Common CFP Exam Findings: Top Deficiencies Regulators Flag (And How to Fix Them)

You passed the last examination. But the Federal Reserve just spent two years documenting exactly how a bank with a CFP on file and a stress testing framework in place can still collapse in forty-eight hours.

Silicon Valley Bank had a Contingency Funding Plan. It had a stress testing model. It had board-level reporting. None of it mattered because the CFP had five of the eight deficiencies regulators have been flagging in examination reports for a decade — and when actual stress arrived, the plan didn’t work.

The OCC, FDIC, and Federal Reserve don’t publish a ranked list of CFP exam findings. But between the Federal Reserve’s April 2023 Material Loss Review of SVB, the 2023 Addendum to the Interagency Policy Statement on Funding and Liquidity Risk Management, and OCC and FDIC examination manuals, the pattern is clear. Here’s what examiners actually find, and what fixing it looks like.

TL;DR

• The same eight CFP deficiencies show up repeatedly across OCC, FDIC, and Fed examinations — SVB is the most public example, not the only one
• The 2023 Addendum (post-SVB) explicitly tightened standards on assumption documentation, discount window operational readiness, and CFP update triggers — if your CFP predates 2023, assume it needs revision
• Most deficiencies fall into two buckets: documentation exists but isn’t credible, or the plan exists but governance never engaged with it
• Community banks face the same baseline standards as large banks on the core requirements — size only affects complexity, not obligation

The Post-SVB Examination Environment

The collapses of Silicon Valley Bank and Signature Bank in March 2023 shifted how examiners evaluate CFPs. Both banks had identified liquidity risk management as an area of concern. SVB received MRIAs — Matters Requiring Immediate Attention, the most serious supervisory finding — in 2021 for CFP and stress testing deficiencies. None of that translated into remediation before the bank failed.

The 2023 Addendum to the Interagency Policy Statement (issued July 2023, via OCC Bulletin 2023-25 and FDIC FIL-23-039) added three specific new requirements to the baseline that has applied since 2010:

1. Operational testing of discount window access — not theoretical inclusion, but an actual draw that proves the process works
2. Realistic availability assessment — each contingent funding source must be assessed for whether it would actually be accessible during the modeled stress scenario, not just whether it’s contractually available
3. Material-change review triggers — CFPs must be reviewed and updated when market conditions, balance sheet composition, or strategic initiatives change materially

Those three additions target the same themes that appear throughout examination findings. Understanding them is the starting point.

The Eight Most Common CFP Deficiencies

1. Stress Scenarios Are Too Mild

The most pervasive exam finding is a stress test that models gradual, moderate deterioration rather than sudden, severe shocks. Examiners have been explicit about this in guidance for years. The 2023 Addendum was partly written because SVB’s scenarios didn’t model what actually happened.

SVB’s depositors didn’t reduce balances by 3–5% over 90 days. They attempted to withdraw approximately $42 billion — roughly 25% of total deposits — in a single day. Standard runoff tables have no row for that. The problem wasn’t the table; it was the assumption that the standard table was adequate for a bank with 94% uninsured deposits concentrated in a single industry.

What examiners want to see: Scenarios calibrated to your institution’s actual risk profile. A bank with concentrated uninsured deposits in one sector needs a scenario that models rapid, correlated withdrawal. A bank with significant derivatives exposure needs realistic margin call modeling. Generic industry-default runoff rates without institution-specific calibration are flagged as inadequate.

The fix: Run a concentration analysis on your deposit book. Identify your top 10 depositor relationships by balance, your largest industry concentrations, and your uninsured deposit percentage. Then ask: what does a scenario look like where those specific depositors react to a specific trigger? Document that scenario alongside your standard idiosyncratic, systemic, and combined scenarios.

2. Assumption Documentation Is Missing or Circular

A CFP stress test is a model. Like any model, its credibility depends entirely on whether the assumptions are documented, supported, and independently reviewed. The most common version of this deficiency: numbers appear in a spreadsheet with no documented rationale. Examiners ask “where did 10% come from?” and the answer is “we’ve always used that.”

SVB’s model issues were documented by the Fed’s Material Loss Review. Management changed assumptions in October 2022 to reduce the reported 30-day deficit by approximately $13 billion — not because the balance sheet improved, but because the numbers were uncomfortable. That’s assumption management, not stress testing. The 2023 Addendum now requires that assumption changes be documented and that assumptions be independently reviewed.

What examiners want to see: For every runoff rate, haircut, and availability assumption: (1) the assumption itself, (2) the source (historical data, regulatory baseline, peer benchmarks, institution-specific analysis), (3) the rationale for why it’s appropriate for this institution, and (4) who reviewed and approved it independently of the team that built the model.

The fix: Create an assumption log separate from the stress test model. For each input variable, document source, date, last review, and reviewer. This isn’t extra documentation — it’s what gives the stress test regulatory credibility.

3. Contingent Funding Sources That Don’t Actually Work

The Federal Reserve discount window shows up as a funding source in CFPs at institutions that have never operationally tested it. FHLB advance capacity is listed at theoretical maximum without accounting for collateral constraints. Credit lines appear from counterparties who would face the same stress scenario.

SVB’s failure was partly attributed to the inability to access the discount window when it was needed. The bank hadn’t maintained the operational readiness to draw on it under stress conditions.

What examiners want to see: For each contingent funding source:

• Actual available capacity (collateral-constrained, not theoretical maximum)
• Prerequisites for access (account open, collateral pre-positioned, operational process tested)
• Date of last operational test (for discount window, this is now required)
• Realistic availability under the stress scenario (would this source be available if your counterparty faces the same systemic stress?)

The fix: Contact your Federal Reserve district bank and conduct an operational test of discount window access. Pre-position collateral. Document the test. For FHLB advances, pull your actual pledged and available-to-pledge collateral report and use that number — not the theoretical maximum borrowing capacity. Review credit line counterparties and assess whether they’d be under concurrent stress in a combined scenario.

4. HTM Securities Counted as Liquid

This deficiency became impossible to ignore after SVB. The bank held approximately $91 billion in held-to-maturity securities. These could not be liquidated without realizing massive losses that would have wiped out equity — which is exactly why they were held-to-maturity. A CFP that counts HTM securities as available liquidity is documenting a fiction.

This isn’t a new examiner concern. The OCC’s Liquidity booklet (updated May 2023) and standard HQLA frameworks have always excluded HTM securities from liquidity calculations. But it became urgent after March 2023.

What examiners want to see: Your HQLA and contingent liquidity calculations should contain only assets that can actually be monetized within the stress scenario’s time horizon without impairing solvency. HTM securities are not liquid assets. Period.

The fix: Pull your securities portfolio categorization. Remove all HTM positions from your liquidity calculations. If removing them creates a structural gap in your survival horizon, that’s a real problem your CFP needs to address through balance sheet changes or expanded contingent funding capacity — not through assumption adjustment.

5. Board Engagement That’s a Rubber Stamp

Examiners review board minutes. They can tell the difference between a board that reviewed CFP results, asked questions, and received answers — and a board that received a slide deck and moved to the next agenda item. SVB’s board approved management’s CFP framework while MRIAs for stress testing deficiencies were outstanding.

What examiners want to see: Board minutes that reflect substantive engagement with CFP results. Questions asked about scenario severity, assumption rationale, and survival horizon trends. Action items when gaps are identified. Evidence that the board reviewed and approved the CFP framework, not just ratified it.

The fix: Before your next board presentation, build a CFP reporting package that requires a response: survival horizon by scenario, comparison to prior period, key assumption changes since last report, and a management assessment of adequacy. Structure the agenda item so directors have to engage, not just approve.

6. CFP Not Updated After Material Changes

A CFP written when the institution had a certain deposit mix, asset portfolio, and balance sheet composition becomes stale when those fundamentals change. Examiners specifically flag CFPs that weren’t updated after acquisitions, new deposit product launches, significant shifts in depositor concentration, or changes in the interest rate environment that altered asset liquidity.

The 2023 Addendum formalized this as a specific requirement: the CFP must be reviewed and revised when market conditions or strategic initiatives change materially.

What examiners want to see: A CFP update log that shows when the document was revised, what triggered the revision, and who approved it. Evidence that the CFP reflected the institution’s actual balance sheet at the time of examination.

The fix: Establish a CFP review trigger list. Every time a new deposit product is launched, a significant acquisition closes, a major borrower relationship changes, or the balance sheet changes materially, the CFP review is triggered. Assign ownership of monitoring these triggers to a specific function — usually treasury or asset-liability management.

7. No Independent Review of Assumptions

For community banks, “independent” means someone outside the treasury or CFO function reviewed and challenged the stress testing assumptions. For larger institutions, the CRO must formally approve. A stress test built, reviewed, and signed off entirely by the treasury team — with no external challenge to the assumptions — lacks the independence that gives it credibility with examiners.

What examiners want to see: Documentation of who reviewed assumptions, what their role is relative to the stress testing team, what questions they raised, and how those questions were resolved.

The fix: Internal audit can perform this function at community banks. The review doesn’t need to be technically deep — it needs to demonstrate independent challenge. Did the reviewer ask whether the runoff rate for concentrated deposits was adequate given the uninsured percentage? Did they ask about the discount window operational readiness? Document the questions and answers.

8. No Sensitivity Analysis

A CFP stress test produces a single output — survival horizon under each scenario — based on a specific set of assumptions. If any key assumption is wrong, the output changes. Examiners expect to see analysis of what happens when key assumptions are wrong: what is the survival horizon if deposit runoff is 2x the base assumption? 5x?

SVB’s assumptions proved catastrophically wrong. The bank had no documented sensitivity analysis showing what happened to its survival horizon under more severe runoff — or if it did, management didn’t act on it.

What examiners want to see: At minimum, sensitivity analysis on the two or three assumptions that most significantly affect survival horizon. Document the results and the management discussion of what the sensitivity implies for the institution’s actual risk exposure.

The fix: Run your stress test at 1x, 2x, and 5x your base runoff assumption for your most concentrated deposit categories. If the survival horizon drops to zero at 2x, that’s a structural liquidity vulnerability your CFP needs to address — not just document.

What Remediation Actually Looks Like

Most CFP deficiencies come in clusters. An institution that has mild scenarios typically also has undocumented assumptions and no sensitivity analysis — because all three trace back to the same root cause: the stress test was designed to produce a passing result rather than to honestly assess risk.

Remediation that sticks requires fixing the root cause, not the symptom:

Most institutions can address the documentation and governance deficiencies within 60–90 days. The harder fixes — adding HQLA, restructuring the deposit mix, establishing operational discount window readiness — require balance sheet decisions that take longer.

So What?

The SVB Material Loss Review is the most thorough public post-mortem on a CFP failure in modern US banking supervision. The Fed documented, in detail, exactly how a bank can have a CFP on file, receive supervisory findings for years, and still fail a liquidity crisis — because the plan was structurally divorced from reality.

The 2023 Addendum isn’t aspirational. Examiners are now specifically checking for discount window operational readiness, assumption documentation quality, and CFP update history after material changes. If your CFP was last reviewed before July 2023 and hasn’t been assessed against the Addendum’s requirements, you’re working with an outdated document.

Need a starting framework? The Business Continuity & Disaster Recovery Kit includes CFP-aligned templates designed to meet FFIEC examination standards.

Related Reading

• What Is a Contingency Funding Plan (CFP)? A Practitioner’s Guide
• Who Needs a Contingency Funding Plan? FINRA, OCC & Interagency Requirements Explained
• Liquidity Stress Testing for Your CFP: Scenarios, Assumptions & Methodology

Frequently Asked Questions

What are the most common CFP deficiencies regulators find? The OCC, FDIC, and Fed consistently cite: stress scenarios too mild for the institution’s actual risk profile; assumption documentation absent or not independently reviewed; contingent funding sources listed but not operationally verified (especially the discount window); HTM securities miscounted as liquid assets; board engagement that doesn’t reflect substantive review; CFPs not updated after material balance sheet or market changes; and no sensitivity analysis on key assumptions.

How did SVB’s CFP fail? The Fed issued MRIAs to SVB in 2021 for CFP and stress testing deficiencies. By August 2022, SVB’s own stress test showed a 30-day liquidity deficit of approximately $18 billion. Rather than addressing the structural gap, management changed model assumptions in October 2022, reducing the reported deficit by $13 billion. The bank held $91 billion in HTM securities that couldn’t be liquidated without destroying capital, and was operationally unready to access the discount window. SVB failed March 10, 2023.

What did the 2023 Addendum change? The Addendum (issued via OCC Bulletin 2023-25 and FDIC FIL-23-039) added three specific requirements: (1) operational testing of Federal Reserve discount window access; (2) realistic assessment of whether contingent sources would actually be available under the specific stress scenario modeled; and (3) material-change triggers requiring CFP review and update when balance sheet composition or market conditions change significantly.

Do community banks face CFP examination standards? Yes. The 2010 Interagency Policy Statement applies to all FDIC-insured institutions. Community banks aren’t subject to LCR/NSFR or the enhanced standards of 12 CFR 252.35, but examiners expect documented stress scenarios, an accessible contingent funding plan, and board-level engagement. The 2023 Addendum reinforced that these baseline expectations apply regardless of asset size.

How often should a CFP be updated? At minimum annually. Beyond scheduled review, the 2023 Addendum requires out-of-cycle updates whenever market conditions or strategic initiatives change materially. Trigger events include: acquisitions, new deposit products, material shifts in depositor composition, changes in the interest rate environment that affect asset liquidity, and any change to contingent funding source access or capacity.

What is an MRA vs. MRIA for CFP? MRAs (Matters Requiring Attention) arise when the CFP has documented gaps that need remediation but don’t pose an immediate safety and soundness concern. MRIAs (Matters Requiring Immediate Attention) arise when the gap is severe enough to require urgent attention — typically when stress testing reveals an unaddressed structural liquidity deficit, the CFP is so stale it’s operationally useless, or when remediation of prior findings hasn’t occurred.