Liquidity Stress Testing for Your CFP: Scenarios, Assumptions & Methodology

Silicon Valley Bank’s internal liquidity stress test was flashing red eight months before the collapse. By August 2022, SVB’s 30-day deficit under stressed conditions was roughly $18 billion. By September, the 90-day deficit hit $23 billion. Management’s response wasn’t to fix the liquidity problem — it was to change the model assumptions to make the deficit disappear.

The Fed had already issued MRIAs for CFP and stress testing deficiencies in 2021. None of it translated to action before the bank failed on March 10, 2023.

If your CFP stress test would have missed what happened to SVB — concentrated uninsured deposits, HTM portfolio impairment, assumptions that modeled gradual stress rather than sudden severe shocks — your stress test isn’t doing its job.

TL;DR

• Every US depository institution must maintain a CFP with documented liquidity stress testing — the 2010 Interagency Policy Statement and 2023 Addendum apply regardless of asset size
• Three required scenarios: idiosyncratic, market/systemic, and combined; combined is the most severe and must be explicitly modeled
• SVB’s failure was telegraphed by its own stress tests — which management gamed rather than acted on; the 2023 regulatory updates specifically address this
• Assumptions must be documented, independently validated, and calibrated to your institution’s actual risk profile — not generic industry defaults

The Regulatory Foundation: What’s Required and Who It Applies To

The 2010 Interagency Policy Statement — Still the Baseline

The Interagency Policy Statement on Funding and Liquidity Risk Management (March 2010), issued jointly by the OCC, Fed, FDIC, and NCUA, is the foundational document governing CFP requirements for all US depository institutions. It requires:

• Formal CFPs that delineate policies for a range of stress environments
• Cash flow projections across multiple stress severity levels
• Diversified funding sources
• High-quality liquid asset (HQLA) cushions
• Quantitative projections of funding needs and capacity

The policy statement applies to every FDIC-insured institution regardless of size. Community banks, credit unions, and fintechs operating on banking licenses are all within scope. The required sophistication scales with the institution’s size and complexity — but the basic requirement to have a documented, tested CFP with stress scenarios does not.

The 2023 Addendum — The SVB Response

The 2023 Addendum to the Interagency Policy Statement (July 28, 2023) was a direct regulatory response to the SVB and Signature Bank failures. Three additions matter most for practitioners:

1. Discount window operational testing. Institutions must operationally test Federal Reserve discount window access — not just list it as a theoretical contingency source. SVB’s inability to access the discount window during the crisis partly reflected that it had never been operationally tested.

2. Funding source realism. Institutions must assess which funding sources are realistically available under adverse circumstances — not just contractually available. A credit facility from a counterparty that would also be under stress in a combined scenario may not be accessible.

3. Periodic CFP review. CFPs must be reviewed and revised as market conditions or strategic initiatives change materially. An acquisition, a new deposit product, or a shift in depositor composition all require CFP reassessment.

Issued via OCC Bulletin 2023-25 and FDIC FIL-23-039.

Enhanced Standards for Larger Institutions

12 CFR 252.35 (Regulation YY) applies to bank holding companies with $100 billion or more in total consolidated assets (formerly $50B; raised by S.2155 in 2018). It codifies formal requirements for:

• Minimum stress scenarios (idiosyncratic, market-wide, combined)
• Minimum time horizons (overnight, 30-day, 90-day, 1-year)
• Liquidity buffer calibrated to the 30-day net stressed cash-flow need
• Monthly testing frequency for most institutions; quarterly for Category IV
• CRO approval of assumptions; independent review of stress testing processes

For smaller institutions, the OCC’s Liquidity booklet (updated May 2023) and FFIEC examiner guidance set the expectations.

The Three Required Stress Scenarios

Every CFP stress test must model at minimum three scenarios. Combined stress is the most demanding and most regulatorily important.

Scenario 1: Idiosyncratic Stress

Idiosyncratic scenarios model events specific to your institution — problems that would affect your liquidity without necessarily affecting peers.

Common idiosyncratic triggers:

• Credit rating downgrade (triggers collateral calls, counterparty withdrawal, loss of unsecured borrowing access)
• Rapid deterioration in asset quality or publicized credit losses
• Large unexpected loan drawdowns from credit commitments
• Margin calls on trading positions or derivatives
• Counterparty withdrawal of repo lines and credit facilities
• Operational failure or reputational event (fraud, exam finding, management departure)
• Loss of access to capital markets for new issuance

Calibration principle: The severity of idiosyncratic scenarios should reflect the institution’s specific vulnerabilities. A bank with significant derivatives exposure should model realistic margin call scenarios. A bank with high commercial loan commitment utilization should model drawdown assumptions specific to its obligor mix.

Scenario 2: Market/Systemic Stress

Systemic scenarios model external market disruptions that would affect the broader financial system — not just your institution.

Common systemic scenarios:

• Market-wide credit market seizure (repo markets freeze, commercial paper markets close)
• SVB-style social-media-amplified deposit flight from the banking sector broadly
• Broad economic recession with simultaneous credit deterioration
• Disruption in a specific sector that affects concentrated depositor or borrower exposures
• Geopolitical or macro shock that changes risk appetite across markets

The SVB lesson: Systemic stress scenarios that modeled “gradual” deterioration missed the actual failure mode. SVB’s depositors didn’t gradually reduce balances over 90 days — 25% of deposits withdrew in a single day. Scenarios must explicitly model sudden, severe shocks, not just gradual deterioration curves.

Scenario 3: Combined Stress

Combined stress models an idiosyncratic event occurring simultaneously with a systemic market disruption. Under 12 CFR 252.35, this is the most severe required scenario, and the liquidity buffer must be sized against it.

Why combined is hardest to survive: In a combined scenario, exactly when your institution needs external funding most (idiosyncratic stress), the market for that funding is simultaneously impaired (systemic stress). Contingent funding sources that would be available in isolation may not be available together.

Practical calibration: The combined scenario should assume multiple funding sources unavailable simultaneously — the Fed discount window congested, FHLB advance capacity constrained by collateral, repo lines cut, and wholesale funding withdrawn. Whatever your survival horizon under this scenario is your real liquidity floor.

Scenario Comparison Matrix

Assumption Documentation: What Examiners Will Challenge

Assumptions are where CFP stress tests succeed or fail. The SVB example is instructive: its stress test results improved materially in October 2022 not because the balance sheet improved, but because management changed assumptions. When the Fed’s Material Loss Review documented this, it became a case study in exactly what examiners now scrutinize.

Deposit Runoff Rates

The LCR regulatory framework (US implementation, final rule effective January 2015) sets baseline runoff assumptions. These are the regulatory minimum — institutions should apply higher runoff where their actual deposit mix warrants:

The SVB adjustment: Standard runoff rates proved catastrophically wrong for concentrated, uninsured institutional deposits in a sector-specific stress. SVB’s uninsured deposits were ~94% of total deposits — the highest among large banks. When tech sector news drove social media concern, customers attempted to withdraw approximately $42 billion in a single day, representing ~25% of total deposits. That’s not on any standard runoff table.

What to adjust in your assumptions:

• Identify any depositor concentrations (industry, geography, relationship type) that would exhibit correlated behavior under stress
• Apply sensitivity analysis showing how your survival horizon changes at 2x, 5x, and 10x standard runoff rates for concentrated categories
• Document the rationale for how you’ve classified deposits as “operational” vs. “non-operational” — examiners will test this classification

Asset Liquidity and HQLA Haircuts

Not all “liquid” assets are equally accessible under stress. The CFP must distinguish between:

The HTM problem: SVB held $91 billion in held-to-maturity securities. These could not be liquidated without realizing losses that would have wiped out capital. A CFP that lists HTM securities as a liquidity source is documenting a fiction. The usable HQLA figure must reflect only assets that can actually be monetized within the stress scenario’s time horizon without impairing solvency.

Contingent Funding Source Availability

Every contingent funding source in your CFP requires stress-tested availability assumptions:

Federal Reserve Discount Window The 2023 Addendum requires operational testing, not just inclusion as a theoretical source. “Available” means: collateral pre-positioned, account open, operational process tested with an actual draw. SVB’s failure was partly attributed to unreadiness to access the discount window. Your CFP should document the date of last operational test.

FHLB Advances FHLB borrowing capacity is collateral-constrained. Your CFP must reflect only unencumbered collateral actually available for pledge — not total eligible collateral, and not credit lines that assume additional pledging. Under combined stress, FHLB itself may impose conditions or limits.

Repo and Secured Financing Repo markets can close or dramatically widen haircuts during systemic stress. The CFP must model availability based on what’s realistic in a stress environment, not current market conditions.

Committed Credit Lines from Other Institutions In combined stress, your credit facility counterparties may themselves be under pressure. A credit line from an institution that would face similar stress is not a diversified funding source.

Documentation requirement: For each contingent funding source, the CFP must document: capacity available (not theoretical maximum), collateral or operational prerequisites, time-to-access under stress, and any conditions that might restrict availability in the modeled stress scenario.

Output Metrics: What the Stress Test Should Produce

Survival Horizon

The survival horizon — sometimes called days of liquidity — measures how many days the institution can meet all funding obligations without accessing new external funding. Calculate it by projecting day-by-day cumulative cash outflows against available HQLA and committed, accessible funding sources under each scenario.

Regulatory minimum: Most regulators expect a minimum 30-day survival horizon under the combined stress scenario. Institutions with concentrated funding or complex balance sheets should target longer horizons and can benchmark against peer practices.

Practical interpretation: An institution showing a 12-day survival horizon under combined stress has a structural CFP gap that needs to be addressed through either balance sheet changes (more HQLA, fewer unstable liabilities) or expanded contingent funding capacity.

LCR and NSFR (For Covered Institutions)

The Basel III LCR (effective in the US from January 2015; fully phased in 2017) requires:

LCR = HQLA ÷ Net Cash Outflows (30-day stressed horizon) ≥ 100%

The NSFR (effective July 2021) requires:

NSFR = Available Stable Funding ÷ Required Stable Funding (1-year horizon) ≥ 1.0

Yale School of Management analysis estimated SVB’s hypothetical LCR at approximately 75% — well below the 100% requirement — had it been subject to LCR standards. The LCR would have been an early warning signal.

For community banks and credit unions not subject to LCR/NSFR, these metrics are still useful benchmarks to calculate internally and track over time. They provide standardized comparisons against regulatory expectations and peer institutions.

Cumulative Funding Gap

The cumulative funding gap shows the running deficit (or surplus) in each time bucket — overnight, 7-day, 30-day, 90-day, 1-year — under each stress scenario. It answers the question: “How much additional funding would we need, and by when?”

Common CFP Stress Testing Deficiencies

Regulators and examiners have been explicit about what they find in examinations. From post-SVB guidance, FDIC community bank liquidity observations, and the OCC’s updated Liquidity booklet:

1. Assumption documentation is inadequate. Runoff rates and availability assumptions appear as numbers in a spreadsheet without documented rationale. Examiners want to know: where did this number come from? What historical data or market research supports it?

2. Scenarios are too mild. Stress scenarios model “moderate” adverse conditions rather than severe shocks. The 2023 Addendum explicitly pushed institutions to model sudden, severe events.

3. HTM securities are treated as liquid. CFPs count held-to-maturity securities as available liquidity without acknowledging the capital impact of liquidation.

4. Contingent sources aren’t actually available. The discount window appears as a funding source but was never operationally tested. FHLB capacity is listed at theoretical maximum, not collateral-constrained actual.

5. No independent review of assumptions. For community banks, “independent” means someone outside the treasury or CFO function reviewed the assumptions. For larger institutions, the CRO must formally approve. A stress test built and reviewed only by the treasury team lacks the independent challenge that gives it credibility.

6. Deposit classification self-serving. SVB classified large portions of corporate deposits as “operational” — which carry lower runoff rates. Examiners now specifically scrutinize how institutions classify deposits that qualify for lower runoff treatment.

7. No sensitivity analysis. The base stress test reflects a single assumption set with no analysis of what happens if key assumptions are wrong by 20%, 50%, or 100%.

Building a CFP Stress Test: Practical Implementation

Governance Structure

Board: Reviews and approves the CFP stress testing framework; receives results and management’s assessment of adequacy.

Senior Management / CRO: Approves assumptions; receives results; responsible for acting on deficits rather than changing assumptions.

Treasury / Asset-Liability Management: Runs the stress test; owns the model; maintains the assumption documentation.

Independent Review: Internal audit or a separate risk function validates that assumptions are documented, independently calibrated, and that the process is functioning as designed.

Documentation Checklist

Before an examiner asks for it, your CFP stress test documentation should include:

• Written stress scenario descriptions (idiosyncratic, systemic, combined)
• Time horizons for each scenario (overnight, 30-day, 90-day, 1-year)
• Deposit segmentation with runoff rate assumptions and documented rationale
• Asset liquidity schedule with haircuts for each category
• Contingent funding source schedule with: capacity available, prerequisites, last operational test date (discount window), and stress availability assumption
• Survival horizon calculation for each scenario
• LCR/NSFR calculations (even if not required for your institution size)
• Sensitivity analysis on key assumptions
• Date of last independent review and who conducted it
• Board/senior management approval date
• CFP update history (with triggers that prompted each update)

30/60/90-Day Build Plan

Days 1–30:

• Map your current deposit book into regulatory runoff categories (retail stable, retail less stable, operational corporate, non-operational corporate, brokered)
• Identify HTM securities and remove them from HQLA calculations
• List all contingent funding sources with current collateral-constrained capacity
• Build a simple 30-day cash flow projection under your current base scenario

Days 31–60:

• Design idiosyncratic and combined stress scenarios calibrated to your institution’s actual risk profile (What’s your concentration? What’s your uninsured deposit percentage? What are your largest single counterparty exposures?)
• Apply runoff rates and availability haircuts to generate stressed cash flow projections
• Calculate survival horizon for each scenario
• Identify gaps and the structural changes or contingency source additions needed to address them

Days 61–90:

• Conduct operational test of discount window access (required by 2023 Addendum)
• Present stress test results to senior management and board with gap analysis
• Document assumption rationale and independent review sign-off
• Incorporate stress test results into CFP — including escalation procedures for when limits are breached
• Align CFP stress testing with BCP testing calendar so both programs reference the same operational risk framework

So What? The Stakes of Getting This Wrong

SVB’s regulators issued MRIAs for CFP and stress testing deficiencies in 2021. The bank’s own stress tests were showing liquidity deficits of tens of billions by late 2022. The model was fixed by changing the assumptions — and then the bank failed.

A CFP stress test that would pass examination but not actually protect the institution from a real liquidity event is worse than no test — because it creates false confidence and delays action.

The 2023 regulatory updates are a direct signal that examiners are looking harder at stress testing quality: scenario severity, assumption documentation, independent challenge, and discount window readiness. If your CFP stress test is a spreadsheet built four years ago that gets refreshed with current balance sheet figures annually, that may no longer be adequate.

Need a starting framework for your CFP? The Business Continuity & Disaster Recovery Kit includes CFP-aligned templates designed for FFIEC examination requirements.

Related Reading

• What Is a Contingency Funding Plan (CFP)? A Practitioner’s Guide
• Who Needs a Contingency Funding Plan? FINRA, OCC & Interagency Requirements Explained
• How to Build a Contingency Funding Plan: Step-by-Step Framework

Frequently Asked Questions

What scenarios are required in a CFP liquidity stress test? Three at minimum: idiosyncratic (institution-specific), market/systemic (external disruption), and combined (both simultaneously). The 2010 Interagency Policy Statement and 12 CFR 252.35 both require this framework. Combined stress is considered most severe and must be explicitly modeled with realistic contingent funding availability under stress.

What time horizons should a CFP stress test cover? Minimum: 30 days (LCR benchmark), 90 days (intermediate), 1 year (structural). Institutions subject to 12 CFR 252.35 (over $100B) also model overnight. For community banks, 30-day and 90-day coverage with the interagency guidance methodology is the examination expectation.

What deposit runoff assumptions should I use? LCR framework baselines: fully insured retail ~3%; less stable retail ~10%+; non-operational corporate deposits 40%; unsecured wholesale maturing within 30 days 100%. Adjust upward for concentrated, uninsured depositors — SVB showed 25% single-day outflow for concentrated tech/VC deposits. Document the rationale for every assumption.

What did SVB’s stress testing failures reveal? By August 2022, SVB’s own stress test showed a 30-day deficit of ~$18 billion. Rather than addressing the gap, management changed assumptions to reduce reported deficits by $13 billion in October 2022. The Federal Reserve had issued MRIAs for CFP and stress testing deficiencies in 2021. SVB’s HTM portfolio ($91B) couldn’t be liquidated without triggering capital-destroying losses.

Do community banks need formal liquidity stress testing? Yes. The 2010 Interagency Policy Statement applies to all depository institutions regardless of size, and the 2023 Addendum reinforced this with specific guidance on discount window testing and assumption realism. LCR/NSFR are not required for community banks, but scenario-based stress testing and documented assumptions are expected in examinations.

What is a survival horizon? The number of days an institution can fund obligations without accessing new external funding under a stress scenario. Calculated by projecting day-by-day cash outflows against accessible HQLA and contingent funding. Most regulators expect at least 30 days under combined stress as a minimum — institutions with complex balance sheets should target longer.