ICAAP as strategic instrument — not as annual paperwork

The Internal Capital Adequacy Assessment Process was conceived under Pillar 2 of the Basel framework as a deliberate counterweight to Pillar 1. Pillar 1 specifies a regulatory capital floor. Pillar 2 asks the institution to determine, on the basis of its own risk profile and forward-looking strategy, how much capital it actually needs to hold. The two numbers are rarely the same. The Pillar 1 floor is, by design, a standardised minimum. The Pillar 2 ICAAP is, by design, the institution’s own answer to the question of capital adequacy.

That distinction is the one most often lost in how ICAAP is actually conducted at institution level. The annual ICAAP submission becomes a document that demonstrates compliance with the regulatory expectation that an ICAAP exists. It uses Pillar 1 capital ratios as its central numbers, applies stresses to those numbers, and submits the result. The exercise is genuine. It is also not what Pillar 2 was designed to require, and it is increasingly not what GCC supervisors are looking to see when they review submissions.

What the Pillar 2 framework actually requires

The Basel Committee’s Pillar 2 framework, set out most directly in the supervisory review process documentation and adopted into the CBUAE Standards and Guidelines for Capital Adequacy, sets four principles. The institution must have a process for assessing its overall capital adequacy in relation to its risk profile, and a strategy for maintaining capital levels. Supervisors should review and evaluate that process and strategy, and take supervisory action if not satisfied with the result. Supervisors should expect institutions to operate above the minimum regulatory ratios. Supervisors should intervene at an early stage to prevent capital falling below prudent levels.

The active verb in the first principle is assessing. The framework was not asking institutions to recompute the Pillar 1 number with stress overlays. It was asking institutions to assess capital adequacy in relation to risks that Pillar 1 either does not cover or under-captures. Concentration risk, interest rate risk in the banking book, business model risk, strategic risk, reputational risk, and increasingly climate and operational resilience risk — none of these are fully addressed in Pillar 1 capital. The Pillar 2 ICAAP is, in principle, the place where they are.

In GCC practice, the relevant supervisory expectations are set out by CBUAE in the Standards re Capital Adequacy and the parallel Guidance documents, by SAMA in the SAMA Capital Adequacy framework adoption, and by CBB in the Capital Adequacy Module under the Rulebook. The regulatory frame is broadly consistent across jurisdictions, with some variance in stress scenario parameters and submission cadence. What is also broadly consistent is the supervisory direction of travel: away from ICAAP as a Pillar 1 stress exercise, toward ICAAP as a Pillar 2 strategic exercise.

Where compliance ICAAP falls short of supervisory expectation

The most common pattern in compliance-oriented ICAAP submissions is that the document is technically complete and substantively disconnected from how the institution actually operates. The risk appetite statement is appended, but the capital figures in the ICAAP do not visibly trace back to risk appetite limits. The stress scenarios are applied to Pillar 1 numbers, but their implications for business strategy or capital allocation are not surfaced. The recovery plan, where one exists, sits in a separate document with separate triggers, and the link between ICAAP stress scenarios and recovery plan activation is not explicit.

Each of these gaps is, individually, fixable. Together they describe the difference between an ICAAP that documents compliance and an ICAAP that informs decisions. The supervisor reviewing the submission can see the gap. The supervisor’s question — increasingly common in thematic reviews — is not whether the ICAAP exists but whether the institution can demonstrate that the ICAAP feeds decisions on capital allocation, business mix, pricing, and risk-taking.

The harder version of the same question is the one the audit committee tends to ask, in a softer register. If the ICAAP scenarios show the institution losing 350 basis points of CET1 in a severe stress, what specifically would the institution do differently this year than last year as a result.

If the answer is nothing — the strategy stays as planned, the dividend policy is unchanged, the concentration limits are unchanged — then the ICAAP is not yet doing the work Pillar 2 was designed to require.

What a strategic ICAAP looks like in practice

A Pillar 2 ICAAP that holds up under thematic review tends to share several characteristics that distinguish it from a Pillar 1 stress recomputation.

Risk appetite is wired into capital. The risk appetite statement is not a separate paragraph — its limits show up as constraints in the capital adequacy projection. A breach in a risk appetite limit in the projection forces a recalculation of the strategy or the appetite, not just a footnote.

Capital is allocated to business lines, not held centrally. The ICAAP projection shows how much capital is supporting the retail book, the corporate book, the project finance book, the trading book. Returns are compared to capital allocated, not to balance sheet size. The board’s strategic conversation moves from “growth in assets” to “growth in risk-adjusted returns on allocated capital.” That is the language Pillar 2 was meant to enable.

Multi-year stress feeds back into strategy. The ICAAP does not stop at “here is the capital under stress.” It surfaces what the institution would do differently — slower loan book growth, higher capital retention, change in business mix — to keep the projected position above its own internal capital thresholds. Those scenario-driven strategic adjustments become the connective tissue between ICAAP and the strategic plan.

The recovery plan is linked, not parallel. The stress scenarios in the ICAAP have explicit triggers in the recovery plan. If a stress condition materialises, the institution does not need to debate whether it has entered recovery — the link is pre-defined and pre-approved by the board.

Concentration risk gets its own capital number. Single-name, sector, and geographic concentrations carry capital add-ons that are calculated separately, justified separately, and updated as the portfolio moves. The supervisor reviewing the submission can see the concentration number, not just the Pillar 1 number with a generic uplift.

None of these elements are exotic. Each of them is in the spirit of the original Pillar 2 design. What makes them rare in practice is not technical difficulty but the organisational discipline required to keep risk appetite, capital allocation, stress testing, recovery planning, and strategic planning aligned across the institution.

A closing observation

That connective tissue is what distinguishes an ICAAP that exists from an ICAAP that does what Pillar 2 was meant to require. It also tends to be what distinguishes a clean supervisory dialogue from a difficult one. The investment is rarely in the numbers themselves. It is in the chain of accountability that runs through them.