The results of the Federal Reserve stress test were announced three weeks ago. Almost all of the initial reporting about those results reflected a fundamental misunderstanding of how it currently functions, and most of the political reaction reflected a fundamental misunderstanding of its consequences. A clear understanding is important given the economic importance of that test and the significant problems with its operation.
The economic importance derives partly from the fact, universally agreed by private and public sector economists, that increases in bank capital requirements reduce lending and economic activity. Even then, the stress test is not neutral across asset classes. It is particularly punitive to two: (1) lending to low- and moderate-income households and small businesses, because losses in the macroeconomic component of the stress test are driven primarily by high unemployment which has a disproportionate effect on those borrowers; and (2) providing liquidity to capital markets through market making, because the global market shock component of the test assumes massive disruptions in capital markets, designed to move against market makers in unprecedented and illogical ways. The stress test particularly rewards one activity: private wealth management, because this activity has effectively no stress losses and therefore does not result in higher capital requirements via the stress tests. These facts should be of concern to policymakers worried about access to credit or market liquidity.
Operation
The first Federal Reserve stress test was conducted in 2009 at the height of the financial crisis. It was called the Supervisory Capital Assessment Program, universally referred to as SCAP. Its purpose was to determine whether banks had sufficient capital to survive a further worsening of that crisis, and its result (after some capital raising) was to provide assurance to the public that the banking system was sound. Widely and appropriately viewed as a success, the process was renamed CCAR and continued each year thereafter. Labeled as a supervisory exercise by the Fed, it became an annual pass-fail test of each bank’s capital sufficiency.
A fundamental change occurred in 2020. Going forward, the net losses calculated for each bank in the test became part of that bank’s capital requirement. Thus, the core regulatory capital requirement –the required ratio of common equity to risk-weighted assets – was set to equal
Those stress losses were designated a “stress capital buffer,” generally referred to as the SCB. While in theory only the 4.5 percent is a minimum requirement and the rest are defined as “buffers,” any violation of the buffers triggers serious penalties for the bank, and therefore banks, investors and regulators universally regard the buffers as de facto minimums.
Thus, when the Fed calculates the SCB for each bank, it is calculating a portion of its minimum capital requirements.
As a procedural matter, this arrangement is unique, as the government is imposing a requirement on an institution without conforming to any of the procedural requirements of the Administrative Procedure Act. The stress scenarios are set without notice or public comment, and many important details of the models that calculate the resulting losses are secret. So, confusion by policymakers about the importance of the stress test is understandable.
Effect
Process aside, the concept behind the SCB is fundamentally sound. Banks should be able to weather a severe economic downturn without completely depleting their capital. So, capitalizing prospective losses is sensible. So, too, is a design where the scenario becomes tougher in good times and less tough in stress times, offsetting some of the test’s inherent procyclicality. And so too is using the unemployment rate as the primary variable in the test, as high unemployment historically has caused bank losses. And of course, banks engaged in significant capital markets activity need a separate component of the test to assess the risk of that business under stress.
The substantive questions are whether the scenario chosen to test bank resilience is sensible, and whether the models used to predict bank gains and losses under that scenario are accurate. There are reasons for doubt on both fronts. The primary concerns raised by the SCB are (1) spurious volatility that varies bank capital requirements significantly, even when risk remains constant; and (2) the global market shock, whose scenarios appear increasingly divorced from logic and market reality.
As a result of this year’s test, capital requirements of many large banks will increase, and in some cases significantly. Some of the increase in capital requirements was driven by the stress scenario chosen by the Federal Reserve and the fact that banks have lowered their allowances for credit losses since the last test. (The lower allowances require a larger reserve build over the stress horizon, which results in larger declines in capital ratios and thereby a higher SCB.) However, a significant driver of the increase in requirements was the Federal Reserve’s projections that arbitrarily inflated noninterest expenses (including operational risk losses). Fed models assume that expenses rise along with bank assets, regardless of the type of those assets; thus, as banks increased their holding of Fed reserves during the relevant period, funded largely by deposits, the Fed’s models presume (conclusively) that they will see significantly higher business expenses, and will see significantly higher operational risk losses.
As a result, the stress test will require J.P. Morgan to hold an additional 0.8 percent of capital, and Bank of America 1.0 percent. Across all banks, there will be an increase of $150 billion in expenses over the past two years, of which $44 billion, or 30 percent, is accounted for by an increase in operational risk losses. Neither of those results makes sense, or has any empirical support. But those conclusions follow from an assumption in the stress test that business expense and operational risk is a function of total assets, regardless of the type of asset.
The operational risk component is particularly arbitrary, for a variety of reasons. Operational risk is defined by the Basel Committee as “the risk of loss resulting from inadequate or failed internal processes, people, and systems or from external events.” There is universal agreement that cyber risk is the predominant risk facing banks today, but cyber attacks generally have not caused significant losses, and in no case have caused ruinous losses. They cause inconvenience and potentially could cause systemic disruptions if they occurred at scale (in both banking and other industries.) Thus, cyber risk is not a problem that can be solved with more capital. (Consider, for perspective, how bizarre it would be to suggest that the answer to the systemic risk posed by AWS, Microsoft and other cloud service providers would be to impose a capital requirement on them.)
Furthermore, there is no evidence that cyber attacks are correlated with market or credit risk, so requiring entirely additive capital for operational risk on top of those other risks seems clearly excessive.[1] This counterfactual and counterintuitive approach is a necessary product of the Fed’s decision to use only a single scenario in stress testing banks. Since the Fed does not wish to exclude any potential risk, a single scenario therefore requires assuming that all of those risks manifest at the same time, in worst-case form, even if they are uncorrelated or negatively correlated (as, for example, volatile markets caused by stress can increase trading revenues). Of course, when banks conduct stress tests for true risk management purposes, they run multiple scenarios. Thus, there appears to be an overwhelmingly strong case to use at least two scenarios, and a strong parallel to demonstrate further the hazards of continuing with the status quo.[2]
The analysis above describes actual operational risk. For capital adequacy purposes, regulators have quantified operational risk by using past litigation costs and regulatory fines, primarily judgments resulting from mortgage losses as part of the global financial crisis. Leaving aside how poor a proxy those litigation losses are for operational risk in 2022 as a general matter, it is worth noting specifically that a bank funding a reserve at the Fed with a commercial or retail deposit is running zero litigation risk.
So, too, with the global market shock. As one Fed governor observed, the actual global market shock of March 2020 was similar to the global market shock included in DFAST 2020. But banks made more than $40 billion in trading revenues in the first half of 2020, yet were projected to lose $87 billion in trading losses in DFAST 2020. The result of the test seems to have had the wrong sign. The trend has continued to the present, as market volatility has generated earnings for banks, but the Fed’s models in this year’s stress test again predicted — and now require capital to be held sufficient to cover — ruinous losses. One major outside study demonstrated numerous flaws in the Fed’s approach (to the extent that its approach could be deduced) that could be producing such an outcome.[3] No one has suggested that the analysis was incorrect.
None of this is to suggest that banks cannot lose money in capital markets; they certainly did so in the global financial crisis. But banks now take significantly less risk, have much improved risk management, and appear to be producing much better results under extreme stress. Indeed, bank regulations have been changed materially to prevent banks from making exactly the kind of losses on residual tranches of asset-backed securities that they made in the GFC. Yet the losses projected in the stress test continue to rise. The Fed’s scenario assumptions on the global market shock and trading revenue models appear to be disregarding more than a decade of history.
Of course, process and substance here are related. There would be great benefit if the scenarios and models were exposed to public comment, as the law appears to require.[4]
Broader Consequences
So, what do consistently and arbitrarily increasing capital requirements for the larger banks mean in practice? It doesn’t mean that they will increase cyber security, as their actual security is irrelevant to the outcome of the test, and it would be impossible to model and quantify for purposes of any such test. Rather, banks will tend to reduce those assets that cause the largest increases in losses under the stress test relative to the return on those assets. While that formula may vary by bank, we have previously demonstrated (see here and here) that loans to low- and moderate-income people, small businesses, and capital-at-risk market making do very poorly by this standard. On the other hand, managing the wealth of the richest people in the world is a triumph, as it brings fee income and very few assets.
Conclusion
The Federal Reserve’s stress test is seriously flawed as a measure of bank risk under stress on multiple counts. Markets do not respond the way the global market shock projects; expenses do not grow along with assets, particularly riskless ones; operational risk has not produced the massive losses the test presumes. Most fundamentally, use of a single stress test requires the Federal Reserve to add up the worst-case scenario for a variety of risks even when those risks are not correlated or are negatively correlated; the result is a punitive capital charge.
All of this matters. Banks adjust their balance sheets to maximize returns to shareholders, and that includes exiting or raising prices for businesses that carry uneconomic capital charges. Policymakers should not be confused about why subprime lending has become a non-bank product; mortgage lending (also disfavored by the stress test) has become predominantly a non-bank product; and the buy side bemoans a lack of market liquidity. It’s time for policymakers to start connecting the dots.
[1] A recent note from the Federal Reserve Bank of New York notes that payment volume increases at times of financial stress and thus that the potential consequences of a successful cyber attack could be greater. However, it presents no evidence that the likelihood of an attack or the likelihood of success of an attack increase as well. Finally, it presents no evidence to suggest that the most likely consequence of such an attack — denial of service — would cause bank financial losses in a way that would necessitate additional capital. https://www.newyorkfed.org/medialibrary/media/research/staff_reports/sr1022.pdf
[2] Baer, Greg. “Stress Test Dummies: A Fundamental Problem with CCAR (and How to Fix It).” Bank Policy Institute, 18 Mar. 2021, https://bpi.com/stress-test-dummies-a-fundamental-problem-with-ccar-and-how-to-fix-it/
[3] Global Market Shock and Large Counterparty Default Study – SIFMA. Aug. 2019, https://www.sifma.org/wp-content/uploads/2019/09/SIFMA-GMS-LCD-Study-FINAL.pdf. Also, see https://bpi.com/trading-revenue-and-stress-tests/.
[4] The Federal Reserve has resisted disclosure of its models on the grounds that banks would “game” the models. This argument is very difficult to understand. “Gaming” here would consist of holding fewer assets that the Fed calculates would lose a lot of money under stress, which one would think would be desirable. More broadly, all laws — from the tax code to environmental rules to speed limits – are “gamed,” but the responsible agencies do not claim an authority to make those laws and regulations secret. And of course, the argument here proves too much. The 4.5 percent minimum requirement to which the SCB is added was issued pursuant to an APA rulemaking, and the process for determining the risk weights of the assets is public; the GSIB surcharge was produced pursuant to rulemaking, and the methodology for imposing it is public (and punishes market making in much the same way as the stress test).[4] Thus, banks can (and do) manage their ratios by divesting assets with high risk weights and high coefficients for purposes of the GSIB surcharge. Under the “gaming” theory, all of these rules would be secret as well.
