Stress Testing: CCAR, Historical Scenarios, and Reverse Stress Tests

A risk manager with a decent VaR model can answer “what is my expected loss over the next day at 99% confidence?” without breaking a sweat. The harder question is “what is my loss if something unusual happens?” VaR handles the first question by assuming the future looks like the past; the second question it actively refuses to answer.

Stress testing is the practice of answering the unusual questions. It is the complement to VaR: where VaR estimates where losses fall in the bottom 1%, stress tests ask — what if the bottom 1% turned into the bottom 0.1%? What if every correlation went to 1? What if every bond I hold defaults? The questions are unreasonable. That is exactly the point: in a real crisis, the unreasonable becomes normal.

There are three ways to ask “what if.” You can borrow a real crisis from history. You can construct one that never happened. Or you can turn the question around — fix the outcome at “the firm dies” and work backwards to the scenario that gets you there. Each way of asking has blind spots, and each patches the others’, which is why a robust stress testing program uses all three. US bank regulation institutionalized the whole apparatus as CCAR. Let’s take them in that order.

Borrowing a Crisis from History

A historical scenario asks “what if 2008 happened again?”: take the actual sequence of shocks from a past crisis and apply it to today’s portfolio. The mechanics take three steps: identify the time window (say, October 1 to October 31, 2008); extract the daily shocks for every relevant risk factor — rates, spreads, equities, FX, commodities; then apply those shocks, in their original sequence, to the current portfolio. The output is a single number or a path: “the loss on today’s portfolio over the 2008 stress period would have been USD X.”

The repertoire is small enough to count on your fingers. October 19, 1987: the S&P 500 fell 22% in a day, still the standard “tail event for equities.” The 1998 LTCM and Russia crisis contributed a different combination — widening credit spreads, an equity vol spike, and contagion across emerging markets. The 2008 GFC is a multi-stage script: Bear Stearns collapses (March 2008), Lehman goes bankrupt (September), AIG is rescued (the week of September 15), the crisis peaks (October–November), the rebound comes (March 2009). The 2011 European debt crisis supplied widening sovereign spreads in Italy and Spain plus the US debt ceiling downgrade. 2020 COVID: a 35% S&P 500 drop in 23 trading days, oil crashing to negative prices, vol jumping past 80. The 2022 rates shock: Fed tightening, Treasury yields up 200 bps in 12 months, the longest duration drawdown since 1949.

What makes historical scenarios genuinely valuable shows up in multi-asset portfolios: they capture the correlation of shocks, which is often the dominant feature of a crisis. In 2008, equity returns were correlated with credit spreads and with funding costs. Calibrating those correlations from scratch in a hypothetical scenario is very hard; use the historical scenario and you inherit them automatically.

The cost sits in the same place: historical scenarios are chained to past crises. A cyber attack on financial infrastructure, a run on a central bank digital currency — new kinds of crisis have no historical analog, and a historical scenario has nothing to say about them. That gap is what the next method fills.

Constructing What History Didn’t Provide

Hypothetical scenarios build the shock sequence from economic reasoning, and they come in two broad kinds. Macro-driven: “what if the Fed raises rates 200 bps faster than the consensus path?” — with the rate, FX, equity, credit, and commodity moves defined step by step. Idiosyncratic: “what if our largest counterparty defaults?” — with the immediate loss, plus the counterparty risk, plus the cascade.

The standard approach at Moody’s, S&P, the IMF, and the Federal Reserve is the same in each case: state a narrative, then translate the narrative into concrete numerical shocks. The Fed’s 2023 CCAR scenario is a good example:

“The hypothetical scenario features a severe recession with global implications. U.S. real GDP growth slows materially and the unemployment rate rises to 5.9%. The narrative stresses commercial real estate losses, corporate debt distress, and a sharp rise in funding costs. Market rates rise and equity prices fall substantially.”

The narrative is then translated into numerical shocks over a 9-quarter horizon:

• Equity market: declines 35% from current levels.
• Investment-grade credit spreads: widen to 4.5% (200 bps over current).
• High-yield credit spreads: widen to 8% (300+ bps over current).
• Long-term Treasury rates: rise 200 bps.
• Unemployment: rises to 5.9%.
• Real GDP growth: turns negative.

These shocks run through the bank’s internal models against the current balance sheet, producing a 9-quarter projection and a stressed capital ratio. If the bank falls below the 4.5% minimum CET1 ratio, the Fed objects and forces a revision of the capital plan.

Hypothetical scenarios close the gap historical ones leave: they can target concerns that no past crisis happens to contain. But they introduce a flaw historical scenarios don’t have. The calibration is judgmental and changes year to year, and whoever constructs the scenario can all too easily build one that confirms what they already believe. If you worry about rates, the rate shock comes out harsh; if credit doesn’t scare you, the credit shock comes out mild. The scenario is subjective, and subjectivity drifts.

What Makes a Scenario Any Good

Since a scenario can be anything you invent, you need standards for judging whether it was invented well. The IMF’s Guide to Stress Testing (Bank of England, BIS, IMF, accumulated over multiple years) lays out principles worth absorbing as judgment rather than memorizing as a checklist.

The first is coverage: stress scenarios should span credit, market, operational, liquidity, and business risk, rather than letting the equity shock hog the stage — if credit risk matters more in your book, the scenario should lean on credit. The second governs the balance between severity and plausibility; the guide’s phrasing is that a scenario should be “within the realm of reason but not within the realm of past experience.” That sentence deserves a second read: past crises alone are insufficient, yet only past crises are automatically plausible, and a good scenario has to stand somewhere between the two. The third draws the boundary against VaR: a stress test must specifically explore adverse outcomes. Shocks generated as random samples from the historical distribution are not stress — they are random scenarios, which is precisely what VaR already handles. The fourth puts a number on severity: a “severe” stress should generate losses comparable to 99.9% VaR or higher; the severely adverse CCAR scenario targets roughly the 99.5th percentile in most asset classes.

The last principle deserves its own paragraph, because it leads directly into the next method: at least one scenario must be a reverse stress test — find the scenario that breaks the bank, and report it.

Asking the Question Backwards

Both methods so far share a direction: pick the scenario, then compute the loss. A reverse stress test flips the direction: fix the loss first — “what would have to happen for this firm to fail?” — and work backwards to the scenario. The procedure is to take the firm’s capital and liability structure, find a scenario under which losses would exhaust capital (or breach regulatory ratios), report that scenario, and then assess its plausibility. It is the most useful stress test and the least commonly performed.

The output often surprises management, and the surprise runs against intuition. A bank might first compute what equity market crash would render it insolvent, arrive at a shock larger than 2008, and conclude “we are robust.” But a reverse stress test on the corporate bond portfolio might find that a 5% default rate combined with 100 bps of spread widening produces a loss larger than 2008 — and that scenario is more likely to happen than a 50% equity market drop. Without asking backwards, that line of fragility never enters the field of view: nobody volunteers to write a forward scenario for “mild credit deterioration.”

The mathematical setup is direct. Define a vector of risk factor shocks $\Delta \mathbf{X}$, and find $\Delta \mathbf{X}$ such that:

subject to $\Delta \mathbf{X}$ lying in a “reasonable” range. There are two ways to run the search: linearly, finding the smallest-magnitude shock that breaches capital, useful for locating the tipping point; or constrained, finding the largest-loss shock within a constraint set (say, equity shock $\le 50\%$), useful for assessing how much “within range” stress can hurt.

The method was introduced in the UK Financial Services Authority’s 2008 paper Stress Testing the UK Banking Sector and is now mandatory for European banks under the EU’s CRD IV. A typical output reads: “A 15% drop in equity markets combined with a 300 bps rise in 5-year CDS spreads and a 50% default probability on our largest counterparty would exhaust our CET1 capital in 6 months.” Management then has two questions to answer: is this scenario possible (yes — parts of it happened in 2008), and which mitigants would help.

Running the Numbers on a Fictional Bank

Let’s make it concrete. Suppose a bank has $50B in equity, $500B in risk-weighted assets, and a portfolio of $200B in corporate bonds, $100B in equities, a $50B trading book (rates, FX, equity derivatives), a $100B loan book, and a $50B mortgage book. A reverse stress for insolvency means finding the shock $\Delta \mathbf{X}$that pushes losses past$30B — enough to wipe out most of the equity and trigger regulatory action.

Walk it line by line. The equity book takes a -50% shock and loses $50B: sufficient on its own. The credit book takes a -10% price shock on corporates plus 500 bps of spread widening and loses $20B plus $50B,$70B in total: also sufficient. The mortgage book under a -20% residential price shock loses $10B: insufficient. The trading book under a 5x vol spike plus the default of the largest counterparty loses $5–10B. Rolled up, the answer is: either a 30% equity drop or 200 bps of credit spread widening would, on its own, generate a loss above $15B; the more extreme scenarios — a 50% equity drop, or a 2008-style credit crisis — would generate $30B+ in losses and trigger insolvency.

The value of the exercise arrives in the last step: management can now ask “what is the probability of 200 bps of credit spread widening?” The historical record is right there: it happened in 2008 and has not happened since. The bank’s risk appetite should rest on a judgment about that probability, not on the sentence “we passed the stress test.”

There is one methodological trap in doing this. A naive reverse stress test searches its way to an absurd scenario — “a 100x equity market crash in one day” — mathematically valid, practically useless. The useful version adds a plausibility filter: shocks must lie within some “extreme but not absurd” range; then find the smallest plausible scenario that breaks the bank, report its likelihood, and break it down by which assumption fails first. A common implementation boxes the shocks, $|\Delta S_i| \le k \sigma_i$, maximizes losses over the box, finds the $k$ and directions that produce the maximum loss, and reports the loss as a function of $k$: “the loss under a $k = 5$ shock is USD X, under $k = 10$ it is USD Y.” What you get is a continuous view of tail risk, with no bet placed on any single scenario.

CCAR: Writing All of This into Regulation

The Federal Reserve’s Comprehensive Capital Analysis and Review (CCAR) is the most consequential stress testing program in the world, applying to every US bank holding company with $100B+ in assets. Everything covered above has a counterpart in the 2023 framework. There are three scenarios — baseline, severely adverse, and a new (since 2021) stress scenario — and banks must pass the severely adverse. Under each scenario, banks project their balance sheet over 9 quarters, that is, 2.25 years. The capital requirement is hard: the stressed CET1 ratio must not fall below 4.5%, plus a 2.5% capital conservation buffer, with an additional 1.0–3.5% surcharge for G-SIBs. And loss projections must be broken out by major exposure category: credit, market, operational, retail, and so on.

The rhythm is annual. The Fed publishes the scenarios each February; banks run their internal models and submit results by April; the Fed reviews submissions in Q2–Q3, publishes aggregate results in June or August, and dictates capital distributions in Q4. The DFAST (Dodd-Frank Act Stress Test) component has been the binding stress test for US banks since 2009, with the Fed publishing scenario details and individual bank results.

Methodologically, each bank’s CCAR model is built bottom-up by its own risk team, and the framework splits prescribed from discretionary. The scenarios themselves — specific shock magnitudes over time — are prescribed. How each shock propagates through the bank — say, what fraction of consumer loans default under 9% unemployment — is left to the bank’s own modeling. Results therefore vary across banks, and the Fed retains veto power: it can reject models it considers inadequate.

The credibility of this system has a specific origin. The first stress test for US banks was the 2009 SCAP (Supervisory Capital Assessment Program), covering the 19 largest bank holding companies — the “19 banks” you occasionally see referenced means this exercise specifically; the post-2012 CCAR/DFAST cycle covers a larger set of firms, around 30–35 in recent years. Of the 19 SCAP banks, 10 were required to raise additional capital, and SCAP was widely seen as credible precisely because the Fed did not clear all 19 unconditionally. The 2011 EU-wide stress test (coordinated by the EBA, sometimes called the EFS or EBA stress test) likewise had several banks fail or barely pass. The annual cycle since 2012 has seen only minor modifications; the framework is stable.

One structural critique is unavoidable, though: CCAR is conservative — good for capital adequacy — but it does not measure the systemic dimension. Banks can each pass CCAR individually while the system fails as a whole — that is the actual lesson of 2008: before the crisis, every major bank looked healthy on its own capital metrics, and the system collapsed together anyway. Individual passes have never meant systemic safety. CCAR does compute a stress aggregate, but the aggregate is not a binding constraint.

The Two Pieces That Get Left Out

The first is operational risk. Operational losses spike in crises — the 2008 crisis produced operational losses of 10–20% of credit losses in some banks — yet stress tests routinely leave them out. CCAR includes an operational risk component (the “OpRisk” model), but it is typically a fixed fraction of revenue, which amounts to admitting the risk was never seriously modeled. The more honest approach models it explicitly by event type: litigation, stressed as pending cases multiplied by 2–3x; cyber attack, at worst-case intrusion cost — remediation, regulatory fines, reputation; fraud, at rogue-trader-scenario loss sizes; system failure, at the cost of a one-week outage. The aggregate of these should land in the 5–15% of revenue range under severely adverse. Stack it on top of credit, market, funding, and business, and you have the complete stress picture.

The second is funding and liquidity. Liquidity-adjusted VaR is one input; a separate liquidity stress test is another, and neither substitutes for the other. The standard format: a 30-day stress horizon; funding costs up 100–300 bps over current; withdrawal of 25–50% of unsecured funding; 50% of credit lines drawn by counterparties under stress; and explicit modeling of asset liquidation markdowns and time to liquidate. The output is the cash position, positive or negative, over 30 days; the liquidity coverage ratio (LCR) under stress should remain above 100%. Most banks compute a stressed LCR weekly for risk management and a severely adverse LCR quarterly for CCAR.

The Blind Spots of Stress Testing Itself

The ceiling on stress testing is in plain sight: a stress test is only as good as the scenarios you design, and by construction you cannot design one for a risk you have not thought of. The 2008 crisis exposed liquidity risk in the securitization pipeline that few had modeled. Historical scenarios also inherit the past’s correlation structure, and a future crisis may have a different one — in 2008, US equity correlations spiked to 0.9 across many sectors, higher than in any historical scenario. The market impact of forced liquidation can be far larger than any historical scenario, and CCAR’s pre-2020 scenarios did not model liquidity spirals. Even a well-defined scenario leaves the behavioral reactions unknown — the bank’s own response, other banks’, the regulators’ — and the bank runs of the 2023 SVB episode happened through social media, not as the output of any structural model.

These gaps are real, and the framework keeps patching them: 2020+ scenarios include deposit run assumptions, 2023+ scenarios include commercial real estate losses. But the fundamental limitation stays where it was: stress tests only cover the scenarios you can describe, and the worst scenario may be exactly the one you can’t.

Which brings us back to the three ways of asking. Historical scenarios anchor the analysis in actual experience; hypothetical scenarios extend it to risks the past never produced; reverse stress tests find the scenario that breaks you. For a US bank holding company, CCAR makes all of this a binding regulatory framework; for non-bank institutions the principles apply, though the implementation varies. For a risk-aware portfolio manager, VaR alone is not enough for any decision that involves catastrophic outcomes: if your framework only computes historical scenarios — say, “the 2008 crisis” — you have about half the picture. Add a hypothetical scenario targeting your specific exposures, and run a reverse stress test on the portfolio you actually hold. Then think about what could go wrong that you haven’t thought of. That last step is where most stress testing programs fall short.

References

Basel Committee on Banking Supervision. Principles for Sound Stress Testing Practices and Supervision. BCBS 155, 2009.

Board of Governors of the Federal Reserve System. Dodd-Frank Act Stress Test 2023: Methodology and Results, June 2023.

European Banking Authority. EU-Wide Stress Testing Methodology, 2023.

Financial Services Authority. Stress Testing the UK Banking Sector, 2008.

International Monetary Fund. Financial Soundness Indicators and Stress Testing. IMF Working Paper.

McNeil, D., Frey, R., & Embrechts, P. (2010). Quantitative Risk Management. Princeton University Press. Ch. 11.