What is an ICAAP? A plain-English guide for UK banks

What does the PRA actually require?

The obligation sits in the Internal Capital Adequacy Assessment Part of the PRA Rulebook. The overall financial adequacy rule requires a firm to hold, at all times, financial resources adequate in amount and quality to meet its liabilities as they fall due. The ICAAP is how the firm shows itself, its board and its supervisor that it does.

The PRA’s expectations are in supervisory statement SS31/15. Paragraph 2.1 sets the standard in three sentences worth reading twice. The assessment must be ongoing and must cover the major sources of risk to the firm’s ability to meet its liabilities. It must include stress testing and scenario analysis. And a firm that is “merely attempting to replicate the PRA’s own methodologies” is not carrying out its own assessment at all.

That last point is where many first drafts fail. An ICAAP that takes last year’s Pillar 2A figure and works backwards only reconciles to it, and the supervisor can tell.

How often does the ICAAP have to be updated?

Annually, under SS31/15 paragraph 2.1: the ICAAP “should be documented and updated annually”, or more often if a change in the business, its strategy or its operating environment means current resources may no longer be adequate. Stress tests and scenario analysis should also run at least annually (paragraph 3.8).

Small domestic deposit takers are the exception. Since 20 January 2026, under PRA PS4/26, an SDDT other than a new and growing bank updates its ICAAP and ILAAP every two years, and SS4/25’s expectations on how often it updates its ICAAP apply from the same date; the rest of SS4/25 replaces SS31/15 for SDDTs from 1 January 2027 (PS4/26 paragraph 1.16). Our page on the SDDT regime covers who qualifies.

What goes into an ICAAP?

The Rulebook and SS31/15 point to the same core contents, scaled to the size and complexity of the firm:

• an inventory of the firm’s material risks, with evidence for any risk it has judged immaterial (SS31/15 paragraph 2.3 expects the firm to be able to show the assessment behind that call);
• an assessment of capital for risks Pillar 1 does not fully capture, such as credit concentration, interest rate risk in the banking book, pension obligation risk and operational risk beyond the Pillar 1 figure (Pillar 2A);
• stress testing and scenario analysis, and a projection of capital resources and requirements over three to five years, before and after the management actions the firm could realistically take (paragraphs 3.8 and 3.9);
• reverse stress testing: the scenarios that would make the business model fail;
• the governance around all of it, and the management body’s approval.

Proportionality cuts both ways. A small lender can write a shorter ICAAP, but it still has to cover every material risk, and a short document with thin evidence is not the same thing as a proportionate one.

Who owns the ICAAP?

The board. SS31/15 paragraph 2.2 expects the ICAAP to be “the responsibility of a firm’s management body”, approved by it and used as an integral part of the firm’s management and decision making. In the SREP the PRA takes the degree of the management body’s involvement into account (paragraph 5.2). It may meet the board, and it expects the management body to understand the ICAAP well enough to take responsibility for it, with management “prepared to discuss and defend all aspects” of it (paragraph 5.7).

In practice the chief risk officer and the risk function prepare it, finance owns the capital plan and treasury brings in funding and liquidity. The test we apply to any draft is simple: could a non-executive director explain, without notes, why the firm holds the capital it does and what would change that answer? If not, the board has signed the ICAAP without owning it.

How does the PRA use the ICAAP in the SREP?

The ICAAP is the firm’s input to the SREP. The PRA reviews it to decide whether all material risks have been identified and whether the amount and quality of capital are enough (paragraph 5.3). It also considers the firm’s vulnerabilities under reverse stress testing, and it can ask for the design and results of those tests (paragraphs 5.2 and 5.4). Two numbers come out. The Pillar 2A requirement, which with Pillar 1 makes up the Total Capital Requirement, and the PRA buffer, a firm-specific amount of capital held above it so the firm can withstand a stress.

Those figures are largely confidential. SS31/15 expects firms to disclose their Total Capital Requirement publicly at the highest level of UK consolidation, and to treat its components and the PRA buffer as confidential unless the law requires otherwise (paragraph 5.37). The ICAAP document itself stays between the firm and its supervisor.

How do the ICAAP and the ILAAP fit together?

The ICAAP deals with capital, the ILAAP with liquidity. They are separate documents under separate Rulebook Parts, but the same stress should drive both. A scenario that erodes capital in the ICAAP usually drains funding too, and a supervisor reading the two side by side will notice if they describe different worlds. We build one scenario set and run it through both. Our ILAAP page covers the liquidity side.

What changes in the ICAAP in 2027?

Basel 3.1 takes effect on 1 January 2027 under PRA PS1/26, published on 20 January 2026. It changes risk-weighted assets under the standardised approaches and phases in the output floor for firms using internal models, so the Pillar 1 figures in the next ICAAP will move. The PRA has said it will rebase Pillar 2A so that the same risk is not counted twice. Most boards will first see the new numbers in their ICAAP, which is why the work needs to start before the capital plan is drafted. Our article on what Basel 3.1 changes for UK banks sets out the detail. Every dated PRA change to 2030 is in our regulatory tracker.

Where do ICAAPs usually go wrong?

• The stress narrative quotes different numbers from the capital plan tables, because they were written by different people from different model runs.
• Management actions assume a capital raise or asset sale that would not work in the stress described.
• Reverse stress testing stops only when capital reaches zero, when the firm would lose market confidence long before then, and it has no link to the recovery plan.
• A risk is called immaterial with no evidence of the assessment behind the call.

Each of these is fixable, and each is cheaper to fix before the board meeting than after the SREP letter. Our ICAAP service covers writing a first ICAAP, reviewing a draft before approval and building the capital model, and the RisKIT capital models give a pre-built starting point in open Excel.

Questions readers ask

Does every bank need an ICAAP?

Yes. The PRA requires one from every bank and building society and reviews it in the SREP.

How often does an ICAAP have to be updated?

Annually, or more often if a change in the business, its strategy or its operating environment means current resources may no longer be adequate (SS31/15 paragraph 2.1). Since 20 January 2026 an SDDT other than a new and growing bank updates its ICAAP every two years (PS4/26).

Who approves the ICAAP?

The management body. SS31/15 paragraph 2.2 makes the ICAAP the responsibility of the firm’s management body, approved by it and used in its decision making.

Is the ICAAP published?

No. The document stays between the firm and its supervisor. Firms disclose their Total Capital Requirement at the highest level of UK consolidation and treat its components and the PRA buffer as confidential unless the law requires otherwise (SS31/15 paragraph 5.37).

Sources: PRA SS31/15 The ICAAP and the SREP, paragraphs 2.1 to 2.3, 3.8, 3.9, 5.2 to 5.4, 5.7 and 5.37; PRA Rulebook, Internal Capital Adequacy Assessment Part; PRA PS4/26 (20 January 2026); PRA PS1/26 (20 January 2026); PRA PS9/24 (12 September 2024).