The Internal Capital Adequacy Assessment Process requires banks to assess their own capital needs. It is a fundamental part of the prudential framework. Banks must demonstrate they understand their risks and hold sufficient capital to cover them. This is not a regulatory exercise to be delegated to the compliance function and forgotten. It is how the board knows the bank is adequately capitalised.
What is the ICAAP?
The ICAAP is a documented process through which a bank assesses whether its capital resources are adequate for its risk profile and business model. It goes beyond regulatory minimums. Regulatory requirements set floors that apply to all banks regardless of their specific circumstances. The bank must form its own view of what capital it actually needs to run its business prudently given its particular risks.
This is not a one-off exercise. Banks must maintain their ICAAP continuously. The PRA expects firms to update the documentation at least annually or more frequently if circumstances change materially. A significant acquisition, a new business line, entry into new markets, or a material change in risk profile would all warrant an update. The ICAAP should always reflect current reality not historical assessments.
The management body bears responsibility for the ICAAP. The board must approve it and use it in decision-making. This is not a compliance exercise delegated to a risk function and ticked off a checklist. It should inform strategic choices about capital allocation, business planning, risk appetite, and dividend policy. A board that does not understand the ICAAP cannot discharge its responsibilities properly.
What must it cover?
The ICAAP must address all material risks the bank faces. Some are captured in Pillar 1. Credit risk, market risk, operational risk. The ICAAP should assess whether Pillar 1 capital is adequate for these risks or whether additional capital is needed. Standardised risk weights may not reflect actual portfolio quality. Internal models may not capture tail risks adequately.
Other risks fall outside Pillar 1 entirely. Interest rate risk in the banking book addresses how changes in rates affect the value of assets and liabilities differently. A fixed-rate mortgage book loses value when rates rise. The ICAAP must quantify this and assess what capital is needed.
Credit concentration risk recognises that having too much exposure to particular sectors, geographies, or counterparties creates risk beyond what diversified assumptions capture. A bank with heavy commercial property exposure faces concentration risk even if each individual loan looks sound.
Pension obligation risk captures the possibility that defined benefit schemes require contributions that strain the bank. Business model risk addresses threats to how the bank makes money. Strategic risk covers whether the strategy itself is viable. Reputational risk considers how damage to the bank’s standing could affect its business. All material risks require assessment.
The process must include stress testing. Banks should model how their capital position would evolve under adverse scenarios. What happens if the economy enters recession? What if a key market collapses? What if several risks crystallise simultaneously? Capital planning must account for these possibilities. The ICAAP should show that capital remains adequate through plausible stress.
Reverse stress testing is also required. Rather than testing whether the bank survives a given scenario, this starts from failure and works backwards. What combination of events would cause the bank to become unviable? Understanding this helps identify vulnerabilities that might otherwise be missed.
How the PRA uses it
The PRA reviews each firm’s ICAAP as part of the Supervisory Review and Evaluation Process. Supervisors assess whether the firm has identified all material risks, whether its methodologies are sound, and whether its capital assessment is adequate. A weak ICAAP suggests weak risk management and attracts closer supervisory attention.
This review informs Pillar 2A requirements. Where the PRA considers the firm has underestimated its risks or capital needs, it may set a higher requirement. The ICAAP is the starting point for a dialogue about capital adequacy. Firms that produce thorough and credible ICAAPs typically receive more predictable supervisory outcomes.
UK and EU approaches
Both jurisdictions require similar processes. The EU framework established under CRD requires credit institutions to assess internal capital. The ECB has published detailed expectations for ICAAP submissions by significant institutions. These are comprehensive and demanding.
The PRA sets expectations through SS31/15 which is being updated as part of Basel 3.1 implementation. The core principles remain consistent. Banks must understand their risks and hold capital to cover them. Good ICAAPs reflect genuine risk understanding.
