# Stress Testing Programme: [Institution name] [Programme year, e.g. 2026 to 2027]

> Stress testing programme for a credit institution: objectives and
> scope, governance, the inventory of stress tests, scenario design and
> severity calibration, the macro-financial variables, methodology by
> risk type, data and balance sheet assumptions, results, management
> actions, reverse stress testing, challenge and validation, and the
> use of results in the risk appetite framework, the ICAAP, the ILAAP
> and the recovery plan. Based on EBA Guidelines on institutions'
> stress testing (EBA/GL/2018/04), Directive 2013/36/EU (CRD) Articles
> 73, 86 and 100, and the revised EBA SREP and supervisory stress
> testing Guidelines (EBA/GL/2026/06, applying from 2027-01-01);
> structure also aligned with the Basel Committee "Stress testing
> principles" (October 2018), cited by name only. Requirements are
> referenced by number; obtain the guideline, directive or principles
> for the normative text and check the current version. Replace every
> `[bracketed]` value and every row marked *Example*. This is a
> document format, not financial, investment, legal, regulatory or
> accounting advice.

<!--
Guidance: How to use this template
- A stress testing programme is the standing framework: which stress
  tests the bank runs, why, how often, with which scenarios and
  methods, who challenges them and how results change decisions. Each
  annual run produces results that feed the ICAAP Report
  (`finance/icaap-report`) and the ILAAP Report (`finance/ilaap-report`).
- Approve the programme at the management body at least once a year
  and whenever the risk profile or the environment changes materially.
  Record each run in section 7 and keep prior runs as annexes.
- Keep scenarios specific to the bank: a severe but plausible
  narrative that hits its own concentrations and business model, not
  only a copy of a supervisory scenario.
- The worked example uses the fictional Fernhollow Bank, a mid-sized
  EU credit institution (EUR, total assets EUR 47,400 million, TREA
  EUR 20,000 million, CET1 ratio 15.0% at 2026-12-31). Results match
  the ICAAP and ILAAP reports. All numbers are fictional.
- Related documents: Risk Appetite Statement
  (`finance/risk-appetite-statement`), Recovery Plan
  (`finance/recovery-plan`), Contingency Funding Plan
  (`finance/contingency-funding-plan`), IRRBB Policy and Report
  (`finance/irrbb-policy-and-report`), Market Risk Limit Framework
  (`finance/market-risk-limit-framework`), Model Risk Management Policy
  (`finance/model-risk-management-policy`), Model Validation Report
  (`ai-data/model-validation-report`), ECL Methodology
  (`finance/ecl-methodology`), Operational Risk RCSA
  (`finance/operational-risk-rcsa`).
-->

## Document control

<!-- Guidance: Record the programme year, the approving meeting and the link to the latest results. Pitfall: a programme document that is approved once and never updated while scenarios change every year. -->

| Field | Value |
|---|---|
| Document ID | [STP-YYYY] *Example:* STP-2026 |
| Institution and scope | [Entities covered] *Example:* Fernhollow Bank, consolidated |
| Programme period | [Dates] *Example:* 2026-07-01 to 2027-06-30 |
| Reference date of the main run | [YYYY-MM-DD] *Example:* 2026-12-31 (first run on 2026-09-30 data, rolled forward to the year-end balance sheet in January) |
| Scenario horizon | [Years] *Example:* three years (2027 to 2029) for capital; 90 days and one year for liquidity |
| Currency and units | [EUR million] |
| Version | [0.1] |
| Status | [Draft / In review / Approved] |
| Owner | [@head-of-stress-testing] |
| Approvers/reviewers | [@chief-risk-officer], [scenario committee], [risk committee], [management body] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |
| Next review | [YYYY-MM-DD] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Head of stress testing (preparer) | [@name] | [Submitted] | YYYY-MM-DD |
| Chief economist (scenario owner) | [@name] | [Scenario narrative confirmed] | YYYY-MM-DD |
| Chief Risk Officer | [@name] | [Recommend] | YYYY-MM-DD |
| Board risk committee | [@chair] | [Recommend to the management body] | YYYY-MM-DD |
| Management body | [@chair] | [Approve programme and scenarios] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | Stress test inventory and calendar updated |
| 0.5 | YYYY-MM-DD | [@name] | *Example:* SCN-002 narrative changed from recession to stagflation with CRE correction |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved by the management body |

## Contents

<!-- Guidance: Keep this list aligned with the headings. -->

1. [Objectives and scope](#1-objectives-and-scope)
2. [Governance and roles](#2-governance-and-roles)
3. [Stress test inventory](#3-stress-test-inventory)
4. [Scenario design](#4-scenario-design)
5. [Methodology by risk type](#5-methodology-by-risk-type)
6. [Data and balance sheet assumptions](#6-data-and-balance-sheet-assumptions)
7. [Results](#7-results)
8. [Management actions](#8-management-actions)
9. [Reverse stress testing](#9-reverse-stress-testing)
10. [Challenge, validation and audit](#10-challenge-validation-and-audit)
11. [Use of results](#11-use-of-results)
12. [Annual calendar](#12-annual-calendar)
13. [Regulatory map and jurisdiction notes](#13-regulatory-map-and-jurisdiction-notes)
14. [Glossary and references](#14-glossary-and-references)
15. [Standard and licence note](#15-standard-and-licence-note)

## 1. Objectives and scope

<!-- Guidance: State why the bank stress tests and what the programme covers. Questions: Which decisions depend on stress test results? Which risks, entities and horizons are in scope? Pitfall: a programme designed only to satisfy the supervisor, with results that nobody uses. -->

State the objectives in terms of decisions: setting and testing the risk appetite, assessing capital and liquidity adequacy in the ICAAP and ILAAP, calibrating the recovery plan indicators, informing the strategic plan and the budget, setting limits and identifying concentrations and hidden vulnerabilities. Then state the scope: risk types, entities, portfolios, horizons and the frequency of each test.

*Example:* Fernhollow Bank's programme has five objectives: (1) confirm that capital stays above the risk appetite floor of 12.0% CET1 in a severe but plausible adverse scenario over three years, or define the actions that restore it; (2) confirm a liquidity survival horizon of at least 60 days in a combined liquidity stress; (3) test the commercial real estate concentration and the deposit franchise, the bank's two main vulnerabilities; (4) calibrate recovery plan indicators; and (5) support the annual strategic plan with a downside case. The scope covers all material risks in the ICAAP risk inventory and the consolidated perimeter. The small client-hedging trading book (internal model for general market risk) is stressed through the trading book scenarios and the stress loss limit MRL-003 (EUR 25 million) of the Market Risk Limit Framework (`finance/market-risk-limit-framework`); the result is immaterial at group level and is not modelled separately in SCN-002.

## 2. Governance and roles

<!-- Guidance: Show who designs, runs, challenges and approves stress tests, and how the management body engages. Questions: Does the management body discuss the scenario narrative before results are produced? Is there an independent challenge of models and assumptions? Pitfall: the board sees only the final numbers and never the assumptions that drive them. -->

Assign clear responsibilities across the three lines. The management body approves the programme and the main scenarios and discusses the results and actions; senior management runs the programme and ensures resources; the risk function owns methodology and coordination; finance owns the baseline projections; business lines provide expert input; model validation and internal audit provide independent challenge.

| Role | Responsibility | Output |
|---|---|---|
| Management body and risk committee | Approve programme, scenarios, results and actions | Minutes, approved scenarios |
| Scenario committee (CRO, CFO, chief economist, business heads) | Design and challenge scenario narratives and severity | Scenario pack |
| Stress testing team (risk) | Coordinate, run models, aggregate results | Results pack |
| Finance | Baseline balance sheet and P&L projections | Baseline plan |
| Treasury | Liquidity scenarios and funding responses | Liquidity results |
| Business lines | Expert judgement on volumes, margins, client behaviour | Documented inputs |
| Model validation | Validate satellite and stress models | Validation reports |
| Internal audit | Review the programme and its use | Audit report |

```mermaid
flowchart TD
    A[Risk identification and vulnerabilities] --> B[Scenario committee designs narratives]
    B --> C[Management body discusses scenarios]
    C --> D[Translate narrative into macro and market variables]
    D --> E[Satellite models and expert judgement by risk type]
    E --> F[Aggregate capital, liquidity and P and L results]
    F --> G[Challenge by risk committee and validation]
    G --> H[Management actions and decisions]
    H --> I[Use: RAF, ICAAP, ILAAP, recovery plan, strategy]
    I --> A
```

## 3. Stress test inventory

<!-- Guidance: List every stress test the bank runs, by type, purpose, frequency and owner, so gaps and overlaps are visible. Questions: Is each material risk covered by at least one sensitivity and one scenario test? Is there a reverse stress test? Pitfall: many disconnected tests with different assumptions that cannot be compared. -->

Cover the main types: sensitivity analysis (one risk factor moved at a time), scenario analysis (several factors moved together under a coherent narrative), reverse stress testing (starting from a defined failure point), and ad hoc tests requested by management or the supervisor. Include supervisory exercises in which the bank participates.

| Test ID | Type | Purpose | Risks | Frequency | Owner | Feeds |
|---|---|---|---|---|---|---|
| ST-001 *(Example)* | Scenario, enterprise-wide | ICAAP normative perspective | All material | Annual, update half-yearly | Stress testing team | ICAAP, RAF |
| ST-002 *(Example)* | Scenario, liquidity | ILAAP survival horizon | Liquidity and funding | Monthly (full), weekly (light) | Treasury and liquidity risk | ILAAP, CFP |
| ST-003 *(Example)* | Sensitivity, credit | CRE price shocks of 10%, 20% and 30% | Credit, concentration | Quarterly | Credit risk | Sector limits |
| ST-004 *(Example)* | Sensitivity, IRRBB | Six supervisory interest rate shocks for EVE and NII | IRRBB | Quarterly | ALM | IRRBB report |
| ST-005 *(Example)* | Sensitivity, CSRBB | Spread widening on liquidity portfolio | CSRBB | Quarterly | Market risk | ICAAP |
| ST-006 *(Example)* | Scenario, operational | Severe cyber event and external fraud wave | Operational | Annual | ORM | ICAAP, RCSA |
| ST-007 *(Example)* | Reverse | Capital and liquidity failure points | All | Annual | Stress testing team | Recovery plan |
| ST-008 *(Example)* | Climate scenario | Transition and physical risk over a long horizon | Credit, business | Annual | Climate risk | Strategy, ICAAP |

## 4. Scenario design

<!-- Guidance: Describe each scenario as a narrative, translate it into variables and explain how severity was calibrated. Questions: Is the scenario severe but plausible for this bank? Does it hit the bank's specific vulnerabilities and combine risks that interact? Pitfall: a scenario that is severe for the economy in general but mild for the bank because it misses its concentrations. -->

Start from the bank's vulnerabilities, write a narrative that explains how a shock unfolds and spreads, and then derive consistent paths for macro and market variables. Calibrate severity against history (for example the worst observed outcomes in comparable downturns), against supervisory scenarios and against expert views. Document why the scenario is plausible and why it is severe enough. Keep a baseline aligned with the budget so the stress effect can be read as a difference.

### 4.1 Scenario narratives

| Scenario ID | Name | Narrative *(Example)* |
|---|---|---|
| SCN-001 | Baseline | Moderate growth, inflation close to 2%, stable policy rates; consistent with the strategic plan and budget |
| SCN-002 | Adverse: stagflation with CRE correction | An energy supply shock pushes inflation back above 5%; central banks keep rates high, long rates rise by 150 bp, the economy contracts for two years, office and retail property values fall sharply as refinancing costs rise, SME defaults climb in energy-intensive sectors and depositors move savings to higher-yielding products |
| SCN-L01 to SCN-L03 | Liquidity scenarios | Idiosyncratic, market-wide and combined liquidity shocks, defined in the ILAAP Report |
| SCN-004 | Reverse | Constructed backwards from the MDA and TSCR breach points (section 9) |

### 4.2 Macro-financial variables

| Variable *(Example)* | SCN-001 2027 | 2028 | 2029 | SCN-002 2027 | 2028 | 2029 |
|---|---|---|---|---|---|---|
| Real GDP growth | 1.4% | 1.5% | 1.5% | -2.5% | -1.0% | 0.8% |
| Unemployment rate (annual average) | 6.1% | 6.0% | 5.9% | 7.8% | 9.0% | 8.6% |
| Consumer price inflation | 2.1% | 2.0% | 2.0% | 5.5% | 4.0% | 2.5% |
| Residential property prices (change) | 3.0% | 3.0% | 3.0% | -7.0% | -5.0% | 0.0% |
| Commercial property prices (change) | 1.0% | 2.0% | 2.0% | -15.0% | -10.0% | -2.0% |
| 10-year EUR swap rate (year end) | 2.6% | 2.7% | 2.8% | 4.1% | 3.9% | 3.5% |
| Equity index (change) | 5.0% | 5.0% | 5.0% | -30.0% | 0.0% | 10.0% |
| BBB corporate spread change (bp) | 0 | 0 | 0 | +250 | +100 | -100 |

Cumulative property price changes in SCN-002: residential 0.93 x 0.95 x 1.00 = 0.8835, a fall of 11.7%; commercial 0.85 x 0.90 x 0.98 = 0.7497, a fall of 25.0%. The 10-year swap rate in SCN-002 is 150 bp above the baseline at the end of 2027 (4.1% minus 2.6%).

Translate the narrative into variables with a documented chain of reasoning: which variable moves first, how the others respond and why. Use the bank's own macroeconomic model or a recognised external forecast for the baseline, and apply shocks that are consistent with each other (for example, higher inflation with higher rates and weaker real income). Add bank-specific variables that the macro paths do not capture, such as deposit pricing pressure from competitors, the loss of a major client or a rating downgrade, and state how they interact with the macro shock. Keep every variable path in a scenario file with a version number so each model run can be traced to the scenario it used.

### 4.3 Severity calibration

*Example:* The scenario committee compared the GDP fall of SCN-002 (a cumulative decline of about 3.5% over two years, since 0.975 x 0.990 = 0.9653) with the deepest two-year contractions in the bank's markets since 2000 and with the most recent EU-wide adverse scenario, and judged it between the two. The commercial property fall of 25% is deliberately more severe than the residential fall because the bank's vulnerability lies there. The scenario is plausible because each element has occurred in the last 25 years, though not all together.

## 5. Methodology by risk type

<!-- Guidance: Explain how scenario variables translate into losses, income and exposure for each risk, which models are used and where expert judgement replaces models. Questions: Are satellite models validated for the stress range? How are second-round effects captured? Pitfall: models estimated on benign data that understate losses in a stress. -->

For each risk type, describe the transmission from scenario variables to financial outcomes, the models or expert methods used, key parameters and limitations. Make the links between risks explicit, for example how higher rates raise both net interest income and credit losses, or how a rating downgrade affects both funding costs and deposit outflows.

| Risk | Transmission and method *(Example)* | Model ID |
|---|---|---|
| Credit risk | PD and LGD satellite models link default and loss rates to GDP, unemployment, rates and property prices; IFRS 9 stage migration and ECL recomputed each year | MOD-ST-03 |
| Concentration | Default of the largest exposures tested separately; CRE LGD floored at 40% | MOD-ST-03 |
| IRRBB and NII | Repricing gap and deposit beta model under the scenario rate path; EVE under the scenario curve | MOD-IR-02 |
| CSRBB and valuation | Spread shocks applied to FVOCI bonds; impact through other comprehensive income into CET1 | Market risk tools |
| Operational risk | Scenario-based losses (cyber event, fraud wave) added in year one | MOD-OR-04 |
| Business risk | Fee income and volumes from business-line expert input, challenged by finance | Expert |
| Liquidity | Behavioural run-off and drawdown under each liquidity scenario | MOD-LQ-01, MOD-LQ-02 |
| RWEA | Credit RWEA recomputed with stressed PDs for IRB portfolios and migration for standardised exposures; output floor tested | Capital engine |

Explain how the ECL under IFRS 9 is projected in stress (see ECL Methodology, `finance/ecl-methodology`) and how the results are kept consistent with accounting rules. Describe where expert judgement overrides model outputs and who approved it.

## 6. Data and balance sheet assumptions

<!-- Guidance: State the data sources, the reference date and whether the balance sheet is static or dynamic. Questions: Are dynamic balance sheet assumptions credible in a stress (for example, can the bank really grow lending)? Pitfall: a dynamic balance sheet that lets the bank grow its way out of the stress. -->

Choose and justify the balance sheet assumption. A static balance sheet (maturing exposures replaced like for like) isolates the stress effect and supports comparison across years; a dynamic balance sheet reflects business plans and management reactions but must be credible under the scenario. Many banks run both. Record data sources, reconciliations with accounting and supervisory reports, and data limitations.

*Example:* Fernhollow Bank runs SCN-002 on a dynamic balance sheet for the ICAAP, with loan growth cut to zero in 2027 and to half the baseline rate in 2028 and 2029, and on a static balance sheet for the comparison with the supervisory exercise. Dividends are set to zero in the adverse scenario because the board's capital policy suspends distributions when the projected CET1 ratio falls below 13.5%.

Reconcile the starting point with the audited financial statements and the supervisory reports at the reference date, and record every manual adjustment in a data log with its approver. Where data are missing (for example historical loss data for a new product), use proxies from comparable portfolios or external data and add a conservative overlay. State the treatment of new business, prepayments, rating migration and collateral values, and keep the same assumptions across the capital and liquidity runs unless there is a documented reason to differ.

## 7. Results

<!-- Guidance: Summarise outcomes against limits and requirements, show the drivers and record the main conclusions. Questions: What is the maximum depletion and when does it occur? Which risk drives most of the loss? Does the result breach any limit or requirement? Pitfall: presenting only end-of-horizon ratios and hiding the trough. -->

### 7.1 Capital results (ST-001, SCN-002, before management actions)

| Metric *(Example)* | 2026 actual | 2027 | 2028 | 2029 | Threshold |
|---|---|---|---|---|---|
| CET1 capital (EUR m) | 3,000 | 2,770 | 2,620 | 2,720 | |
| TREA (EUR m) | 20,000 | 21,400 | 22,000 | 21,800 | |
| CET1 ratio | 15.0% | 12.9% | 11.9% | 12.5% | Floor 12.0%; OCR + P2G 10.125% |
| Leverage ratio | 6.8% | 6.2% | 5.9% | 6.0% | 3.0% |
| Cumulative impairments (EUR m) | | 520 | 1,000 | 1,200 | |

Main drivers of the 3.1 percentage point CET1 depletion to the 2028 trough: impairments of EUR 1,000 million over two years, of which commercial real estate EUR 430 million and SME lending EUR 390 million (the rest mortgages and consumer), valuation losses of EUR 130 million on the liquidity portfolio, operational losses of EUR 40 million, and RWEA inflation of EUR 2,000 million, mainly from rating migration and partly from the reduced loan growth in 2028, partly offset by pre-provision profit of EUR 680 million and tax effects of EUR 110 million. Check: 3,000 minus 1,000 minus 130 minus 40 + 680 + 110 = 2,620. Full details are in the ICAAP Report, section 8.

### 7.2 Liquidity results (ST-002)

| Metric *(Example)* | Result | Appetite | Status |
|---|---|---|---|
| Survival horizon, combined stress SCN-L03 | about 80 days | 60 days | Within appetite |
| LCR trough in SCN-002 (2028) | 124% | 120% | Within appetite, below early warning 130% |
| NSFR trough in SCN-002 (2028) | 113% | 110% | Within appetite, below early warning 115% |

The liquidity results stay within appetite, but two of them fall below early warning levels in the adverse macro scenario. The programme therefore treats the 2028 senior bond maturity as the key liquidity vulnerability and links it to the pre-funding decision recorded in section 11. Read these results together with the capital results: the same scenario that lowers the CET1 ratio also slows deposit growth and raises funding costs, so capital and liquidity actions must be planned together.

### 7.3 Sensitivity results

| Test | Shock | Impact *(Example)* | Limit or reference |
|---|---|---|---|
| ST-003 | CRE prices minus 30% (instantaneous) | Additional ECL EUR 360 million, CET1 minus 1.6 pp after tax | Sector limit review trigger at minus 1.5 pp |
| ST-004 | Worst of six supervisory shocks (EVE) | EVE minus EUR 300 million, 8.8% of Tier 1 | Outlier test threshold 15% of Tier 1 |
| ST-005 | Spreads plus 200 bp on FVOCI bonds | OCI minus EUR 95 million | Internal limit EUR 150 million |

Recompute: 300 / 3,400 = 8.8% of Tier 1. A CET1 effect of 1.6 percentage points on TREA of 20,000 is EUR 320 million, which corresponds to an ECL increase of EUR 360 million less a tax effect of EUR 40 million (only part of the provision is tax deductible in the example).

## 8. Management actions

<!-- Guidance: List credible actions with triggers, effects and timing, and test their feasibility under the scenario. Pitfall: actions that would not be available in the scenario, such as issuing equity in a market crash. -->

Define management actions in advance, linked to triggers in the risk appetite framework and recovery plan, and show results before and after them. Each action needs an owner, an estimated effect, a time to execute, preconditions and an assessment of feasibility under the specific scenario. Do not include actions that depend on market conditions the scenario has removed.

| Action ID | Action | Trigger | Effect in SCN-002 *(Example)* | Feasibility |
|---|---|---|---|---|
| MA-001 | Suspend dividends | Projected CET1 below 13.5% | Included in results (no distribution 2027 to 2029) | High |
| MA-002 | Slow corporate lending growth | Projected CET1 below 12.5% | TREA minus EUR 300 million | High |
| MA-003 | Sell non-core participation | Projected CET1 below 12.0% | CET1 plus EUR 60 million | Medium |
| MA-004 | Synthetic securitisation of SME loans | Projected CET1 below 11.5% | TREA minus EUR 800 million (not counted) | Medium, market dependent |

With MA-002 and MA-003 the 2028 CET1 ratio becomes 2,680 / 21,700 = 12.35%, above the floor of 12.0%.

## 9. Reverse stress testing

<!-- Guidance: Start from defined failure points, find the scenarios that cause them and judge their plausibility. Questions: Which combinations of events would make the business model unviable? Are they monitored by early warning indicators? Pitfall: a reverse stress test that simply scales up the adverse scenario without exploring other combinations. -->

Define failure points for capital (for example breach of the MDA threshold, breach of TSCR as a proxy for non-viability) and for liquidity (exhaustion of counterbalancing capacity). Work backwards to the loss or outflow that would cause each, then explore several combinations of events that could produce it, including non-macro events such as fraud, cyber attacks, conduct fines and the loss of a key counterparty. Assess plausibility and feed the results into early warning indicators and recovery options.

| ID | Failure point | Required loss or outflow *(Example)* | Plausible combinations | Response |
|---|---|---|---|---|
| RST-001 | CET1 at OCR 9.125% (TREA 22,000) | CET1 loss of EUR 992.5 million from 3,000 | SCN-002 plus a 40% CRE price fall and default of the two largest borrower groups | CRE limit cut, single-name limit review |
| RST-002 | CET1 at TSCR 5.625% | CET1 loss of EUR 1,762.5 million | RST-001 plus a severe cyber event and forced asset sales after SME deposit flight | Recovery indicators and options in `finance/recovery-plan` |
| RST-003 | Counterbalancing capacity exhausted within 30 days | Net outflows above EUR 8,500 million | 60% of SME and corporate deposits, 25% of less stable and 10% of stable retail deposits leave, no roll-over of wholesale funding maturing in the period, 15% of undrawn facilities drawn: net outflows 8,730 after inflows of 1,200 (ILAAP section 6.2) | CFP early warning indicators in `finance/contingency-funding-plan` |

Recompute: 3,000 minus (9.125% x 22,000 = 2,007.5) = 992.5; 3,000 minus (5.625% x 22,000 = 1,237.5) = 1,762.5. RST-003: 5,400 + 1,500 + 1,800 + 600 + 630 = 9,930 gross outflows; 9,930 minus 1,200 = 8,730, which exceeds the counterbalancing capacity of 8,500. The required outflow is about 1.8 times the 30-day net outflow of the combined scenario SCN-L03 (4,900), which is what makes the reverse scenario more extreme than the regular one.

## 10. Challenge, validation and audit

<!-- Guidance: Show how assumptions, models and results are challenged before they reach the board. Questions: Who can stop a result from being used? Are expert overlays documented and approved? Pitfall: challenge that happens after the board has seen the numbers. -->

Document the challenge at each step: the scenario committee challenges narratives and variable paths; model validation reviews satellite models and overlays under the Model Risk Management Policy (`finance/model-risk-management-policy`) with findings recorded in Model Validation Reports (`ai-data/model-validation-report`); the risk committee challenges results and actions; internal audit reviews the whole programme periodically. Benchmark results against supervisory exercises and peer disclosures where available, and explain material differences.

| Finding ID | Source | Finding *(Example)* | Action | Due |
|---|---|---|---|---|
| CH-001 *(Example)* | Scenario committee | Deposit outflow assumption in SCN-002 too mild compared with 2023 bank failures abroad | Raise less stable retail run-off by 5 points | 2026-11-30 |
| CH-002 *(Example)* | Model validation | CRE LGD model not tested for price falls above 20% | Floor CRE LGD at 40% pending re-estimation | 2027-03-31 |
| CH-003 *(Example)* | Internal audit | Expert overlays on fee income not documented | Overlay log introduced | 2027-01-31 |

## 11. Use of results

<!-- Guidance: Show how results changed decisions. Pitfall: a "use" section that lists documents rather than decisions. -->

Record the decisions taken on the basis of stress test results during the year, with dates and owners, so the supervisor and internal audit can see that stress testing is part of management and not a separate exercise.

| Decision | Based on | Date *(Example)* | Owner |
|---|---|---|---|
| CRE sector limit lowered in steps from 14% to 12% of loans (13.5% end-2027, 12.5% end-2028, 12.0% end-2029) | ST-001, ST-003, RST-001 | 2026-12-15 | Credit committee |
| Risk appetite CET1 floor confirmed at 12.0%, with pre-approved actions MA-002 and MA-003 | ST-001 | 2027-02-20 | Management body |
| Pre-funding of half of the 2028 senior bond maturity | ST-002 | 2027-02-20 | ALCO |
| Recovery plan CET1 indicator set at 11.0% | ST-001, RST-001 | 2027-03-15 | Recovery plan owner |

## 12. Annual calendar

<!-- Guidance: Fix the timeline so scenarios are approved before the run and results arrive before the ICAAP and ILAAP sign-off. -->

Plan the cycle backwards from the date the ICAAP and ILAAP must be submitted. The management body should discuss and approve the scenario narratives before any numbers are produced, so that its challenge shapes the exercise rather than reacting to it. Leave time for at least one iteration between the first results and the final run, because the first results almost always reveal an assumption that needs to change. Run a lighter update at mid-year, or sooner if a trigger in the risk appetite framework fires or the economic outlook shifts materially, and record the reason for every off-cycle run in the stress test inventory.

*Example:* Fernhollow Bank approves scenarios at the end of August, produces first results in mid-November on 2026-09-30 data, challenges them in December, rolls them forward to the actual 2026-12-31 balance sheet in January and February, and signs the ICAAP and ILAAP in March. The roll-forward replaces the starting balance sheet and capital position with the year-end actuals and re-runs the projections; a material change from the first results goes back to the risk committee before sign-off.

```mermaid
gantt
    title Annual stress testing cycle (Example)
    dateFormat YYYY-MM-DD
    section Design
    Vulnerability review and scenario narratives :a1, 2026-07-01, 45d
    Scenario approval by management body :a2, after a1, 15d
    section Execution
    Baseline projections and 2026-09-30 data load :b1, 2026-09-01, 45d
    Model runs and aggregation on 2026-09-30 data :b2, after b1, 30d
    Year-end roll-forward on 2026-12-31 actuals :b3, 2027-01-05, 45d
    section Challenge and use
    Validation and committee challenge :c1, after b2, 30d
    ICAAP and ILAAP integration and sign-off :c2, after b3, 30d
```

## 13. Regulatory map and jurisdiction notes

<!-- Guidance: List the rules relied on with status and dates; label proposals as proposals. -->

| Topic | Reference | Status as of 2026-10 (check the current version) |
|---|---|---|
| Institutions' own stress testing | EBA/GL/2018/04, Guidelines on institutions' stress testing | In force; referenced by the revised SREP Guidelines |
| ICAAP and ILAAP stress testing | CRD Arts 73 and 86 | In force |
| Supervisory stress testing | CRD Art. 100; EBA/GL/2022/03 until 2026-12-31, EBA/GL/2026/06 from 2027-01-01 | EBA/GL/2026/06 repeals EBA/GL/2022/03 and EBA/GL/2017/05 |
| EU-wide stress test | EBA methodology for the relevant exercise (if the bank is in the sample) | Check the EBA site for the current exercise |
| SSM expectations | ECB Guide to the ICAAP (July 2026), Principle 7; ECB Guide to the ILAAP (November 2018), Principle 7 | Current |
| International principles | Basel Committee, Stress testing principles (October 2018) | Name only |
| UK entity (if any) | PRA supervisory statements on ICAAP (SS31/15, updated December 2025) and ILAAP (SS24/15) | Names only; check the PRA Rulebook |
| US (if a US banking organisation exists) | 12 CFR part 252 company-run stress test requirements for covered companies | Check thresholds and local law |

## 14. Glossary and references

<!-- Guidance: Define every abbreviation once and list sources with versions and dates. -->

| Term | Meaning |
|---|---|
| Sensitivity analysis | Stress test that moves one risk factor or a small set of factors without a narrative |
| Scenario analysis | Stress test that moves many variables together under a coherent narrative |
| Reverse stress test | Test that starts from a failure outcome and identifies scenarios that would cause it |
| Satellite model | Model linking scenario variables to risk parameters such as PD, LGD or deposit outflows |
| Static balance sheet | Assumption that maturing positions are replaced like for like |
| Dynamic balance sheet | Assumption that the balance sheet evolves with business plans and management reactions |
| Management action | Pre-defined action that changes capital or liquidity, with trigger and feasibility assessment |
| OCR, TSCR, P2G | Overall capital requirement, total SREP capital requirement, Pillar 2 guidance (see ICAAP Report) |

References (cited by number and title; obtain the official text):

- EBA, Guidelines on institutions' stress testing, EBA/GL/2018/04.
- EBA, Guidelines (revised) on common procedures and methodologies for SREP and supervisory stress testing, EBA/GL/2026/06, 26 June 2026, applying from 2027-01-01.
- Directive 2013/36/EU (CRD), Articles 73, 86 and 100, as amended. EUR-Lex.
- ECB, Guide to the ICAAP (July 2026) and Guide to the ILAAP (November 2018). ECB Banking Supervision.
- Basel Committee on Banking Supervision, Stress testing principles, October 2018 (name only).

## 15. Standard and licence note

Based on EBA Guidelines EBA/GL/2018/04 and EBA/GL/2026/06, Directive 2013/36/EU (CRD) Articles 73, 86 and 100, and the ECB Guides to the ICAAP and ILAAP. Structure aligned with the Basel Committee "Stress testing principles" (October 2018), cited by name only. EUR-Lex, ECB and EBA material is reused with acknowledgement; guideline and article numbers are cited and no normative text is reproduced. The structure, guidance, scenarios and the Fernhollow Bank example are original; Fernhollow Bank and every figure are fictional. Check the current official versions before use. This is a document format, not financial, investment, legal, regulatory or accounting advice.

Template licence: MIT.