How to write an ICAAP: a practitioner’s guide with structure and board checklist

It uses it to decide how much capital you must hold above Pillar 1. The ICAAP is your input to the SREP, and the SREP sets Pillar 2 capital: Pillar 2A for risks that Pillar 1 does not capture, or does not capture fully, and the PRA buffer that sits above your requirements so you can withstand a stress.

Pillar 1 plus Pillar 2A is your Total Capital Requirement. Pillar 2B covers the risks you may face over a forward-looking horizon, including under stress. Behind all of it sits the overall financial adequacy rule in the ICAA Part: a firm must always hold enough financial resources that its liabilities can be met as they fall due.

The ICAAP does not arrive alone. The Pillar 2 data items go in with it: FSA071 from every firm, and FSA072 to FSA075 for operational risk from significant firms and firms with an AMA permission. Since 1 January 2026, firms in scope of the step-in risk rules also file SI700.00, and SI01.00 and SI02.00 where they apply, at the same time as the ICAAP.

A practitioner’s note: the supervisor reads the document with those returns open beside it. A Pillar 2A figure in the narrative that does not match the template, or an entity described in the step-in return that the risk assessment never mentions, is the first question in the SREP meeting. We reconcile the document to every return before it goes to the board.

For the basics, start with what an ICAAP is. This guide is for the people who write one and the board that approves it.

Sources: PRA SS31/15 The ICAAP and the SREP, paras 2.1, 5.10, 5.14 and 5.20, current version effective 1 July 2026; PRA Rulebook, Internal Capital Adequacy Assessment Part, rule 2.1; Reporting Pillar 2 Part, rules 1.1 and 3.1 to 3.2; Regulatory Reporting Part, 24.4 and 24.5.

The PRA does not set a single chapter list for the ICAAP, and SS31/15 expects the assessment to be the firm’s own. The structure below is the one we use.

Every material risk that Pillar 1 does not capture or captures only in part. SS31/15 names interest rate risk in the banking book among them, and operational risk carries the most detailed expectations. In the drafts we review, credit concentration is where smaller lenders most often carry exposure that the standardised risk weights do not reflect.

Operational risk is the section supervisors test hardest. SS31/15 expects an approach that captures potentially severe exposures at a soundness standard comparable to a 99.9% confidence interval over one year, using scenario analysis that covers at least the Basel event types in Annex 2 of the Operational Risk Part. Internal and external loss data should both be used, with a systematic process for deciding when external data applies. Smaller firms may use a simplified approach to aggregating scenarios.

When the PRA sets the operational risk add-on it looks at your business model, your ICAAP analysis (historical losses and the design and severity of your scenarios), the quality of your own assessment, what it has learned from engaging with you and a peer comparison. For significant firms the methodology also fits your scenarios to a fat-tailed distribution, which is why each scenario needs either one frequency and at least two severity points, or at least two annual impact assessments. A scenario written as a single loss figure cannot be used that way.

• From 1 January 2027 the PRA retires the refined methodology for all firms (PS2/26).
• PS15/26 removes the benchmarking methodology, IRB benchmarks included, and brings in systematic methodologies for exposures to central governments and central banks, to regional governments and local authorities, and for retail unconditionally cancellable commitments. Phase 2 is due for consultation in 2027.
• The SME and infrastructure support factors leave Pillar 1 and return as firm-specific Pillar 2A adjustments, so their removal does not raise overall requirements (PS7/25).
• PS15/26 left the Pillar 2A operational risk methodology unchanged.
• Where step-in risk applies, SS1/25 expects it to be addressed, if appropriate, in the internal capital adequacy assessment.

Our operational risk capital page covers the method in more depth.

Sources: PRA SS31/15, paras 2.18A to 2.18K; PRA SoP5/15, paras 4.9A, 4.9D, 4.15 and 4.16; PS2/26, para 1.11; PS15/26, 28 May 2026, paras 1.6, 1.12, 2.1 and 3.1; PS7/25; SS1/25, para 3.2.

1 January 2027Basel 3.1 applies, except the internal model approach for market risk (1 January 2028)

It must show capital resources against requirements in every year of the plan on the rules that will apply in that year. For an ICAAP written now, that means Basel 3.1 risk-weighted assets from 1 January 2027 and, for firms with internal models where the output floor applies, a floor that rises each year.

The minimum ratios do not change: CET1 of 4.5%, Tier 1 of 6% and total capital of 8% of total risk exposure amount, with the capital conservation buffer of 2.5% on top. What changes is the denominator.

• Existing real estate exposures must be assessed for material dependence on property cash flows by 1 January 2027, and revalued where you estimate a fall of more than 10% since the last valuation. The result moves risk weights in year one of the plan.
• The PRA does not intend to count the same risk twice in Pillar 1 and Pillar 2A. Its off-cycle review will rebase variable Pillar 2A and the PRA buffer, and it does not need a full ICAAP.
• During the floor transition, the PRA will rebase Pillar 2 so that floor-driven RWA increases do not raise Pillar 2A where the risk is unchanged. Model that rebasing explicitly rather than holding Pillar 2A flat as a percentage.

A practitioner’s note: the most common error we find is a plan that starts from the risk-weighted assets in the last regulatory return while projecting a different balance sheet. Run the base year through the same model as the projections. Our paper on the output floor covers the floor calculation in detail, and the RisKIT capital models (pre-built, open Excel, with every formula visible, in versions for the current rules and for Basel 3.1) give a starting point with set-up and validation support.

Sources: Bank of England, PS1/26 Implementation of Basel 3.1: final rules, 20 January 2026, paras 1.23, 1.24 and 2.6; PS1/26 Appendix 1 rule instrument, Article 92(1), 92(2A) and 92(5); PS9/24, paras 6.2, 6.6 and 6.11; PRA Rulebook, Capital Buffers Part, 2.1.

The cycle, the guidance and some of the methods. Since 20 January 2026, SDDTs other than new and growing banks update the ICAAP and ILAAP, and the Pillar 2A and 2B parts of the ICAAP, every two years. The reverse stress-testing frequency changed on the same date. From 1 January 2027 an SDDT follows SS4/25 in place of SS31/15.

Pillar 2A moves to simplified methodologies for credit, credit concentration and operational risk under SoP5/25. A Single Capital Buffer of at least 3.5% of risk-weighted assets replaces the capital conservation buffer, the countercyclical buffer and the PRA buffer, and for new and growing banks it covers six months of projected operating expenses, still at no less than 3.5%. A non-cyclical stress testing framework replaces the cyclical one, and the step-in risk rules do not apply.

As of 13 October 2025, 56 of around 80 eligible firms had opted in. Entry is by modification by consent, so an eligible firm can stay outside, and the PRA will review the criteria no later than the end of 2028.

A practitioner’s note: a two-year cycle is not a lighter ICAAP. A document that has to hold for two years needs clearer triggers for an off-cycle refresh, because the business will change inside that window. Our paper on whether your bank should join the SDDT regime sets out the choice.

Sources: PRA PS4/26 The Strong and Simple Framework, 20 January 2026, paras 1.12, 1.15 and 1.16; PRA PS20/25, 28 October 2025, paras 1.14, 1.17, 1.38, 4.43 and 4.58; PRA PS15/23, 5 December 2023, para 2.27.