The US Federal Reserve’s Comprehensive Capital Analysis and Review (CCAR) for 2018 occurred amid anticipation of regulatory relief. The US administration had signaled a desire to reduce the burden on banks and named new leadership at the three banking agencies, including the Federal Reserve.
Stay current on your favorite topics
Nevertheless, by several important measures CCAR 2018 was a more stressful test than CCAR 2017. It incorporated an extremely strenuous “severely adverse scenario.” Furthermore, the new tax law required significant short-term write-downs of deferred tax assets. This reduced starting capital positions despite the law’s deep tax cuts.
The Federal Reserve released its CCAR 2018 results on June 28, revealing that stress capital levels decreased for 28 of the 30 bank holding companies (BHCs) that had been subjected to the test in 2017 (exhibit). Both Goldman Sachs’ and Morgan Stanley’s stress capital levels fell below required minimums, and four other institutions implemented adjusted capital actions to avoid doing so. The Federal Reserve objected to Deutsche Bank USA’s capital plan on a qualitative basis.
Despite the apparent severity of the 2018 test, some observers saw signs that the Federal Reserve was adopting a gentler approach. They cited the “conditional non-objections” given to Goldman Sachs, Morgan Stanley, and State Street despite their low stress capital levels. All three of these banks passed the qualitative portion of the test.
Important concrete steps toward resetting the future of CCAR have been taken since the 2018 test. All indicate an intent to increase transparency and further efficiency, while retaining supervisory expectations and the level of capital in the system. In May 2018 the Economic Growth, Regulatory Relief, and Consumer Protection Act (the Relief Act) was passed. This law promised a more risk-based approach and released institutions with under $100 billion in assets from CCAR. Then in October, the Federal Reserve introduced a proposed rule defining four categories of firms with more than $100 billion in assets, each subject to different stress-testing requirements (Tailoring Rule). The rule would replace the current two categories: “large and complex” and “large and non-complex.” It would not apply to foreign banking organizations (FBOs), for which the Federal Reserve plans to develop a separate proposal. More recently, Federal Reserve vice chair Randal Quarles has signaled an interest in ultimately removing the qualitative public-objection tool. He suggested that the Fed would continue to hold firms to the same rigorous standards through standard supervision and issuing a rating of each firm’s capital position and planning.
In preparing for CCAR 2019, banks must decide how to calibrate their approach, balancing the continued potential for regulatory and supervisory relief against the realities observed in CCAR 2018. With all this as context, we see six overarching themes for institutions to keep in mind.
1. The shift to risk-based regulatory approaches continues, easing the burden for regional banks but not for the largest firms
While the proposed Tailoring Rule and other signals from the Federal Reserve leadership suggest a growing openness to a risk-based approach, they also leave stress-testing requirements unchanged for the largest banks. For the smaller, less complex US institutions subject to CCAR, the rule would relax already differentiated requirements yet further. Currently large and non-complex banks are subject only to an annual quantitative CCAR component. Under the proposed rule, most of these institutions would undergo CCAR only every other year and would not be required publicly to report the results of an internally run stress test.1 In a speech to the Brookings Institution given in November 2018, Federal Reserve Vice Chair Quarles indicated that he would recommend to the board that 2019 would be the first off-year in the new cycle. Firms in this category would be able to reduce compliance costs further by reducing staff time spent on formal CCAR reporting and documentation requirements.
The largest and most complex US banks get no relief under the Tailoring Rule, however. Enhanced Prudential Standards would remain unchanged for US globally systematically important banks (G-SIBs)2 and would also apply to all other banking institutions that hold over $700 billion in assets or have significant international activity.3 For those other institutions currently classified as large and complex for the purposes of CCAR,4 the proposed rule would relax capital-planning and stress-testing standards only slightly: they would not need to run a mid-cycle stress test, and would have to disclose internal stress-test results only every other year. And while Vice Chair Quarles suggested that the qualitative objection in CCAR might be eliminated completely, he also indicated that the Federal Reserve will maintain similar standards for high-quality processes, governance, and modeling. When banks do not meet these standards, the Fed would continue to identify shortcomings through the confidential supervisory process, including very demanding requirements for immediate remedial action.
Would you like to learn more about our Risk Practice?
Until the Federal Reserve develops a refreshed approach for FBOs, existing requirements will continue to apply to them. Moreover, regulators have been layering in additional FBO-specific requirements, including the expectation that they build and enhance capabilities for transfer pricing and booking models. For now, FBOs should assume that any new rule will largely maintain these requirements. As they progress, they also have the opportunity to leverage at a group level the capabilities they build for CCAR (projection and aggregation, for example). FBOs can also formalize internal, ad hoc processes for interacting at the group level (such as for hedging). For all such work, FBOs should not decelerate their current efforts and may need to make focused efforts to explain this imperative at the group level.
2. Internal controls remain an area of relative weakness
Fundamentally, the Federal Reserve expects banks to provide their own fully effective controls. Attention to internal controls is not new. Over the past four years, all six of the Fed’s qualitative objections or conditional non-objections have publicly cited weaknesses in controls as one of the reasons for the decision.
Nonetheless, internal controls remain an area of residual weakness for larger institutions. While the Federal Reserve recognizes that such firms largely meet overall supervisory expectations, it continues to call out many instances of controls that fall short. Gaps remain in data and information systems, capital-planning audits, and, perhaps most importantly, in model-risk management. Large institutions should continue to invest in building these capabilities. And they should not hope for further relief until their internal controls meet expectations unambiguously.
Many FBOs, both larger and smaller, have particular work to do to improve their controls because they have a delayed start compared to domestic institutions. In 2018, the Federal Reserve made the intermediate holding companies of most FBOs subject to CCAR, creating six new filers. In 2019, all six will be incorporating a global market shock (GMS) for the first time. As FBOs progress, they can also leverage the control capabilities they build for CCAR at a group level.
3. Expectations for model-risk management in CCAR reflect broader regulatory priorities for risk management
Model-risk management (MRM) is arguably the most important CCAR control, since models are at the heart of any stress-testing program. At most banks, however, model-risk management lags behind actual modeling practices, which are comparatively more mature and less often criticized by regulators. Recent regulatory feedback on MRM has centered mostly on three areas: standards for validating qualitative models; approaches for understanding model limitations and overlays; and consistent application of validation standards across all models, qualitative and quantitative. The MRM challenge is greatest for models that look at losses or revenues in stressed conditions that have no historical precedent.
Supervisory standards for MRM within CCAR reflect the Federal Reserve’s expectations for how banks will approach model risk firm-wide. Because of the intensity of model use in CCAR, it provides a laboratory for improving model-risk management beyond stress testing. Regulators have consistently used CCAR as a first testing ground before expanding model-risk expectations. Similarly, banks can roll out standards and frameworks on their CCAR models first, before applying them more broadly. Banks that apply high standards consistently across all CCAR models, and across all three lines of defense, can improve regulators’ confidence both in their CCAR results and in their enterprise model-risk-management programs.
In this context, proactive institutions have begun to evaluate how effectively they are managing model risk across CCAR, including both quantitative and qualitative models. Banks should develop model-risk management controls across each of the three lines of defense—the businesses, the model-risk-management function, and the audit function. Each line should have its own systematic processes to identify all sources of model error, rather than relying on the next line to catch issues. Doing so helps capture model error early, improving both the efficiency of the CCAR process, and the quality of its output.
In their role as the first line of defense, businesses should have two main areas of focus. One is to ensure that they maintain model development standards consistently across all modeling teams. The second is to take full ownership of their models, including the choice of who will run each model, and each model’s use case.
The second line of defense—the model-risk-management function—needs to maintain a well-defined framework for validating models and to apply it in a way that is informed by key risks and limitations of each model. The validation framework should address such questions as, “what are the differences between annual reviews and ongoing monitoring?” and “how are we reviewing overlays?” The framework should also include a systematic way to understand risks and limitations associated with using each model. Model validation thus needs to go well beyond statistics, to reveal how an error might manifest itself during model use and the implications of the error. This is difficult for two reasons: first, validation time is limited, and second, there is a wide variety of CCAR models, spanning multiple businesses and use cases, degree of volatility in the modeled quantity, and modeling techniques. Validation teams that understand the key source of risk in any model—data, framework, performance, or governance—can focus on testing that source of risk rather than following a generic testing plan. If a model has minor technical limitations but unclear usage protocols, for example, then the validators should focus on usage.
The third line of defense—the audit group—needs to maintain a framework for ensuring that the bank’s models conform to model-risk-management policies and procedures. Audit needs a risk-based process for choosing which models to review, since it will not be able to review them all. The selection process should consider both materiality and quality of models to ensure that models with the most impact on capital are reviewed before the CCAR submission.
4. The imperative grows for governance that enables an agile process
There has been substantial uncertainty in CCAR requirements year to year. This was highlighted in the 2018 cycle, when many firms struggled to incorporate both the new tax law and the unexpectedly severe supervisory scenario. Several banks added last-minute modifications, reviews, and governance approvals. Some rapidly adjusted their scenarios—such as by introducing large idiosyncratic events—or developed new ones and reran results. The 2018 McKinsey CCAR Survey found, for example, that most filers, particularly those most exposed to equity markets, recalibrated their scenarios after the Federal Reserve released its scenarios. Such last-minute changes proved especially burdensome for institutions with less agile processes. For these banks to adapt to the scenarios, overlays may have been the only approach available.
Some degree of volatility will likely persist. While Vice Chair Quarles has indicated that the Federal Reserve is considering ways to reduce stress testing volatility, a dynamic test brings with it some necessary uncertainty. Economic conditions and risks as well as firms’ circumstances and activities vary over time. Furthermore, now that banks are fully capitalized, even moderate amounts of year-over-year volatility in the stress test can be consequential.
Given this context and the further regulatory changes on the horizon, banks should implement a more agile governance process. This can help in several ways. They will be better able to address unexpected elements of the CCAR test. They will be able to respond more quickly to errors found late in the internal process. And they will be able to accommodate business decisions or changes in business circumstances occurring up to and even after the jump-off and scenario-release dates.
Building stress-testing models helps a bank reduce risk and improve capital planning
A further reason for adopting a more agile process involves the interaction, yet to be determined, between CCAR and the switch to CECL—the Current Expected Credit Loss accounting standard. According to the present timetable, CECL would be incorporated into the 2020 CCAR submission. Proposals have been made to delay CECL until 2021, however, to allow more time for institutions to understand its implications, particularly on forecasted loss scenarios and potential reductions to capital.
To improve governance and process flexibility and speed, banks should limit the review-and-challenge regime to only a few layers. A good rule of thumb is three layers, including the board. Within this structure, senior-management input to review and challenge should occur early in the process to avoid unnecessary rework. Finally, institutions should develop a special governance process for unforeseen issues and questions that does not disrupt the main review-and-challenge regime. Without this additional process, unexpected questions arising during production could cause substantial delays if the governance process is a linear one. Review and challenge would have to pause entirely as an investigation is conducted of the unforeseen question—such as, for example, why negative rates might increase pre-provision net revenue (PPNR) or how to adapt to an unexpectedly harsh supervisory scenario.
5. Proactive firms are investing in automation and using CCAR machinery for better business-as-usual decision making
Many firms have revealed or begun to implement plans for significant automation of processes, including model execution, data capture and aggregation, initial validation checks, preparation of review-and-challenge materials, and final documentation. Regulatory guidance in this area has been limited, so most firms have made only tentative steps. Automation is, however, a valuable area to pursue since it enables more sustainable, flexible, and adaptable processes.
We see direct benefit in the form of increased agility, lowered costs, and greater insight. Automation improves agility by enabling much faster execution of stress-testing processes. For instance, to arrive at production stress-testing results, banks can use fourth-quarter tests to update the jump-off points for the first quarter of the following year. This will improve the speed and efficiency with which they develop models and scenarios; create, update, and rerun overlays; and execute handoffs between workstreams.
While automation of processes may require an up-front investment, it lowers costs in the long run. It frees resources for higher value-added activities and areas of focus in the CCAR program (such as analyzing the drivers of risk). Furthermore, the data required to automate CCAR can be used for other efforts, like BCBS 239.
Finally, automation can improve insight by giving firms more time to analyze and act on data. The extra time can have several benefits. Firms can use it to identify emerging risks inside and outside CCAR, allowing them, for instance, to update scenarios to deal with a geopolitical event. They can create scenarios to determine risk appetite (for example, by stressing commercial-real-estate portfolios to assess limits). They can optimize portfolios by assessing how these might perform in different stress environments. They can rapidly assess potential deals and trades and how these might add to stress losses. Finally, they can conduct stress tests in quarter four and use these for year-end budgeting, allowing stress testing to inform business strategy.
For those firms looking to begin automating processes, a first step would be to target areas of high cost such as running reports, documentation, handoffs between workstreams, and review and challenge. Firms can move these to business-as-usual systems where possible, which allows for better alignment with business-as-usual processes. Automating model execution is a next step. This entails first rationalizing the model landscape, consolidating and removing some models, and then automating the rest.
6. Deliberate talent management enables CCAR sustainability and integration with business decision making
Firms have an opportunity to move beyond current stress-testing organizational models, which typically rely on fully dedicated teams of 40 or more individuals. Many of these teams were established quickly, often in response to CCAR failure or strong private regulatory feedback. They have remained largely static. Now that most banks have successfully built their CCAR machinery, they stand to gain by assessing which roles create the highest value and which are no longer required.
Refreshing and systematizing stress-testing talent models also will help build CCAR sustainability. Typically, CCAR programs rest on the shoulders of leaders who have been involved in stress testing for many years. These people have an unparalleled cross-bank view but, in some cases, have been worn down by the year-on-year demands of stress testing. Most banks have taken a reactive approach to the situation, waiting until such CCAR veterans ask to move on, and only then looking to replace them. Instead, institutions should support talent rotation out of stress testing more preemptively. This will let them take maximal institutional advantage of skills people gain through stress testing, placing them deliberately elsewhere in the bank. It will also help proactively manage the composition of the CCAR team itself, so that it is not composed of only those people who choose to stay, no matter how talented they are.
At the same time, banks should consider rotational models that bring talent from other parts of the bank into the CCAR program for two or three years. Such people should be placed in roles identified as creating the highest value. Such placements will create more direct linkages between business and functional capabilities and CCAR, identifying parallel skill sets required in multiple parts of a bank (such as scenario development, active review and challenge, and analytical modeling). A CCAR rotational program can also include high-potential new hires, who have been presented with a clear employee value proposition. An entry role in a CCAR program provides the new employee with a challenging and enriching multidisciplinary exposure to the institution. This can serve as a launching pad to another role after two or more CCAR cycles. Banks can also consider opportunities to bring together multiple disaggregated regulatory-response teams.
Banks with mature stress-testing programs also have an opportunity to reconsider how they manage performance, to ensure that they are recognizing and rewarding the right behaviors and skills. Too often, banks focus on standard technical skill sets at the expense of higher-level abilities essential for a CCAR program that is sustainable and adds business value. For example, while CCAR programs tend to have a broad base of modeling and accounting talent, they often have fewer people adept at executive-level synthesis or producing materials for regulatory audiences. Improved performance management can change this.
Similarly, banks should look to develop and reward people who can successfully manage and collaborate across reporting lines to undertake root-cause analysis and address issues. Examples include people who can engage with both the wholesale-banking team and the model-validation team to test whether the bank used the right data set in loss modeling and how to explain the choice or people who can quickly find ways to improve suboptimal loss-given-default modeling in response to audit feedback.
Many institutions have come a long way in creating the processes and infrastructure they need to meet the Federal Reserve’s stress-testing demands. Those that consider and act upon the themes we have outlined here can create an easier path to success in the future and use CCAR to improve their businesses despite the changing regulatory picture.
