Bank Stress Testing Explained: DFAST, CCAR, and What the Scenarios Actually Test

In the Fed’s 2023 stress test, the severely adverse scenario assumed unemployment climbing to 10%, commercial real estate prices dropping 40%, and a broad financial market shock. Every major bank holding company passed. Six months later, New York Community Bancorp disclosed CRE losses that sent its stock down 60% in a single session. NYCB sat below the $100 billion supervisory threshold. That gap — between what the stress test covers and what actually breaks — is what every serious bank analyst should understand.

Bank stress testing asks the question a balance sheet snapshot cannot answer: if the economic cycle turned hard, would this bank still have enough capital to absorb losses and keep lending? After 2008 proved that undercapitalization was systemic and invisible until it wasn’t, Congress made stress testing a legal requirement for the largest institutions. The two instruments are DFAST and CCAR. They are related but not identical, and the distinction matters in practice.

What Bank Stress Testing Actually Measures

A stress test is a nine-quarter forward simulation. Regulators define a hypothetical economic shock — the scenario — and each covered institution applies it to its own portfolio, projecting loan losses, pre-provision net revenue, and the resulting trajectory of capital ratios quarter by quarter.

The output that matters is whether the bank’s Common Equity Tier 1 ratio stays above its regulatory minimum throughout the scenario, even as losses mount. The median CET1 ratio for large banks entering recent stress cycles has been around 13–14%, which reflects nearly two decades of capital rebuilding since 2008. If a bank enters the scenario at 12% CET1 and the model projects it falls to 4.5% by quarter seven, the bank would breach its buffer before the recession even ended. That is a failure, and it has direct consequences for dividend and buyback approvals.

Data for these projections flows from the Call Report (FFIEC 031/041/051) and the FR Y-9C for holding companies. Loan loss projections draw on Schedule RC-C loan balances, Schedule RI-B charge-off history, and the bank’s own modeled loss rates. Large banks run internal models; the Fed runs its own parallel models. The Fed’s results govern.

That widening buffer is real. But the scenario designs have also become more targeted, and the question of what risk sits inside the scenario versus what lies just outside it — CRE concentration, interest rate duration risk at smaller banks — is the professional’s concern. A bank with a 13% CET1 ratio and a 350% CRE-to-risk-based-capital concentration (well above the 300% regulatory threshold) may look well-capitalized on paper while carrying a risk profile the stress test scenario barely touches.

DFAST vs. CCAR: The Actual Difference

Both programs use the same scenarios. Both project capital. The distinction is scope and consequence.

DFAST is the quantitative test. The Fed applies its supervisory scenarios to a bank’s portfolio and publishes projected capital trajectories. It is standardized — the same scenario runs at every covered institution simultaneously so results are comparable across firms. The output is a set of projected quarterly capital ratios under baseline and severely adverse assumptions.

CCAR sits on top of DFAST for the largest firms and adds a capital-planning dimension. The Fed evaluates not just whether projected capital stays above minimums, but whether the bank’s planned capital actions — dividends, share buybacks, new issuances — are sustainable under stress. A bank planning to return $8 billion to shareholders over the next four quarters has to demonstrate that plan survives the severely adverse scenario. If it doesn’t, the Fed can object to those distributions.

CCAR also historically included a qualitative review of whether a bank’s internal capital-planning processes were sound — data governance, model risk management, board oversight of capital adequacy. The Fed scaled back the formal qualitative objection power after 2019, but capital-planning quality still influences examiner assessments and supervisory ratings, including CAMELS scores.

In short: DFAST is the model output. CCAR is what happens to your dividend when the model output is bad.

Which Institutions Are Covered

The supervisory stress test applies to bank holding companies with $100 billion or more in total consolidated assets. The 2018 Economic Growth Act directed the Fed to tailor frequency and stringency by size. Category I and II firms — generally $700 billion or more, or institutions with significant international activity — run the test annually. Category III and IV firms (roughly $100–700 billion) are on a biennial cycle.

Below $100 billion: exempt from the supervisory test. That is most of the 4,300-odd FDIC-insured institutions in the country. Community banks are not off the hook for capital planning — examiners expect them to conduct internal stress analysis — but they do not face the Fed’s formal scenario and public disclosure requirements.

The NYCB situation illustrates what that threshold means in practice. A $90 billion bank with heavy CRE concentration is not an obvious low-risk institution, but it sat below the supervisory perimeter. The 2023 bank failures — SVB, Signature, First Republic — accelerated a regulatory conversation about whether $100 billion is the right cutoff, particularly for institutions with concentrated business models or significant interest rate risk. That conversation has not yet produced a formal rule change, but examiners at institutions in the $30–100 billion range are asking harder capital-planning questions today than they were three years ago.

How the Scenarios Are Built

The Fed publishes supervisory scenarios each February. For 2026, the projection horizon runs Q1 2026 through Q1 2029 — nine quarters. There are two scenarios.

The baseline reflects a moderate expected economic path. It is a reference point, not a pass/fail test.

The severely adverse scenario is the one that matters. It is designed as a deliberately harsh hypothetical recession: unemployment rises sharply — typically to 10% or higher from wherever it starts — equity prices drop 30–40%, commercial real estate prices fall meaningfully, and financial market conditions stress across asset classes.

One thing analysts consistently miss: the severely adverse scenario is a single deterministic path, not a probability distribution. It is not the Fed’s forecast. It is a chosen stress point, and the choice of that point — what to include, what to leave out — is itself a policy judgment. The 2022 rate shock that crushed held-to-maturity portfolios at regional banks was not prominently featured in prior-year severely adverse scenarios. The Fed has since added interest rate sensitivity to its scenario toolkit, but the design will always lag the previous crisis.

Banks apply these macro paths to their specific portfolios. A bank heavy in construction and land loans faces a very different loss projection than one that primarily holds 1–4 family residential mortgages. The scenario is standardized; the loss rates it generates are institution-specific.

What Community Banks Should Be Running

For the roughly 4,200 banks below the $100 billion threshold, and for analysts evaluating any institution, the same underlying discipline applies even without a formal DFAST filing. You are asking: does this bank have enough capital for the risk it carries, and what happens if credit quality deteriorates over the next six to eight quarters?

Start with capital. A CET1 ratio at the industry median of around 13% for larger banks — or the 10–12% range more typical for community banks — provides meaningful absorption capacity. Well-capitalized minimums are CET1 at 6.5%, Tier 1 at 8%, and total capital at 10%, but those minimums are floors, not targets. Examiners expect community banks to operate with buffers above those minimums, and prompt corrective action triggers well before a bank reaches them.

Next, stress the loan book. Community bank NPL ratios have been running around 0.8–1.0% in a benign environment. Net charge-off rates have been approximately 0.35–0.50% annually. A plausible stress scenario might assume NPLs doubling to 1.5–2.0% and NCOs moving to 0.80–1.00%, which is roughly what occurred in 2009–2010 for well-run community banks. Apply those loss rates to the loan portfolio, subtract from pre-provision net revenue, and ask whether the bank still has positive earnings before the loan loss provision eats through capital.

CRE concentration is the specific pressure point right now. The 300% regulatory threshold — CRE loans (excluding owner-occupied) divided by risk-based capital — was established in 2006 guidance and remains the line examiners reference. Banks above 300% should expect more examiner scrutiny of their concentration risk management practices and stress testing methodology. Banks above 400% in a rising-rate environment are going to have a difficult conversation in their next exam.

The allowance-to-loans ratio post-CECL has settled in the 1.1–1.4% range for most community banks. Day-one CECL reserves were generally higher than the prior incurred-loss reserves, but the reserve-build discipline it requires — accounting for expected losses over the life of the loan at origination — is actually closer to what a stress test framework demands than the old incurred-loss standard was.

Reading Capital Resilience Without Running a Formal Stress Test

The Call Report gives you most of what you need for any institution. Capital ratios from Schedule RC-R, loan concentrations from RC-C, charge-off and nonperforming loan history from RI-B, and unrealized gains/losses on AFS and HTM securities. Tracking those metrics across time and against peer banks tells you whether a bank is building capital cushion or quietly eroding it.

HTM unrealized losses deserve particular attention after 2022. Those losses do not run through regulatory capital under the AOCI opt-out that most community banks elect — but they represent real economic exposure. A bank that funded long-duration bond purchases at 2020–2021 yields and is now holding those bonds to maturity has a balance sheet that looks adequately capitalized while carrying interest rate risk that would only materialize fully in a liquidity event.

BankRegReports pulls Call Report data directly from FFIEC filings — FFIEC 031/041/051 for banks, FR Y-9C for holding companies — and surfaces 24 years of quarterly history with peer benchmarking built in. You can see how a specific bank’s CET1 ratio and CRE concentration moved through 2008, through 2020, and through the 2022 rate shock without downloading a single ZIP file from the FFIEC website.

Analysts who want to pull this programmatically can use the BankRegAPI:

from bankregreports import BankReg

client = BankReg("brr_your_api_key_here")

# Capital ratio history for a specific bank (rssd_id maps to Fed RSSD identifier)
capital = client.bank("3510506").capital_ratios(periods=24)
print(capital[["period", "cet1_ratio", "cre_concentration", "npl_ratio"]])

Full endpoint documentation is at api.bankregreports.com/api/v1/docs/. The API is useful for building monitoring dashboards or running peer-group screens across hundreds of institutions at once — the kind of work that used to require a data team.

The Bigger Question the Scenarios Don’t Settle

Passing a stress test is not the same as being resilient. It means a bank’s modeled capital stays above its minimum under a specific hypothetical scenario the Fed published in February. What the model cannot capture is the idiosyncratic risk in a particular portfolio, the operational friction of actually working through a loss cycle, and the risks that happened to fall outside the scenario boundary this year.

The NYCB CRE losses were not exotic. They were straightforward credit losses on a concentrated book in a market where office and multifamily valuations were under visible pressure. A bank analyst watching quarterly Call Report data would have seen the CRE concentration building. The question is whether anyone was watching.

For community banks, that vigilance is internal — the ALCO process, the loan review function, the board’s capital adequacy discussion. The supervisory stress test exists to enforce a minimum standard for the institutions large enough to threaten systemic stability. For everyone below $100 billion, the discipline has to come from within.

The data in this post is available through the BankRegReports platform. Pull peer benchmarks, Call Report metrics, UBPR trends, and enforcement history for any FDIC-insured bank — no data engineering required. Explore the platform →

Frequently Asked Questions

What is bank stress testing? A forward-looking simulation in which regulators apply a hypothetical severe economic scenario to a bank and project how its losses and capital would evolve over nine quarters. The test determines whether the bank would remain adequately capitalized through a severe downturn.

What is the difference between DFAST and CCAR? DFAST is the quantitative projection of losses and capital under standardized supervisory scenarios. CCAR builds on DFAST for the largest banks and adds an evaluation of the bank’s capital plan — including planned dividends and share buybacks — and whether those plans hold up under stress.

Which banks are subject to the supervisory stress test? The Federal Reserve’s stress test applies to bank holding companies with $100 billion or more in total consolidated assets. The largest firms run annually; those in the $100–700 billion range are on a biennial cycle. Banks below $100 billion are not subject to the supervisory test, though examiners expect them to conduct internal capital stress analysis.

What is the severely adverse scenario? A deliberately harsh hypothetical recession published annually by the Federal Reserve, featuring sharply rising unemployment (often to 10% or higher) and steep declines in equity and real estate prices. It is not an economic forecast; it is a stress point chosen to test whether banks can absorb a crisis comparable to or worse than 2008.

How long is the stress test projection horizon? Nine quarters. For the 2026 cycle, scenarios run from Q1 2026 through Q1 2029.

What CRE concentration ratio triggers heightened scrutiny? The 300% threshold — CRE loans excluding owner-occupied divided by risk-based capital — is the line established in 2006 interagency guidance. Banks above this level should expect more detailed examiner review of their concentration risk management and internal stress testing practices.

Where can I track a bank’s capital strength over time?BankRegReports displays capital ratios, asset quality, and concentration metrics from the FFIEC Call Report for every U.S. bank, with 24 years of quarterly history and peer benchmarking. The underlying data is also available through the BankRegReports Data API.