Purpose and process of the ICAAP

4. The ICAAP is an internal process of a Bank which enables it to determine and maintain the amount and quality of capital that is adequate in relation to the Bank’s risk profile as assessed by conducting a comprehensive internal risk assessment process. Banks are encouraged to maintain capital over and above the regulatory minimum capital. The ICAAP, which should be based on an internal risk assessment process, should be embedded in the Bank’s business and organisational processes.

5. When assessing its capital needs, a Bank should take into account the impact of economic cycles, and sensitivity to other external risks and factors. For larger or more complex institutions, this may mean developing an appropriate stress testing and scenario testing framework. The AFSA does not prescribe any specific approach for the ICAAP and, consequently, a Bank can choose to implement an ICAAP which is proportionate to the nature, size and complexity of the business activities. In completing an ICAAP, a Bank should:

(a) estimate the amount of capital required to absorb potential losses, if any, for the significant risks identified through an internal risk assessment process;

(b) perform reasonable and proportionate sensitivity tests to analyse the impact of variation in the risk parameters of significant risks identified in the internal risk assessment process on the profitability and the capital position of the Bank;

(c) estimate, using the range and distribution of possible losses estimated from historical data, the level of capital required reasonably to cover likely losses;

(d) estimate the capital required to address potential increase in the Bank’s capital requirement to support planned growth in business levels or any significant deviation in growth from plans; and

(e) document the ranges of capital required for each of the factors identified above and enable the Governing Body and the senior management to form an overall view on the amount and quality of capital which that Bank should hold.

6. The AFSA does not require a Bank to implement ICAAP through sophisticated models and the AFSA has no prescribed approach for developing an internal capital model for the Bank’s ICAAP assessment. However, a Bank should be able to demonstrate:

(a) the confidence levels set and whether these are linked to its corporate strategy;

(b) the time horizons set for the different types of business that it undertakes;

(c) the extent of historic data used and back-testing carried out;

(d) that it has in place a process to verify the correctness of the model's outputs; and

(e) that it has the skills and resources to operate, maintain and develop the model.

7. If a Bank's internal model makes explicit or implicit assumptions in relation to correlations within or between risk types, or in relation to diversification benefits between business lines, the Bank should be able to explain to the AFSA, with the support of empirical evidence, the basis of those assumptions. A Bank's model should also reflect the past experience of both the Bank and the sectors in which it operates.

8. The assumptions required to aggregate risks that are modelled and the confidence levels adopted should be considered by the Bank's senior management. A Bank should also consider whether any relevant risks, including systems and control risks, are not captured by the model.

9. A Bank using an internal capital model should validate the assumptions of the model through a comprehensive stress testing programme. In particular this validation should:

(a) test correlation assumptions (where risks are aggregated in this way) using combined stresses and scenario analyses;

(b) use stress tests to identify the extent to which the Bank's risk models omit non-linear effects, for instance the behaviour of derivatives in Market Risk models; and

(c) consider not just the effect of parallel shifts in interest rate curves, but also the effect of the curves becoming steeper or flatter.

10. Any internal assessment of capital adequacy should address diversification benefits and transferability of Capital Resources between members of the Financial Group. It should also describe the distribution of the capital required by the Financial Group across all entities, including the Bank.

The SREP in detail

15. A SREP of an IRAP and an ICAAP forms an integral part of the overall supervisory approach of the AFSA. A SREP is expected to enable assessment of the effectiveness, completeness and quality of an IRAP and ICAAP in relation to the overall risk profile of the Bank. It leverages from information collected and assessments carried out as part of the wider supervisory regime, including desk- based reviews, on-site risk assessments, discussions with the Bank’s management, and reviews completed by internal and external auditors.

16. The SREP is structured to provide consistency of treatment across Banks, taking into consideration the differences in risk profiles, business strategies and management. An essential element of the SREP is the qualitative assessment of each type of risk and its management within the overall context of the Bank’s internal governance.

17. The AFSA’s assessment of the individual risk profile of a Bank will provide the context for evaluation of the Bank’s IRAP and/or ICAAP. The evaluation in turn will be used by the AFSA to augment its understanding of the overall risk profile of a Bank. Also, in relation to a Bank, the AFSA might involve such a Bank in a formalised discussion of risks and capital adequacy, which might lead to a requirement for additional capital.

18. The SREP may be used as a regulatory tool for Banks which are required to perform an IRAP and/or ICAAP. The SREP for each Bank will be proportionate in terms of the size, scale and complexity of its business and its impact on financial sector stability. The AFSA will cooperate actively with other supervisory authorities whenever a Bank is part of a Group and is prudentially regulated on a consolidated basis.

19. The SREP evaluation cycle will be determined in the discretion of the AFSA and be based on the risk assessment, developments in the risk profile and changes in the Bank’s strategy or products. The SREP is as far as possible aligned with the risk assessment process to ensure that a recent risk assessment is available for the SREP evaluation process.

20. It is envisaged that the AFSA will use a range of supervisory tools of qualitative or quantitative nature to perform the SREP. The SREP is not intended as, and should not constitute, a parallel or secondary IRAP or ICAAP. Its purpose is to evaluate the quality, completeness and consistency of the IRAP or ICAAP of the Bank.

Review of the ICAAP Assessment

21. Upon receipt of an IRAP or ICAAP the AFSA would normally:

(a) subject the data provided to an initial analysis for completeness and accuracy followed by a more detailed comparison with the relevant data held on file at the AFSA about the Bank;

(b) determine if there are material changes compared with previous submissions;

(c) determine if the submitted data contains indicators of a possible material change in the Bank’s risk profile;

(d) address and discuss any information gaps or anomalies with the Bank; and

(e) form an assessment about content and quality of the submission which will be integrated into the overall supervisory approach.

Evaluation of the ICAAP

22. The SREP evaluation of the IRAP and, where applicable, the ICAAP covers all activities of a Bank and takes all relevant data collected during the supervisory process into account. The SREP evaluation process will use desk based reviews, Bank visits and meetings to arrive at a final view. As part of the SREP, the AFSA will consider:

(a) the completeness of the ICAAP by ensuring that it covers all business areas, internal governance and all risk categories of the Bank;

(b) the soundness and quality of the ICAAP process in relation to the Bank’s size, business complexity and risk profile;

(c) soundness of qualitative calibration and quantitative methodology whenever employed by the Bank;

(d) execution of the ICAAP in terms of consistency, quality and documentation;

(e) adequacy of internal controls and quality assurance processes on the ICAAP; and

(f) adequacy of management information and whether the management had responded adequately and in a timely manner to such information.

23. Based on the SREP, the AFSA will form an assessment which will be communicated to the Bank and flow into the overall supervisory approach. The action required resulting from the ICAAP will be communicated to the Bank as part of a risk mitigation programme.

24. In relation to a Bank, where the AFSA does not agree with the results of the Bank’s ICAAP results, the AFSA will involve the Bank in a dialogue to reconcile any difference in view to arrive at a consensus estimate of the capital level required to address all risks identified either by the Bank or by the AFSA in its SREP. Such an estimate will be specified by the AFSA as the Individual Capital Requirement for the Bank. Where consensus is not possible the AFSA may impose an Individual Capital Requirement on a Bank.

Individual Capital Requirement (ICR)

25. Upon completing the SREP, the AFSA may impose an Individual Capital Requirement on a Bank as detailed in Chapter 11 of BBR. The ICR may be imposed where the AFSA concludes that the Bank should hold more capital to provide for its overall risks.