ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The ICAAP is where a bank says, in its own words, how much capital it needs and why. Supervisors set minimums; the internal capital adequacy assessment process is the institution’s own answer, covering the risks the minimums do not, and it is read as evidence of whether management understands its own balance sheet.
This guide covers the six building blocks, how the ICAAP feeds supervisory review, what changed for the 2026 cycle in European banking supervision, and where these documents lose credibility.
It sits in Pillar 2 of the Basel framework: Pillar 1 sets minimum capital for credit, market and operational risk; Pillar 2 asks whether that is actually enough for your institution. In the EU the obligation is in Article 73 of the Capital Requirements Directive — institutions must have sound, effective and comprehensive strategies and processes to assess and maintain on an ongoing basis the amounts, types and distribution of internal capital they consider adequate to cover the nature and level of the risks to which they are or might be exposed.
Three words in that sentence do the work. Ongoing — it is a process, not an annual document. Types and distribution — quality and location of capital, not just quantity. Might be exposed — forward-looking, which is why stress testing sits inside it. Its liquidity twin, the ILAAP, answers the same question for funding.
| Block | What it has to establish |
|---|---|
| Governance | That the management body owns it, challenges it and uses it in decisions |
| Risk identification | A complete inventory, including risks outside Pillar 1 — concentration, interest rate risk in the banking book, business model, conduct, climate |
| Quantification | Internal capital per material risk, with the method, assumptions and their limits stated |
| Capital planning | A multi-year projection under baseline and adverse conditions, with management actions |
| Stress testing | Severe but plausible scenarios tied to the actual business model, plus reverse stress testing |
| Use and controls | Evidence it drives limits, pricing and strategy — and independent validation of the models |
European supervisory expectations ask institutions to run the assessment from two angles at once: a normative perspective, projecting compliance with regulatory ratios and requirements over the planning horizon, and an economic perspective, assessing whether internal capital covers economic risk irrespective of accounting or regulatory treatment. Both, not one. An ICAAP that only projects the regulatory ratio has answered the supervisor’s question rather than its own.
The document is a core input to the Supervisory Review and Evaluation Process, feeding the assessment of governance, risk management and capital adequacy. The ECB overhauled its framework for the 2026 SREP cycle, and one change matters here: the ICAAP is no longer used as the starting point for calibrating Pillar 2 requirements risk by risk.
It would be a serious misreading to conclude it matters less. The assessment of its soundness still bears materially on the SREP outcome through internal governance and risk management, which in turn shapes capital add-ons. What has changed is the mechanism, not the importance — a weak ICAAP now damages you through the governance score rather than through a direct calculation.
The risk inventory stops at Pillar 1. The whole point is the risks the minimums do not capture. An inventory with no concentration, banking-book interest rate or business model risk has skipped the exercise.
Stress scenarios that could not hurt you. Scenarios calibrated so the institution passes comfortably tell the supervisor how the scenarios were chosen. Reverse stress testing — what would it take to break us — is harder to fake and more useful.
Written by risk, unread by the board. The management body has to own it. Minutes showing genuine challenge are worth more than another hundred pages of methodology.
No link to decisions. If limits, pricing, product approval and the capital plan do not visibly reference it, the process is documentation. Our guide to risk appetite covers the join that makes the link real.
Assumptions without limitations. Every model has a range in which it works. Saying so is a sign of maturity; omitting it invites the supervisor to find the boundary for you.
What does ICAAP stand for?
Internal capital adequacy assessment process — the institution’s own assessment of how much capital it needs, why, and how it will stay adequate under stress.
Who has to run one?
Banks and investment firms subject to the capital requirements regime, with proportionality: a small domestic institution is expected to run a proportionate process, not the same one as a global bank.
How is it different from the ILAAP?
The ICAAP addresses capital adequacy; the ILAAP addresses liquidity and funding adequacy. They share governance, scenarios and much of the risk inventory, and supervisors read them together.
How often is it updated?
At least annually, with the process running continuously — material changes in strategy, risk profile or the environment should trigger a reassessment rather than waiting for the cycle.
Does a good ICAAP reduce our capital requirement?
Not mechanically, and less directly than it once did in European banking supervision. It influences the supervisory view of governance and risk management, which affects the overall outcome including add-ons.
Treat the ICAAP as the institution’s own argument rather than a supervisory submission. Build it on a risk inventory that genuinely goes beyond Pillar 1, quantify with stated assumptions and stated limits, run both the normative and economic perspectives, and stress it hard enough that something breaks. Then show it being used — in limits, in pricing, in the capital plan and in board challenge — because from the 2026 cycle onward that is the channel through which its quality reaches your capital requirement.
Capital assessment templates, stress testing frameworks and board reporting packs are in the Basel III Prudential Risk Toolkit, or start with the free ISO templates.
September 2, 2026
September 2, 2026
September 2, 2026
September 2, 2026
September 2, 2026