What does the PRA Rulebook require in an ILAAP?
It requires the firm to meet the overall liquidity adequacy rule and to run a process that shows it does. Rule 2.1 of the Internal Liquidity Adequacy Assessment Part says a firm “must at all times maintain liquidity resources which are adequate, both as to amount and quality, to ensure that there is no significant risk that its liabilities cannot be met as they fall due”.
The Part applies to every CRR firm (rule 1.1), which covers banks, building societies and PRA-designated investment firms. Rule 2.2 adds an adequate buffer of high quality, unencumbered assets and a prudent funding profile, and it closes one door outright: liquidity that might come from a central bank’s emergency liquidity assistance cannot be counted.
Chapter 13 sets the process. The firm reviews its ILAAP regularly and assesses its liquidity and funding resources, its methods and assumptions, its stress test results and its compliance with the Part (rule 13.1). The ILAAP must name the measures in the liquidity contingency plan the firm would actually use (rule 13.1(4)). The firm keeps a written record for at least three years (rule 13.2), and the management body, which also sets the liquidity and funding risk appetite (rule 4.1), approves the ILAAP (rule 13.3).
What goes into an ILAAP document?
The firm’s approach to liquidity and funding, set out so the PRA can test it. SS24/15 gives two templates as a guide, a full one in Appendix 1 and a shorter one in Appendix 2 for small domestic deposit takers (paragraphs 2.4 and 2.5). Firms do not have to follow either line by line, but the PRA expects a document that is firm specific and “not prepared in a formulaic manner”, and it is “equally sceptical of overly large, unwieldy documents as it is of documents providing too little detail” (paragraph 2.5).
Whatever its length, the document should carry:
- a risk appetite statement “defining the duration and type of stress or stresses that the firm aims to survive”, cascaded into limits (SS24/15 paragraph 2.15);
- stress testing across a range of severe but plausible scenarios, including a macroeconomic stress, with the degree of conservatism discussed in the document (paragraph 2.18);
- the lowest point of cumulative stressed net cashflows, both inside the 30-day LCR horizon and across the firm’s own survival horizon, measured daily (paragraph 2.19);
- a prudent funding profile, and a tolerance for asset encumbrance set through metrics the firm reports internally and to the PRA (paragraphs 2.17A to 2.17D);
- where relevant, an overview of how the firm applies the LCR and NSFR rules in its reporting (paragraph 2.6A);
- an assessment of how fast it could turn each type of non-cash HQLA into cash, day by day, through repo and outright sale in a stress (paragraph 2.29A);
- the liquidity contingency plan, tested at least annually and approved by senior management (rules 12.1 and 12.3).
How does the PRA use the ILAAP in the L-SREP?
It tests the ILAAP as the firm’s own case and then gives the firm individual liquidity guidance (ILG). The liquidity supervisory review and evaluation process (L-SREP) runs “at a frequency which is proportionate to the nature, scale and complexity of a firm’s activities” (SS24/15 paragraph 3.1), so there is no fixed cycle for every firm.
The PRA checks the firm’s arrangements against the liquidity rules, evaluates its risks and what stress testing reveals, and judges whether its liquidity resources meet its needs over different horizons (paragraph 3.2). It may meet the management body, which “should be able to demonstrate an understanding of the ILAAP consistent with its taking responsibility for the ILAAP” (paragraph 3.6). The resulting guidance advises the firm of “the amount and quality of HQLAs” the PRA considers appropriate, beyond the buffer the LCR requires (paragraph 3.10).
The ILAAP sits on top of several layers, and they are easy to confuse:
| Layer | What it asks | Where it is set |
|---|---|---|
| Liquidity coverage ratio (LCR) | A liquidity buffer of at least 100% of net liquidity outflows over a 30 calendar day stress period | Liquidity Coverage Ratio (CRR) Part, Article 4 |
| Net stable funding ratio (NSFR) | Available stable funding of at least 100% of required stable funding | Liquidity (CRR) Part, Article 428b(2) |
| Pillar 2 liquidity | Risks Pillar 1 misses or under-captures: cash flow mismatch, franchise viability (such as debt buyback and early termination of non-margined derivatives), intraday liquidity and other liquidity risks | SoP1/18 (December 2023 version, effective 1 July 2024), chapters 3 to 6 |
| Individual liquidity guidance (ILG) | The amount and quality of HQLA the PRA considers appropriate, beyond the LCR buffer, plus qualitative actions | SS24/15 paragraphs 3.9 to 3.11, after the L-SREP |
| Overall liquidity adequacy | The firm’s own judgement that it has enough liquidity of the right quality; meeting the ratios and Pillar 2 guidance does not settle it | ILAA Part rule 2.1; SS24/15 paragraph 2.17 |
If the LCR or NSFR falls, or is expected to fall, below 100%, the firm must notify the PRA without delay and submit a plan to restore compliance (Liquidity (CRR) Part, Article 414(1)). A firm with total assets of £5 billion or more must be able to report PRA110 daily; a smaller firm must be able to report it weekly (Article 414(3)).
What survival period does the PRA expect?
The PRA does not set one survival period for every firm. The firm sets its own in its risk appetite statement (SS24/15 paragraph 2.15), and the PRA’s baseline is that firms “should survive throughout the granular LCR stress scenario (30 day horizon)” of its cash flow mismatch framework on a consolidated currency basis (paragraph 3.12).
The detail that matters is inside the 30 days. The LCR measures day 30, and the PRA’s Pillar 2 liquidity policy says a firm can meet its LCR “yet is not able to survive the stress scenario captured in the LCR itself”, because cumulative outflows can exceed available liquidity before day 30 (SoP1/18 paragraph 3.4). So the PRA computes flows with daily granularity (paragraph 3.8), and it watches the far side of day 30 too. Firms “may ‘window-dress’ their LCRs by pushing maturity mismatches just beyond the 30 day horizon” (paragraph 3.5(c)), so the PRA monitors a 90-day horizon through benchmark retail-only and wholesale-only scenarios (paragraphs 3.13 to 3.15).
The PRA does not generally apply Pillar 2 liquidity guidance to small domestic deposit takers (SDDTs), except for a particularly material idiosyncratic risk (SoP1/18 paragraph 1.6).
How often must the ILAAP be updated?
At least annually for most firms, and at least every two years for an SDDT or SDDT consolidation entity. That is rule 13.1(1) of the Internal Liquidity Adequacy Assessment Part in the version in force since 20 January 2026, introduced by PRA PS4/26.
SS24/15 puts it in terms of the document: SDDTs that are not new and growing banks “should update their ILAAP documents at least every two years”, and all other firms annually (paragraph 2.2). Any firm should update sooner if a change in its business or operating environment suggests its liquidity or funding is no longer adequate, and the PRA can ask an SDDT for an updated ILAAP, for example where the last one was of poor quality. Our SDDT regime page covers who qualifies.
How does the ILAAP connect to the ICAAP and the recovery plan?
Through the same stresses and the same contingency actions. SS24/15 paragraph 2.40A says the PRA “strongly encourages firms to combine their liquidity contingency plan (also known as a contingency funding plan) and their recovery plan into one integrated document”, and expects separate documents to be exceptional and consistent with each other.
The recovery planning statement pulls the same way. SS9/17 paragraph 2.60 encourages firms to keep recovery plan scenario testing consistent with the stress testing they use for the ICAAP and the ILAAP. For SDDTs the link becomes explicit on 1 January 2027, when SS4/25 takes effect: an SDDT can draw on its ILAAP work when it assesses liquidity risk in the ICAAP, and if the ILAAP highlights liquidity concerns the PRA expects the ICAAP to build on that analysis (SS4/25 paragraphs 2.6 and 2.7).
Our article on ICAAP vs ILAAP sets out the four places the two documents must agree, and which prudential assessment your firm needs compares every assessment side by side.
What would CP5/26 change?
It would add a new short, sharp stress scenario and tighten what the ILAAP document says about central bank collateral, governance and funding plans. The PRA published CP5/26, Modernising the liquidity policy framework, on 17 March 2026, and the consultation closed on 17 June 2026.
- A new firm-designed scenario “with sudden and severe liquidity outflows that peak during the initial days of a stress”, focused on the first week, with no requirement to extend it beyond seven days (paragraph 2.8).
- Drawing capacity on pre-positioned collateral, after haircuts, presented in the ILAAP across all legal entities and central banks, foreign facilities included (paragraph 2.31), with the assessment “reported to and approved by the firm’s management body” (paragraph 2.36).
- Illustrative guidance on what an ILAAP should contain, with a proportionate approach for SDDTs (paragraph 2.32).
- Governance expectations for preparing the ILAAP document (paragraph 2.41), and funding plans integrated with the strategic plan (paragraph 2.45).
Implementation would come in two phases. The central bank facility and pre-positioned collateral proposals, and the end of the PRA110 monetisation section, would apply as soon as the rules are made; everything else would apply 12 months later (paragraphs 1.21 and 1.22). In its Regulatory Digest of 1 October 2026 the PRA said it now expects to publish the policy statement in the first quarter of 2027 rather than the fourth quarter of 2026. Until then SS24/15 stands. Every dated change is in our regulatory tracker.
Where do ILAAPs usually go wrong?
Mostly where the document relies on a ratio the PRA has already said is not enough. The first check we make on any draft is whether the conclusion on overall liquidity adequacy at the front is the figure the stress testing produces at the back.
- Stress results reported at day 30 only, so the low point inside the window never appears. The PRA wants the lowest point measured daily (SS24/15 paragraph 2.19).
- Treating the LCR and NSFR as the answer. SS24/15 says “a firm cannot rely solely on meeting the NSFR, LCR and/or LCR and Pillar 2 guidance” to satisfy the overall liquidity adequacy rule (paragraph 2.17).
- Monetisation assumed rather than tested. SoP1/18 asks firms to consider how the accounting classification could get in the way of selling HQLA outright, in particular where a sale would crystallise a loss against the carrying value in the accounts (paragraph 3.5(b)).
- A contingency plan that sits apart from the ILAAP, when rule 13.1(4) requires the ILAAP to name the measures the firm would use and SS24/15 paragraph 2.40A wants the plan integrated with the recovery plan.
Our ILAAP service covers writing an ILAAP, reviewing a draft before approval and building the liquidity stress testing behind it, and the RisKIT liquidity models give a pre-built starting point in open Excel. Terms are defined in our glossary.
Questions readers ask
Does every bank need an ILAAP?
Yes. The Internal Liquidity Adequacy Assessment Part applies to every CRR firm (rule 1.1), which includes banks, building societies and PRA-designated investment firms.
Who approves the ILAAP?
The management body. Rule 13.3 says a firm “must ensure that its management body approves the firm’s ILAAP”. The liquidity contingency plan is approved by senior management (rule 12.3).
Is the liquidity contingency plan part of the ILAAP?
It is a separate requirement under rule 12.1, tested at least annually (rule 12.3), but the ILAAP must identify the contingency measures the firm would implement (rule 13.1(4)).
What is different for an SDDT?
A two-year review cycle (rule 13.1(1)), a shorter template in Appendix 2 of SS24/15, and in general no Pillar 2 liquidity guidance unless a particularly material idiosyncratic risk calls for it (SoP1/18 paragraph 1.6). SDDTs that are new and growing banks should still update their ILAAP documents annually (SS24/15 paragraph 2.2).
Sources: PRA Rulebook, Internal Liquidity Adequacy Assessment Part, rules 1.1, 2.1, 2.2, 4.1, 12.1, 12.3 and 13.1 to 13.3; PRA Rulebook, Liquidity Coverage Ratio (CRR) Part, Article 4; PRA Rulebook, Liquidity (CRR) Part, Articles 414 and 428b; PRA SS24/15 (January 2026 version), paragraphs 2.2, 2.4, 2.5, 2.6A, 2.15, 2.17 to 2.19, 2.29A, 2.40A, 3.1, 3.2, 3.6 and 3.9 to 3.12; PRA SoP1/18 Pillar 2 liquidity (December 2023, effective 1 July 2024), paragraphs 1.6, 3.4, 3.5, 3.8 and 3.13 to 3.15; PRA SS9/17 Recovery planning (March 2026), paragraph 2.60; PRA SS4/25 (effective 1 January 2027), paragraphs 2.6 and 2.7; PRA PS4/26 (20 January 2026); PRA CP5/26, Modernising the liquidity policy framework (17 March 2026), paragraphs 1.21, 1.22, 1.24, 2.8, 2.31, 2.32, 2.36, 2.41 and 2.45; PRA Regulatory Digest, September 2026 (1 October 2026). Accessed 10 October 2026.
How we research and check our articles: our editorial policy.
