Security, data and compliance in Stress Testing & Capital Planning (DFAST)

How Stress Testing & Capital Planning (DFAST) protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person can see and do follows their role; entering an overlay is separate from approving it.

Locked results

Approved scenarios and final runs are locked; any later change creates a new version rather than altering the record.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, change, run, approval and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• Dodd-Frank Act Section 165(i) (company-run stress tests)
• Federal Reserve Regulation YY (12 CFR Part 252)
• Federal Reserve Capital Plan Rule (12 CFR 225.8)
• OCC and FDIC stress testing rules (12 CFR Part 46; 12 CFR Part 325, Subpart C)
• NCUA capital planning and stress testing (12 CFR Part 702, Subpart E)
• Interagency Guidance on Model Risk Management (SR 11-7)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for institutions outside the US.
• Dedicated environment: A single-tenant environment for institutions whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for data loading support and platform administration during each cycle.

Limitations

• The product projects capital from the scenarios, models and assumptions you approve; it does not decide what capital your institution should hold. Capital decisions are made by your management and board.
• Projections are only as sound as the models and data behind them. Your models remain your institution's responsibility and should be validated under your model risk process.
• It does not submit regulatory reporting forms or capital plans to regulators; your team files them.
• Supervisory scenarios are loaded as regulators publish them. The product does not predict or design supervisory scenarios.
• It is designed for US capital and stress testing requirements. Other jurisdictions' stress testing regimes are not included as configured templates.
• It does not calculate allowance for credit losses for accounting purposes; that is handled by a separate CECL or IFRS 9 process.
• Liquidity stress testing is not included.
• Built-in calculation templates suit simpler portfolios; complex models are connected from your own environment rather than rebuilt in the product.