## Abstract

This paper develops an analytical model of contagion in financial networks with arbitrary structure. We explore how the probability and potential impact of contagion is influenced by aggregate and idiosyncratic shocks, changes in network structure and asset market liquidity. Our findings suggest that financial systems exhibit a *robust-yet-fragile* tendency: while the probability of contagion may be low, the effects can be extremely widespread when problems occur. And we suggest why the resilience of the system in withstanding fairly large shocks prior to 2007 should not have been taken as a reliable guide to its future robustness.

## 1. Introduction

In modern financial systems, an intricate web of claims and obligations links the balance sheets of a wide variety of intermediaries, such as banks and hedge funds, into a network structure. The advent of sophisticated financial products, such as credit default swaps and collateralized debt obligations, has heightened the complexity of these balance sheet connections still further. As demonstrated by the financial crisis, especially in relation to the failure of Lehman Brothers and the rescue of American International Group (AIG), these interdependencies have created an environment for feedback elements to generate amplified responses to shocks to the financial system. They have also made it difficult to assess the potential for contagion arising from the behaviour of financial institutions under distress or from outright default.^{1}

This paper models two key channels of contagion in financial systems by which default may spread from one institution to another. The primary focus is on how losses can potentially spread via the complex network of direct counterparty exposures following an initial default. But, as Cifuentes *et al.* (2005) and Shin (2008) stress, the knock-on effects of distress at some financial institutions on asset prices can force other financial entities to write down the value of their assets, and we also model the potential for this effect to trigger further rounds of default. Contagion due to the direct interlinkages of interbank claims and obligations may thus be reinforced by indirect contagion on the asset side of the balance sheet—particularly when the market for key financial system assets is illiquid.

The most well-known contribution to the analysis of contagion through direct linkages in financial systems is that of Allen & Gale (2000).^{2} Using a network structure involving four banks, they demonstrate that the spread of contagion depends crucially on the pattern of interconnectedness between banks. When the network is complete, with all banks having exposures to each other such that the amount of interbank deposits held by any bank is evenly spread over all other banks, the impact of a shock is readily attenuated. Every bank takes a small ‘hit’ and there is no contagion. By contrast, when the network is ‘*incomplete*’, with banks only having exposures to a few counterparties, the system is more fragile. The initial impact of a shock is concentrated among neighbouring banks. Once these succumb, the premature liquidation of long-term assets and the associated loss of value bring previously unaffected banks into the front line of contagion. In a similar vein, Freixas *et al.* (2000) show that tiered systems with money-centre banks, where banks on the periphery are linked to the centre but not to each other, may also be susceptible to contagion.^{3}

The generality of insights based on simple networks with rigid structures to real-world contagion is clearly open to debate. Moreover, while not being so stylized, models with endogenous network formation (e.g. Leitner 2005; Castiglionesi & Navarro 2007) impose strong assumptions that lead to stark predictions on the implied network structure that do not reflect the complexities of real-world financial networks. And, by and large, the existing literature fails to distinguish the probability of contagious default from its potential spread.

However, even prior to the current financial crisis, the identification of the probability and impact of shocks to the financial system was assuming centre-stage in policy debate. Some policy institutions, for example, attempted to articulate the probability and impact of key risks to the financial system in their *Financial stability reports*.^{4} Moreover, the complexity of financial systems means that policymakers have only partial information about the true linkages between financial intermediaries. Given the speed with which shocks propagate, there is, therefore, a need to develop tools that facilitate analysis of the transmission of shocks through a given, but arbitrary, network structure. Recent events in the global financial system have only served to emphasize this.

Our paper takes up this challenge by introducing techniques from the literature on complex networks (Strogatz 2001) into a financial system setting. Although this type of approach is frequently applied to the study of epidemiology and ecology, and despite the obvious parallels between financial systems and other complex systems that have been highlighted by prominent authors (e.g. May *et al.* 2008) and policymakers (e.g. Haldane 2009), the analytical techniques we use have yet to be applied to economic problems and thus hold out the possibility of novel insights.

In what follows, we draw on these techniques to model contagion stemming from unexpected shocks in complex financial networks with arbitrary structure and then use numerical simulations to illustrate and clarify the intuition underpinning our analytical results. Our framework explicitly accounts for the nature and scale of aggregate and idiosyncratic shocks and allows asset prices to interact with balance sheets. The complex network structure and interactions between financial intermediaries make for non-linear system dynamics, whereby contagion risk can be highly sensitive to small changes in parameters. We analyse this feature of our model by isolating the probability and spread of contagion when claims and obligations are interlinked. In so doing, we provide an alternative perspective on the question of whether the financial system acts as a shock absorber or as an amplifier.

We find that financial systems exhibit a *robust-yet-fragile* tendency: while the probability of contagion may be low, the effects can be extremely widespread when problems occur. The model also highlights how *a priori* indistinguishable shocks can have very different consequences for the financial system, depending on the particular point in the network structure that the shock hits. This cautions against assuming that past resilience to a particular shock will continue to apply to future shocks of a similar magnitude. And it explains why the evidence of the resilience of the financial system to fairly large shocks prior to 2007 (e.g. 9/11, the Dotcom crash and the collapse of Amaranth to name a few) was not a reliable guide to its future robustness.

The intuition underpinning these results is straightforward. In a highly connected system, the counterparty losses of a failing institution can be more widely dispersed to, and absorbed by, other entities. So, increased connectivity and risk sharing may lower the probability of contagious default. But, *conditional* on the failure of one institution triggering contagious defaults, a high number of financial linkages also increases the potential for contagion to spread more widely. In particular, high connectivity increases the chances that institutions that survive the effects of the initial default will be exposed to more than one defaulting counterparty after the first round of contagion, thus making them vulnerable to a second-round default. The effects of any crises that do occur can, therefore, be extremely widespread.

Our model draws on the mathematics of complex networks (see Strogatz (2001) and Newman (2003) for authoritative and accessible surveys). This literature describes the behaviour of connected groups of nodes in a network and predicts the size of a susceptible cluster, i.e. the number of vulnerable nodes reached via the transmission of shocks along the links of the network. The approach relies on specifying all possible patterns of future transmission. Callaway *et al.* (2000), Newman *et al.* (2001) and Watts (2002) show how probability-generating function techniques can identify the number of a randomly selected node’s first neighbours, second neighbours and so on. Recursive equations are constructed to consider all possible outcomes and obtain the total number of nodes that the original node is connected to—directly and indirectly. *Phase transitions*, which mark the threshold(s) for extensive contagious outbreaks, can then be identified.

In what follows, we construct a simple financial system involving entities with interlocking balance sheets and use these techniques to model the spread and probability of contagious default following an unexpected shock, analytically and numerically.^{5} Unlike the generic, undirected graph model of Watts (2002), our model provides an explicit characterization of balance sheets, making clear the direction of claims and obligations linking financial institutions. It also includes asset price interactions with balance sheets, allowing the effects of asset-side contagion to be clearly delineated. We illustrate the robust-yet-fragile tendency of financial systems and analyse how contagion risk changes with capital buffers, the degree of connectivity and the liquidity of the market for failed banking assets.^{6}

Our framework assumes that the network of interbank linkages forms randomly and exogenously: we leave aside issues related to endogenous network formation, optimal network structures and network efficiency.^{7} Although some real-world banking networks may exhibit core–periphery structures and tiering (see Boss *et al.* (2004) and Craig & von Peter (in press) for evidence on the Austrian and German interbank markets, respectively), the empirical evidence is limited and, given our theoretical focus, it does not seem sensible to restrict our analysis of contagion to particular network structures. In particular, our assumption that the network structure is entirely arbitrary carries the advantage that our model encompasses *any* structure that may emerge in the real world or as the optimal outcome of a network formation game. And it is a natural benchmark to consider.

We also model the contagion process in a relatively mechanical fashion, holding balance sheets and the size and structure of interbank linkages constant as default propagates through the system. Arguably, in normal times in developed financial systems, banks are sufficiently robust that very minor variations in their default probabilities do not affect the decision of whether or not to lend to them in interbank markets. Meanwhile, in crises, contagion spreads very rapidly through the financial system, meaning that banks are unlikely to have time to alter their behaviour before they are affected—as such, it may be appropriate to assume that the network remains static. Note also that banks have no choice over whether they default. This precludes the type of strategic behaviour discussed by Morris (2000), Jackson & Yariv (2007) and Galeotti & Goyal (2009), whereby nodes can choose whether or not to adopt a particular state (e.g. adopting a new technology).

Our approach has some similarities to the epidemiological literature on the spread of disease in networks (see Anderson & May 1991; Newman 2002; Jackson & Rogers 2007; or the overview by Meyers 2007). But there are two key differences. First, in epidemiological models, the susceptibility of an individual to contagion from a particular infected ‘neighbour’ does not depend on the health of their other neighbours. By contrast, in our set-up, contagion to a particular institution following a default is more likely to occur if another of its counterparties has also defaulted. Second, in most epidemiological models, higher connectivity simply creates more channels of contact through which infection could spread, increasing the potential for contagion. In our setting, however, greater connectivity also provides counteracting risk-sharing benefits as exposures are diversified across a wider set of institutions.

Another strand of related literature (e.g. Davis & Lo 2001; Frey & Backhaus 2003; Giesecke 2004; Giesecke & Weber 2004; Cossin & Schellhorn 2007; Egloff *et al.* 2007) considers default correlation and credit contagion among firms, often using reduced-form credit risk models. In contrast to these papers, clearly specified bank balance sheets are central to our approach, with bilateral linkages precisely defined with reference to these. And our differing modelling strategy, which focuses on the transmission of contagion along these links, reflects the greater structure embedded in our network set-up.

The structure of the paper is as follows. Section 2 describes the structure of the financial network, the transmission process for contagion and analytical results characterizing a default cascade. Section 3 uses numerical simulations to study the effects of failures of individual institutions and to articulate the likelihood and extent of contagion. Section 4 considers the impact of liquidity effects on system stability. Section 5 discusses points of contact with the empirical literature on interbank contagion being pursued by central banks. The final section concludes.

## 2. The model

### (a) Network structure

Consider a financial network in which *n* financial intermediaries, ‘banks’ for short, are randomly linked together by their claims on each other. In the language of graph theory, each bank represents a *node* on the graph and the interbank exposures of bank *i* define the *links* with other banks. These links are *directed* and *weighted*, reflecting the fact that interbank exposures comprise assets as well as liabilities and that the size of these exposures is important for contagion analysis. Figure 1 shows an example of a directed, weighted financial network in which there are five banks, with darker lines corresponding to higher value links.

A crucial property of graphs such as those in figure 1 is their *degree distribution*. In a directed graph, each node has two degrees, an *in-degree*, the number of links that point into the node, and an *out-degree*, which is the number pointing out. Incoming links to a node or bank reflect the interbank assets/exposures of that bank, i.e. monies owed to the bank by a counterparty. Outgoing links from a bank, by contrast, correspond to its interbank liabilities. In what follows, the joint distribution of in- and out-degree governs the potential for the spread of shocks through the network.

For reasons outlined above, our analysis takes this joint degree distribution, and hence the structure of the links in the network, as being entirely arbitrary, though a specific distributional assumption is made in our numerical simulations in §3. This implies that the network is entirely random in all respects other than its degree distribution. In particular, there is no statistical correlation between nodes and mixing between nodes is proportionate (i.e. there is no statistical tendency for highly connected nodes to be particularly connected with other highly connected nodes or with poorly connected nodes).

Suppose that the total assets of each bank consist of interbank assets, , and illiquid external assets, such as mortgages, . Further, let us assume that the total interbank asset position of every bank is evenly distributed over each of its incoming links and is independent of the number of links the bank has (if a bank has no incoming links, for that bank). Although these assumptions are stylized, they provide a useful benchmark that emphasizes the possible benefits of diversification and allows us to highlight the distinction between risk sharing and risk spreading within the financial network. In particular, they allow us to show that widespread contagion is possible even when risk sharing in the system is maximized. We consider the implications of relaxing these assumptions in §2*e*.

Since every interbank asset is another bank’s liability, interbank liabilities, , are endogenously determined. Apart from interbank liabilities, we assume that the only other component of a bank’s liabilities is exogenously given customer deposits, *D*_{i}. The condition for bank *i* to be solvent is therefore
2.1
where *ϕ* is the fraction of banks with obligations to bank *i* that have defaulted, and *q* is the resale price of the illiquid asset.^{8} The value of *q* may be less than 1 in the event of asset sales by banks in default, but equals 1 if there are no ‘fire sales’. We make a zero recovery assumption, namely that, when a linked bank defaults, bank *i* loses all of its interbank assets held against that bank.^{9} The solvency condition can also be expressed as
2.2
where is the bank’s capital buffer, i.e. the difference between the book value of its assets and liabilities.^{10}

To model the dynamics of contagion, we suppose that all banks in the network are initially solvent and that the network is perturbed at time *t*=1 by the initial default of a single bank. Although purely idiosyncratic shocks are rare, the crystallization of operational risk (e.g. fraud) has led to the failure of financial institutions in the past (e.g. Barings Bank). Alternatively, bank failure may result from an aggregate shock that has particularly adverse consequences for one institution: this can be captured in the model through a general erosion in the stock of illiquid assets or, equivalently, capital buffers across all banks, combined with a major loss for one particular institution.

Let *j*_{i} denote the number of incoming links for bank *i* (the in-degree). Since linked banks each lose a fraction 1/*j*_{i} of their interbank assets when a single counterparty defaults, it is clear from equation (2.2) that the only way default can spread is if there is a neighbouring bank for which
2.3
We define banks that are exposed in this sense to the default of a single neighbour as *vulnerable* and other banks as *safe*. The vulnerability of a bank clearly depends on its in-degree. Specifically, recalling that the capital buffer is taken to be a random variable (see footnote 10), a bank with in-degree *j* is vulnerable with probability
2.4
Further, the probability of a bank having in-degree *j*, out-degree *k* and being vulnerable is *υ*_{j}⋅*p*_{jk}, where *p*_{jk} is the joint degree distribution of in- and out-degree.

The model structure described by equations (2.1)–(2.4) captures several features of interest in systemic risk analysis. First, as noted above, the nature and scale of adverse aggregate or macroeconomic events can be interpreted as a negative shock to the stock of illiquid assets, , or, equivalently, to the capital buffer, *K*_{i}. Second, idiosyncratic shocks can be modelled by assuming the exogenous default of a bank. Third, the structural characteristics of the financial system are described by the distribution of interbank linkages, *p*_{jk}. And, finally, liquidity effects associated with the potential knock-on effects of default on asset prices are captured by allowing *q* to vary. To keep matters simple, we initially fix *q*=1, returning later to endogenize it.

### (b) Generating functions and the transmission of shocks

In sufficiently large networks, for contagion to spread beyond the first neighbours of the initially defaulting bank, those neighbours must themselves have outgoing links (i.e. liabilities) to other vulnerable banks.^{11} We therefore define the probability-generating function for the joint degree distribution of a vulnerable bank as
2.5
The generating function contains all the same information that is contained in the degree distribution, *p*_{jk}, and the vulnerability distribution, *υ*_{j}, but in a form that allows us to work with sums of independent draws from different probability distributions. Specifically, for our purposes, it generates all the moments of the degree distribution of only those banks that are vulnerable.^{12}

Since every interbank asset of one bank is an interbank liability of another, every outgoing link for one node is an incoming link for another node. This means that the average in-degree in the network, , must equal the average out-degree, . We refer to this quantity as the *average degree* and denote it by
2.6

From , we can define a single-argument generating function, *G*_{0}(*y*), for the number of links leaving a randomly chosen vulnerable bank. This is given by
2.7
Note that
2.8
so that *G*_{0}(1) yields the fraction of banks that are vulnerable.

We can also define a second single-argument generating function, *G*_{1}(*y*), for the number of links leaving a bank reached by following a randomly chosen incoming link. Because we are interested in the propagation of shocks from one bank to another, we require the degree distribution, *υ*_{j}⋅*r*_{jk}, of a vulnerable bank that is a random neighbour of our initially chosen bank.

At this point, it is important to note that this is not the same as the degree distribution of vulnerable banks on the network as a whole. This is because a bank with a higher in-degree has a greater number of links pointing towards it, meaning that there is a higher chance that any given outgoing link will terminate at it, in precise proportion to its in-degree. Therefore, the larger the in-degree of a bank, the more likely it is to be a neighbour of our initially chosen bank, with the probability of choosing it being proportional to *jp*_{jk}.^{13} The generating function for the number of links leaving a vulnerable neighbour of a randomly chosen vulnerable bank is thus given by
2.9

Now suppose that we follow a randomly chosen outgoing link from a vulnerable bank to its end and then to every other vulnerable bank reachable from that end. We refer to this set of banks as the (outgoing) *vulnerable cluster* at the end of a randomly chosen outgoing link from a vulnerable bank. Because it captures links between vulnerable banks, the size and distribution of the vulnerable cluster characterize how default spreads across the financial network following an initial failure.

As figure 2 illustrates, each vulnerable cluster (represented by a square in the figure) can take many different forms (see also Newman 2003). We can follow a randomly chosen outgoing link and find a single bank at its end with no further outgoing connections emanating from it. This bank may be safe (*s*) or vulnerable (*v*). Or we may find a vulnerable bank with one, two or more links emanating from it to further clusters. At this point, we assume that the links emanating from the defaulting node are tree-like and contain no cycles or closed loops. This is solely to make an exact solution possible: the thrust of the argument goes through without this restriction and we do not apply it when conducting our numerical simulations in §3.

Let *H*_{1}(*y*) be the generating function for the probability of reaching an outgoing vulnerable cluster of given size (in terms of numbers of vulnerable banks) by following a random outgoing link from a vulnerable bank. As shown in figure 2, the total probability of all possible forms can be represented self-consistently as the sum of probabilities of hitting a safe bank, hitting only a single vulnerable bank, hitting a single vulnerable bank connected to one other cluster, two other clusters and so on. Each cluster that may be arrived at is independent. Therefore, *H*_{1}(*y*) satisfies the following self-consistency condition:
2.10
where the leading factor of *y* accounts for the one vertex at the end of the initial edge and we have used the fact that if a generating function generates the probability distribution of some property of an object, then the sum of that property over *m* independent such objects is distributed according to the *m*th power of the generating function. By using equation (2.9) and noting that *G*_{1}(1) represents the probability that a random neighbour of a vulnerable bank is vulnerable, we may write equation (2.10) in implicit form as
2.11

It remains to establish the distribution of outgoing vulnerable cluster sizes to which a randomly chosen bank belongs. There are two possibilities that can arise. First, a randomly chosen bank may be safe. Second, it may have in-degree *j* and out-degree *k*, and be vulnerable, the probability of which is *υ*_{j}⋅*p*_{jk}. In this second case, each outgoing link leads to a vulnerable cluster whose size is drawn from the distribution generated by *H*_{1}(*y*). So, the size of the vulnerable cluster to which a randomly chosen bank belongs is generated by
2.12
And, in principle, we can calculate the complete distribution of vulnerable cluster sizes by solving equation (2.11) for *H*_{1}(*y*) and substituting the result into equation (2.12).

### (c) Phase transitions

Although it is not usually possible to find a closed-form expression for the complete distribution of cluster sizes in a network, we can obtain closed form expressions for the moments of its distribution from equations (2.11) and (2.12). In particular, the average vulnerable cluster size, is given by 2.13

Noting that *H*_{1}(*y*) is a standard generating function so that *H*_{1}(1)=1, it follows from equation (2.12) that
2.14
And we know from equation (2.11) that
2.15
So, substituting equation (2.15) into (2.14) yields
2.16

From equation (2.16), it is apparent that the points that mark the *phase transitions* at which the average vulnerable cluster size diverges are given by
2.17
or, equivalently, by
2.18
where we have used equations (2.6) and (2.9).

The term is the average out-degree of a vulnerable first neighbour, counting only those links that end up at another vulnerable bank. If this quantity is less than 1, all vulnerable clusters are small and contagion dies out quickly since the number of vulnerable banks reached declines. But if is greater than 1, a ‘giant’ vulnerable cluster—a vulnerable cluster whose size scales linearly with the size of the whole network—exists and occupies a finite fraction of the network. In this case, system-wide contagion is possible: with positive probability, a random initial default at one bank can lead to the spread of default across the entire vulnerable portion of the financial network.

As the average degree, *z*, increases, typical in- and out-degrees increase, so that more of the mass of *p*_{jk} is at higher values for *j* and *k*. This increases the left-hand side of equation (2.18) monotonically through the *j*⋅*k* term but reduces it through the *v*_{j} term as *v*_{j} is lower for higher *j* from equation (2.4). So, equations (2.17) and (2.18) will either have two solutions or none at all. In the first case, there are two phase transitions and a continuous window of (intermediate) values of *z* for which contagion is possible. For values of *z* that lie outside the window and below the lower phase transition, the term is too small and the network is insufficiently connected for contagion to spread (consider what would happen in a network with no links); for values of *z* outside the window and above the upper phase transition, the *v*_{j} term is too small and contagion cannot spread because there are too many safe banks.

### (d) The probability and spread of contagion

From a system stability perspective, we are primarily interested in contagion within the giant vulnerable cluster. This only emerges for intermediate values of *z*, and only when the initially defaulting bank is either in the giant vulnerable cluster or directly adjacent to it. The likelihood of contagion is, therefore, directly linked to the size of the vulnerable cluster within the window.^{14} Intuitively, near both the lower and upper phase transitions, the probability of contagion must be close to zero since the size of the vulnerable cluster is either curtailed by limited connectivity or by the presence of a high fraction of safe banks. The probability of contagion is thus non-monotonic in *z*: initially, the risk-spreading effects stemming from a more connected system will increase the size of the vulnerable cluster and the probability of contagion; eventually, however, risk-sharing effects that serve to reduce the number of vulnerable banks dominate, and the probability of contagion falls.^{15}

At the minimum, the *conditional* spread of contagion (i.e. conditional on contagion breaking out) must correspond to the size of the giant vulnerable cluster. But once contagion has spread through the entire vulnerable cluster, the assumption that banks are adjacent to no more than one failed bank breaks down. So, ‘safe’ banks may be susceptible to default and contagion can spread well beyond the vulnerable cluster to affect the entire connected component of the network. Near the lower phase transition, *z* is sufficiently low that nearly all banks are likely to be vulnerable. Therefore, in this region, the size of the giant vulnerable cluster corresponds closely to the size of the connected component of the network, meaning that the fraction of the network affected by episodes of contagion is roughly similar to the probability that contagion breaks out. But these quantities diverge as *z* increases, and, near the upper phase transition, the system will exhibit a robust-yet-fragile tendency, with episodes of contagion occurring rarely, but spreading very widely when they do take place.

From equation (2.18), the size of the contagion window is larger if, for a given *j*, the probability that a bank is vulnerable, *v*_{j}, is larger. Greater levels of vulnerability also increase the size of the giant vulnerable cluster and, hence, the probability of contagion within the range of intermediate *z* values. Therefore, it is clear from equation (2.4) that an adverse shock that erodes capital buffers will both increase the probability of contagion and extend the range of *z* for which contagious outbreaks are possible.

### (e) Relaxing the diversification assumptions

In our presentation of the model, we assumed that the total interbank asset position of each bank was independent of the number of incoming links to that bank and that these assets were evenly distributed over each link. In reality, we might expect a bank with a higher number of incoming links to have a larger total interbank asset position. Intuitively, this would curtail the risk-sharing benefits of greater connectivity because the greater absolute exposure associated with a higher number of links would (partially) offset the positive effects from greater diversification. But, as long as the total interbank asset position increases less than proportionately with the number of links, all of our main results continue to apply. In particular, *v*_{j} will still decrease in *z*, though at a slower rate. As a result, equation (2.18) will continue to generate two solutions, though in an extended range of cases. The contagion window will thus be wider. On the other hand, if the total interbank asset position increases more than proportionately with the number of links, *v*_{j} will increase in *z* and greater connectivity will unambiguously increase contagion risk. This latter case does not seem a particularly plausible description of reality.

Assuming an uneven distribution of interbank assets over incoming links would not change any of our fundamental results. In particular, *v*_{j} would still decrease in *z*, maintaining the possibility of two solutions to equation (2.18). But an uneven distribution of exposures would make banks vulnerable to the default of particular counterparties for higher values of *z* than would otherwise be the case. As a result, the contagion window will be wider.

## 3. Numerical simulations

### (a) Methodology

To illustrate our results, we calibrate the model and simulate it numerically. Although the findings apply to random graphs with arbitrary degree distributions, we assume a uniform (Poisson) random graph in which each possible directed link in the graph is present with independent probability *p*. In other words, the network is constructed by looping over all possible directed links and choosing each one to be present with probability *p*—note that this algorithm does not preclude the possibility of cycles in the generated network and thus encompasses all of the structures considered by Allen & Gale (2000). The Poisson random graph was chosen for simplicity given the primary focus of this section in empirically confirming our theoretical results; conducting the simulation analysis under different joint degree distributions would be a useful extension but is left for future work.

Consistent with bankruptcy law, we do not net interbank positions, so it is possible for two banks to be linked with each other in both directions. The average degree, *z*, is allowed to vary in each simulation. And although our model applies to networks of fully heterogeneous financial intermediaries, we take the capital buffers and asset positions on banks’ balance sheets to be identical.^{16}

As a benchmark, we consider a network of 1000 banks. Clearly, the number of financial intermediaries in a system depends on how the system is defined and what counts as a financial intermediary. But several countries have banking networks of this size, and a figure of 1000 intermediaries also seems reasonable if we are considering a global financial system involving investment banks, hedge funds and other players.

The initial assets of each bank are chosen so that they comprise 80 per cent external (non-bank) assets and 20 per cent interbank assets—the 20 per cent share of interbank assets is broadly consistent with the figures for developed countries reported by Upper (2007). Banks’ capital buffers are set at 4 per cent of total (non-risk-weighted) assets, a figure calibrated from data contained in the 2005 published accounts of a range of large, international financial institutions. Since each bank’s interbank assets are evenly distributed over its incoming links, interbank liabilities are determined endogenously within the network structure. And the liability side of the balance sheet is ‘topped up’ by customer deposits until the total liability position equals the total asset position.

In the experiments that follow, we draw 1000 realizations of the network for each value of *z*. In each of these draws, we shock one bank at random, wiping out all of its external assets—this type of idiosyncratic shock may be interpreted as a fraud shock. The failed bank defaults on all of its interbank liabilities. As a result, neighbouring banks may also default if their capital buffer is insufficient to cover their loss on interbank assets. Any neighbouring banks that fail are also assumed to default on all of their interbank liabilities, and the iterative process continues until no new banks are pushed into default.

Since we are only interested in the likelihood and conditional spread of system-wide contagion, we wish to exclude very small outbreaks of default outside the giant vulnerable cluster from our analysis. So, when calculating the probability and conditional spread of contagion, we only count episodes in which over 5 per cent of the system defaults. As well as being analytically consistent on the basis of numerical simulations, a 5 per cent failure rate seems a suitable lower bound for defining a systemic financial crisis.

### (b) Results

Figure 3 summarizes the benchmark case. In this and all subsequent diagrams, the extent of contagion measures the fraction of banks that default, *conditional* on contagion over the 5 per cent threshold breaking out.

The benchmark simulation confirms the results and intuition of §2*c*,*d*. Contagion only occurs within a certain window of *z*. Within this range, the probability of contagion is non-monotonic in connectivity, peaking at approximately 0.8 when *z* is between 3 and 4. As noted above, the conditional spread of contagion as a fraction of network size is approximately the same as the frequency of contagion near the lower phase transition—in this region, contagion breaks out when any bank in, or adjacent to, the giant vulnerable cluster is shocked and spreads across the entire cluster, which roughly corresponds to the entire connected component of the network.

For higher values of *z*, however, a large proportion of banks in the network fail when contagion breaks out. Of particular interest are the points near the upper phase transition: when *z*>8, contagion never occurs more than five times in 1000 draws; but in each case where it does break out, every bank in the network fails. This highlights that *a priori* indistinguishable shocks to the network can have vastly different consequences for contagion.

In figure 4, we compare our benchmark results with the limiting case, since our analytical results only strictly apply in the limit as . Watts (2002) notes that numerical results in random graph models approximate analytical solutions in the vicinity of *n*=10 000. Figure 4 demonstrates that a smaller number of nodes in the benchmark simulation does not fundamentally affect the results: the contagion window is widened slightly, but the qualitative results of the analytical model remain intact.

Figure 5 considers the effects of varying banks’ capital buffers. As expected, an erosion of capital buffers both widens the contagion window and increases the probability of contagion for fixed values of *z*.^{17} For small values of *z*, the extent of contagion is also slightly greater when capital buffers are lower but, in all cases, it reaches one for sufficiently high values of *z*. When the capital buffer is increased to 5 per cent, however, this occurs well after the peak probability of contagion. This neatly illustrates how increased connectivity can simultaneously reduce the probability of contagion but increase its spread conditional on it breaking out.

Figure 6 illustrates how changes in the average degree and capital buffers jointly affect the *expected* number of defaults in the system. Since this diagram does not isolate the probability of contagion from its potential spread, rare but high-impact events appear in the benign (flat) region as the expected number of defaults in these cases is low. Figure 6 serves to highlight another nonlinear feature of the system: when capital buffers are eroded to critical levels, the level of contagion risk can increase extremely rapidly.

Finally, in figure 7, we relax the zero recovery assumption. Instead, we assume that, when a bank fails, its default in the interbank market equals its asset shortfall (i.e. its outstanding loss after its capital buffer is absorbed) plus half of any remaining interbank liabilities, where the additional amount is interpreted as reflecting bankruptcy costs that are lost outside the system.^{18} As we might expect, this reduces the likelihood of contagion because fewer banks are vulnerable when the recovery rate can be positive. But it is also evident that relaxing the zero recovery assumption does not fundamentally affect our broad results.

### (c) Interpretation and discussion

Contagious crises occur infrequently in developed countries, suggesting that financial systems are located near to the upper phase transition of our model. The findings of Soramaki *et al.* (2007), who report average degrees in financial systems of 15, are consistent with this. But recent events have demonstrated that financial systems are prone to occasional system-wide breakdown, with policymakers intervening to limit the extent of contagion.

Our framework implies that financial systems exhibit a robust-yet-fragile tendency. Although the likelihood of contagion may be low, its impact can be extremely widespread. Moreover, even if contagion from idiosyncratic shocks never occurs when banks have relatively high capital buffers, figure 5 highlights that if an adverse aggregate shock, such as the macroeconomic downturn we are currently experiencing, erodes capital buffers, the system could be susceptible to contagion risk.

*A priori* indistinguishable shocks also have vastly different consequences in our model. Although the system may be robust to most shocks of a given size, if it is hit by a similarly sized shock at a particular pressure point, possibly reflecting a structural weakness, the ensuing financial instability could be significant. This result cautions against assuming that the resilience of a financial system to large shocks at some point in the past will continue to apply to future shocks of a similar magnitude.

## 4. Liquidity risk

We now incorporate liquidity effects into our analysis. When a bank fails, financial markets may have a limited capacity to absorb the illiquid external assets that are sold. As a result, the asset price may be depressed. Following Schnabel & Shin (2004) and Cifuentes *et al.* (2005), suppose that the price of the illiquid asset, *q*, is given by
4.1
where *x*>0 is the fraction of system (illiquid) assets that have been sold in the market (if assets are not being sold in the market, *q*=1). We calibrate *α* so that the asset price falls by 10 per cent when one-tenth of system assets have been sold.

We integrate this pricing equation into our numerical simulations. Specifically, when a bank defaults, all of its external assets are sold in the market, reducing the asset price according to equation (4.1). We assume that, when the asset price falls, the external assets of all other banks are marked-to-market to reflect the new asset price. From equation (2.4), it is clear that this will reduce banks’ capital buffers and has the potential to make some banks vulnerable, possibly ultimately tipping them into default.

The incorporation of (market) liquidity risk introduces a second potential source of contagion into the model from the asset side of banks’ balance sheets. Note, however, that this liquidity risk only materializes upon default. Realistically, asset prices are likely to be depressed by asset sales before any bank defaults. So, accounting only for the post-default impact probably understates the true effects of liquidity risk.

Figure 8 illustrates the effects of incorporating liquidity risk into the model. As we might expect, liquidity effects magnify the extent of contagion when it breaks out. The contagion window also widens.

As shown, liquidity effects do not drastically alter the main results of our model. But this should not be taken to mean that liquidity effects are unimportant. In part, the limited effect of liquidity risk reflects the already high spread of contagion embedded in the benchmark scenario. As demonstrated by May & Arinaminpathy (2010) in a similar set-up, liquidity effects can be more material if recovery rates upon interbank default are relatively high. And, to the extent that liquidity risk materializes before any bank defaults, it can be viewed as having the potential to erode capital buffers and increase the likelihood of an initial default.

## 5. Relationship with the empirical literature

There is a large empirical literature that uses counterfactual simulations to assess the danger of contagion in a range of national banking systems (see Upper (2007) for a comprehensive survey). This literature has largely tended to use actual or estimated data on interbank lending to simulate the effects of the failure of an individual bank on financial stability.^{19} The evidence of contagion risk from idiosyncratic shocks is mixed. Furfine (2003) and Wells (2004) report relatively limited scope for contagion in the US and UK banking systems. By contrast, Upper & Worms (2004) and van Lelyveld & Liedorp (2006) suggest that contagion risk may be somewhat higher in Germany and The Netherlands. Meanwhile, Mistrulli’s (2007) results for the Italian banking system echo the findings of this paper: he finds that, while only a relatively low fraction of banks can trigger contagion, large parts of the system are affected in worst-case scenarios. Moreover, he shows that, when moving from an analysis of actual bilateral exposures (which form an incomplete network) to a complete structure estimated using maximum entropy techniques, the probability of contagion from a random, idiosyncratic bank failure is reduced but its spread is sometimes widened.

Contagion owing to aggregate shocks is examined by Elsinger *et al.* (2006), who combine a model of interbank lending in the Austrian banking system with models of market and credit risk. They take draws from a distribution of risk factors and compute the effects on banks’ solvency, calculating the probability and the severity of contagion. Their findings also echo the results reported in our paper. While contagious failures are relatively rare, if contagion does occur, it affects a large part of the banking system.

Counterfactual simulations have also been used to assess how changes in the structure of interbank loan markets affect the risk of contagion. But these results do not show a clear relationship. Mistrulli (2005) and Degryse & Nguyen (2007) consider how contagion risk has evolved in Italy and Belgium as their banking structures have shifted away from a comparatively complete graph structure towards one with multiple money-centre banks. Their findings suggest that, while this shift appears to have reduced contagion risk in Belgium, the possibility of contagion risk in Italy appears to have increased.

As noted by Upper (2007), existing empirical studies are plagued by data problems, and the extent to which reported interbank exposures reflect true linkages is unclear: generally, interbank exposures are reported only on a particular day once a quarter and exclude a range of items, including intraday exposures. As such, they underestimate the true scale of financial connectivity. Moreover, national supervisory authorities do not generally receive information on the exposures of foreign banks to domestic institutions, making it difficult to model the risk of global contagion in the increasingly international financial system. And studies attempting to analyse the effects of changes in network structure on contagion risk are constrained by short time series for the relevant data series.

## 6. Conclusion

In this paper, we develop a model of contagion in arbitrary financial networks that speaks to concerns about the widespread transmission of shocks in an era of rapid financial globalization and in the wake of a major systemic financial crisis. Our model applies broadly to systems of agents linked together by their financial claims on each other, including through interbank markets and payment systems. While high connectivity may reduce the probability of contagion, it can also increase its spread when problems occur. Adverse aggregate shocks and liquidity risk also amplify the likelihood and extent of contagion.

Our results suggest that financial systems may exhibit a robust-yet-fragile tendency. They also highlight how *a priori* indistinguishable shocks can have vastly different consequences, which helps explain why the evidence of the resilience of the system to fairly large shocks prior to 2007 was not a reliable guide to its future robustness.

The approach provides a first step towards modelling contagion risk when true linkages are unknown. It would be useful to extend the simulation analysis by relaxing the assumption that the defaulting bank is randomly selected and, along the lines of Albert *et al.* (2000), considering the implications of targeted failure affecting big or highly connected interbank borrowers. This would be particularly interesting in a set-up in which the joint degree distribution was calibrated to match observed data. Added realism could also be incorporated into the model by using real balance sheets for each bank or endogenizing the formation of the network. Extending the model in this direction could help guide the empirical modelling of contagion risk and is left for future work.

## Acknowledgements

This paper represents the views of the authors and should not be thought to represent those of the Bank of England or Monetary Policy Committee members. We thank Emma Mattingley, Nick Moore, Barry Willis and, particularly, Jason Dowson for excellent research assistance. We are also grateful to Kartik Anand, Fabio Castiglionesi, Geoff Coppins, Avinash Dixit, John Driffill, Sanjeev Goyal, Andy Haldane, Simon Hall, Matteo Marsili, Robert May, Marcus Miller, Emma Murphy, Filipa Sa, Nancy Stokey, Merxe Tudela, Jing Yang, three anonymous referees and seminar participants at the Bank of England, the University of Oxford, the University of Warwick research workshop and conference on ‘World Economy and Global Finance’ (Warwick, 11–15 July 2007), the UniCredit Group Conference on ‘Banking and Finance: Span and Scope of Banks, Stability and Regulation’ (Naples, 17–18 December 2007), the 2008 Royal Economic Society Annual Conference (Warwick, 17–19 March 2008) and the 2008 Southern Workshop in Macroeconomics (Auckland, 28–30 March 2008) for helpful comments and suggestions.

## Footnotes

↵1 See Rajan (2005) for a policymaker’s view of the recent trends in financial development and Haldane (2009) for a discussion of the role that the structure and complexities of the financial network have played in the financial turmoil of 2007–2009.

↵2 Other strands of the literature on financial contagion have focused on the role of liquidity constraints (Kodres & Pritsker 2002), information asymmetries (Calvo & Mendoza 2000) and wealth constraints (Kyle & Xiong 2001). As such, their focus is less on the nexus between network structure and financial stability. Network perspectives have also been applied to other topics in finance: for a comprehensive survey of the use of network models in finance, see Allen & Babus (2009).

↵3 These papers assume that shocks are unexpected—an approach we follow in our analysis. Brusco & Castiglionesi (2007) model contagion in financial systems in an environment where contracts are written contingent on the realization of the liquidity shock. As in Allen & Gale (2000), they construct a simple network structure of four banks. They suggest, however, that greater connectivity could serve to enhance contagion risk. This is because the greater insurance provided by additional financial links may be associated with banks making more imprudent investments. And, with more links, if a bank’s gamble does not pay off, its failure has wider ramifications.

↵4 See Bank of England (2007).

↵5 Eisenberg & Noe (2001) demonstrate that, following an initial default in such a system, a unique vector that clears the obligations of all parties exists. However, they do not analyse the effects of network structure on the dynamics of contagion.

↵6 Nier

*et al.*(2007) also simulate the effects of unexpected shocks in financial networks, though they do not distinguish the probability of contagion from its potential spread and their results are strictly numerical—they do not consider the underlying analytics of the complex (random graph) network that they use. Recent work by May & Arinaminpathy (2010) uses analytic mean-field approximations to offer a more complete explanation of their findings and also contrasts their results with those presented in this paper.↵7 See Leitner (2005), Gale & Kariv (2007), Castiglionesi & Navarro (2007) and the survey by Allen & Babus (2009) for discussion of these topics. Leitner (2005) suggests that linkages that create the threat of contagion may be optimal. The threat of contagion and the impossibility of formal commitments mean that networks develop as an

*ex ante*optimal form of insurance, as agents are willing to bail each other out in order to prevent the collapse of the entire system. Gale & Kariv (2007) study the process of exchange on financial networks and show that, when networks are incomplete, substantial costs of intermediation can arise and lead to uncertainty of trade as well as market breakdowns.↵8 A regulatory requirement for banks to maintain capital above a certain level at all times could easily be incorporated into the model by rewriting the solvency condition to require that exceeds a positive constant. This would not fundamentally alter the analysis.

↵9 This assumption is likely to be realistic in the midst of a crisis: in the immediate aftermath of a default, the recovery rate and the timing of recovery will be highly uncertain and banks’ funders are likely to assume the worst-case scenario. Nevertheless, in our numerical simulations, we show that our results are robust to relaxing this assumption.

↵10 Formally, this capital buffer is taken to be a random variable—the underlying source of its variability may be viewed as being generated by variability in

*D*_{i}, drawn from its appropriate distribution. For notational simplicity, we do not explicitly denote this dependence of*K*_{i}on*D*_{i}in the subsequent expressions.↵11 If the number of nodes,

*n*, is sufficiently large, banks are highly unlikely to be exposed to more than one failed bank after the first round of contagion, meaning that safe banks will never fail in the second round. This assumption clearly breaks down either when*n*is small or when contagion spreads more widely. However, the logic of this section still holds in both cases: in the former, the exact solutions derived for large*n*will only approximate reality (this is confirmed by the numerical results in §3); in the latter, the exact solutions will apply but the extent of contagion will be affected, as discussed further in §2*d*.↵12 For a description of the key properties of probability-generating functions, including those that are used in this paper, see Grimmett & Welsh (1986); for a more advanced treatment, see Wilf (1994).

↵13 This point is discussed in more detail in the context of undirected graphs by Feld (1991), Newman

*et al.*(2001) and Newman (2003).↵14 Note that this is not given by equation (2.16) since this equation is derived on the assumption that there are no cycles connecting subclusters. This will not hold in the giant vulnerable cluster.

↵15 In the special case of a uniform (Poisson) random graph in which each possible link is present with independent probability

*p*, an analytical solution for the size of the giant vulnerable cluster can be obtained using techniques discussed in Watts (2002) and Newman (2003). Since this does not account for the possibility of contagion being triggered by nodes directly adjacent to the vulnerable cluster, it does not represent an analytical solution for the probability of contagion. However, it highlights that the size of the giant vulnerable cluster, and hence the probability of contagion, is non-monotonic in*z*.↵16 With heterogeneous banks, the critical ratio, which determines vulnerability in equation (2.4), would vary across banks. In his undirected framework, Watts (2002) shows that, when thresholds such as this are allowed to vary, the qualitative theoretical results continue to apply but the contagion window is wider. Intuitively, with heterogeneity, some banks remain vulnerable even when relatively well connected because they have low capital buffers relative to their interbank asset position. Therefore, incorporating bank heterogeneity into our numerical simulations would simply widen the contagion window. See also Iori

*et al.*(2006) for a discussion of how bank heterogeneity may increase contagion risk.↵17 Reduced capital buffers may also increase the likelihood of an initial default. Therefore, they may contribute to an increased probability of contagion from this perspective as well.

↵18 Since interbank assets make up 20 per cent of each bank’s total asset position, interbank liabilities must, on average, make up 20 per cent of total liabilities. Therefore, for the average bank, if we take (insured) customer deposits as senior, the maximum bankruptcy cost under this assumption is 10 per cent of total assets/liabilities, which accords with the empirical estimates of bankruptcy costs in the banking sector reported by James (1991).

↵19 A parallel literature explores contagion risk in payment systems (see Angelini

*et al.*1996).- Received August 5, 2009.
- Accepted February 9, 2010.

- © 2010 The Royal Society