Stress testing severity — when historical scenarios stop being enough

Stress testing across the GCC has, over the past decade, become a substantially more disciplined exercise than it was at the start of the cycle. Most institutions now run multi-scenario credit, market, and liquidity stresses on a quarterly or semi-annual cadence. The frameworks exist. The governance exists. The reporting to ALCO and the board is in place.

What has not consistently kept pace is severity. A scenario library that was calibrated in 2017 against the 2008 financial crisis and the 2014–2016 oil shock now anchors most institutions’ definition of “severe.” Those episodes were severe. They are also not the right comparators for the next severe stress event, which will almost certainly transmit differently — through liquidity channels that did not exist in their current form a decade ago, through deposit behaviour that has been reshaped by digital banking, and through credit-liquidity interactions that are harder to model than either dimension on its own.

The question being asked by GCC supervisors and increasingly by audit committees is not whether the institution is running stress tests. It is whether the stress tests credibly represent what the institution would actually experience under stress.

The historical-scenario problem

The conventional structure of a stress testing exercise begins with a set of historical reference events, applies an adverse multiplier to define a “severe” version, and runs the resulting macroeconomic path through the credit and market risk models. The output is a capital impact, a liquidity coverage impact, and a series of board-level numbers that can be compared to risk appetite limits.

The structure is sound. The reference events are increasingly the problem. The 2008 crisis transmitted to GCC banks primarily through the global wholesale funding market and through real estate price corrections. The 2014–2016 oil shock transmitted through corporate revenue, government project spend, and SME default rates. Both episodes played out over months and quarters. Deposit behaviour, while pressured in specific institutions, did not move at the speed that digital channels now make possible.

A 2026 severe stress event will plausibly retain elements of both — sustained oil pressure, real estate softening, corporate revenue compression — but will also include a component that historical scenarios under-represent. The variables interact in ways that the standard credit-then-market-then-liquidity sequential modelling does not capture.

This is not an argument for abandoning historical scenarios. They remain useful anchors. It is an argument for treating them as the floor of plausible stress, not the ceiling.

Where the liquidity-credit interaction matters most

The single dimension where the historical-scenario approach most consistently understates risk is the interaction between credit deterioration and liquidity stress. In a sequential model, credit losses are calculated under stress, then liquidity coverage is calculated under a separate stress. The institution survives each individually. The supervisory question — and the harder analytical question — is what happens when both stresses materialise simultaneously and reinforce each other.

The transmission runs in both directions. Credit deterioration in a specific sector reduces the institution’s HQLA buffer if it forces unplanned provisioning that touches CET1. It also reduces the market’s willingness to provide wholesale funding to the institution, narrowing the institution’s available liquidity tools. At the same time, an institution under perceived stress sees deposit movement — corporate first, then high-net-worth, then retail — that can compress the LCR position faster than the credit deterioration alone would.

The speed of this movement has changed materially with digital banking. A corporate treasurer can move significant cash positions across institutions in minutes rather than days. A high-net-worth client with a banking app can rebalance their concentration overnight. The retail behaviour that historically followed news cycles by days now follows them by hours. The aggregate effect, on an institution where stress is already developing, can compress timelines from a quarterly stress horizon to a multi-day operational reality.

The implication for stress testing severity is that the maximum-outflow assumptions inherited from pre-digital LCR calibration are likely understated for any institution with meaningful retail or HNW digital channels. The defensible response is not to abandon the regulatory LCR calibration — that remains the supervisory benchmark — but to run a parallel internal stress with outflow assumptions calibrated to the institution’s actual digital exposure, and to surface the difference to ALCO as part of normal cadence.

Reverse stress testing — the question worth asking

For mid-sized banks, NBFCs, and fintechs operating in the GCC — institutions whose business model concentration tends to be higher than tier-1 commercial banks — reverse stress testing has shifted from optional analytical exercise to substantive supervisory expectation.

The framing of reverse stress testing inverts the conventional stress logic. The conventional stress asks what happens to capital and liquidity under a defined severe scenario. The reverse stress asks what scenario would cause the institution to become non-viable, and whether such a scenario is plausible. The output is not a capital number. The output is a description — sometimes uncomfortably specific — of the path to failure.

For a mid-sized institution, the reverse stress question often surfaces concentration risks that conventional stress testing under-weights. A single-sector concentration that produces an acceptable capital impact in a moderate stress can be the variable that causes non-viability in a severe stress. A funding model that depends on a small number of large depositors can survive a moderate liquidity stress but fail under a deposit-flight scenario calibrated to actual concentration. A reliance on a single correspondent banking relationship can be a credit risk and a liquidity risk simultaneously, in a way that does not show up in either pillar’s conventional reporting.

The supervisory benefit of running a reverse stress is that the institution surfaces these dependencies to itself before the supervisor does. The strategic benefit is that the institution can then make a decision about each one — accept the concentration with clear board awareness, reduce it through targeted action, or hedge it through specific risk transfer. The reverse stress is the exercise that makes the conversation possible.

What ALCO should be seeing

The output of a stress testing programme that has been calibrated for current conditions tends to look different from the output of one that has not, in a few specific ways.

ALCO should see scenarios where credit and liquidity stress are simultaneous and reinforcing, not sequential. The institution’s response under such scenarios should be modelled, not assumed. Management actions — drawing on committed lines, selling specific HQLA, accelerating recovery actions — should have explicit triggers and explicit costs.

The scenario library should include at least one scenario in which the largest deposit concentrations move adversely within a 72-hour window, with the LCR position recalculated under those assumptions. For institutions with material digital channels, the relevant time window is shorter still.

Reverse stress test outputs should be on the ALCO agenda at least annually, with the path to non-viability described in narrative form before being supported by numbers. The narrative is what makes the discussion possible at board level.

Sector concentration in the credit book should be stressed against sector-specific scenarios, not against an aggregate macro path. A real estate concentration moved adversely in isolation produces different numbers than the same concentration moved against a general slowdown.

A closing observation

In recent engagements where we have reviewed stress testing frameworks for GCC institutions across the size range — from tier-1 commercial banks to mid-sized NBFCs and fintechs — the most consistent finding has not been weakness in the modelling itself. It has been calibration. The scenarios were defensible against historical events. The transmissions were modelled correctly within each risk type. What was missing was either the interaction between risk types, or the severity calibration against current operating reality.

Closing that gap is rarely a technical project. It is a calibration project, a governance project, and in some cases a deposit behaviour analytics project. The model architecture usually does not need to change. The scenarios it runs through, increasingly, do.