What Is ICAAP in Banking: Stress Testing and Supervisory Review

The Internal Capital Adequacy Assessment Process, or ICAAP, is the Pillar 2 requirement under the Basel framework that obliges each bank to evaluate its own capital needs against its actual risk profile, rather than relying only on the standardized minimums set by Pillar 1. The bank produces a bank-specific capital target, documents how it arrived at that figure, and submits the assessment to its supervisor, who scrutinizes it through the Supervisory Review and Evaluation Process (SREP).¹

The point is straightforward. Pillar 1 uses uniform formulas for credit, market, and operational risk. Those formulas cannot see what makes any given institution uniquely vulnerable. The ICAAP is where the bank confronts those gaps and demonstrates it holds enough capital to survive them.

Why the Standardized Minimums Aren’t Enough

Pillar 1 assumes a diversified portfolio and treats every bank through the same lens. Real balance sheets don’t cooperate. Concentration risk is the clearest case: a bank heavily exposed to a single industry or region faces losses that standardized credit-risk formulas understate. Interest rate risk in the banking book is another gap; when market rates shift, long-term assets and liabilities can move in opposite directions and produce losses that Pillar 1 ignores entirely. Reputational risk, strategic risk, and pension obligation risk sit inside the ICAAP’s scope as well.¹

Operational risk deserves a note. Pillar 1 does charge capital for it, but the standardized calculation often underestimates real exposure to conduct risk, cybersecurity vulnerabilities, and legal liability. The UK’s Prudential Regulation Authority, for instance, assesses conduct risk capital separately under Pillar 2A because standard operational risk approaches do not reflect the scale of recent conduct losses.²

The Two Perspectives Every ICAAP Must Cover

The European Central Bank expects every ICAAP to assess capital adequacy through two lenses, and the distinction sits at the heart of the framework.

The normative perspective asks whether the bank can meet all of its regulatory capital requirements on an ongoing basis over a multi-year horizon — typically at least three years. That includes Pillar 1 minimums, any Pillar 2 add-ons, and combined buffer requirements. The bank projects its capital ratios under a credible baseline scenario and under adverse scenarios that stress its specific vulnerabilities. If any requirement is breached in the projections, management has to explain the corrective action it would take.³

The economic perspective is different. It strips away accounting conventions and regulatory definitions and asks a more direct question: does the bank have enough internal capital to absorb the economic losses its actual risks could produce? Every material risk that could deplete capital in economic terms belongs in this assessment, whether or not regulatory ratios capture it. An unrealized loss that accounting rules permit the bank to ignore might still represent a real economic vulnerability.³

The two views inform each other. Unrealized losses identified economically can materialize and damage regulatory ratios. Skipping either perspective leaves blind spots that supervisors will find during SREP.

Stress Testing Provides the Quantitative Backbone

Both perspectives rely on stress testing. The bank simulates severe but plausible adverse events — a sharp rise in unemployment, a housing market collapse, a sudden widening of credit spreads — and traces the impact through its balance sheet to see what happens to capital ratios and economic capital.

Scenarios have to be tailored to the institution. A bank with heavy commercial real estate lending should stress property values and vacancy rates. A bank with significant trading activity should model extreme market dislocations. Generic, off-the-shelf scenarios don’t survive supervisory scrutiny.

Capital and liquidity assessments have to talk to each other. The ECB expects ICAAP and ILAAP stress tests to share assumptions, results, and management actions, because a scenario where credit losses erode capital will also affect funding costs and liquidity positions.³ Stress test findings then drive real decisions: raising fresh capital, retaining earnings, reducing risk exposures, or restricting dividends.

Proportionality

Not every bank needs the same level of sophistication. Under Article 73 of the Capital Requirements Directive, the ICAAP must be proportionate to the nature, scale, and complexity of the institution’s activities.⁴ A regional bank with straightforward lending can use simpler risk quantification than a globally active institution with complex trading books.

Proportionality is not a shortcut. The ECB assesses each ICAAP case by case and expects larger or more complex institutions to use more sophisticated methods, with independent validation scaled to the materiality of the risks and the complexity of the models.³ A superficial ICAAP defended on proportionality grounds will be rejected if the risk profile is more complex than the assessment reflects.

Who Owns the ICAAP Inside the Bank

The board of directors bears ultimate accountability. The board approves the capital plan and reviews it at least annually, sets the risk appetite, and integrates capital planning into strategic decisions. Under the Federal Reserve’s expectations, the board should receive capital adequacy briefings at least quarterly, covering macroeconomic conditions, current capital levels relative to forecasts, post-stress goals, and potential sources of emerging stress.⁵

Senior management designs and runs the process, makes analytically supported recommendations to the board, and monitors practices to identify limitations. For the largest U.S. firms subject to Category I standards, senior management must review the capital planning process quarterly; Category II and III firms review semi-annually.⁵

Internal audit provides the independent check. Audit evaluates the adequacy of both the capital planning process and its control environment without having played any role in building the ICAAP, performs substantive testing, and reports material deficiencies to the board or audit committee. For Category I firms, these briefings happen at least quarterly.⁵

Model Validation

Banks rely on quantitative models to estimate losses, project capital ratios, and run stress tests. When the models are wrong, the ICAAP is wrong. The Federal Reserve’s revised guidance on model risk management (SR Letter 26-02, issued April 2026, superseding SR 11-7) defines validation as evaluating whether models perform as expected, including their reliability and limitations.⁶ Sound validation has three components:

Conceptual soundness. Assessing and documenting the model’s design, key assumptions, qualitative judgments, and data selection, and asking whether the theoretical foundation makes sense for the intended use.
Outcomes analysis. Comparing model outputs to real-world outcomes through back-testing, outlier analysis, and testing for persistent deviations beyond established performance thresholds.
Ongoing monitoring. Evaluating whether the model continues to perform as products, exposures, market conditions, and data change.

Validation should happen before a model enters use. If urgent business needs force early deployment, the guidance calls for closer attention to limitations, informing stakeholders, and placing controls such as usage limits or more frequent performance monitoring.⁶ Effective challenge by objective experts with sufficient independence to force changes must run throughout the model lifecycle.

What Goes Into the ICAAP Submission

The submission is a package, not a single document. At its center is the risk appetite statement, defining how much risk the institution will accept in pursuit of its strategic objectives. The risk register catalogs identified threats and maps each one to the capital reserved against potential losses. Capital adequacy projections show how the bank’s financial position evolves under baseline and adverse conditions, backed by the detailed results of recent stress tests.

Documentation of policies and procedures has to be thorough enough that someone unfamiliar with a specific process or model could understand how it works, its limitations, its key assumptions, and its uncertainties.⁵ The documents are reviewed and updated at least annually. Where a bank prepares both an ICAAP and an ILAAP, documents that address both processes only need to be submitted once, in either package, provided a reader’s manual explains where each section sits.⁷

The ICAAP also has to be consistent with the recovery plan. Any management action in the ICAAP with material impact must be reflected in the recovery plan without delay, and the other way around, so both documents stay current.³

How Supervisors Review the ICAAP

Once submitted, the ICAAP is assessed by the regulator. In the euro area, the ECB’s SREP evaluates each significant institution across four elements:⁸

Business model viability, meaning whether the strategy generates adequate returns and remains sustainable.
Governance and risk management, meaning whether internal structures, controls, and risk culture are sound.
Risks to capital, meaning whether the bank holds enough capital relative to the risks it actually faces.
Risks to liquidity and funding, meaning whether the bank can meet its obligations under normal and stressed conditions.

Each element is scored. Higher scores reflect greater threat to viability; banks scoring 1 or 2 are low-risk, those scoring 3 or 4 are medium or high risk.⁸

The ECB has streamlined the SREP cycle to conclude by the end of October each year. Supervisory dialogue meetings run from late June through mid-July, a four-week hearing period begins in early August during which banks can review draft decisions and exercise their right to be heard, and final decisions are notified by the end of October.⁹ When an institution’s risk profile has not changed materially, its SREP decision may be updated less frequently than annually.

Pillar 2 Requirement Versus Pillar 2 Guidance

The SREP can produce two distinct capital outcomes.

A Pillar 2 Requirement (P2R) is a legally binding, bank-specific charge on top of Pillar 1, covering risks that Pillar 1 underestimates or ignores. P2R must be met with a minimum of 56.25% Common Equity Tier 1 (CET1) capital, though regulators can require a higher CET1 share based on the bank’s circumstances.¹⁰ For 2026, the average CET1 P2R for ECB-supervised banks remained stable at 1.2% of risk-weighted assets.¹¹

Pillar 2 Guidance (P2G) is a non-binding recommendation for the capital level the ECB expects a bank to hold as a strategic buffer against stressed conditions. For banks participating in EU-wide stress tests, P2G is calibrated through a bucketing approach based on how much the bank’s capital ratios decline under the adverse scenario; for non-participants, it reflects a forward-looking assessment of resilience.¹² Average P2G for 2026 decreased to 1.1% CET1, from 1.3% the prior year.¹¹

What Happens If a Bank Falls Short

Breaching a P2R triggers direct legal consequences. Because the requirement is binding, a bank falling below it may face supervisory measures including sanctions.¹⁰ More concretely, when capital drops below the combined buffer requirement (the sum of Pillar 1, P2R, and applicable buffers), automatic restrictions activate on the Maximum Distributable Amount. Dividends, Additional Tier 1 coupon payments, and variable remuneration are all capped. The bank must submit a capital conservation plan explaining how it will restore compliance.

P2G is not legally binding, but that does not make it consequence-free. If capital continues to decline into the combined buffer requirement, the same MDA restrictions activate. Supervisors also treat a persistent inability to maintain P2G as a signal of deeper problems, which leads to more intensive engagement in the next SREP cycle.

In the United States, the FDIC and other regulators use a spectrum of enforcement tools when capital planning processes are inadequate. Informal actions include board resolutions and memoranda of understanding. When problems are more severe, typically reflected in a risk management composite rating of 3, 4, or 5, formal enforcement follows: cease-and-desist orders, prompt corrective action directives for undercapitalized institutions, and civil money penalties.¹³ Restrictions on growth, forced divestitures, and prohibitions on acquisitions are all available.

The U.S. Equivalent

The United States does not use the term “ICAAP.” The capital planning framework for large U.S. banks serves functionally similar purposes. Bank holding companies, covered savings and loan holding companies, and intermediate holding companies of foreign banking organizations with $100 billion or more in total assets are subject to the Federal Reserve’s supervisory stress tests and capital plan rule.¹⁴

Firms must estimate losses, revenues, expenses, and resulting capital levels under hypothetical economic conditions supplied by the Federal Reserve. Banks with significant trading activity, defined as aggregate trading assets and liabilities of $50 billion or more or at least 10% of total consolidated assets, must also model a global market shock. Large firms with substantial trading or custodial operations incorporate a counterparty default scenario.¹⁴

Stress test results feed each firm’s stress capital buffer, the U.S. analog to a Pillar 2 add-on. The Federal Reserve calculates a preliminary SCB by June 30 and a final SCB by August 31 of each stress test year. In 2026, the Federal Reserve voted to maintain current stress test-related capital requirements while public feedback on the framework is being considered.¹⁵

1
Bank for International Settlements. Pillar 2 Framework Executive Summary
2
Bank of England. The PRA’s Methodologies for Setting Pillar 2 Capital
3
European Central Bank. ECB Guide to the Internal Capital Adequacy Assessment Process (ICAAP)
4
European Banking Authority. CRD Article 73
5
Federal Reserve. SR 15-18 – Federal Reserve Supervisory Assessment of Capital Planning and Positions
6
Federal Reserve. SR Letter 26-02 – Revised Guidance on Model Risk Management
7
European Central Bank (Banking Supervision). Information Collection Note on the ICAAP and ILAAP
8
European Central Bank. Methodological Note for Supervisory Banking Statistics
9
European Central Bank Banking Supervision. FAQ on the SREP of Tomorrow
10
European Central Bank. Pillar 2 Requirement
11
European Central Bank. ECB Keeps Capital Requirements Broadly Stable for 2026
12
European Central Bank (Banking Supervision). Pillar 2 Guidance
13
Federal Deposit Insurance Corporation. Formal and Informal Enforcement Actions Manual – Chapter 1
14
Federal Reserve. 2026 Supervisory Stress Test Scenarios
15
Federal Reserve. Dodd-Frank Act Stress Tests 2026