information technology, and data. Control standards for these areas should address risk, testing, authorization and approval, timing of implementation, post-installation verification, and recovery, as applicable.

Internal audit should play a key role in evaluating capital planning and the elements described in this guidance to ensure that the entire process is functioning in accordance with supervisory expectations and the firm’s policies and procedures. Internal audit should review the manner in which deficiencies are identified, tracked, and remediated. Furthermore, internal audit should ensure appropriate independent review and challenge is occurring at all key levels within the capital planning process.

As discussed further in Appendix E: Role of the Internal Audit Function in the Capital Planning Process, internal audit staff should have the appropriate competence and influence to identify and escalate key issues. All deficiencies, limitations, weaknesses, and uncertainties identified by the internal audit function that relate to the firm’s capital planning process should be reported to senior management, and material deficiencies should be reported to the board of directors (or the audit committee of the board) in a timely manner.¹⁶

A capital policy is a firm’s written assessment of the principles and guidelines used for capital planning, issuance, usage, and distributions.¹⁷ This includes internal post-stress capital goals (as discussed in more detail below and in Appendix F: Estimating Impact on Capital Positions) and real-time targeted capital levels; guidelines for dividend payments and stock repurchases; strategies for addressing potential capital shortfalls; and internal governance responsibilities and procedures for the capital policy. The capital policy must be approved by the firm’s board of directors or a designated committee of the board.¹⁸

The capital policy should be reevaluated at least annually and revised as necessary to address changes to the firm’s business strategy, risk appetite, organizational structure, governance structure, post-stress capital goals, real-time targeted capital levels, regulatory environment, and other factors potentially affecting the firm’s capital adequacy.

A capital policy should describe the firm’s capital adequacy decision-making process, including the decision-making process for common stock dividend payments or stock repurchases.¹⁹ The policy should incorporate actionable protocols, including governance and escalation, in the event a post-stress capital goal, real-time targeted capital level, or other early warning metric is breached.

The policy should also include elements such as:

A firm should establish post-stress capital goals that are aligned with its risk appetite and risk profile, its ability to act as a financial intermediary in times of stress, and the expectations of internal and external stakeholders. Post-stress capital goals should be calibrated based on the firm’s own internal analysis, independent of regulatory capital requirements, of the minimum level of post-stress capital the firm has deemed necessary to remain a going concern over the planning horizon. A firm should also determine targets for real-time capital ratios and capital levels that ensure that capital ratios and levels would not fall below the firm’s internal post-stress capital goals (including regulatory minimums) under stressful conditions at any point over the planning horizon. For more details, see Appendix F: Capital Policy.

As part of its capital planning process, a firm should incorporate appropriately stressful conditions and events that could adversely affect the firm’s capital adequacy into its capital planning. As part of its capital plan, a firm must use at least one scenario that stresses the specific vulnerabilities of the firm’s activities and associated risks, including those related to the company’s capital adequacy and financial condition.²⁰ More generally, as part of its ongoing capital adequacy assessment, a firm should use multiple scenarios to assess a broad range of risks, stressful, conditions, or events that could impact the firm’s capital adequacy.

A firm should develop complete firm-specific scenarios that focus on the specific vulnerabilities of the firm’s risk profile and operations. The scenario design process should be directly linked to the firm’s risk-identification process and associated risk assessment. For those aspects of risks not well captured by scenario analysis, the firm should clearly articulate how the risks are otherwise captured and addressed in the capital planning process and factored into decisions about capital needs and distributions.

In developing its scenarios, the firm should recognize that multiple stressful conditions or events can occur simultaneously or in rapid succession. The firm should also consider the cumulative effects of stressful conditions, including possible interactions among the conditions and second-order or “knock-on” effects.

When identifying and developing the specific set of stressful conditions to capture in its stress scenarios, the firm should engage a broad range of internal stakeholders, such as risk experts, business managers, and senior management, to ensure the process comprehensively takes into account the full range of vulnerabilities specific to the firm.

A firm’s stress scenario should be supported by a detailed narrative describing how the scenario addresses the firm’s particular material risks and vulnerabilities, and how the paths of the scenario variables relate to each other. The narrative should describe the key attributes of the scenario, including any stress events in the scenario, such as counterparty defaults, large operational risk related events, and ratings downgrades. For more details, see Appendix G: Scenario Design.

A firm should employ estimation approaches that allow it to project the impact on capital positions of various types of stressful conditions and events. The firm’s stress testing practices should capture the potential increase in losses or decrease in pre-provision net revenue (PPNR) that could result from the firm’s risks, exposures, and activities under stressful scenarios. A firm should estimate losses, revenues, expenses, and capital using a sound method that relates macroeconomic and other risk drivers to its estimates. The firm should be able to identify the manner in which key variables, factors, and events in a scenario affect losses, revenue, expenses, and capital over the planning horizon. Projections of losses and PPNR should be done at a level of granularity that allows for the appropriate differentiation of risk drivers, while balancing practical constraints such as data limitations (see Appendix A: Use of Models and Other Estimation Approaches and Appendix D: Sensitivity Analysis and Assumptions Management).

The balance sheet projection process should establish and incorporate the relationships among revenue, expense, and on- and off-balance sheet exposures under stressful conditions, including new originations, purchases, sales, maturities, prepayments, defaults, and other borrower and depositor behavior considerations. A firm should also ensure that changes in its asset mix and resulting RWAs are consistent with PPNR and loss estimates. A firm should be able to identify key risk drivers, variables or factors in the scenarios that generate increased losses, reduced revenues, and changes to the balance sheet and RWAs over the planning horizon (see Appendix H: Risk-Weighted Asset (RWA) Projections).

A firm should estimate losses using a sound method that relates macroeconomic and other risk drivers to losses. A firm should empirically demonstrate that a strong relationship exists between the variables used in loss estimation and prior losses. When using supervisory scenarios, a firm should project additional scenario variables beyond those included in the supervisory scenarios if the additional variables would be more directly linked to particular portfolios or exposures. A firm should include a variety of loss types in its stress tests based on the firm’s exposures and activities. Loss types should include retail and wholesale credit risk losses, credit and fair value losses on securities, market and default risk on trading and counterparty exposures, and operational-risk losses.

a. Credit risk losses on loans and securities

A firm should develop sound methods to estimate credit losses under stress that take into account the type and size of portfolios, risk characteristics, and data availability. A firm should understand the key characteristics of its loss estimation approach. In addition, a firm’s reserves for each quarter of the planning horizon, including the last quarter, should be sufficient to cover estimated loan losses consistent with generally accepted accounting standards. A firm should account for the timing of loss recognition in setting the appropriate level of reserves at the end of each quarter of the planning horizon.

A firm should test credit-sensitive securities for potential other-than-temporary impairment (OTTI) regardless of current impairment status. The threshold for determining OTTI for structured products should be based on cash-flow analysis and credit analysis of underlying obligors.

b. Fair-value losses on loans and securities

As applicable, a firm should project changes in the fair value of loans and available-for-sale securities (and impaired held-to-maturity securities). The projections should be based on relevant risk drivers, such as changes in credit spreads and interest rates. The firm should ensure that the risk drivers appropriately capture underlying risk characteristics of the loan or security, including duration and the credit risk of the underlying collateral or issuer.

c. Market and default risks on trading and counterparty exposures

A firm should project how the stress affects mark-to-market values and the default risk of its trading and counterparty exposures. A firm should capture all of its trading positions and counterparty exposures, identify all relevant risk factors, and employ sound revaluation methods. As part of its scenario analysis, as described in greater detail in section III.E of this guidance “Incorporating Stressful Conditions,” a firm should use scenarios that severely stress the firm’s mark-to-market positions and account for the firm’s idiosyncratic risks.

d. Operational-risk losses

A firm should maintain a sound process for estimating operational risk losses in its capital planning process. Operational losses can rise from various sources, including inadequate or failed internal processes, people, and systems, or from external events (see Appendix I: Operational Loss Projections).

A firm should have a structured, transparent, and repeatable framework in place to develop credible loss projections under stress that takes into account the differences in loss characteristics of different types of operational loss events. The approaches used to project operational losses should be well supported and include scenario analysis.

In projecting PPNR, a firm should take into account not only its current positions, but also how its activities, business strategy, and revenue drivers may evolve over time under the varying circumstances and operating environments. The firm should ensure that the various PPNR components, including net interest income, non-interest income and non-interest expense, and other key items projected by the firm such as balance sheet positions, RWA, and losses, are projected in a manner that is internally consistent.

The ability to effectively project net interest income is dependent upon the firm’s ability to identify and aggregate current positions and their attributes; project future changes in accruing balances due to a variety of factors; and appropriately translate the impact of these factors and relevant interest rates into net interest income based on assumed conditions. Accordingly, a firm’s current portfolio of interest-bearing assets and liabilities should serve as the foundation for its forward-looking estimates of net interest income. Beginning positions, positions added during the planning horizon, and the expected behavior of those positions are critical determinants of net interest income. A firm should have the ability to capture these dynamic relationships under its stress scenarios, and should ensure all related assumptions are well supported (see Appendix D: Sensitivity Analysis and Assumptions Management).

Non-interest income is derived from a diverse set of sources, including fees, certain realized gains and losses, and mark-to-market income. Non-interest income generally is more susceptible to rapid changes than net interest income, especially if certain market measures move sharply. A firm’s projections should incorporate material factors that could affect the generation of non-interest income under stress, including the firm’s business strategy, the competitive landscape, and changing regulations.

Non-interest expenses include both expenses that are likely to vary with certain stressful conditions and those that are not. Projections of expenses that are closely linked to revenues or balances should vary with projected changes in revenue or balance sheet levels. Non-interest expense should be projected using either quantitative estimation methods or well-supported judgment, depending on the underlying drivers of the expense item.

A firm should have well-documented processes for projecting the size and composition of on- and off-balance sheet positions and RWAs over the planning horizon that feed in to the wider capital planning process (see Appendix H: Risk-Weighted Asset (RWA) Projections).

A firm should have a consistently executed process for aggregating enterprise-wide stress test projections of losses, revenues, and expenses, including estimating on- and off-balance sheet exposures, and RWAs, and for calculating post-stress capital positions and ratios. The aggregation system should be able to bring together data and information across business lines, portfolios, and risk types and should include the data systems and sources, data reconciliation points, data quality checks, and appropriate internal control points to ensure accurate and consistent projection of financial data within enterprise-wide scenario analysis. Internal processes for aggregating projections from all relevant systems and regulatory templates should be identified and documented. In addition, the beginning points for projections and scenario variables should align with the end of the historical reference period.

Projections of losses and PPNR under various scenarios are key components of enterprise-wide stress testing and capital planning. The firm should ensure that its projection approaches, including any specific processes or methodologies employed, are well supported, transparent, and repeatable over time.

A firm should generally use models or other quantitative methods, supported by expert judgment as appropriate, as the basis for generating projections. In limited instances, such as in cases of new products or businesses, or where insufficient data are available to support modeled approaches, qualitative approaches may be appropriate in lieu of quantitative methods to generate projections for those specific areas.

A firm should adhere to supervisory guidance on model risk management (SR-11-7) when using models, and should have sound internal controls around both quantitative and qualitative approaches.

Firms use a range of quantitative approaches for capital planning. The type and level of sophistication of any quantitative approach should be appropriate for the type and materiality of the portfolio or activity for which it is used and the granularity and length of available data. The firm should also ensure that the quantitative approach selected generates credible estimates that are consistent with assumed scenario conditions.

A firm should separately estimate losses and PPNR for portfolios or business lines that are either sensitive to different risk drivers or sensitive to risk drivers in a markedly different way, particularly during periods of stress. For instance, losses on commercial and industrial loans and commercial real estate (CRE) loans are, in part, driven by different risk factors, with the path of property values having a pronounced effect on CRE loan losses, but not necessarily on other commercial loans. Similarly, although falling property values affect both income-producing CRE loans and construction loans, the effect often differs materially due to structural differences between the two portfolios. Such differences can become more pronounced during periods of stress.

A firm should have a well-supported variable selection process that is based on economic intuition, in addition to statistical significance where applicable. The firm should provide a clear rationale for the macroeconomic variables or other risk drivers chosen for all quantitative approaches, including why certain variables or risk drivers were not selected.

A firm should estimate losses and PPNR at a sufficiently disaggregated level within a given portfolio or business line to capture observed variations in risk characteristics (for example, credit score or loan-to-value ratio ranges for loan portfolios) and performance across sub-portfolios or segments under changing conditions and environments. Loss and PPNR estimates should also be sufficiently granular to capture changing exposure levels over the planning horizon. However, in assessing the appropriate level of granularity of segments, a firm should factor in issues such as the availability of data or the costs and benefits of model complexity. For example, when projecting losses for a more diverse portfolio with a range of borrower risk characteristics and observed historical performance, firms should segment the portfolio more finely based on key risk attributes unless the segments lack sufficient data observations to produce reliable model estimates.

a. Use of data

A firm should use internal data to estimate losses and PPNR as part of its enterprise-wide stress testing and capital planning practices.²¹ However, it may be appropriate for a firm to use external data if internal data limitations exist as a result of systems limitations, acquisitions, or new products, or other factors that may cause internal data to be less relevant for developing stressed estimates. If a firm uses external data to estimate its losses or PPNR, the firm should ensure that the external data reasonably approximate underlying risk characteristics of the firm’s portfolios or business lines. Further, the firm should make adjustments to estimation methods or outputs, as appropriate, to account for identified differences in risk characteristics and performance reflected in internal and external data. In addition, firms should relate their projections under stress scenarios to the characteristics of their assets and activities described in their internal data.

A firm should generally include all available data in its analysis, unless the firm no longer engages in a line of business or its activities have changed such that the firm is no longer exposed to a particular risk. The firm should not selectively exclude data based on the changing nature of the ongoing business or activity without strong empirical support. For example, excluding certain loans only on the basis that they were underwritten to standards that no longer apply or on the basis that the loans were acquired by the firm is not sound practice.

b. Use of vendor models²²

A firm should have processes to confirm that any vendor or other third-party models it uses are sound, appropriate for the given task, and implemented properly. A firm should clearly outline limitations and uncertainties associated with vendor models.

Vendor model management includes having an appropriate vendor selection process, assigning staff to oversee and maintain the vendor relationships, and ensuring that there is sufficient documentation of vendor models. A firm should also confirm that vendor models have been sufficiently tested and that data used by the vendor are appropriate for use at the firm. The firm should also establish key measures for evaluating vendor model performance and tracking those measures whenever those vendor models are used, as well as assess vendor models (including to incorporate any relevant updates or changes). Vendor models should be subject to validation processes similar to those employed for models developed internally.

A firm should use measures to assess model performance that are appropriate for the type of model being used. The firm should outline how each performance measure is evaluated and used. A firm should also assess the sensitivity of material model estimates to key assumptions and use benchmarking to assess reliability of model estimates (see Appendix C: Use of Benchmark Models in the Capital Planning Process and Appendix D: Sensitivity Analysis and Assumptions Management).

A firm should employ multiple performance measures and tests, as generally no single measure or test is sufficient to assess model performance. This is particularly the case when the models are used to project outcomes in stressful circumstances. For example, assessing model performance through out-of-sample and out-of-time back testing may be challenging due to the short length of observed data series or the paucity of realized stressed outcomes against which to measure the model performance. When using multiple approaches, the firm should have a consistent framework for evaluating the results of different approaches and supporting rationale for why it chose the methods and estimates ultimately used.

A firm should provide supporting information about models to users of the model output, including descriptions of known measurement problems, simplifying assumptions, model limitations, or other ways in which the model exhibits weaknesses in capturing the relationships being modeled. Providing such qualitative information is critical when certain quantitative criteria or tests measuring model performance are lacking.

A qualitative approach to project losses and PPNR may be appropriate in limited cases where severe data or other limitations preclude the development of reliable quantitative approaches. The firm should document why such an approach is reliable for generating projections and is justified based on business need.

When using a qualitative approach, the firm should substantiate assumptions and estimates using analysis of current and past risk drivers and performance, internal risk identification, forward-looking risk assessments, external analysis or other available information. The firm should conduct an initial and ongoing assessment of the performance and viability of the qualitative approach. The processes used in qualitative projection approaches should be transparent and repeatable. The firm should also clearly document qualitative approaches and key assumptions used.

Qualitative approaches should be subject to independent review, although the review may differ from the review of quantitative approaches or models. The level of independent review should be commensurate with:

Firm staff conducting the independent review of the qualitative approaches should not be involved in developing, implementing or using the approach. However, this staff can be different than the staff that conducts validation of quantitative approaches or models.

A firm may need to rely on overrides or adjustments to model output (model overlay) to compensate for model, data, or other known limitations.²³ If well-supported, use of a model overlay can represent a sound practice.

A model overlay may be appropriate to address cases of identified weaknesses or limitations in the firm’s models that cannot be otherwise addressed, or for select portfolios that have unique risks that are not well captured by the model used for those exposures and activities.²⁴ In contrast, a model overlay that functions as a general “catch all” buffer on top of targeted capital levels to account for model weaknesses generally would not represent sound practice.²⁵

A firm should also avoid extensive reliance on model overlays throughout its capital planning process, particularly for material portfolios or where an overlay would have a large effect on projections. Further, a firm should reduce its reliance on overlays by addressing the underlying model issue over time. Firms should evaluate the reasons for overlays and track and analyze overlay performance.

As part of its overall documentation of methodologies used in stress testing, a firm should document its use of model overlays. Firms must be able to identify the main factors necessitating the use of an overlay as well as how the selected overlay addresses those factors. Key assumptions related to the overlay should be clearly outlined and consistent with assumed scenario conditions.

A firm should establish a consistent firm-wide process for applying model overlays and for controls around model overlays. The process can vary by model type and portfolio, but should contain some key elements, as described below. This process should be outlined in the firm’s policies and procedures and include a specific exception process for the use of overlays that do not follow the firm’s standards. As part of model development, implementation, and use, overlays should be well documented, supported, and communicated to senior management. Model overlays should be applied in an appropriate, systematic, and transparent manner. Model results should also be reported to senior management with and without overlay adjustments.

Model overlays (including those based solely on expert or management judgment) should be subject to validation or some other type of effective challenge.²⁶ Consistent with the materiality principle in SR-11-7, the intensity of model risk management for overlays should be a function of the materiality of the model and overlay. Effective challenge should occur before the model overlay is formally applied, not on an ex-post basis.

Validation or other type of effective challenge of model overlays may differ from quantitative model validation. Staff responsible for effective challenge should not also be setting the overlay itself or providing significant input to the level or type of overlay. For example, a committee that develops an overlay should not also be responsible for the effective challenge of the overlay. In addition, staff engaging in the effective challenge of model overlays should meet supervisory expectations relating to incentives, competence, and influence (as outlined in SR-11-7). Staff conducting effective challenge should confirm that model overlays are sufficiently conservative to compensate for model limitations and associated uncertainties in model estimates. Sensitivity analysis should be used to help quantify the overlay.

Overlays and adjustments used by a firm should be reviewed and approved at a level within the organization commensurate with the materiality of that overlay or adjustment to overall pro forma results. In general, the purpose and impact of overlays should be communicated to senior management in a manner that facilitates an understanding of the issues by the firm’s senior management. Material overlays to the model—either in isolation or in combination—should receive a heightened level of support and scrutiny, up to and including review by the firm’s board of directors (or a designated committee), in instances where the impact on pro forma results is material.

Senior management should periodically receive a high-level description of the use of model overlays. This description should include the number of models having overlays, whether more material models have overlays, whether overlays on the whole result in more or less conservative projections, and the range of the effect of overlays on the model output (especially for those cases where the overlays produce less conservative outcomes).

Senior management should be able to independently assess the reasonableness of using an overlay to capture a particular risk or compensate for a known limitation. Extensive use of overlays should trigger discussion as to whether new or improved modeling approaches are needed to reduce overlay dependency. Signs that the underlying model needs revision or redevelopment include a high rate of overrides or overrides that consistently affect model performance.

As noted in Appendix A: Use of Models and Other Estimation Approaches, a firm should use a variety of methods, including benchmarking, to assess model performance and gain comfort with model estimates. A firm should use benchmark or challenger models to assess the performance of its primary models for all material portfolios or to supplement, where appropriate, the primary models.²⁷ Such models should be used in conjunction with other aspects of benchmarking, such as comparing model results to actual market data, internal firm data, data from similar firms or portfolios, or judgmental estimates by business line experts. A firm should also use benchmark models during validation as an additional check on the primary model and its results.

Use of benchmark models is particularly important when primary models have exhibited significant deficiencies or are still under development. For instance, a firm’s primary model may use a preferred methodology, but lack a rich data set to support modeled estimates. In these cases, the firm should use benchmark models based on different data and modeling approaches to provide additional checks on primary model estimates. To the extent that a benchmark model highlights that a primary model has flaws (e.g., the model is producing output that is vastly different from experience during prior periods of stress), a firm should analyze whether it would be appropriate to adjust the model specification, apply model overlays, or develop different estimation approaches.

Benchmark models that are developed and run independently of primary models can be used to more effectively calibrate the firm’s final estimates. For example, a firm can use benchmark model outputs to substantiate model overlays, given differences in risk capture between primary and benchmark models. This type of “triangulation” is especially suitable for those areas of modeling that present considerable uncertainty.

Benchmark models used to arrive at the firm’s final estimates should be subject to model risk management. The intensity and frequency of validation or other type of effective challenge of benchmark models of a firm should correspond to the importance of those models in generating estimates. For example, if the output of a benchmark model is averaged with primary model results to develop final estimates, or if the benchmark model is used to develop overlays or overrides for the primary model, that model should be subject to more intensive validation.

Benchmark models that are used only during the validation process and do not contribute directly to the firm’s estimates do not need to be validated. However, a firm should assess the rigor of all benchmark models and benchmark data used to ensure they provide reasonable comparisons.

A firm should understand the sensitivity of its stress testing estimates used in capital planning to the various inputs and assumptions. In addition, sensitivity analysis should be used to test the robustness of quantitative approaches and models and enhance reporting to the firm’s senior management, board of directors, and supervisors. A firm should ensure that it identifies, documents, and manages the use of all key assumptions used in capital planning.

Understanding and documenting a range of potential outcomes provides insight into the inherent uncertainty and imprecision around pro forma results. A firm should assess the sensitivity of its estimates of capital ratios, losses, revenues, and RWAs to key assumptions and uncertainty across the entire firm’s projections under stress. Through this assessment, a firm should calculate a range of potential estimates based on changes to assumptions and inputs. Examples of assumptions that generally should be subject to sensitivity analysis include projected market share, size of the market, cost and flow of deposits, utilization rate of credit lines, discount rates, or level and composition of trading assets and RWA.

A firm should also evaluate the sensitivity of models to key assumptions to evaluate model performance, assess the appropriateness of assumptions, and understand uncertainty associated with model output.

Sensitivity analysis for capital planning models should be applied in a manner consistent with the expectations outlined in the Federal Reserve’s supervisory guidance on model risk management (refer to SR letter 11-7). Sensitivity analysis should be conducted during model development and during model validation to provide information about how models respond to changes in key inputs and assumptions, and how those models perform in stressful conditions. In addition, sensitivity analysis should be applied to understand the range of possible results from vendor-provided models and vendor-provided scenario forecasts that have opaque or proprietary elements. Sensitivity analysis should be used to provide information to help users of model output interpret results, but does not have to result in changes to models or model outputs. Changes made based on sensitivity analysis should be clearly documented and justified.

A firm should ensure that the key sensitivities are presented to senior management and the board in advance of decision-making around the firm’s capital plan and capital actions. Sensitivity analysis should also be used to inform senior management, and, as appropriate, the board of directors about the potential uncertainty associated with models employed of the firm’s projections under stress.

A firm should clearly document assumptions when estimating losses, PPNR, and balance sheet, and RWA components. Documentation should include the rationale and empirical support for assumptions and specifically address how those assumptions are consistent with and appropriate under the firm’s scenario conditions.

A firm’s rationale for assumptions used in capital planning should be consistent with the different effects of scenario conditions, shifts in portfolio mix, and growth or decline in balances projected over the planning horizon. For example, the firm should scrutinize and support any assumptions about sizeable loan growth during a severe economic downturn.

A firm should generally use conservative assumptions, particularly in areas of high uncertainty. The firm should provide greater support for assumptions that appear optimistic or otherwise appear to benefit the firm (such as loss reduction or revenue enhancement). A firm should not assume that senior management will be able to realize favorable strategic actions that cannot be reasonably assured in stress scenarios given the high level of uncertainty around market conditions. Further, a firm should not assume that it would have the perfect foresight that would allow it, for example, to make significant expense reductions in the first quarter of the forecast horizon in anticipation of the forthcoming economic deterioration described in the scenario.

A firm should not always assume that historical patterns will repeat. For example, a firm should not assume that if it has suffered no or minimal losses in a certain business line or product in the past, such a pattern will continue. In addition, a firm should carefully analyze effects of any structural changes in customer base, product, and financial markets on its projections, as these changes could significantly affect a firm’s performance under stress scenarios. Furthermore, the firm should explore the potential effects of changes in assumed interrelationships among variables and the behavior of exposures. The firm should also explicitly justify, document, and appropriately challenge any assumptions about diversification benefits.

A firm should confirm that key assumptions used in vendor or other third-party products are transparent and have sufficient support before using the products in stress testing. The firm should limit use of vendor products whose assumptions are not fully transparent or supported or use those products only in conjunction with another approach or compensating controls (e.g., overlays).

A firm’s internal audit function should play a key role in evaluating the adequacy of the firm’s capital planning process and in assessing whether the risk management and internal control practices supporting that process are comprehensive and effective. A firm should establish an audit program around its capital planning process that is consistent with SR letter 13-1, “Supplemental Policy Statement on the Internal Audit Function and Its Outsourcing.”

The internal audit function should identify all auditable processes related to capital planning and develop an associated audit plan. The audit function should also perform substantive testing to ascertain the effectiveness of the control framework supporting the firm’s capital planning process, communicate identified limitations and deficiencies to senior management, and communicate material limitations and deficiencies to the board of directors (or the audit committee of the board). The audit function should comprehensively cover the firm’s capital planning process.

The internal audit function should perform periodic reviews of all aspects of the internal control framework supporting the capital planning process to ensure that all individual components as well as the entire process are functioning in accordance with supervisory expectations and the firm’s policies and procedures. The internal audit function should also review the manner in which deficiencies are identified, tracked, and remediated. Furthermore, the internal audit function should ensure appropriate independent review is occurring at various levels within the capital planning process.

A firm’s internal audit staff should have the appropriate competence and stature to identify and escalate key issues when necessary. Adequate quantitative expertise is needed to assess the effectiveness of the capital planning processes and procedures. The role of audit staff is to evaluate whether the capital planning process is comprehensive, rigorous, and effective. The internal audit function may also rely on an independent third party external to the firm to complete some of the substantive testing as long as the internal audit function can demonstrate proper independence of the third party from the area being assessed and provide oversight over the execution and quality of the work.

Other supervisory expectations for the internal audit function relating to the capital adequacy process include:

The internal audit function should have a documented plan describing its strategy to assess the processes and controls supporting the firm’s capital planning process. When defining the annual audit universe and audit plan, the internal audit function of a firm should focus on the most significant risks relating to the capital planning process. The firm may leverage existing or regularly scheduled audits to ensure coverage of all the capital planning process components; however, the findings and conclusions of these audits should be incorporated into the overall summary of audit activities and conclusions regarding the firm’s capital planning process.

The internal audit function should also establish a process for reviewing and updating, as appropriate, its audit plan annually to account for material changes to the firm’s capital planning process, internal control systems, infrastructure, work processes, business lines, or changes to relevant laws and regulations. The firm should also ensure that the periodic assessment of the capital planning process is supported by a reliable and current assessment of the individual components.

On an annual basis, the internal audit function should report to senior management and the board of directors on the capital planning process to inform recommendations and decisions on the firm’s capital plan. The report should provide an opinion of the capital planning process, a statement of the effectiveness of the controls and processes employed, a status update on previously identified issues and remediation plans, and any open issues or uncertainties related to the firm’s capital plan. Any key processes that are not comprehensively reviewed and tested, due to timing or significant changes in processes, should be clearly documented and identified as areas with potential heightened risk. In addition, a firm’s internal audit function should brief theboard of directors (or a designated committee thereof) and senior management at least quarterly on the status of key findings relating to the capital planning process.

The internal audit function should track responses to its findings and report to the board any cases in which senior management is not implementing required changes related to audit findings or is doing so with insufficient intensity. In addition, the internal audit function should report any identified material deficiencies, limitations, or weaknesses related to the firm’s capital planning process to the board of directors and senior management in a timely manner.

A firm’s capital policy should describe how the firm manages, monitors, and makes decisions regarding capital planning.²⁸ The policy should include internal post-stress capital goals and real-time targeted capital levels; guidelines for dividends and stock repurchases; and strategies for addressing potential capital shortfalls.

A firm’s capital policy should describe the manner in which consolidated estimates of capital positions are presented to senior management and the board of directors. The capital policy should require staff with responsibility for developing capital estimates to clearly identify and communicate to senior management and board of directors the key assumptions affecting various components that feed into the aggregate estimate of capital positions and ratios. The capital policy should require that aggregated results be directly compared against the firm’s stated post-stress capital goals, and that those comparisons are included within the standard reporting to senior management and the board of directors.

Post-stress capital goals should provide specific minimum thresholds for the level and composition of capital that the firm intends to maintain during a stress period. Post-stress capital goals should include any capital measures that are relevant to the firm.

The firm should be able to demonstrate through its own internal analysis, independently of regulatory capital requirements, that remaining at or above its internal post-stress capital goals will allow the firm to continue to operate. Capital goals should take into consideration the uncertainty inherent in capital planning, as well as the economic and market outlook.

The capital policy should describe how senior management and the board concluded that the firm’s post-stress capital goals are appropriate, sustainable in different conditions and environments, and consistent with its strategic objectives, business model, and capital plan. In addition, the capital policy should describe the process by which the firm establishes its post-stress capital goals, and include the supporting analysis underpinning the goals chosen by the firm.

A firm should annually review its capital goals, evaluate whether its post-stress capital goals are still appropriate based on changes in operating environment, business mix, or other conditions, and adjust those goals as needed.

A firm should adjust its real-time capital targets (that is the amount of current capital it holds above its post-stress capital goals to ensure it does not fall below those goals under stress) more frequently than it adjusts capital goals, based on changes in the business mix, operating environment, or other current conditions and circumstances.

A firm’s capital policy should describe the processes relating to common stock dividend and repurchase decisions, including the processes to determine the timing, form, and amount of all planned distributions. The capital policy should also specify the analysis and metrics that senior management and the board use to make capital distribution decisions. The analysis should include strategic considerations such as new business initiatives, potential acquisitions, and the other relevant factors.

The capital policy should identify the types of calculations and analysis that support a firm’s proposed capital actions and determine the amount of capital available for distribution at any given time. For example, a firm should develop and use payout ratio limits in the decision making process. While payout ratio limits or targets should not be the single determining factor, the capital policy should describe how payout ratio limits or targets are considered, including how they are consistent with firm’s strategic goals, how they were derived, and what analysis was used to determine the appropriate amount of capital to distribute in a given period. Further, a firm should include in its capital policy threshold levels for payout ratios that trigger management action. Such action should include escalation to the board and potential suspension of capital distributions. Escalation protocols should be clear, credible, and actionable in the event of an actual or projected target is breached.

A firm’s capital policy should include specific capital contingency actions the firm would take to remedy any current or prospective deficiencies in its capital position. The firm’s capital contingency plan should reflect strategies for identifying and addressing potential capital shortfalls and specify circumstances under which the board of directors and senior management will revisit planned capital actions or otherwise institute contingency measures.²⁹ A contingency plan should include a set of thresholds for metrics or events that provide early warning signs of capital deterioration and that trigger management action or scrutiny.³⁰ Additionally, triggers for more severe levels of deterioration should be linked to escalation procedures for more immediate management action and should be consistent with triggers in the firm’s recovery plan. Triggers should reflect both point-in-time and forward-looking measures (both baseline and stress).

Capital contingency plans should include options for actions that a firm would consider taking to remedy any current or prospective deficiencies in its capital position, such as reducing or ceasing capital distributions, raising additional capital, reducing risk, or employing other means to preserve existing capital. Contingency options in the firm’s capital policy should be consequential, realistic, actionable, and comprehensive.

Capital contingency plans should include a detailed explanation of the circumstances in which the firm would consider implementing these options, including when it would reduce or suspend a dividend or repurchase program or not execute a previously planned capital action. The capital contingency plans should specify the type of information that would be provided to decision makers when the firm’s current or projected capital levels have deteriorated, including how management would present options to address the capital position and the long-term viability of the firm. Contingency options should be ranked according to ease of execution and impact and should incorporate an assessment of stakeholder reactions. All options should be evaluated for their feasibility and the reasonableness of underlying assumptions (such as whether a firm would be able to raise capital or draw on capital from another entity during a period of stressful market conditions).

As part of its capital plan, a firm must use at least one scenario that stresses the specific vulnerabilities of the firm’s risk profile and operations, including those related to the company’s capital adequacy and financial condition.³¹ The firm’s stress scenario should be at least as severe as the Federal Reserve’s severely adverse supervisory scenario, measured in terms of its effect on net income and other elements that affect capital.³²

As noted in the core document, a firm should develop at least one complete firm-specific scenario that focuses on the specific vulnerabilities of the firm’s risk profile and operations. The firm’s scenario should be carefully tailored to the idiosyncratic risks of the firm, as defined through the firm’s internal material risk-identification process, and should incorporate circumstances that are particularly stressful to the firm, given the firm’s idiosyncratic risks and key vulnerabilities. Such circumstances include those affecting the firm’s particular business model, revenue drivers, mix of assets and liabilities, geographic footprint, portfolio characteristics, and specific operational risk vulnerabilities. The firm can incorporate the idiosyncratic stress considerations in macroeconomic and financial market variables or a discrete stress event included in the scenario. A firm-specific scenario would not meet supervisory expectations if it is not tailored to the firm’s activities and risks. This is the case even if the severity is generally equivalent to the supervisory stress scenarios or if the post-stress capital ratios are lower than those under the supervisory severely adverse scenario.

The stress scenario should include stressful circumstances and events that could, on a standalone basis or in combination, reduce the firm’s capital levels and ratios and potentially impede the firm’s ability to operate as a going concern, and cover material risks to which the firm is exposed over the course of an annual planning cycle. A firm’s scenario should include factors that capture economy- or market-wide stresses and idiosyncratic risks that can put a strain on the firm. A firm should also take into account conditions and events that have not previously occurred, but that may pose a significant threat to the firm given its exposures, risk profile, and business strategy.

In addition, a firm should use multiple scenarios as part of its ongoing capital adequacy assessment to assess a broad range of risks, stressful conditions, or events that could impact the firm’s capital adequacy. This assessment should inform development of the internal stress scenario(s) used in the firm’s plan, the firm’s post-stress capital goals, and its current capital targets. The firm’s scenarios should collectively address all material risks to which the firm is exposed over the course of an annual planning cycle.

In designing its stress scenarios, a firm should incorporate risks and vulnerabilities that arise from multiple factors, sources, and events. Historical data may provide a starting point for scenarios, but a firm should also consider other data sources and challenge conventional assumptions when identifying the stressful conditions and events that could adversely affect the firm’s capital adequacy. In certain instances, scenarios that include economic and financial market variables that deviate from historical experience and correlations are appropriate if, for example, previously unobserved vulnerabilities exist in certain sectors of the economy or financial markets. In addition, the firm should not exclude experiences that have occurred outside its own history when designing stress scenarios, particularly if the firm has recently expanded its business to include new products, markets, or customers.

The macroeconomic variables used in a given scenario should collectively describe the general operational environment considered in the scenario. A firm should ensure that the scenario includes sufficient macroeconomic variables to support its stress testing estimation methods. While a firm should assess the internal consistency of the scenario, the firm should evaluate whether deviations from historically observed relationships among macroeconomic variables that increase the degree of stress placed on the firm may be appropriate.

Depending on the significance of market risk in a firm’s overall risk profile, the firm’s stress scenarios should include an adverse movement in financial market variables, such as asset prices, spreads, and rates, and related risk factors that impact a firm’s trading exposures. The firm should base market risk factors in the scenario on a thorough evaluation of the specific positions of the firm and the material risks coincident with those positions. A firm should limit use of past periods of financial market stress that do not sufficiently stress the firm’s current positions.

A firm should maintain a sound process for projecting RWAs over the planning horizon. The firm’s initial RWA calculations should be consistent with applicable regulatory capital requirements. In addition, the firm’s projections of RWAs should be developed in a fashion consistent with the scenario conditions and in accordance with applicable regulatory capital requirements.

Starting balances for both on- and off-balance sheet exposures and applicable risk weights form the foundation for estimates of post-stress capital ratios. Therefore, firms should verify carefully the accuracy of these starting balances. Moreover, deficiencies in starting RWA calculations are generally compounded in RWA projections over the planning horizon. A firm should ensure that it has sound controls around its RWA calculation and regulatory reporting processes as part of the firm’s broader data governance program.

A firm should ensure that RWA projections are consistent with a given scenario and incorporate the impact of projected changes in exposure amounts and risk characteristics of on- and off-balance sheet exposures under the scenario. A firm should demonstrate that assumptions associated with RWA projections are clearly conditioned on a given scenario and are consistent with stated internal and external business strategies. In addition, firms should ensure that projected market risk-weighted assets (market RWAs) are consistent with market factors (e.g., volatility levels, equity index levels, bond spreads) and assumptions around the size and composition of their trading assets.

A firm should document assumptions for projecting RWAs and their relationship to the RWA projections. If the firm’s models for projecting RWAs rely upon historical relationships, the firm should provide a description of the historical data used and clearly describe why these relationships are expected to be maintained under a given scenario. Further, a firm should analyze the appropriateness of assumptions regarding the following:

For purposes of projecting RWAs under the standardized approach, a firm should project balances, risk characteristics, and calculation parameters with appropriate consistency and granularity to facilitate application of appropriate regulatory risk weights for its on- and off-balance sheet exposures.³³ In particular, RWA projections should include information sufficient to assess the impact of potential changes to the following:

The methods and processes used to project market RWAs will differ across firms, in part as a function of the combination of model and non-model based methods used to determine starting market RWAs. However, as a general matter, market RWAs are expected to be positively correlated to volatility, spreads, or other relevant market factors, holding all things equal. If a firm projects flat or declining market RWAs over the planning horizon under the stress scenarios, the firm should provide support for the reasonableness of these assumptions under stressful market conditions. In addition, the firm should demonstrate that those assumptions are applied consistently across the enterprise-wide stress testing process, including for revenue projections.

If a firm that is not currently subject to the market risk rule projects its trading assets and trading liabilities to grow over the planning horizon, it should assess whether the projected growth would require the firm to calculate market RWA under the regulatory capital rule.³⁵ The firm should estimate the effect of market RWAs, if applicable, on its projected capital ratios and document the process used to project market RWAs in its capital plan.

A firm should implement and document an independent review of RWA regulatory reporting by the firm’s internal audit function or another independent control function. The independent review should ensure point-in-time RWA calculation processes appropriately capture all relevant on- and off-balance sheet exposures and are consistent with applicable risk-weighting methodologies to which the firm is subject under Regulation Q. The independent review should be conducted by a party with the necessary expertise to perform such reviews but with independence from the assignment of the risk weights for regulatory reporting purposes. The review should provide reasonable assurance that the initial RWAs are accurate and that the methods used to project RWAs are sound. Documentation of the independent review should clearly describe the scope of the review, outcomes and findings of the review, and any associated remediation efforts. A firm should also ensure that the underlying data processes supporting RWA projections include appropriate controls, reconciliations and attestations, and that data integrity testing is conducted by an independent party.

A firm faces a wide range of operational risk in conducting its business operations. Operational losses can arise from various sources, including inadequate or failed internal processes, people, and systems, or from external events, and can differ in frequency and severity. For example, some operational loss events, such as credit card fraud, are often more predictable as they occur at high frequency, but generally have low loss severity. The outcome of other events, such as major litigation, are less certain and can result in outsized losses.

A firm should maintain a sound process for estimating operational risk losses in its capital planning process, taking into account the differences in loss characteristics of different operational loss event types. A firm’s risk-identification process should include the evaluation of the type of operational risk loss events to which the firm is exposed and the sensitivity of those events to internal and external operating environments.

The firm-specific scenario submitted in a firm’s capital plan should capture the firm’s material operational risks, be designed with the firm’s particular vulnerabilities in mind, and include potential firm-specific events such as system failures, or litigation-related losses. The firm should evaluate both the firm’s own loss history and the large loss events experienced by industry peers with similar business mix and overall operational risk profiles.

The firm should have transparent and well-supported estimation approaches based on both quantitative analysis and expert judgment, and should not rely on unstable or unintuitive correlations to project operational losses. Scenario analysis should be a core component of the firm’s operational loss projection approaches.

Certain operational risks, particularly those most likely to give rise to large losses, often may not have measureable relationships to the overall scenario conditions. In addition, large operational loss events are often idiosyncratic, limiting the relevance of historical data. The firm should also limit dependence on distribution-based approaches that rely on historical data and require significant assumptions when projecting large operational losses. The firm should evaluate a range of outcomes under various scenarios, and make generally conservative assumptions.

The firm should engage business line and senior management to identify operational risk vulnerabilities and assess ways an operational risk event may unfold. The estimation approaches should also be subject to an effective independent review and challenge process.

The firm’s operational loss projection approaches should make appropriate use of relevant reference data, including both internal and external data, evaluate all measurable linkages to overall scenario conditions, and include all potential sources of material operational risk losses across the firm. A firm’s internal loss data should serve as both inputs to the firm’s operational loss estimation approaches projections and a benchmark for operational loss estimates in various scenarios. A firm should have sound and comprehensive internal data-collection processes that capture key operational elements. The firm should include all relevant operational loss data, including large operational loss events such as legal settlements and tax and compliance penalties. If a firm’s internal data lack sufficient operational loss history or granularity, the firm should use relevant external data to supplement its internal data.

The Federal Reserve has elevated expectations for a LISCC Firm and a Large and Complex Firm relating to operational loss projections. For example, a LISCC Firm and a Large and Complex Firm should use scenario analysis in its operational loss projections, use both internal and external operational risk data, have greater support for its assumptions, and solicit input from senior management on operational risk events. In contrast, a Large and Noncomplex Firm is not expected to use scenario analysis, may use external data if internal data are lacking, and is not held to the same expectations related to assumptions or engagement with senior management.