CFP Testing Under the 2023 Interagency Addendum: What Regulators Expect

TL;DR

• CFP Testing is Mandatory: Regulatory bodies (OCC, FDIC, NCUA, Federal Reserve) explicitly require robust testing of your Contingency Funding Plan, emphasizing access to contingent funding sources.
• Beyond Paperwork: Effective testing goes beyond reviewing documents; it involves practical exercises like tabletop simulations and operational drills to ensure readiness.
• Learn from Every Drill: Implement thorough after-action reviews to identify gaps, refine your plan, and continuously improve your firm’s liquidity resilience.

---

The best Contingency Funding Plan (CFP) isn’t just a beautifully written document; it’s a living, breathing framework that has been rigorously tested and proven to work under pressure. Many financial institutions spend significant effort developing their CFPs, only to fall short when it comes to validating their effectiveness through testing. This oversight can turn a theoretical safeguard into a real liability during a liquidity crisis.

Regulators, having witnessed liquidity events, are increasingly scrutinizing the testing component of CFPs. The 2023 Addendum to the Interagency Policy Statement on Funding and Liquidity Risk Management, issued by the OCC, FDIC, NCUA, and Federal Reserve, explicitly calls for institutions to regularly test their plans, especially their ability to access contingent funding sources. This isn’t a suggestion; it’s a critical expectation.

This guide dives into the practicalities of testing your CFP, covering various exercise types, scenario design, and crucial after-action reviews to ensure your institution is truly ready when liquidity stress hits.

Why CFP Testing is Non-Negotiable: Regulatory Imperatives

The 2023 Addendum to the Interagency Policy Statement on Funding and Liquidity Risk Management (issued July 28, 2023) serves as a stark reminder. The FDIC, for instance, notes that firms must “be aware of the operational requirements to obtain funding from contingent sources, including testing access to contingent funding sources on a regular basis.” Similarly, the NCUA emphasizes that “depository institutions should regularly test any contingency borrowing lines to ensure the institution’s staff are well versed in how to access them and that they function as envisioned.”

This regulatory emphasis highlights a fundamental truth: a plan, no matter how comprehensive, is only as good as its tested execution. Without testing, you’re operating on assumptions, not proven capabilities.

Types of CFP Testing Exercises

Effective CFP testing involves a spectrum of activities, from discussion-based exercises to full-scale operational drills. Each serves a distinct purpose in evaluating different aspects of your plan.

1. Tabletop Exercises (TTX)

Tabletop exercises are discussion-based sessions where key stakeholders review and discuss their roles, responsibilities, and decision-making processes under various hypothetical liquidity stress scenarios. They are excellent for:

• Validating the Plan’s Logic: Do the action plans make sense? Are the trigger levels appropriate?
• Clarifying Roles & Responsibilities: Does everyone know their part during a crisis? (Refer to our guide on CFP Governance: Roles, Responsibilities & Board Reporting for more on this.)
• Identifying Gaps: Exposing weaknesses in communication, coordination, or documentation.
• Training Personnel: Familiarizing staff with the CFP and crisis response protocols.

Designing Effective Tabletop Scenarios:

Your scenarios should be realistic, challenging, and tailored to your institution’s unique risk profile. Consider a mix of idiosyncratic (firm-specific) and systemic (market-wide) events.

Scenario Type	Example Event	Key Stressors	Focus Areas for Testing
Idiosyncratic	Major operational failure (e.g., cyberattack, critical system outage)	Reputational damage, deposit outflows, credit rating downgrade	Internal communication, crisis management team activation, reputational risk response, access to internal liquidity.
Market-Wide	Sudden, widespread market volatility (e.g., geopolitical crisis, major bank failure)	Counterparty risk, funding market freezing, asset illiquidity	External communication, contingent funding source activation, collateral management, interbank market access.
Combined	Merger announcement followed by negative analyst report & social media rumors	Rapid deposit outflow, heightened counterparty scrutiny	Speed of response, ability to combine internal/external actions, media management.

Injects and Complications: To make the exercise dynamic, introduce “injects” – pieces of information or events that unfold during the drill, requiring participants to react. Examples: “News breaks that your primary correspondent bank is experiencing issues,” or “A key member of the liquidity team is unreachable.”

2. Operational Testing & Simulation Drills

Operational testing moves beyond discussion to actual, hands-on verification of specific CFP components. This is where you test the mechanics.

• Testing Borrowing Lines: As emphasized by regulators, this is crucial. Can you actually draw on pre-arranged credit facilities or FHLB advances? This involves:
  • Documentation Review: Ensure all agreements are current and accessible.
  • Collateral Movement: Can collateral be pledged and moved efficiently to access funds? This means simulating or actually moving securities to a custodian or the Federal Reserve.
  • Communication Protocols: Verifying that communication channels with counterparties and liquidity providers are functional.
  • (For more on identifying and leveraging these sources, see Identifying & Prioritizing Contingent Funding Sources: A Practical Ranking Framework.)
• Cash Flow Projection Validation: Run your models with stress scenarios to ensure they accurately project liquidity needs and available resources.
• Early Warning Indicator (EWI) Drills: Simulate triggers (e.g., a sudden increase in funding costs, a negative news alert) to test whether your EWIs function correctly and escalate alerts as designed. (Learn more in Early Warning Indicators for Liquidity Stress: What to Monitor & How to Set Triggers.)
• Communication Drills: Practice internal and external communications during a crisis, including stakeholder notifications, media statements, and regulatory reporting.

The Importance of After-Action Reviews (AAR)

A testing exercise isn’t complete until a thorough After-Action Review (AAR) is conducted. The AAR is where lessons are learned and the CFP is strengthened.

Key AAR Components:

1. Objective Review: Did the exercise meet its objectives?
2. Performance Analysis: What went well? What didn’t? Focus on processes, decision-making, and resource allocation.
3. Gap Identification: Pinpoint specific weaknesses, ambiguities, or failures in the plan or its execution.
4. Recommendations: Develop concrete, actionable recommendations for improving the CFP, training, systems, or procedures. Assign owners and deadlines.
5. Lessons Learned: Document overarching insights that can be applied to future planning and risk management.

Integrating AAR Findings: The insights from AARs must be formally integrated back into your CFP. This means updating policies, procedures, contact lists, and potentially even your stress testing methodologies (as discussed in Liquidity Stress Testing for Your CFP: Scenarios, Assumptions & Methodology). This iterative process of plan-test-learn-refine is the hallmark of a resilient liquidity risk management program.

Beyond Liquidity: The Overlap with Business Continuity

While CFPs focus specifically on funding and liquidity, their testing often overlaps significantly with broader business continuity planning. Many of the exercises discussed—tabletops, communication drills, after-action reviews—are also core components of testing your Business Continuity Plan (BCP). This is why understanding the distinction, and where they intersect, is crucial. (For a deeper dive, check out Contingency Funding Plan vs. Business Continuity Plan: What’s the Difference?.) Leveraging existing BCP testing frameworks and resources can enhance your CFP testing efficiency.

So What? Practical Steps for Your Firm

Neglecting CFP testing is a silent risk that can cripple an institution during a crisis. By implementing a robust testing regimen, you move beyond theoretical readiness to actual operational resilience.

1. Schedule Regularly: Make CFP testing a recurring part of your risk management calendar, at least annually, and more frequently for significant changes.
2. Involve Key Stakeholders: Ensure Treasury, Risk, Operations, Legal, Compliance, and senior management are active participants.
3. Document Everything: From exercise plans and scenarios to AAR findings and remediation plans. Regulators want to see proof of your testing and continuous improvement.
4. Practice Collateral Management: Don’t just assume you can move collateral quickly; practice the operational steps.
5. Integrate with BCP/DR: Look for synergies with your Business Continuity and Disaster Recovery testing to maximize efficiency and holistic resilience.

Need a comprehensive framework for testing your BCP and DR plans, which includes tabletop exercise templates?

Get the BCP/DR Kit to streamline your business continuity efforts and ensure your organization is truly prepared for any disruption.

FAQ

Q1: How often should we test our Contingency Funding Plan? A1: Best practice, and regulatory expectation, is at least annually. However, you should also conduct targeted testing whenever there are significant changes to your business model, funding sources, market conditions, or regulatory requirements.

Q2: What’s the biggest mistake firms make when testing their CFP? A2: The most common mistake is conducting “paper exercises” that only review the plan verbally, without simulating actual operational steps or challenging underlying assumptions. Another significant error is failing to adequately document and act upon the findings from after-action reviews.

Q3: Can we combine CFP testing with other exercises, like BCP drills? A3: Yes, and it’s often beneficial. While CFPs are specific to liquidity, many aspects of crisis response—communication, command and control, stakeholder coordination—overlap with broader Business Continuity Plans. Combining exercises can enhance efficiency and provide a more holistic view of organizational resilience, provided both liquidity and operational continuity objectives are met.