ICAAP, ILAAP and SREP Explained

ICAAP, ILAAP and SREP are three acronyms that come up constantly in bank risk and regulatory circles, and they're closely connected, but it's easy to lose track of what each one actually covers. This guide sets out what each process is, how they relate to each other, and why they matter well beyond a tick-box compliance exercise.

Pillar 1 vs Pillar 2: why these processes exist

Basel's capital framework works in layers. Pillar 1 sets standardised minimum capital requirements that apply to every bank in broadly the same way, covering credit, market and operational risk using prescribed formulas. Pillar 2 recognises that those standardised rules can't capture every risk a specific bank actually faces, whether that's concentration risk in a particular loan book, reputational risk, or exposures unique to that institution's business model. ICAAP and ILAAP are how banks are required to fill that gap themselves, through their own internal assessment.

ICAAP: assessing capital adequacy

The Internal Capital Adequacy Assessment Process (ICAAP) is a forward-looking exercise, typically covering a three-to-five-year horizon, in which a bank assesses whether it holds enough capital to cover all the material risks it actually faces, not just the risks captured by Pillar 1's standardised calculations. That means going beyond credit and market risk to consider firm-specific threats such as concentration risk, interest rate risk in the banking book, and reputational risk. A well-run ICAAP isn't a document produced once a year to satisfy a regulator; it's meant to genuinely inform how the bank's board and senior management think about capital planning and risk appetite.

ILAAP: assessing liquidity adequacy

The Internal Liquidity Adequacy Assessment Process (ILAAP) does the equivalent job for liquidity and funding. It asks whether a bank can meet its financial obligations, both in normal conditions and under stress, across timeframes ranging from intraday liquidity needs to longer-term structural funding. Where ICAAP is about having enough capital to absorb losses, ILAAP is about having enough accessible liquidity to keep operating even when funding markets tighten unexpectedly.

SREP: how regulators use ICAAP and ILAAP

The Supervisory Review and Evaluation Process (SREP) is the framework regulators use to evaluate a bank's overall risk profile, and a bank's ICAAP and ILAAP submissions are central inputs into that review. Supervisors assess the quality and credibility of a bank's internal assessments, not just their conclusions, and the outcome of SREP can directly result in firm-specific add-ons to a bank's Pillar 1 capital and liquidity requirements. In other words, a weak or poorly evidenced ICAAP doesn't just risk a critical comment from a supervisor, it can lead to a bank being required to hold more capital than it otherwise would.

Why the quality of these assessments matters

Regulators have been explicit that they expect more than a compliance exercise. A high-quality ICAAP and ILAAP genuinely shape how a supervisor views a bank's internal governance and risk management, which is part of why these processes now demand deeper integration with strategic planning, more sophisticated forward-looking stress analysis, and explicit board-level accountability, rather than being delegated entirely to a risk function working in isolation.

How these fit together with wider risk management

ICAAP, ILAAP and SREP don't sit in isolation from the rest of a bank's risk framework. ICAAP's coverage of interest rate risk connects directly to the kind of analysis covered in our guide to Interest Rate Risk in the Banking Book (IRRBB), and the whole Pillar 1/Pillar 2 structure builds on the capital framework explained in our guide to Basel II's three pillars. For anyone studying toward the FRM qualification or working in bank risk more broadly, understanding how these three processes connect is genuinely foundational knowledge, not just exam trivia.

FAQ

Is ICAAP the same thing as SREP? No. ICAAP is the bank's own internal assessment; SREP is the supervisor's review process, which uses the ICAAP (and ILAAP) as key inputs.

Do all banks need to produce an ICAAP and ILAAP? Under Basel's Pillar 2 framework, yes, banks are expected to carry out both assessments, though the scale and sophistication expected scales with the size and complexity of the institution.

What happens if a regulator isn't satisfied with a bank's ICAAP? It can result in supervisory findings, closer scrutiny, and firm-specific additional capital or liquidity requirements on top of the standard Pillar 1 minimums.

ICAAP, ILAAP and SREP together form the backbone of how modern bank supervision goes beyond a one-size-fits-all capital rule, matching capital and liquidity requirements to the risks a specific institution actually carries.

What a bank's ICAAP and ILAAP submission actually contains

In practice, an ICAAP package brings together several strands of work: a risk identification and materiality assessment covering every risk type the bank is exposed to, a capital planning projection showing how capital resources and requirements evolve under the bank's business plan, and a suite of stress tests modelling how capital would hold up under adverse scenarios. ILAAP follows a similar structure but for liquidity, typically including a liquidity risk inventory, cash flow projections across multiple time horizons, a contingency funding plan for stress events, and an assessment of the bank's buffer of high-quality liquid assets. Both documents are ultimately owned and signed off by the board, which is a deliberate design choice: regulators want capital and liquidity adequacy treated as a strategic board-level responsibility, not something delegated entirely to a risk or finance function.

How often these assessments happen

ICAAP and ILAAP aren't one-off documents. Most banks are expected to refresh them at least annually, with the depth of the annual update often depending on the size and complexity of the institution and any material changes to its business model, balance sheet, or risk profile during the year. Larger or more complex banks typically maintain ICAAP and ILAAP processes that run continuously in the background, feeding into quarterly capital and liquidity monitoring, with the annual document acting as a formal, board-approved snapshot of that ongoing work rather than a process that starts from scratch each year.

A bank's leverage position is one of the inputs supervisors weigh when assessing overall capital adequacy through the SREP process. For more on this specific metric, see our guide to the leverage ratio under Basel III, including the minimum requirement and the additional buffer that applies to globally systemically important banks.