What Is ILAAP? How Banks Assess Liquidity Adequacy

The Internal Liquidity Adequacy Assessment Process, known as ILAAP, is the set of internal strategies, policies, and systems an EU-supervised bank uses to identify, measure, and manage its liquidity risk so it can meet its obligations even under stress. It is grounded in Article 86 of the Capital Requirements Directive (CRD IV) and assessed each year by supervisors as part of the Supervisory Review and Evaluation Process (SREP).¹ The European Central Bank published its definitive ILAAP guide in November 2018, setting out seven principles supervisors apply when reviewing each bank’s process.

Why ILAAP Exists

Minimum regulatory ratios alone cannot capture every liquidity risk a bank faces. The Basel III reforms, developed after the 2007–2008 financial crisis, created two standardized liquidity metrics known as Pillar 1 requirements.² The Liquidity Coverage Ratio (LCR) requires banks to hold enough high-quality liquid assets to survive a 30-day stress scenario.³ The Net Stable Funding Ratio (NSFR) complements the LCR by promoting a sustainable funding structure over a one-year horizon.⁴

Those ratios apply uniformly across banks above a certain size, but a lender that relies heavily on short-term wholesale funding carries a different risk profile from one funded primarily by retail deposits. Pillar 2 fills the gap. CRD IV Article 86 requires each institution to maintain robust strategies for identifying, measuring, and monitoring liquidity risk, tailored to its business lines, currencies, and legal entities, and proportionate to its complexity and risk tolerance. ILAAP is the mechanism that satisfies this Pillar 2 obligation. Supervisors look at whether the bank has genuinely internalized liquidity management, not just hit a ratio on paper.

The Seven ECB Principles

The ECB’s 2018 guide translates the CRD IV liquidity provisions into seven principles. They are the benchmarks supervisors apply when evaluating ILAAP during the SREP.¹

The management body is responsible for sound governance of ILAAP, approving and overseeing all key elements and signing an annual Liquidity Adequacy Statement that reflects its own view of the bank’s liquidity position.
ILAAP must be integral to the overall management framework, woven into business strategy, daily decision-making, and risk management, with quantitative metrics and qualitative monitoring working together.
ILAAP must contribute to the continuity of the institution by assessing liquidity adequacy from multiple perspectives and over different time horizons, including intraday.
All material liquidity and funding risks must be identified, including those from off-balance-sheet commitments, intragroup flows, and currency mismatches.
Internal liquidity buffers must consist of clearly defined, high-quality assets, and stable funding sources must be clearly identified. The internal definition of what qualifies should be at least as strict as the regulatory classification.
The methodologies used to quantify liquidity risk must be adequate, internally consistent, and independently validated.
Stress testing must be regular and designed to ensure the bank can maintain adequate liquidity under adverse conditions.

Proportionality runs through all seven principles. A large, internationally active bank must maintain a far more sophisticated framework than a smaller regional institution, but the principles themselves apply to both.

What Goes Inside The Framework

Liquidity Risk Appetite Statement

Every ILAAP begins with a Liquidity Risk Appetite Statement, the document that defines how much liquidity risk the bank is willing to accept while pursuing its business objectives. It typically includes quantitative limits on metrics such as minimum LCR levels (often set above the regulatory floor), maximum reliance on any single funding source, minimum survival periods under stress, and concentration limits by currency and counterparty. It also sets qualitative guardrails: governance structures, internal controls, and reporting frequency. Compliance is monitored continuously, with quarterly risk reporting and annual stress tests at a minimum.

The statement is not a static document. It should evolve with the bank’s strategy; a shift toward more capital-markets-oriented funding, for example, carries a different liquidity profile that the appetite framework needs to reflect. Supervisors pay close attention to whether the stated risk appetite actually matches the bank’s observed behavior.

Stress Testing

Liquidity stress testing sits at the center of ILAAP. Banks must simulate scenarios where cash inflows dry up, depositors withdraw funds rapidly, or wholesale funding markets freeze, and then measure whether the institution can survive without external intervention. Scenarios generally fall into three categories: institution-specific crises, market-wide shocks, and combined scenarios where both hit at once.

Effective stress tests go beyond simple cash-flow projections. They incorporate management responses, meaning what the bank would actually do to raise liquidity under stress, and model second-round effects such as how selling assets into a stressed market depresses prices further, or how liquidity drains from weaker institutions toward stronger ones during a system-wide crisis. Time horizons typically cover overnight, one week, 30 days, 90 days, and in some cases up to a year.

Contingency Funding Plan

When stress tests reveal potential shortfalls, the Contingency Funding Plan (CFP) is what the bank would actually execute. The plan details specific actions, such as selling particular asset portfolios, drawing on committed credit lines, adjusting pricing to attract deposits, or accessing central bank facilities, along with the expected cash amounts and execution timelines for each. It must identify who is responsible for activating each step and the internal escalation process.

Regulators expect banks to test their contingency plans, not just write them. Testing typically involves a dry-run exercise where the bank walks through the activation steps without executing trades, verifying that the operational infrastructure, decision-making chains, and communication protocols work as documented. One area that frequently draws supervisory attention is the link between intraday liquidity management and the contingency plan: a bank that cannot mobilize collateral quickly enough to meet intraday payment obligations has a gap that no amount of planning on paper can fix.

What Banks Submit, And When

Banks under ECB supervision submit their ILAAP package annually as part of the SREP cycle. Starting with the 2025 SREP cycle, the ECB moved the submission deadline to March 15 each year, with the ILAAP template, the EBA funding plan, and key supporting documents due by that date.⁵ Beyond the annual submission, banks must continuously share new or updated internal documents with their Joint Supervisory Team throughout the year.

The package itself covers several categories. The ILAAP report summarizes the institution’s internal findings: how it identified and quantified its liquidity risks, and whether its buffers are adequate. Supporting documentation covers methodology and policy, including how the bank selects its significant risk drivers, how it models cash flows across different time horizons, and how its stress testing framework operates. Banks must also provide quantitative data on their funding profile and its perceived stability across significant currencies, along with evidence of compliance with both minimum regulatory requirements (LCR, NSFR) and any additional supervisory requirements.¹

How Supervisors Use ILAAP

After receiving the package, the ECB’s Joint Supervisory Teams evaluate the bank’s liquidity and funding risk profile from several angles: the adequacy of the liquidity buffer, the sustainability of the funding structure, the quality of risk management and internal controls, and whether the bank’s own assessment is realistic. The outcome is a liquidity risk score reflecting the institution’s overall risk profile. There is no mechanical formula; supervisors reach a holistic judgment based on what they observe.⁶

A bank that scores well generally continues under routine supervision. A bank that scores poorly faces qualitative measures (requiring improvements to governance, risk management, or internal controls) or quantitative ones. Quantitative measures for liquidity can include requiring the bank to maintain an LCR above the regulatory minimum, imposing a currency-specific LCR, or setting a minimum survival period longer than the standard 30 days. The 2024 SREP cycle resulted in four quantitative liquidity measures being imposed on specific banks, each tailored to that institution’s particular weaknesses.⁷ Separately, the ECB has the power to restrict dividend payments and impose maturity-mismatch limits when circumstances warrant it.

The 2024 results also showed where ILAAP matters beyond headline ratios. Supervisors flagged banks that relied too heavily on short-term market funding, held concentrated counterbalancing capacity, or used overly optimistic deposit assumptions in their projections, even where the LCR looked comfortable.⁷ A bank can meet the ratio and still carry liquidity risks the ratio does not capture.

How ILAAP Differs From ICAAP

The two acronyms often get conflated, but they address different risks. ICAAP, the Internal Capital Adequacy Assessment Process, asks whether the bank holds enough capital to absorb losses and remain solvent. ILAAP asks whether the bank holds enough liquid assets and stable funding to meet its obligations as they come due, even under stress. A bank can be well-capitalized and still fail if it cannot convert assets to cash fast enough to meet a sudden surge in withdrawals. Both processes feed into the SREP, and the ECB has signaled that each will play a larger role in determining supervisory capital and liquidity add-ons in future cycles.⁸

The US Equivalent

ILAAP is a European framework. The United States does not use the term, but Regulation YY imposes comparable liquidity risk management requirements on bank holding companies with $100 billion or more in total consolidated assets.⁹ Those institutions must conduct internal liquidity stress tests and maintain a buffer sufficient to meet projected net stressed cash-flow needs over a 30-day planning horizon under multiple scenarios. The buffer must consist of highly liquid, unencumbered assets: cash, high-quality liquid assets as defined in the LCR rule, or other assets the bank demonstrates have low credit and market risk with an active secondary market. US branches and agencies of foreign banking organizations face a shorter 14-day stress horizon rather than the standard 30 days. Regulation YY also requires management information systems capable of collecting and aggregating liquidity data across the enterprise. For readers working outside the EU, the terminology is different but the underlying expectations rhyme.

1
European Central Bank. ECB Guide to the Internal Liquidity Adequacy Assessment Process
2
European Banking Authority. The Basel Framework – The Global Regulatory Standards for Banks
3
Bank for International Settlements. Basel III – The Liquidity Coverage Ratio and Liquidity Risk Monitoring Tools
4
Office of the Comptroller of the Currency. Net Stable Funding Ratio – Final Rule
5
European Central Bank. ECB Clarification on ICAAPs and ILAAPs and Respective Package Submissions
6
European Central Bank. Supervisory Methodology 2024
7
European Central Bank. Aggregated Results of the 2024 SREP
8
European Central Bank. ECB Guides to ICAAP and ILAAP
9
eCFR. 12 CFR Part 252 – Enhanced Prudential Standards (Regulation YY)