What banks need to know about ICAAP?

Sataporn Ungcharoenwong

09.07.2026

ICAAP, or the Internal Capital Adequacy Assessment Process, requires banks to assess whether they hold enough capital to cover all the risks they face, including those not fully captured by standard regulatory calculations. It is a core supervisory expectation under the Basel framework, applying to all banks subject to Pillar 2 oversight. The sections below walk through what ICAAP involves, how it connects to Basel IV and CRR3, and how banks can make the process more manageable.

What does ICAAP actually require banks to do?

ICAAP requires banks to identify, measure, and document all material risks to their business, then demonstrate that their internal capital is adequate to absorb those risks under both normal and stressed conditions. It goes beyond the minimum regulatory capital requirements by asking banks to form their own view of how much capital they actually need. Regulators review this self-assessment as part of the Supervisory Review and Evaluation Process (SREP).

In practical terms, this means banks need to produce a forward-looking assessment that covers their risk profile, capital planning horizon, stress scenarios, and governance over the process itself. The output is typically a written ICAAP document submitted to the relevant supervisor, but the real value lies in the internal discipline it creates.

The assessment should be proportionate to the bank’s size, complexity, and risk profile. A large, internationally active bank will run a far more granular ICAAP than a smaller domestic institution, but both are expected to show genuine internal engagement with the question: do we have enough capital, and how do we know?

How does ICAAP fit into the Basel framework?

ICAAP sits within Pillar 2 of the Basel framework, which is the supervisory review pillar. While Pillar 1 sets standardized minimum capital requirements for credit, market, and operational risk, Pillar 2 acknowledges that those minimums do not capture every risk a bank faces. ICAAP is the mechanism through which banks fill that gap with their own internal analysis.

Under Basel IV and the EU’s CRR3 implementation, the Pillar 1 calculations have become more comprehensive, but Pillar 2 remains just as relevant. Regulators still expect banks to look beyond standardized formulas and assess risks such as interest rate risk in the banking book (IRRBB), concentration risk, pension risk, and business model risk, none of which are fully addressed by Pillar 1 alone.

ICAAP works alongside ILAAP, the Internal Liquidity Adequacy Assessment Process, which applies the same logic to liquidity rather than capital. Together, they form the decision-support layer of a bank’s overall risk and capital management framework. Supervisors use both documents to challenge whether a bank’s own view of its risks is realistic and well-supported.

What risks must be covered in an ICAAP?

An ICAAP must cover all material risks the bank is exposed to, not just those included in Pillar 1 calculations. This typically includes credit risk, operational risk, IRRBB, concentration risk, liquidity risk, strategic risk, reputational risk, and any other risks that could have a meaningful impact on the bank’s capital position.

The starting point is a risk identification exercise where the bank maps out every risk category relevant to its business model. From there, each material risk needs to be measured or estimated, and the bank must explain its methodology for doing so. Where quantification is not straightforward, qualitative assessments with clear reasoning are expected.

A few risk types deserve particular attention in the current environment:

IRRBB: With interest rate volatility in recent years, regulators have sharpened their focus on how banks model the impact of rate changes on their banking book earnings and economic value.
Concentration risk: Single-name, sector, or geographic concentrations that Pillar 1 credit risk models may understate need to be explicitly addressed.
Climate and ESG-related risks: Increasingly, supervisors expect banks to consider how physical and transition risks affect their capital adequacy over the planning horizon.

The key principle is completeness. If a risk is material to your business, it belongs in the ICAAP, regardless of whether it fits neatly into a regulatory formula.

How do stress tests factor into the ICAAP process?

Stress testing is central to a credible ICAAP. Banks are expected to run stress scenarios that challenge their capital position under adverse but plausible conditions, demonstrating that they remain adequately capitalized even when things go wrong. The ICAAP stress test is not a pass/fail exercise but a tool for understanding vulnerabilities and informing capital planning decisions.

A well-constructed ICAAP stress test framework typically includes a baseline scenario reflecting the bank’s central economic outlook and at least one or two adverse scenarios that reflect meaningful downturns. These scenarios should be tailored to the bank’s specific risk profile rather than copied from a generic template.

What makes stress testing genuinely useful in the ICAAP context is the ability to model interdependencies across risk types. A macroeconomic downturn scenario, for example, will simultaneously affect credit risk through rising defaults, IRRBB through rate movements, and liquidity through deposit outflows. Capturing those interactions, rather than running each risk in isolation, produces a much more realistic picture of capital adequacy under stress.

Dynamic balance sheet modeling is another important element. Static stress tests assume the bank’s balance sheet stays the same throughout the scenario, which is rarely realistic. A dynamic approach models how management actions, new business volumes, and portfolio runoff change the exposure profile over the stress horizon.

What are the most common ICAAP challenges for banks?

The most common ICAAP challenges are data fragmentation, over-reliance on manual processes, and difficulty connecting stress test outputs to real capital planning decisions. Many banks also struggle to produce a consistent narrative that links their risk assessment to their capital strategy in a way that satisfies supervisors.

Here are the challenges that come up most frequently in practice:

Basel

Pre-configured Basel models, out-of-the-box regulatory scenarios, and liquidity metrics.

Ready in weeks, not months.

Book a Demo →

Siloed data and systems: Risk data sitting in separate systems for credit, liquidity, and market risk makes it hard to run integrated scenarios or produce a consolidated view of capital adequacy.
Slow calculation cycles: When stress test calculations take hours or days to run, banks cannot iterate quickly or explore multiple scenario variations. This limits the analytical depth of the ICAAP.
Model documentation gaps: Supervisors expect clear model governance, including documentation of assumptions, limitations, and validation outcomes. Gaps here are a frequent source of supervisory findings.
Disconnect between ICAAP and business decisions: The ICAAP should inform strategy and capital allocation, not just satisfy a regulatory filing requirement. When the process is treated purely as a compliance exercise, it loses its practical value.
Keeping up with regulatory change: Basel IV and CRR3 continue to reshape Pillar 1 calculations, which in turn affects how banks calibrate their Pillar 2 assessments. Staying current requires flexible systems that can adapt without lengthy IT projects.

How can banks streamline and improve their ICAAP?

Banks can streamline their ICAAP by centralizing risk data, automating calculation workflows, and building a stress testing environment that allows rapid scenario iteration without requiring IT intervention for every change. The goal is to shift time and effort away from data wrangling and toward genuine risk analysis.

A few practical steps make a meaningful difference:

Consolidate your data foundation: A single, well-governed data layer that feeds all risk calculations eliminates the inconsistencies that slow down ICAAP production and create reconciliation headaches.
Invest in scenario modeling flexibility: Your stress testing environment should allow you to define macroeconomic scenarios, adjust behavioral assumptions, and run portfolio projections without waiting on IT. User-driven configuration is the difference between an ICAAP that informs decisions and one that just documents them.
Integrate across risk types: Running credit risk, IRRBB, and liquidity risk in the same environment makes interdependency modeling straightforward and produces more credible stressed capital estimates.
Build in model governance from the start: Traceability from source data through to final capital numbers, with clear documentation of model assumptions and a structured approval workflow, makes supervisory review much smoother.
Treat ICAAP as a live process, not an annual document: The most effective ICAAPs are updated regularly as the risk environment changes, not assembled in a rush before the submission deadline.

This is exactly where we come in. Our ICAAP and ILAAP solution is built as the decision-support layer of our Basel.NXT module, supporting macroeconomic scenario selection, dynamic balance sheet modeling, portfolio behavior modeling per scenario, and interdependency management across risk types. Everything runs in a single environment, so your teams spend less time reconciling data and more time understanding what the numbers actually mean for your capital position.

This content was generated with the help of AI and it may contain mistakes