Reverse stress testing should be the most interesting conversation in a bank. It is the one exercise where the CRO is allowed to ask: "What, specifically, would break us?" — and is obliged, by regulation, to answer in a way the Management Body can read. It is also the one exercise where most banks produce a document so generic that it is effectively interchangeable between institutions: a pandemic scenario, a cyber scenario, a macro scenario, bullet-pointed, with depletion numbers that trace back to last year's EBA stress test with a sign flip.
The ECB has been patient about this for a long time. It is not patient any more. Post the 2023 turmoil in US regional banks — where the underlying failure mechanism (uninsured deposit runs against unhedged AFS portfolios) was reverse-stress-testable and, for several banks, had been tested in name but not in substance — the SSM moved reverse stress testing from a supporting-role exercise in the ICAAP to a governance artefact the JST will now read first. The cycle following that shift has already produced the first P2G decisions explicitly citing reverse-stress-test credibility as a driver.
This essay makes one argument. Reverse stress testing is not a risk-management exercise. It is a governance exercise. And its strategic value sits in exactly one place: it is the one document a CRO can place in front of a Joint Supervisory Team to convert a qualitative concern ("we are not sure this business model is resilient") into a quantitative answer ("it takes X, for Y quarters, with correlation structure Z, to break it — and here are the triggers we have installed"). That conversion is the defence.
"Every CRO has been told their reverse stress test needs to be more 'creative.' What the ECB actually wants is more precise — three scenarios, stated in quantitative failure conditions, owned by the Management Body."
— Ezelman CRO briefing, 2025 SREP post-mortem1 · Why reverse stress testing became a Pillar 2 instrument
The transition from compliance exercise to supervisory instrument happened in three moves.
First move — 2018 EBA Guidelines on institutions' stress testing. These first formalised reverse stress testing as a mandatory component of the ICAAP, distinct from regulatory stress testing. For several years, banks treated this as a checklist requirement. ICAAPs typically contained two or three reverse scenarios with ordinal severity and no quantitative failure point.
Second move — 2020 ECB ICAAP expectations. The ECB clarified that reverse stress tests should identify the conditions under which a bank's business model becomes non-viable, not merely the conditions under which it breaches a capital threshold. That distinction is important — non-viability is a wider bar, covering liquidity, funding, reputation and strategic optionality alongside capital. Few banks caught up.
Third move — 2023–24 post-SVB reflection. The ECB revisited reverse stress testing in several speeches and a targeted review. The message: the exercise needs to stop being about depicting an implausible apocalypse, and start being about finding the plausible path to failure that the institution has insufficiently hedged. The combination of idiosyncratic plus systemic stress was explicitly promoted as the analytical anchor — which is precisely the configuration the 2023 US regional failures exhibited.
The operational consequence: the JST now expects the reverse stress test to answer three questions, in the ICAAP itself, and with quantitative rigour:
Q2. At what severity & duration do those shocks cross the threshold?
Q3. What are the observable early-warning indicators — and who owns each one?
If the ICAAP does not contain a defensible answer to all three, the reverse stress test is read as non-credible. And once it is read as non-credible, the JST begins to import conservatism into its Pillar 2G recommendation to compensate for what the bank has not demonstrated about its own fragility. This is the mechanical link from RST quality to capital — and it is, in our experience, worth 30 to 60 bps of P2G on a mid-cap G-SIB.
2 · The three scenarios the ECB actually wants
The 2025 revisions of the ECB's supervisory expectations on ICAAP clarified the structure of reverse stress testing that the JST now expects. Three scenarios — no more, and decisively not fewer.
Idiosyncratic scenario
A failure path driven by the bank's own balance sheet, business model, or governance. Examples: a rapid, name-specific deposit run, a single counterparty concentration triggering cascading losses, a compliance event inducing reputational freeze in wholesale funding. The ECB wants to see that the bank has identified its own fragility points, not industry-generic ones.
Systemic scenario
A failure path driven by a macro-financial event that affects many institutions simultaneously. Examples: severe sovereign stress in a domestic market, a prolonged rate-hike cycle combined with asset-price corrections, large-scale geopolitical disruption of a critical trade corridor. This is the closest to a classic stress test, but reverse-formulated — not "what is the capital impact of scenario X?" but "what systemic configuration exhausts capital before management actions can compensate?"
Combined scenario
The failure path that has, historically, actually produced bank failures: an idiosyncratic weakness interacting with a systemic shock. 2023 SVB was a combined scenario — long-duration asset mismatch (idiosyncratic) meeting a rate-hike cycle (systemic) meeting a narrow depositor base (idiosyncratic). Every CRO who tells us the institution's reverse stress test is "robust" without a combined scenario, is telling us the exercise is not what the ECB is reading.
The test for credibility is not whether each scenario is creative. It is whether each scenario produces a quantitatively specified failure point — a combination of capital, liquidity and funding metrics that crosses a defined non-viability threshold, with a duration, and with an identified point of no-return action. Qualitative RST is not a reverse stress test. It is a discussion document.
3 · From compliance artefact to capital defence: the inversion
The structural move we help banks execute in this area is simple to state and demanding to implement: invert the reverse stress test. Most banks run RST as a scenario-to-outcome exercise (scenario defined first, capital outcome computed). The ECB wants the opposite — outcome defined first (non-viability), scenario space computed to reach it.
Common RST practice — "forward from scenario"
Starts with a curated list of hypothetical events. Runs the existing stress-test infrastructure against them. Reports the resulting capital depletion and compares to buffer. Concludes "scenario X produces a Y bps depletion, the bank remains viable."
- Looks quantitative but is anchored on stress-test engine assumptions.
- Does not identify the minimum shock needed to break the institution.
- Cannot support a Management-Body conversation on action triggers.
- The JST reads it as an extension of the stress test, not a reverse one.
Inverted RST — "backward from failure"
Starts with a defined non-viability condition (e.g. CET1 < 6%, LCR < 80% for 10 consecutive days, unsecured funding access lost for 30 days). Searches the scenario space backward for the mildest configuration that reaches that condition. Reports the severity, duration, and indicator signature.
- Identifies the actual fragility frontier of the institution.
- Produces concrete triggers for management action, tied to indicators.
- Provides the Management Body with a quantitative defence narrative.
- The JST reads it as a credible governance instrument — and prices P2G lower.
The inversion requires two things the bank often does not have: a non-viability condition that the Management Body has formally endorsed, and a scenario-search tooling capable of running backward. Both are achievable inside a twelve-month programme. Neither is a box the existing stress-test function can tick from its existing backlog.
4 · The observable signal the JST is scoring
Supervisors do not just read the RST document. They score the surrounding signals. In our mandate work, six signals consistently appear in the JST assessment of a bank's reverse-stress-test programme. We list them in the order the JST considers them.
Six credibility signals · the JST scores each one
- Management-Body endorsement. The non-viability condition is formally endorsed by the MB, in writing, with a date and a named owner for each indicator. Not delegated to Risk Committee; endorsed by the full board.
- Scenario specificity. Each of the three scenarios is described with sufficient quantitative precision that an external party can reproduce the failure path — not "a severe rate shock" but "a 350 bps shock over three quarters with a 60% correlation to credit spreads."
- Indicator system. Each scenario has a set of early-warning indicators, monitored monthly, reported to a named Executive Committee member, with escalation triggers already in place.
- Recovery-plan linkage. The non-viability thresholds in the RST are the same thresholds used in the Recovery Plan. If they diverge, the JST reads the RST as an academic exercise disconnected from the bank's own preparedness.
- Challenger scenario. At least one scenario was proposed by a non-Risk function (Finance, Treasury, Business) and survived the analytical review. If Risk built all three, the exercise is reading as self-challenged.
- Evolution from prior year. The current RST explicitly references what changed versus the prior year, and why. Static RSTs are read as box-ticks. RSTs that evolve with the balance sheet are read as live governance.
A bank whose RST satisfies all six signals is effectively uninvitable to an upward P2G correction. A bank that satisfies three or fewer is, in our sample, where the additional 30–60 bps comes from.
5 · A worked example — the inverted RST in practice
Consider, anonymously, a mid-cap European G-SIB with a corporate-banking franchise, a mid-sized private bank and a modest trading book. Under its traditional RST, the bank ran three scenarios (pandemic, cyber, sovereign-stress) — each producing a CET1 depletion within the combined buffer and each labelled "resilient." The 2024 JST assessment called the RST "technically compliant but not analytically useful." The P2G for that cycle went up materially against the prior baseline.
We rebuilt the exercise the following year against a defined non-viability condition: CET1 ratio below the Pillar 1 + Pillar 2R floor, for at least six consecutive months, with access to unsecured wholesale funding closed at the same time. Scenario search ran backward from that condition.
Three scenarios emerged as genuinely plausible paths to failure, each with quantitatively specified severity:
- Idiosyncratic — private-bank reputational event. Loss of 22% of AUM over six months, combined with a market-wide repricing of fee income multiples, produces a 160 bps depletion and triggers a funding-market freeze of approximately 45 days. Thresholds crossed at month 5.
- Systemic — sovereign stress in two core markets simultaneously. A sovereign spread blowout of 400 bps in two of the bank's three top-exposure sovereigns produces 210 bps depletion, plus 180 bps of IRRBB impact via AFS losses, plus a sharp deposit outflow in the private bank. Compound effect crosses the failure threshold at quarter 3.
- Combined — corporate-banking concentration meeting a policy-induced rate cycle. The dominant economic loss path. The top-20 corporate counterparty concentration, already within appetite, becomes a failure driver when combined with the compression of the bank's trading-book hedge effectiveness under rate volatility. Minimum shock configuration: 300 bps rate shock over two quarters, with 40% concentration default under severe adverse, within 18 months. Non-viability threshold crossed.
The combined scenario was the one the bank had not previously identified. Six early-warning indicators were defined, monthly monitoring was installed, the MB endorsed the non-viability thresholds, and the Recovery Plan was re-anchored on the same triggers. In the following SREP cycle, the JST's written assessment explicitly referenced "materially improved reverse-stress-test infrastructure" as a positive factor. P2G did not fall to zero, but it fell materially against the internal baseline — one of the clearest single-input contributions we have observed in our mandate history. Mandate-specific figures withheld under sitewide public-data policy.
6 · Why this is a CRO instrument, not a Risk-Modelling one
The last and most important point: reverse stress testing reports to the CRO, not to the Head of Stress Testing. It is not a quant exercise. It is a narrative exercise, quantitatively supported, whose author is the CRO and whose audience is the Management Body.
Where this goes wrong is when the CRO delegates the RST to the stress-testing team. The stress-testing team will produce a technically correct document that answers the question nobody asked. The document the JST wants to read has four authors: the CRO (business-model fragility narrative), the CFO (capital and liquidity thresholds), the Treasurer (funding-access scenarios), and the Chair of the Risk Committee (challenge and endorsement). The Risk-Modelling team supports all four; it does not own any of them.
This is why the first recommendation we make on every reverse-stress-test rebuild is organisational: move the exercise from the stress-testing function to the CRO's own office, with monthly visibility to the Risk Committee, and with a named board-level endorser of the non-viability condition. The quantitative work comes second. The governance work comes first — and is the part the JST can actually see.
7 · Closing — the conversation the ECB is trying to have
The CRO trying to reduce a Pillar 2G number has limited levers. The stress-test result is what it is by the time the letter arrives. The ICAAP is what the existing governance architecture allows. The on-site findings are closed on a schedule that is not under the bank's control. Reverse stress testing is the one lever that sits genuinely inside the CRO's own office — and the one that the ECB has most visibly re-weighted as a credibility signal over the last three years.
This is why it is the highest-leverage conversation a CRO can be having with a Joint Supervisory Team right now. Not because it is the most technical, or the most novel, or the most interesting. Because it is the one the supervisor is most ready to read — and the one where a credible answer, produced inside a twelve-month window, measurably moves the number that every other Pillar 2 lever cannot.
The banks that will emerge from the next SREP cycle with lower P2G are the banks rebuilding their RSTs now. The banks still running the exercise as a narrative document with one page per scenario will discover, eighteen months from today, that the conversation has moved without them.