ILAAP stress testing: PRA expectations

It’s a Friday afternoon, and the deposit-tracking screen in the treasury function is moving the wrong way faster than anyone has seen. A funding line hasn’t rolled, a rumour is circulating, and outflows the annual plan had spread across a month are arriving in hours. The question in the room is brutally simple: does the buffer last until Monday? The Internal Liquidity Adequacy Assessment Process (ILAAP) exists so that the answer is known before the Friday arrives, not discovered during it.

The ILAAP is a firm’s own assessment of every material liquidity and funding risk it runs, the buffer it holds against those risks, and whether that buffer survives a range of stresses across the horizons that matter. It is the liquidity counterpart to the Internal Capital Adequacy Assessment Process (ICAAP), and like the ICAAP it is firm-led: the institution does the analysis and owns the conclusion, then defends it to the supervisor.

The supervisor on the other side is the Prudential Regulation Authority (PRA), and its review carries consequences. Its expectations are also moving: Silicon Valley Bank’s failure in March 2023 reshaped what a credible liquidity stress looks like, and the framework is now facing its first comprehensive proposed overhaul since the post-crisis rules were retained in UK law.¹ Stress testing is where those expectations are most concrete, and it is where this piece concentrates.

What the ILAAP has to prove

The PRA’s expectations live in one place: supervisory statement SS24/15, "The PRA’s approach to supervising liquidity and funding risks", most recently updated in January 2026. Everything that follows draws on it. SS24/15 doesn’t impose a single template. It applies proportionality in the statement’s own terms: the ILAAP "should be proportionate to the nature, scale and complexity of the firm’s activities as set out in Chapter 13 of the ILAA rules".² Proportionality never excuses leaving a material risk uncovered.

At its core, the ILAAP has to demonstrate four things:

• Every funding dependency the firm runs, and how resilient each one is when conditions turn.
• The composition and quality of the internal liquidity buffer, not merely its size.
• The firm’s capacity to generate liquidity from its own assets under stress.
• A viability assessment: whether the firm survives the stresses it has modelled, across the horizons that matter.

For euro-area significant institutions the ECB sets out a comparable ILAAP framework.³

The assessment then feeds the Liquidity Supervisory Review and Evaluation Process (L-SREP), the PRA’s formal review of the ILAAP and its conclusions. The L-SREP can result in firm-specific Pillar 2 liquidity guidance, or in requirements on the size and composition of the buffer. The relationship mirrors the capital side: the ILAAP feeds the L-SREP as the ICAAP feeds the capital-side Supervisory Review and Evaluation Process (SREP). The difference is the clock. Capital adequacy plays out over at least a three-year planning horizon; liquidity adequacy is tested from overnight out to three months, with the sharpest test measured in days.

What scenarios and horizons must an ILAAP stress test cover?

Stress testing is the analytical core of the ILAAP, and it is where the PRA’s expectations are most specific. A firm must model a range of scenarios, not just one. SS24/15 requires at least three: a name-specific stress in which the firm alone loses the market’s confidence, a market-wide stress in which funding dries up for everyone, and a combination of the two. Each must be calibrated to the firm’s own funding structure and business model, not lifted from a single standardised scenario, because the run that breaks a wholesale-funded challenger bank looks nothing like the one that breaks a retail deposit-taker.

The horizons are stated differently. SS24/15 sets two reference points, the 30-day LCR horizon and survival days along the firm’s own risk-appetite horizon, and expects daily granularity across both, so the firm chooses where to read the curve rather than working to a fixed ladder.²

Multiple horizons matter because liquidity risk isn’t uniform across time, and daily granularity is what exposes that. Common practice reads the curve at overnight, one week, one month and three months. The overnight and one-week points test whether the firm survives the first, sharpest phase of a run, when the most volatile funding leaves and the buffer is the only thing standing. The one-month and three-month points test whether the firm can rebuild a stable funding position before the buffer is exhausted. A firm can pass at three months and still fail overnight, which is precisely why a single-horizon test isn’t enough. For each scenario at each horizon, the firm quantifies its net cash-flow position and asks whether the liquid asset buffer covers the outflows all the way through.

Buffers you can actually monetise

A buffer only counts if it can be converted into cash at the moment cash is needed. This is the distinction the PRA is moving to make explicit: not how large the liquid asset buffer is, but whether it can be monetised under the conditions of an actual stress. The obligation is not new, and CP5/26 says as much: the existing framework already "requires firms to manage the risk that firms may be unable to monetise sufficient liquid assets to meet liquidity outflows in a stress", but "does not provide sufficient details on the specific aspects that firms should consider in managing this risk".¹

An asset that is liquid in calm markets and unsellable in a crisis is not a buffer; it is a hope.

The standardised rules behind the buffer are the Liquidity Coverage Ratio (LCR) and the Net Stable Funding Ratio (NSFR), retained in UK law after Brexit. The LCR requires a firm to hold enough high-quality liquid assets (HQLA) to cover its net outflows over a 30-day stress, at a ratio of at least 100% under the Basel Committee on Banking Supervision’s standard: for every pound of net outflow expected in the stress, a pound of liquid assets on hand.⁴ The NSFR is the structural companion, requiring longer-dated assets to be funded by stable liabilities. The LCR and the NSFR set the floor; the ILAAP tests whether that floor is actually high enough for the firm’s own risks.

Two practical expectations follow. The first concerns spending the buffer. A firm can’t simply start selling its liquid assets when trouble hits: drawing down the buffer needs the PRA’s agreement, under a plan agreed in advance, so the conditions and triggers are settled in calm markets rather than negotiated mid-crisis.

The second concerns back-up liquidity, which SS24/15 addresses directly.² A firm can pre-position collateral at the Bank of England as contingent liquidity: assets parked with the central bank in advance, ready to be borrowed against in a stress. The ILAAP has to include that borrowing capacity in its projections and test how quickly it can actually be mobilised. Contingent liquidity that cannot arrive in time is not contingent liquidity.

How did Silicon Valley Bank change what the PRA expects from a liquidity stress?

The ILAAP’s horizons and monetisation tests all sharpened for one reason. When Silicon Valley Bank failed in March 2023, digital banking and social media drove deposit outflows at a speed the post-crisis rules had never contemplated, and the PRA has since built its case for reform on exactly that gap.¹ The standardised 30-day run-off assumptions in the LCR were built on a pre-digital picture of how fast depositors move. A run that regulators had imagined unfolding over weeks can now empty a bank in a few days.

The PRA’s response is CP5/26, "Modernising the liquidity policy framework", published in March 2026 with the consultation closing on 17 June 2026. It is the first comprehensive update to the UK Pillar 2 liquidity framework since the post-crisis rules were retained, and its centrepiece for stress testing is a new sudden-outflow scenario designed to capture exactly the digital deposit flight the existing calibration missed. It also writes the monetisation test into the rulebook itself, reframing the Overall Liquidity Adequacy Rule around how quickly assets become cash, and brings ILAAP governance under the PRA’s model risk expectations.

The deeper point is that the worst plausible scenario has moved. Calibrating the most severe name-specific stress to the run speeds the post-crisis rules assumed is no longer defensible, and the ILAAP is where a firm has to show it has absorbed that.

What does reverse stress testing add to a liquidity assessment?

Conventional stress testing starts with a scenario and asks what it does to the firm. Reverse stress testing inverts it: fix the endpoint at the firm’s failure, and work backward to what would get there. The PRA defines that endpoint as the moment the market loses confidence in the firm, which "may be reached well before the firm’s financial resources are exhausted".

Because failure is a confidence event rather than a capital-exhaustion one, reverse stress testing is liquidity’s sharpest question: what loss of confidence would empty the buffer regardless of its size? It is a separate, firm-wide requirement under SS31/15 rather than part of the ILAAP itself,⁵ and our companion piece on reverse stress testing covers it in full⁶. The aim isn’t to pass; it’s to know where the edge is.

What the PRA actually tests

For a treasury and risk function, the ILAAP isn’t a document-production exercise. It is the evidence that the firm has asked the hard questions before a supervisor does: how fast the buffer becomes cash, and whether the scenario that tests it is honest. The PRA reads the ILAAP to see whether the firm has identified its real funding vulnerabilities, calibrated its stresses to its own balance sheet rather than a generic template, and held a buffer that survives the fastest plausible run across every horizon that matters.

The practical work this quarter isn’t another buffer increase. It is being able to answer three questions in front of the L-SREP: which scenario would actually break this firm, and how fast; whether the buffer can be monetised in time under that scenario; and whether the drawdown and central bank mobilisation steps are agreed and tested rather than assumed. The first question outranks the other two, because their answers depend on it. A firm that can answer all three convincingly already knows how its Friday afternoon ends. A firm that cannot has a document, not an assessment.

Frequently asked questions