Developing/Refining Your Stress Testing Framework Special Assets Management Association Conference Santa Barbara, CA April 19, 2013 Investors Jeff Curry Managing Director-FTI Consulting Financial Institutions Group Financial and Risk Management Practice

Why Stress Testing for All Banks? As clearly noted by the regulatory agencies, banks < $10 billion are not required or expected to conduct stress testing required for larger banks under DFA or the capital plan rule, or to comply with stress testing guidance (which is for banks > $10 billion). However, the crisis of 2007-2009 demonstrated that all banks, not just the larger ones, did not have a good understanding of their vulnerability to deteriorating economic or financial environments. This is because the focus of risk management was based on current or historical measures of risk. There were only limited examples of forward-looking risk measures or tools, and many of these were used on an ad hoc basis. Banks had only limited, inconsistently-applied measurement or analytical tools to see the crisis coming. Stress testing represents the primary tool (actually, set of tools) that can be used to consistently evaluate risks on a forward-looking basis. Arguably, had sound stress testing practices been in place, banks could have seen the 2007-2009 crisis coming, and could’ve even defused much of the crisis before it happened.

Why Stress Testing for All Banks? Continued Now, stress testing represents the analytical cornerstone of proactive enterprise risk management for all banking institutions going forward. If a bank needs risk management (what bank doesn’t?), then it needs a sound stress test modeling and related governance framework. In short, stress testing is considered a best practice in (and beyond) the banking industry. Again, stress testing is not required by regulators for banks < $10 billion, but it is undeniably a key component of risk management in any bank (regardless of size). Stress testing is nothing new: It has been required for years in the analysis and management of many risks banks face, including for interest rate, liquidity and CRE risk. We believe that the extension of stress testing to an enterprise-wide perspective is part of the natural evolution of the industry to more holistic risk management. Moreover, many new banking practices –such as ERM itself– start out as applicable to only larger institutions, only to subsequently be “pushed down” to smaller and smaller institutions, ultimately becoming best practices for the industry. We believe that enterprise stress testing falls into this category.

So, What Should Your Bank Do? Begin the process of formalizing your bank’s stress testing framework now. Don’t wait. Start by developing your stress testing governance structure (next few slides). Think through now what enhancements to your modeling capabilities are needed to support sound stress testing going forward. Develop a capital stress testing capability now. A key question today for banks > $10 billion: Can your asset/liability model be an adequate platform for capital stress testing? Start evaluating the data challenges and issues now. Sound stress testing requires granular, loan-level data, particularly for collateral. Portfolio or segment-level data is generally not sufficient enough to fully evaluate the impact of scenario-specific parameters on collateral values. This is clearly true for special assets. Data issues are presenting the primary challenges to banks in developing their stress testing programs. These should be addressed sooner rather than later. Problems include: Obtaining sufficient historical data on asset performance. Ensuring data consistency, especially if mergers/acquisitions have taken place. Key fields are not populated consistently to support stress testing. Integrating data from disparate loan servicers/vendor platforms. Consider building or evolving your data warehouse to consistently collect and maintain data for stress testing (and many other) applications. Synchronize stress testing data/analysis and internal loan/asset rating system applications.

Stress Testing Framework * Components Stress Testing Framework Stress Testing Policy Stress Test Models/ Methodologies Model Results Reporting Operating Principles Assumptions Stress Test Models: Data Flows Procedures Model Validation/ Governance Controls Overall governing document for Stress Testing Documentation that is specific to each model Documentation that is applicable to all models * Required for banks > $10 billion in the Interagency Supervisory Guidance on Stress Testing for Banking Organizations With More Than $10 Billion in Total Consolidated Assets, effective July 29, 2012

Stress Test Policy: The Lead Governance Document Structure Introduction/Purpose of Policy Objectives of Stress Testing Authorities and Responsibilities Stress Test Modeling Approaches at Sample Bank Limits on Stress Testing Outcomes and Treatment of Exceptions to Such Outcomes Frequency and Priority of Stress Testing Analysis Impact of Proposed New Products and Strategies Stress Test Results Reporting Internal Controls

Enterprise Stress Testing Governance Components

Enterprise Stress Testing Governance Structure (Example)

Thank you for your interest and attention. Jeff Curry, Managing Director FTI Consulting Washington, DC Office 1101 K Street; Suite B100 (202) 346-8876 (Office) (703) 980-6640 (Mobile) jeff.curry@fticonsulting.com www.fticonsulting.com