Internal capital adequacy assessment process template

Small and mid-sized banks including Category III institutions using the simplified risk-based approach (collectively referred to as SMSBs or institutions) can use this template in their internal capital adequacy assessment process (ICAAP) document. While the use of this template is not mandatory, the ICAAP document should cover all the elements contained in this template, including the expectation of an Appendix A with details related to the quantification of material risks to which the institution is exposed. We expect the board to approve an institution's ICAAP document.

All SMSBs should complete the ICAAP data return on an annual basis (using actual fiscal year-end data), file it within 90 days of the fiscal year end date through the Regulatory Reporting System, and ensure that the ICAAP document supports the ICAAP data return. Where an SMSB prepares its ICAAP using other than year-end data, it should prepare a board-approved addendum to explain significant differences between what the board approved and what is shown in the ICAAP data return using actual year-end numbers.

The amount of detail in the ICAAP document will vary based on the size and complexity of the institution. Through the ICAAP document, an SMSB can refer to supplementary information such as its policies, risk management framework(s), and processes.

Executive summary

The executive summary should provide an overview of the ICAAP methodology and results such as:

• confirmation that the institution (on a consolidated basis) assessed its capital as adequate given its size and complexity and a summary of the target capital metrics ratified by the board
• commentary on the most material risks faced by the institution, why the level of risk is acceptable or, if it is not, what mitigating actions are planned
• a summary of the main findings of the ICAAP analysis including an assessment of the institution's internal capital compared to regulatory requirements over its planning horizon and a summary of stress test results and how they inform and support capital management
• a summary of its business strategy and how the strategy relates to the financial and capital planning targets
• a brief description of the review, challenge, and approval process of the ICAAP

Background of ICAAP

The background section should provide a high-level overview of the institution's ICAAP, demonstrating the interconnectivity of the institution's risk management framework, strategy, business planning, and capital management. The background should concisely describe relevant policies and systems used by the institution to identify, manage, and monitor risks according to its risk appetite statement.

Risk appetite statement

The ICAAP document should include the institution's risk appetite statement and set out the frequency of reviews of the risk appetite statement as well as risk tolerance by management and the board.

Material risks and Appendix A

The section of the ICAAP document on material risks should include a brief description of how the institution identifies material risks. To the extent applicable, we expect SMSBs to consider the following types of risks:

• credit risk
• market risk
• operational risk
• structural interest rate risk in the banking book (IRRBB)
• concentration risk
• funding risk
• business and strategic risk
• reputation risk
• securitization risk
• climate risk
• other relevant risks

In a separate appendix (labelled Appendix A of the ICAAP document), provide further details on the institution's risk assessment and quantification methodology, including how the institution:

• defines each of the material risks to which it is exposed
• determines the materiality of each material risk
• quantifies each material risk for capital allocation purposes including details of data required for analysis, key assumptions, and methodology

The explanation of how the institution quantifies each material risk should include details of the approach taken (for example, modelled, stress test, expert judgement), the calibration of such approach, and the results for the final Pillar 2 capital level used in the institution's capital target. SMSBs should organize Appendix A consistently with the ICAAP data return and expand on the quantification used for each Pillar 2 risk identified. 

For SMSBs exposed to credit risk or IRRBB, we expect each to be a core part of their Pillar 2 capital allocation. Additionally, we expect SMSBs to have capital allocation for operational risk, especially those with core business risks that are tied to operational processes, which includes most institutions.

Capital planning

The description of capital planning should include the institution's:

• baseline capital forecasts (at least quarterly, based on the annual business plan)
• three-year summary forecast capital position and main assumptions related to the business plan
• capital planning and management process including details of how the institution incorporates the ICAAP into this process

Stress and scenario testing

The ICAAP document should have a section with details of stress and scenario testing that includes a concise description of how the institution uses its stress testing program to support the assessment of capital adequacy and the management of capital.

As ICAAP is, first and foremost, a key internal process in institutions' capital management and planning, we expect each institution to develop its own fit-for-purpose forward-looking scenarios that appropriately align with its business model, risk profile, and operating environment.

In the current macro and geopolitical environment, we expect institutions to reflect the potential impact of tariffs on key macroeconomic variables within their baseline scenarios. Stress testing could include multifactor stress tests that cover all major risks and material portfolios to assess capital resiliency to weather a severe but plausible stress environment. Institutions should clearly document key assumptions supporting both the baseline and stressed scenarios reflected in their ICAAPs.

Where management actions are considered in the stress tests, the ICAAP document should clearly articulate the nature of such management actions. The institution should include a comprehensive assessment of the feasibility of management actions in a severe but plausible stress environment as well as the respective timeframes to complete those actions. The ICAAP document should include the impact on the capital ratio(s) pre- and post-management actions.

Reverse stress testing is an integral part of an ICAAP. In conducting reverse stress tests, SMSBs should examine their vulnerabilities and consider scenarios that challenge the viability. We expect institutions to clearly outline the reverse stress testing scenarios, summarize key insights and conclusions drawn (including main vulnerabilities identified), and describe any measures implemented to address vulnerabilities and enhance overall financial resilience.

Please note that we may request institutions to conduct prescribed stress tests and report the results of these stress tests, together with their impact on the ICAAP. We will communicate these separately through the lead supervisors.

Integration of ICAAP into risk management

The ICAAP document should include descriptions of how the institution:

• uses the ICAAP
• embeds the ICAAP results in its decision-making process
• integrates ICAAP results into setting of risk limits setting and monitoring of risks
• reports ICAAP results to the board

Challenge and next steps

The final section of the ICAAP document should:

• summarize the extent of challenge and testing of the ICAAP and the control processes applied to the ICAAP calculations
• outline the board and senior management sign-off procedures
• identify the nature of any third-party review of the ICAAP
• identify any plans to enhance the ICAAP going forward