Liquidity Risk KRIs Beyond LCR and NSFR: The 12 Early Warning Metrics That Give You Days, Not Hours

TL;DR

• LCR and NSFR are backward-looking compliance ratios — they tell regulators you passed; they don’t tell you when you’re three days from a crisis
• SVB had an LCR above 100% while building the conditions for failure: 93.8% uninsured deposits, extreme HTM concentration, and a duration gap that would have triggered every liquidity KRI on this list
• The U.S. bank liquidity framework has five components — LCR, NSFR, ILST, RLAP, RLEN — but early warning requires a separate KRI layer that most institutions underinvest in
• The 12 metrics here give risk managers days to act, not hours — and several of them require no technology beyond a weekly Excel pull

When Silicon Valley Bank failed on March 10, 2023, depositors withdrew $42 billion in a single day. What made the failure exceptional wasn’t the amount — it was the velocity. By the time SVB’s risk function could model the scenario, billions in withdrawal requests had arrived within hours. The escalation process never caught up.

SVB wasn’t ungoverned. At the time of failure, the bank had 31 open Matters Requiring Attention, several related specifically to liquidity risk management and capital planning. Federal Reserve officials had raised concerns about liquidity risk as early as 2021. The bank filed regular liquidity reports. It passed its LCR requirements.

Something was missing. What was missing was a layer of early warning metrics that translated balance sheet vulnerabilities into actionable signals before the run started.

That’s what liquidity risk KRIs are for.

Why LCR and NSFR Aren’t Enough

The Liquidity Coverage Ratio (LCR) requires covered banks to hold sufficient High-Quality Liquid Assets (HQLA) to cover 30 days of net cash outflows under a specified stress scenario. The Net Stable Funding Ratio (NSFR) requires available stable funding to exceed required stable funding over a one-year horizon. Both set a floor of 100%.

These are minimum compliance ratios. They measure a snapshot in time. They don’t tell you:

• Whether your deposit base is concentrated in a sector that could run simultaneously
• How fast your contingent funding capacity could be accessed in a real stress event
• Whether your collateral is already pledged and unavailable
• How quickly your HQLA would erode if you had to fund unexpected outflows for five consecutive days

The full U.S. liquidity risk framework for large banks includes three additional components beyond LCR and NSFR: Internal Liquidity Stress Tests (ILSTs) conducted monthly by the bank, Resolution Liquidity Adequacy and Positioning (RLAP), and Resolution Liquidity Execution Need (RLEN) — both required for GSIB resolution planning. But even with all five components, regulators and risk managers need forward-looking early warning signals operating continuously.

That’s the KRI layer.

The 12 Liquidity Risk KRIs Beyond LCR and NSFR

These metrics are organized in roughly the order you’d expect them to signal stress — from structural vulnerabilities (which flash amber when normal, and red well before a crisis) to real-time flow metrics (which flash when a crisis is already underway).

Thresholds above are illustrative starting points — your institution should calibrate these against your own historical data, peer comparisons, and risk appetite. A $500M community bank and a $200B regional bank have very different “normal” ranges for wholesale funding reliance.

A Closer Look at the Metrics That Matter Most

Uninsured Deposit Ratio and Sector Concentration (KRIs 1–3)

SVB’s uninsured deposit ratio was 93.8% as of year-end 2022 — the highest among all U.S. banks with more than $50 billion in assets. That single metric should have been flashing red on any liquidity risk dashboard for years before the failure.

Why does this matter so much? Depositors with balances above FDIC limits have a rational incentive to run when they perceive risk — they have more to lose. A bank with 30% uninsured deposits has a different stress scenario than one with 90%. The behavioral assumptions embedded in your ILST should reflect this; most banks’ stress tests underestimate uninsured depositor run-off speed.

Combine uninsured deposit concentration with sector concentration — SVB’s depositors were overwhelmingly venture-backed technology startups, connected through shared investors, group chats, and social networks — and you have a scenario where a single influential voice can trigger simultaneous withdrawals across thousands of accounts within hours. The interconnectedness of the depositor base amplified the speed of the run.

HTM Securities and Duration Gap (KRIs 5–6)

SVB held an outsized proportion of its assets in held-to-maturity securities purchased when interest rates were near zero. HTM securities are not marked to market — which means unrealized losses don’t appear in earnings or regulatory capital ratios. But they also cannot be sold without reclassifying the entire HTM portfolio, which triggers mark-to-market recognition of losses across all HTM holdings.

This created a structural trap: SVB had assets that looked liquid on the balance sheet but were economically illiquid in a rising rate environment. The duration gap — the mismatch between how long assets and liabilities reprice — had widened to extreme levels. When rates rose sharply, the unrealized losses on the HTM portfolio swamped the bank’s tangible equity, and the news of those losses accelerated the deposit run.

Duration gap isn’t just an interest rate risk KRI — it’s a liquidity risk KRI when it reaches extreme levels. A bank with a 5-year duration gap is effectively betting that it won’t need to liquidate assets for five years. That bet failed catastrophically at SVB.

Available Contingent Funding Capacity (KRI 8)

Your contingent funding plan identifies the sources you’d draw on under stress: FHLB advance lines, Federal Reserve discount window eligibility, repo lines, collateral available to pledge. Available contingent funding capacity measures how much of that identified capacity is actually available — the unused portion.

Many banks discover in a real stress event that their contingent capacity is smaller than their plan assumed: FHLB advance limits are lower than expected, collateral is already pledged for other purposes, or the discount window application process is slower than the stress scenario allows.

SVB reportedly had difficulties accessing the Fed discount window at the speed the crisis required. Stress testing contingent funding access — not just its nominal amount — is a more rigorous version of KRI 8.

Net Deposit Outflow Rate (KRI 12)

This is the most real-time metric on the list: what percentage of your deposit base left in the last 24 hours, 48 hours, or 7 days? A 3% weekly outflow is unusual; a 1% daily outflow in a single business day is a crisis signal.

For banks with core deposit systems that generate daily reports, this metric is a free KRI that costs only the discipline to monitor it. For banks that only review deposit trends weekly or monthly, the signal arrives too late.

SVB withdrew $42 billion in a single day. That’s not a metric that can be caught and responded to with a weekly deposit trend report. Intraday deposit monitoring was the tool that could have provided hours — not days — of additional response time.

Setting Thresholds: What Examiners Expect

When examiners review your liquidity KRI program — during IT examinations, liquidity risk management reviews, or ILST validations — they’re looking for:

1. Calibration rationale. Why is your amber threshold where it is? “That’s where we put it” isn’t sufficient. Thresholds should be calibrated against historical data, peer benchmarks (where available), and your institution’s liquidity stress survival horizon. The calibration methodology should be documented.

2. Escalation triggers. What happens when a KRI hits amber? Who is notified? Who is responsible for reviewing and responding? An amber trigger that generates a report nobody reads isn’t a KRI — it’s a false comfort.

3. Reporting cadence. Board and senior management reports should include liquidity KRI status. Regulators expect board-level visibility into liquidity risk metrics, not just operational-level monitoring. The interest rate risk KRI framework published recently covers the IRRBB intersection — duration gap, DSCR, and repricing gap metrics overlap with liquidity risk in rising rate environments.

4. Trend analysis. A KRI at 38% that was 20% six months ago tells a different story than a KRI that’s been stable at 38% for three years. KRI dashboards should show trend lines, not just point-in-time values.

How These KRIs Relate to Your Contingency Funding Plan

If your institution has a Contingency Funding Plan (CFP), your liquidity KRIs should be directly integrated with it. Specifically:

• KRI thresholds should map to CFP activation stages. A “Stage 1 Elevated Watch” in your CFP should be triggered by specific KRI amber readings — not just a narrative description of “when management decides stress is emerging.”
• CFP funding sources should be stress-tested for availability, not just existence. KRI 8 (available contingent funding capacity) tests this continuously. Periodic draw tests on your FHLB line and discount window relationship confirm they’d actually work under stress.
• Early warning indicators vs. KRIs. Your CFP likely identifies both. KRIs are your internal metrics; early warning indicators (EWIs) are often external signals — rating agency watches, peer failures, market spread movements — that also trigger CFP review.

The credit risk KRI post covers the credit portfolio metrics that can become liquidity triggers when charge-off rates accelerate and investor confidence shifts.

Building Your Liquidity KRI Dashboard

The mechanics:

Data sources for the 12 KRIs:

Reporting cadence:

• KRIs 11–12: Daily (real-time or next-morning reporting)
• KRIs 7–9: Weekly
• KRIs 1–6, 10: Monthly (with immediate escalation if a threshold is breached)
• Board/ALCO reporting: Monthly with trend analysis; quarterly deep dive

Owner assignment: Each KRI should have a named owner responsible for data collection, threshold review, and escalation if triggered. Treasury owns KRIs 4, 8–10. Finance owns KRIs 1–3, 5–6. Risk management owns the dashboard and escalation process.

If you’re building a KRI library from scratch across risk domains — including these 12 liquidity metrics plus credit, operational, cyber, and compliance indicators — the KRI Library provides 132 pre-built KRIs across six risk domains with calibrated Green/Amber/Red thresholds, data source mapping, and escalation trigger definitions.

The SVB Lesson That’s Easy to Misread

It’s tempting to read SVB as a uniquely extreme case — 93.8% uninsured, an 8-month CRO vacancy in 2022, 31 open MRAs at failure. Too anomalous to learn from.

That’s the wrong read. The Federal Reserve’s Material Loss Review of SVB found that the board’s risk committee had only one member with any background in risk management. The bank’s ILST assumptions underestimated the speed and severity of a depositor run driven by social media and interconnected stakeholders. The liquidity risk KRIs that were in place weren’t escalated with sufficient urgency to senior management and the board.

These are not exotic failures. Board composition gaps, overly benign ILST assumptions, and weak KRI escalation are routine findings in bank examinations. The metrics that would have flagged SVB’s vulnerabilities are available at most institutions — the question is whether they’re being monitored, whether the thresholds are calibrated to signal danger before it becomes crisis, and whether escalation actually reaches the people who can act.

LCR compliance is a compliance problem. Liquidity risk management is a survival problem. The KRI layer is what bridges them.

The goal isn’t to build a dashboard that would have saved SVB three years ago. The goal is a KRI program that gives your risk function the days — not hours — needed to act when conditions start shifting. That means starting with deposit concentration and wholesale funding monitoring, calibrating thresholds against your specific depositor base, and wiring KRI triggers directly into your Contingency Funding Plan activation sequence.

The metrics are mostly straightforward. The discipline is in treating amber as a call to action rather than a call to monitor more closely.