Internal Capital Adequacy Assessment Process (ICAAP) is one of the top priorities of ECB banking supervision. Compliance is demanding for the world’s largest banks – but even more so for small to medium-sized institutions. Given the time and effort demanded by ICAAP, doesn’t it make sense to go beyond compliance and get some genuine business value out of the exercise? The ECB itself has offered some constructive advice on how to move forward.
The evolution of ICAAP
ICAAP consists in designing and implementing a risk-adjusted management framework to ensure that the bank constantly meets its regulatory capital requirements and manages risks beyond those captured in Pillar 1 (e.g. concentration risk, migration risk, fraud or rogue trading, liquidity risk etc.) This process is documented into an ICAAP report that needs to be approved by the board before being submitted to the regulator for review. Stress testing to establish ICAAP became a more significant aspect of Pillar 2 after the 2008 financial crisis.
New liquidity regulations also introduced an ILAAP (Internal Liquidity Adequacy Assessment Process) as part of Pillar 2 Guidance from the ECB (P2G). Supervisors want to be assured that an institution’s stress testing provides adequate protection against macroeconomic shocks and liquidity dry-ups.
In practice, creating an ICAAP framework and reports requires a financial institution to go through the following steps:
1. Assess all of the risks to which the bank is exposed
2. Calculate how much capital is required to offset each risk using adapted models
3. Apply stress tests to assess how this capital might be affected by changing business conditions (guidance on this was provided in Basel III)
4. Define how much capital should be held. This capital is known as internal or economic capital and may be different to the regulatory capital it is required to hold
5. Embed the ICAAP metrics in business decisions
6. The board and senior management must demonstrate understanding of their roles and responsibilities, with full documentation and formalised approval process
Updating the guidelines – seven principles
Since the introduction of ICAAP the ECB has provided further assistance to institutions with a view to strengthening and streamlining their ICAAP processes and at encouraging the use of best practices, explaining in greater detail the ECB’s expectations of the ICAAP, leading to more consistent and effective supervision. In its November 2018 Guide it set out seven principles to make the purpose and requirements of ICAAP fully transparent, and to underline that it was of concern at the highest levels of the business. These are:
1. The management body is responsible for the sound governance of the ICAAP;
2. The ICAAP is an integral part of the overall management framework;
3. The ICAAP contributes fundamentally to the continuity of the institution by ensuring its capital adequacy from different perspectives;
4. All material risks are identified and taken into account in the ICAAP;
5. Internal capital is of high quality and clearly defined;
6. ICAAP risk quantification methodologies are adequate, consistent and independently validated;
7. Regular stress testing is aimed at ensuring capital adequacy in adverse circumstances.
In August 2020 the ECB then published a report into banks’ ICAAP practices in terms of each of these seven principles. It was based on a sample of the larger institutions, including 37 global systemically important banks (G-SIBs) covering all Single Supervisory Mechanism (SSM) countries as well as all banking clusters and almost all business models.
The report noted significant progress and that some ICAAP areas are broadly established across banks, such as risk identification processes, the generation of capital adequacy statements and regular conduct of stress-testing and capital planning, including adverse scenarios. However, the ECB identified several areas of weakness and underlined that the pandemic had shown very clearly the importance of even stricter adherence to ICAAP principles to strengthen banks’ ability to successfully navigate through stressful times.
It’s worth highlighting these weaknesses:
First, poor data quality. Timely, adequate and available data is a prerequisite for sound ICAAP. “Ultimately, weak data quality poses a clear threat to banks’ continuity,” the ECB states.
Second, the ECB cites room for improvement on the economic ICAAP perspective and not least, “the use of economic perspective information in decision-making, as reflected, for instance, in the limit system and internal reporting.” The ECB stated its concern that “the lack of mutual information between the normative and economic perspective, for example potential losses stemming from material risks under the economic perspective are often not systematically translated into profit and loss (P&L)/balance sheet impacts for projecting regulatory capital ratios under the normative perspective.”
A weak economic perspective can hamper banks’ ability to take decisions with due consideration of the economic risk associated with those decisions, which will ultimately be detrimental to banks’ financial strength. Moreover, it evidentially threatens banks’ continuity, because issues concerning the relationship between economic value and economic risk cannot be addressed in an active and timely manner. This, in turn, could weaken market participants’ and depositors’ trust.
Third, many banks do not systematically monitor their environment to identify new threats early enough.
As the world economy becomes more unpredictable, the ICAAP framework must be expanded to cover a wide range of non-financial as well as financial risks. These include, most notably, climate risks (as a direct result of environmental changes, or as a result of the transitional risks as we move towards a lower emission, circular economy, or as a result of damage to reputation). The November 2020 report says quite bluntly, “Climate-related risks are considered to be a key risk driver for the euro area banking sector but “Banks’ practices for considering these in their risk management processes are barely established and heterogeneous”. Banks still tend to bundle climate risk with others (e.g. environmental, social risk and sustainability risk. Only a few treat it as a separate risk, the ECB notes, and this lack of transparency understates the significance of climate risk.
Using ICAAP outputs to drive business decisions
The most striking aspect of the November 2020 guidance, therefore, is that the ECB addresses issues not just from a purely regulatory or normative perspective but as an advisor on best business practices and in particular the materiality of risks. For example, it states that “many banks should improve their forward-looking and pro-active risk identification … Otherwise, these banks risk being taken by surprise by either ineffective risk mitigation or by evolving risks and they may take business decisions that expose them to unknown or unintended risks.”
And even more tellingly:
“Many banks also need to overcome their current silo approaches and start identifying and managing concentrations, particularly across risks. The way things stand, those banks might unconsciously expose themselves to identical or correlated risk drivers that may simultaneously impact them via different risk types, thereby threatening their continuity to a far greater extent than they are aware.”
A good ICAAP, in short, enhances a financial institution’s ability to stay economically healthy and take appropriate management decisions based on a strong set of reliable information. It is a very useful tool to ensure not only prudential risk management but also good governance of the business as a whole. This in turn provides the basis for meaningful discussions between risk management and the customer-focused functions of the business. While this may lead to some tension at times, it is a creative tension that will lead to better outcomes, including the identification of new opportunities to grow the business, if used constructively.
The challenge for less well-resourced institutions
Note that all of these comments relate to the ECB’s analysis of the performance of the world’s largest banks, which are well-resourced institutions with the technological means at their disposal to respond to the changing demands of ICAAP, even if they are currently falling short in some areas.
By contrast, smaller and less well-resourced banks and financial institutions will struggle to keep pace. The Chief Risk Officer – and other senior executives – may wish to do more, but they often lack both the personnel and the analytical tools to go beyond meeting the minimum normative requirements. In fact, we see that many institutions are still using inadequate and outdated technologies to quantify ICAAP, including spreadsheets, which are error-prone, which necessarily leads to poor data quality, and prevent effective crossfunctional collaboration.
Such institutions should take the opportunity to put the automated technology in place to integrate data from various source systems and support optimum risk assessments and stress testing. On the one hand this will relieve the burden of manual compilation of ICAAP reports, while on the other, it will provide insights to support better business decision-making and the identification, mitigation or elimination of risks.
The need to harness ICAAP outputs to drive business decisions is greater than ever, but the good news is that this challenge is more easily overcome today than ever thanks to the availability of secure software-as-a-service solutions through the cloud to integrate data and provide highly sophisticated analyses and stress tests, similar to those used by the world’s largest banks. They are sufficiently flexible to identify very specific risks in any institution, for example post-merger or climate-related concentration risks that would otherwise remain hidden. Such technology also provides a platform for establishing sustainable, financially sound risk appetite and risk-based pricing.
For more information about active portfolio management and benefits it brings, please visit our PortolioStudio™
