Internal capital adequacy assessment process expectations and related internal audit requirements

This letter sets out our expectations for the 2026 internal capital adequacy assessment process (ICAAP) and the related internal audit review. These expectations apply to all small and medium-sized banks (SMSBs), including Category III institutions using the simplified risk-based approach (collectively, SMSBs or institutions). The letter also introduces a proportionate approach to the frequency of ICAAP updates.

Consistent with our commitment to a proportionate, risk-based Supervisory Framework, SMSBs may, beginning in 2026, adopt a biennial cycle for comprehensive ICAAP updates, comprising of the ICAAP report, ICAAP Data Return, and internal audit review as applicable. Institutions adopting the biennial cycle would complete an ICAAP update every two years. We expect SMSBs to prepare interim-year updates, addressing the affected areas of the ICAAP, where material changes occur in their risk profile, capital position, governance, business strategy, or operating environment. This change reduces documentation and reporting burden while maintaining existing capital requirements and institutions' responsibility to hold capital commensurate with their risks.

Guideline E-19, Internal Capital Adequacy Assessment Process for Deposit-Taking Institutions, remains in effect. Notwithstanding the frequency of ICAAP updates, the ICAAP remains, first and foremost, an internal risk-management and capital-planning process rather than a regulatory reporting exercise. Institutions adopting a biennial ICAAP cycle remain responsible for maintaining effective governance, risk assessment, stress testing, internal controls, and capital planning on an ongoing basis. Consistent with Guideline E-19, an institution's ICAAP should be as simple or complex as needed and should reflect how the institution is managed and organized in practice. The appendix outlines the key elements of the ICAAP document.

As part of ongoing supervisory activities, lead supervisors retain the discretion to request ICAAP documentation, including a comprehensive ICAAP update and related internal audit reports, at any time where warranted by institution-specific circumstances or supervisory considerations.

SMSBs should submit the ICAAP Data Return with each comprehensive ICAAP update and in any interim year update that changes the content of the return. We may also require more frequent submissions where appropriate.

The ICAAP Data Return should be based on fiscal year-end data. Where the ICAAP is prepared using data from another date, institutions should maintain a board-approved addendum explaining any material differences from fiscal year-end results.

As in previous years, we will provide SMSBs, no later than October 16, 2026, the prescribed single-factor stress-test scenarios and downturn assumptions for use in ICAAP assessments and related ICAAP Data Return reporting for those institutions that complete a comprehensive ICAAP update or interim-year update for 2026.

Should you have any questions or concerns, please contact your lead supervisor.

Yours sincerely, 
Steve Bevington 
Executive Director, Risk Assessment and Intervention Hub