The 2025 EBA cycle exposed the same preparation gap we saw in 2023. The fix is not a better engine. It is a different kind of programme.
The EBA stress test is commonly understood as a computational exercise. It is not. It is three simultaneous examinations, each testing a different institutional capability. Banks that prepare for only one of the three are structurally unprepared.
The 2023 cycle demonstrated this pattern with uncomfortable clarity. Institutions that invested heavily in engine upgrades but neglected narrative coherence and second-line challenge received supervisory feedback that was more critical -- not less -- than banks with weaker engines but stronger governance. The 2025 cycle repeated this lesson almost exactly.
Can the engines generate a full P&L, balance sheet, and capital trajectory under constrained macro scenarios? This tests not just model quality but data lineage, reconciliation discipline, and the ability to produce auditable results under time pressure.
Engine & data capabilityDoes the story told in the stress test align with the ICAAP, Pillar 3 disclosures, recovery plan, and strategic plan? Supervisors read all four documents. Contradictions between them are treated as governance failures, not modelling errors.
Cross-document alignmentWhat is the quality of independent challenge? Did the risk function genuinely stress the assumptions, or did it rubber-stamp the first line's output? Supervisors assess challenge logs, escalation records, and the degree of genuine tension in the process.
Governance & challenge qualityMost banks begin stress test preparation by reviewing their projection engines. This is necessary but reveals a predictable pattern of late-stage discoveries. The table below catalogues the four most common findings and their prevention.
These discoveries are not edge cases. We observe at least two of the four in every pre-cycle readiness assessment we conduct. The critical variable is not whether they exist but when they are discovered. A finding identified 12 months before submission can be remediated through the normal governance cycle. The same finding identified 3 months before submission forces manual workarounds that supervisors can detect and will challenge.
| Discovery | Impact | Frequency | Prevention |
|---|---|---|---|
| IFRS 9 segmentation mismatch | Staging model segments do not align with stress test reporting granularity, requiring manual reclassification under time pressure | Very common | Pre-cycle reconciliation exercise mapping IFRS 9 segments to EBA templates 12 months before submission |
| NII model calibration gap | Net interest income projections fail under negative-rate or inverted-curve scenarios because models were calibrated on benign rate environments | Common | Backtesting NII models against the 2022-2024 rate path and re-calibrating pass-through assumptions |
| Credit satellite model drift | PD/LGD satellite models produce implausible outputs at scenario extremes due to calibration drift since last validation cycle | Frequent | Annual satellite model stress-range validation with explicit out-of-sample testing at EBA-severity macro paths |
| Op risk AMA/SA mismatch | Operational risk projections under the new standardised approach produce capital numbers inconsistent with internal AMA estimates used elsewhere | Emerging | Parallel-run AMA and SA projections before the cycle, with documented explanation of differences for supervisory Q&A |
If your projection engine has not been run end-to-end under a plausible adverse scenario at least 12 months before the EBA submission window, you are behind. The discovery-remediation-revalidation cycle for any of the issues above requires 6 to 9 months. Late discovery means either manual workarounds (which attract supervisory scrutiny) or material findings in the quality assurance phase.
The most underestimated dimension of stress test preparation is narrative coherence. Supervisors do not read the stress test submission in isolation. They compare it against the ICAAP, the recovery plan, Pillar 3 disclosures, and the strategic plan. When these documents tell different stories, the supervisory conclusion is not that the bank made an error. It is that the bank lacks governance integration.
The most dangerous contradictions are not numerical. They are narrative. If your strategic plan says you are growing in commercial real estate, your ICAAP says CRE concentration risk is managed, and your stress narrative shows 400bps of CRE loss under adverse, the supervisor will ask why the board approved the strategy. The fix is not changing the numbers. It is ensuring the narrative across all documents reflects a coherent risk appetite.
Building narrative coherence requires a dedicated cross-functional workstream that maps key assertions across all regulatory documents. This is not a modelling task. It is a governance discipline that requires senior risk, finance, and strategy personnel to sit in the same room and resolve contradictions before submission.
The practical implementation requires an assertion mapping exercise. Each key claim in the strategic plan ("we are growing in segment X") must be traced through the ICAAP ("segment X concentration is within appetite"), the recovery plan ("segment X stress would trigger indicator Y"), and the stress test narrative ("under adverse, segment X contributes Z bps of loss"). When these four statements are internally consistent, the institution demonstrates integrated governance. When they contradict, it demonstrates the opposite.
Map every key claim across strategic plan, ICAAP, recovery plan, and Pillar 3. Build the assertion register.
Cross-functional workshops to identify and resolve narrative conflicts. Escalate strategic decisions to the board.
Embed resolved narratives into all documents. Second-line challenge of coherence. Board sign-off on unified story.
Narrative coherence cannot be achieved in the final quarter before submission. The assertion mapping exercise alone requires 3 months. Resolution of contradictions requires strategic decisions that must go through board governance. Institutions that begin this work fewer than 12 months before the EBA submission deadline will face irreconcilable trade-offs between accuracy and consistency.
Reverse stress testing has a different purpose from forward stress testing. It asks: what combination of events would cause the firm to fail? In practice, most reverse stress tests fail for one of three reasons. Each represents a governance failure, not a technical one.
The scenario describes a "severe global recession" without specifying transmission channels, second-order effects, or institution-specific vulnerabilities. Supervisors treat abstraction as evidence that the bank has not genuinely considered its own failure modes.
Remediation: Require scenarios to name specific counterparties, funding sources, and operational dependencies that would be impaired.
The reverse stress test produces a scenario so extreme it is dismissed as implausible. This is by design: teams select scenarios that will not generate uncomfortable board discussions. The result is a compliance exercise that provides no governance value.
Remediation: Separate scenario generation from scenario assessment. Use external facilitation to prevent self-censorship.
The board paper presents reverse stress test results as information, not as a decision item. The board notes receipt rather than debating whether the identified vulnerabilities require strategic response. Supervisors see through this immediately.
Remediation: Structure the board paper with explicit decision points: "Does the board accept this residual vulnerability? If not, what strategic action is required?"
"If your reverse stress test does not make the board uncomfortable, it is not a reverse stress test. It is a compliance artefact."
-- Ezelman governance assessment frameworkA credible reverse stress test in 2026 must engage with the contemporary pathology landscape. Generic macro deterioration is insufficient. The following five pathologies represent the minimum scope for a firm that wishes to demonstrate genuine governance capability.
A scenario in which geopolitical escalation causes simultaneous closure of multiple wholesale funding markets. Not a generic liquidity stress, but a named-geography scenario: what happens if USD swap lines become restricted for European banks, or if Gulf deposit concentration reverses in a single quarter?
Funding & LiquidityA disorderly transition scenario in which regulatory reclassification of carbon-intensive exposures triggers simultaneous credit migration across multiple portfolios. The key question: at what speed of reclassification does the capital buffer become insufficient?
Climate & ESGThe failure of the bank's largest single-name or connected-group exposure, combined with a market environment that prevents orderly portfolio adjustment. This tests whether concentration limits are genuinely calibrated to survival or merely to regulatory compliance.
Credit ConcentrationA scenario in which a sustained cyber event renders core banking systems unavailable for 7-14 days, combined with a concurrent market stress that prevents manual processing of critical transactions. This tests operational resilience claims against economic reality.
Operational ResilienceThe most important scenario: a combination of two or more of the above, calibrated to the institution's specific vulnerability profile. Supervisors are increasingly sceptical of reverse stress tests that consider pathologies in isolation. Real failure typically involves cascading events that compound through shared dependencies.
Multi-Vector CascadeConverting reverse stress testing from a compliance exercise into a governance tool requires four structural components. Most banks have one or two. Top-quartile banks have all four.
The architecture described below is not aspirational. It reflects what we observe in institutions that consistently receive positive supervisory feedback on their reverse stress testing frameworks. Each component addresses a specific failure mode identified in the previous sections.
A standing committee (not ad hoc) with a mandate to generate, assess, and escalate reverse stress scenarios. Membership must include CRO, CFO, and Head of Strategy. Without this structural commitment, reverse stress testing will always be subordinated to other priorities during busy periods.
A formal process for generating scenarios that separates ideation from assessment. The most effective approaches use structured workshops with external facilitation, red-teaming techniques, and explicit requirements for institution-specific (not generic) pathologies. Scenario generation must occur annually, not only before supervisory exercises.
A dedicated annual session (minimum half-day) where the board engages with reverse stress test results in a discussion format. The agenda must include explicit decision points on risk appetite, strategic vulnerabilities, and recovery plan adequacy. This cannot be combined with a regular board meeting where attention is divided.
A documented, auditable connection between reverse stress test findings and recovery plan calibration. If the reverse stress test identifies a vulnerability, the recovery plan must demonstrate that the identified recovery actions are sufficient. Gaps between the two documents must be escalated to the board with a remediation timeline.
The preparation gap is not about technology. It is about governance integration. Banks that treat stress testing as a computational problem and reverse stress testing as a compliance obligation will continue to underperform in supervisory assessments.
"The CRO who can explain precisely how the bank would fail -- naming counterparties, funding sources, and operational dependencies -- is the CRO whose board can make informed strategic decisions. Specificity is not a modelling requirement. It is a governance requirement."
-- Ezelman analysis, based on EBA 2023 and 2025 cycle observationsThe institutions that will define top-quartile performance in the 2027 cycle are those that begin now: building narrative coherence, establishing reverse stress governance architecture, and treating the preparation programme as a 12-month discipline rather than a 3-month sprint.
The fix is not a better engine. It is a different kind of programme.
This requires institutional courage. It means the CRO presenting a reverse stress test to the board that names specific counterparties whose failure would threaten the institution. It means the CFO acknowledging that certain strategic growth ambitions create concentration risks that are not fully mitigated. It means the CEO accepting that operational resilience claims may not survive a genuine multi-day outage combined with market stress.
The banks that perform this exercise honestly are the banks that supervisors trust. And supervisory trust, in the current environment, is not a soft outcome. It determines Pillar 2 add-ons, SREP scores, and the degree of supervisory intrusion in strategic decision-making. The return on investment in genuine stress test and reverse stress test governance is measurable, direct, and substantial.