ICAAP: The Internal Capital Adequacy Assessment Process Guide

Capital Planning, Stress Testing and Pillar 2 Supervision for UK Regulated Firms

The Internal Capital Adequacy Assessment Process — ICAAP — is the framework through which regulated firms assess their own capital needs, beyond the formulaic Pillar 1 minimums. ICAAP requires firms to identify all material risks they face, assess the capital required to support those risks under both normal and stressed conditions, plan for capital adequacy across a multi-year horizon, and document the analysis in a way that supports senior management challenge and FCA supervisory dialogue. For investment firms now operating under the Investment Firm Prudential Regime (IFPR), the ICAAP has been substantively replaced by the Internal Capital Adequacy and Risk Assessment (ICARA) — combining the historic ICAAP with the wind-down planning framework into a single integrated document.

This guide explains how ICAAP and ICARA actually work in practice — the regulatory framework, the substantive components of a credible assessment, the stress testing discipline, the senior management governance expected, and the recurring patterns where firms fall short during FCA review. It also covers the recruitment dimension — the senior finance, risk and compliance leadership that effective ICAAP/ICARA production requires.

What’s missing from most online explanations of ICAAP is the practical substance. The framework is well-documented; what’s harder to find is what good substantive content looks like, how the FCA examines documents during the supervisory review process, and where firms commonly produce ICAAP/ICARAs that look comprehensive but fail substantive scrutiny. That’s the gap this guide fills.

Where ICAAP Comes From — The Regulatory Framework

The ICAAP framework originates in the Basel II framework, where Pillar 2 introduced the concept of supervisory review of capital adequacy beyond the formulaic Pillar 1 calculation. Pillar 2 operates on a two-sided basis:

• The firm’s side — the firm conducts its own internal capital adequacy assessment process (ICAAP)
• The supervisor’s side — the FCA conducts a Supervisory Review and Evaluation Process (SREP), examining the ICAAP and reaching its own conclusion on appropriate capital

The framework now operates in different forms across UK financial services:

For investment firms specifically, see our MIFIDPRU & IFPR Guide. For the broader prudential context, the framework intersects with the FCA Threshold Conditions, particularly the Appropriate Resources condition.

The Substantive Components of an ICAAP

A credible ICAAP includes several substantive components:

Business model and strategic context

The ICAAP starts with the firm’s business model — what it does, who its customers are, how it generates revenue, what its strategic direction is, and what risks are inherent in the business. The strategic context matters because capital needs flow from the business model.

Risk identification

Comprehensive identification of all material risks the firm faces, including:

• Credit risk — including counterparty credit risk where relevant
• Market risk — for firms with trading or material market exposure
• Operational risk — including conduct risk, technology risk, third-party risk
• Liquidity risk — typically managed separately but with capital implications
• Concentration risk — across counterparties, sectors, geographies
• Strategic risk — risks to the business model itself
• Reputational risk — impact of conduct or operational issues on franchise value
• Conduct risk — including risk of customer redress and regulatory intervention
• Pension risk — for firms with material defined benefit obligations
• Group risk — for firms in groups, including contagion and support requirements

Risk assessment and measurement

For each material risk, the firm assesses the magnitude and quantifies the capital requirement. Quantification uses various approaches depending on the risk type — statistical models, scenario analysis, expert judgment, and benchmarking to industry data.

Capital allocation

The aggregate capital requirement is built up from individual risk requirements, with appropriate consideration of diversification benefits where applicable.

Stress testing

Substantive stress testing examining how the firm’s capital position would evolve under adverse scenarios — including idiosyncratic firm-specific scenarios and broader macroeconomic stress.

Capital planning

Forward-looking capital planning across a multi-year horizon, including organic capital generation, planned capital actions (issuance, distribution), and stress impacts on the capital trajectory.

Wind-down considerations

For firms required to consider wind-down (now mandatory for IFPR investment firms through ICARA), the analysis includes the capital required to support an orderly wind-down. See our Wind-Down Planning Guide.

Conclusions and senior management attestation

The ICAAP concludes with the firm’s overall capital conclusion — typically expressed as the firm’s view of appropriate capital across the planning horizon — supported by senior management attestation and board approval.

Stress Testing — The Heart of ICAAP

Stress testing is the most substantively important component of any credible ICAAP. The discipline involves projecting the firm’s financial position under adverse scenarios and assessing whether capital remains adequate. Effective stress testing typically includes:

Multiple scenario types

• Baseline — the firm’s central economic forecast
• Macro stress — adverse macroeconomic conditions including recession, market dislocation, and similar
• Idiosyncratic stress — firm-specific scenarios such as conduct events, operational losses, or specific business pressures
• Combined stress — concurrent macro and idiosyncratic stress
• Reverse stress test — identifying scenarios that would cause the firm to fail and assessing the plausibility of those scenarios

Multi-year horizon

Stress testing typically projects 3-5 years forward, capturing both immediate impacts and the trajectory of recovery or further deterioration.

Action triggers

Stress testing identifies the points at which the firm would need to take management actions — capital actions, business model changes, cost reductions — to maintain capital adequacy. The ICAAP documents the planned actions and assesses their feasibility.

Reverse stress testing

Reverse stress testing — identifying the scenarios that would cause the firm to fail — has been an increasing FCA focus. The discipline forces firms to think about tail risks substantively rather than just modelling within historical experience.

Senior Management Governance

The ICAAP is fundamentally a senior management document. The substantive expectations include:

Board ownership

The board must own the ICAAP — substantively, not just through formal approval. This means engagement with the underlying analysis, challenge of key assumptions, debate about scenarios, and substantive discussion of conclusions.

Senior management attestation

Senior management — typically led by the SMF2 (CFO) and SMF4 (CRO) — attests to the substantive accuracy of the ICAAP and the appropriateness of the conclusions. See our SMF2 Guide and SMF4 Guide.

Risk committee engagement

The risk committee (where established) typically reviews the ICAAP in detail, with substantive analytical engagement and challenge.

SREP dialogue

Following ICAAP submission, the firm engages with FCA supervisory review through the SREP process. Substantive senior management engagement is expected.

The SREP — How the FCA Reviews the ICAAP

The Supervisory Review and Evaluation Process (SREP) is how the FCA examines the ICAAP and reaches its own conclusion on appropriate capital. The process typically involves:

• Detailed review of the ICAAP submission
• Discussions with senior management on key elements
• Independent FCA assessment of the firm’s risk profile
• Examination of stress testing severity and methodology
• Review of capital planning and management actions
• Determination of any additional capital requirement (Pillar 2 add-on)

For larger or higher-risk firms, the SREP can be substantial — extending over months and involving extensive supervisory engagement. For smaller firms, the SREP is typically less intensive but still substantively engages with the ICAAP.

ICAAP Production — Operational Reality

Producing an ICAAP is operationally substantial. Typical production involves:

Cross-functional engagement

Finance, risk, compliance, business lines, treasury, operations, and IT all contribute to ICAAP production. The CFO and CRO typically lead, with substantive contributions from other functions.

Multi-month timeline

ICAAP production typically takes 3-6 months for an established firm, longer for first-time production or material methodology changes.

Iterative review and challenge

Multiple rounds of review and challenge — internal management, risk committee, board — refine the document substantively before final submission.

Specialist support

Many firms engage specialist consultants for stress testing methodology, capital model validation, or specific risk analysis areas.

Documentation discipline

Strong ICAAP documentation supports the analysis with clear reasoning, evidenced inputs, and substantive challenge — not just summary conclusions.

Sector-Specific ICAAP Considerations

Banks and building societies

Bank ICAAPs are PRA-supervised and substantively comprehensive — covering credit, market, operational, liquidity, and various other risks across sometimes complex banking books and trading activities. Stress testing is heavily scrutinised, often involving regulatory stress test programmes.

Investment firms (now ICARA)

Following the IFPR, investment firms produce ICARA — combining the historic ICAAP with wind-down planning. The K-factor capital model is the new starting point. See our MIFIDPRU & IFPR Guide.

Wealth managers and asset managers

Investment manager ICARAs focus on operational risk, conduct risk (including potential customer redress), client money/assets risk, and the wind-down framework given the customer-facing nature of the business.

Insurance firms

Insurance firms operate the Solvency II ORSA, with substantively different methodology focused on insurance risk, market risk, and the SCR/MCR framework. The principles of forward-looking risk assessment overlap but the operational reality differs substantially.

Payments and e-money firms

Payments firms operate sector-specific prudential rules with safeguarding requirements distinct from the broader prudential framework. ICAAP-equivalent assessment varies by specific firm structure.

Common ICAAP Pitfalls

Inadequate stress severity. Stress scenarios that don’t reflect genuinely adverse conditions, with stress impacts that look modest relative to plausible scenarios.

Generic risk identification. Risk identification that doesn’t reflect the firm’s specific business model, with generic risk taxonomies copied without firm-specific adaptation.

Capital model weaknesses. Capital models with inadequate validation, poor documentation, or insufficient sensitivity analysis.

Weak management actions. Stress test management actions that lack credibility — actions the firm couldn’t realistically execute under stress conditions, or that don’t have the magnitude assumed.

Inadequate reverse stress testing. Reverse stress tests that identify implausible failure scenarios rather than examining genuinely possible tail risks.

Disconnect from business reality. ICAAPs that don’t reflect actual business operations, with stress scenarios that don’t engage with the firm’s commercial drivers.

Documentary rather than substantive engagement. ICAAPs produced as compliance documents without substantive senior management ownership.

Forward-looking weakness. Capital planning that doesn’t substantively address how the firm’s capital trajectory would evolve under stress.

SREP engagement weakness. Inadequate engagement with FCA supervisory review, with defensive responses to challenge rather than substantive engagement.

ICAAP and Senior Recruitment

Effective ICAAP production requires specific senior team capability:

• SMF2 (CFO) — typically owns the ICAAP overall, with primary accountability for capital planning. See our SMF2 Guide
• SMF4 (CRO) — owns the risk identification and assessment components. See our SMF4 Guide
• Head of Capital / Capital Manager — operational lead on capital planning and stress testing
• Head of Risk Modelling — for firms with quantitative capital models
• Head of Treasury — for capital actions and liquidity dimension
• Internal capital validation specialists — for firms with sophisticated capital models

For firms preparing first-time ICAAPs (typically post-authorisation) or addressing material findings from FCA SREP, specialist senior support is frequently engaged through fractional or interim arrangements. See our Regulated CFO Recruitment page.

Further Reading and Authoritative Sources

For the FCA’s authoritative guidance on capital adequacy, see the IFPRU and MIFIDPRU sourcebooks. For PRA-supervised banks, see the PRA Rulebook.

Related Guides: Prudential, Risk and Authorisation

Part of FD Capital’s series of practical guides for FCA-regulated firms: MIFIDPRU & IFPR — Investment Firm Prudential Regime | Three Lines of Defence Model | Wind-Down Planning | FCA Threshold Conditions | How to Become FCA Authorised | SMF2 — Chief Finance Function | SMF4 — Chief Risk Officer Function | Operational Resilience | Third-Party Risk Management