What is ICAAP? A Pillar 2 guide for UK banks

Every year a UK bank’s capital team writes a document that no customer will ever see and no competitor will ever read, and that nonetheless helps decide how much capital the firm must hold. It can run long. It has an audience of one regulator: the supervisors at the Prudential Regulation Authority who will use it to set the firm’s capital requirement for the year ahead. That document is the Internal Capital Adequacy Assessment Process, or ICAAP. The ICAAP’s standard rhythm is annual, though small domestic deposit takers (SDDTs) moved to a different instrument and a longer cycle in January 2026.¹

The ICAAP is a firm-led self-assessment of all the material risks a bank runs, the capital and other resources it needs to cover them, and the quality of the processes it uses to manage them. It is not a return to be filled in. SS31/15 puts the point sharply: "If a firm is merely attempting to replicate the PRA’s own methodologies, it will not be carrying out its own assessment in accordance with the ICAA rules."² It wants a narrative: the bank’s own honest account of what could go wrong, and what it holds against the possibility.

That account matters because it feeds the Supervisory Review and Evaluation Process (SREP), through which the PRA sets each firm’s Pillar 2 capital (PRA, SS31/15, Ch.5). Pillar 2 is where the requirement stops being a standard formula and becomes specific to the firm, and for many banks it is the part of the stack that bites hardest. Pillar 2 is also a moving target: the PRA is rebuilding the credit-risk methodology behind Pillar 2A, with the changes taking effect on 1 January 2027.

What the ICAAP actually is

For firms outside the small domestic deposit taker regime, the ICAAP’s standing instrument in the UK is PRA Supervisory Statement SS31/15, in force and most recently updated in December 2025.² SDDTs leave its scope on 1 January 2027 and pick up SS4/25 and SoP5/25 instead.¹ It frames the ICAAP as a firm-led assessment of all material risks, the resources held against them, and the processes used to manage them. The emphasis on firm-led is deliberate. The PRA expects the bank to make its own case, not to reproduce a supervisory template.

A UK bank’s capital requirement is built in layers, and the ICAAP speaks to the layers above the Pillar 1 minimum.

• Pillar 1: the minimum requirement, set by standardised rules that apply to every firm, covering credit, market, and operational risk.³
• Pillar 2A: the firm-specific add-on, set by the PRA through the SREP to cover risks Pillar 1 captures poorly or not at all, such as credit concentration, pension obligations, and interest rate risk in the banking book (set out in the PRA’s Statement of Policy, SoP 5/15).
• The PRA Buffer (Pillar 2B): a further firm-specific amount, sized from the bank’s own stress testing, meant to be usable in a downturn so the firm can keep operating rather than breach its minimum.

Pillar 1 is the same calculation for every firm. Pillar 2 is the bank’s own case, tested by the supervisor, and the ICAAP is how that case is made. A parallel process, the Internal Liquidity Adequacy Assessment Process (ILAAP), is applied to liquidity and funding.⁴

Which risks does Pillar 1 miss?

Pillar 2A exists because Pillar 1 is a blunt instrument. Its standardised formulae capture the broad shape of credit, market, and operational risk, but they miss risks specific to how an individual bank is built. SS31/15 expects a firm to assess every material risk, including those Pillar 1 does not reach, and to quantify an add-on for each under both normal and stressed conditions.

The usual suspects are concentration risk, where a portfolio is exposed to a single name, sector, or region more heavily than the average book; pension obligation risk, from a defined-benefit scheme; and interest rate risk in the banking book (IRRBB), the sensitivity of a bank’s earnings and capital to rate moves. The sum of these add-ons is the heart of a firm’s Pillar 2A case.

Two principles govern the whole exercise. The first is proportionality: the ICAAP must match the nature, scale, and complexity of the firm, so a small lender is not held to the documentary standard of a global bank. The second is the use test: the assessment must genuinely drive decisions, with the board owning the output (PRA, SS31/15, Ch.2). An add-on the board cannot explain is one the PRA will not accept.

Forward and reverse stress testing in the ICAAP

Capital is held against the future, so the ICAAP turns to stress testing. SS31/15 expects a firm to run a range of forward-looking scenarios, from a base case to severe stress, calibrated to its own risk profile rather than to a standard regulatory scenario, and to project its capital resources and requirements over a "three to five year horizon". SS31/15 leaves the choice of shocks to the firm, asking for "events of varying nature, severity and duration" that "can be economic, financial, operational or legal". In practice that means testing firm-specific and market-wide shocks alike. The PRA Buffer (Pillar 2B) is sized from how much capital the firm would burn through in these stresses while remaining a going concern.

One scenario type runs the logic backwards. Reverse stress testing asks not how bad it could get, but what would have to happen for the business to become unviable (PRA, SS31/15, Ch.4), and our companion piece works through it in detail⁵. The firm starts from the point of failure and works back to the events that would cause it. The PRA defines the point of failure as the moment the market loses confidence and the firm can no longer carry on its activities, and it is explicit that the point may be reached well before the firm’s financial resources are exhausted.

A bank can fail while still technically solvent. The point of non-viability can arrive well before the capital runs out.

The distinction between non-viability and the point at which capital runs out is the whole value of reverse stress testing. It forces a board to confront the scenarios it would rather not name. The board must then sign the analysis off and use it to inform risk appetite rather than leave it in an appendix. Approval by the management body is SS31/15’s own expectation;² for the operational detail of how to test to the point of failure, SS31/15 Chapter 4 points firms to FG11/07, guidance the FSA issued and the FCA inherited.⁶

How does the SREP set Pillar 2A and the PRA Buffer?

The ICAAP is the firm’s case; the SREP is the verdict. Through the Supervisory Review and Evaluation Process the PRA reviews the ICAAP alongside its own data and analysis, challenges the firm’s assumptions, and translates the result into the two firm-specific numbers that matter:²

• Pillar 2A guidance: the additional own funds the firm must hold for risks under-captured by Pillar 1.
• The PRA Buffer (Pillar 2B): the additional, usable capital the firm should hold to absorb its own stress scenarios and stay a going concern.

Neither Pillar 2A guidance nor the PRA Buffer is settled in the abstract. Both flow from the quality of the ICAAP and the supervisory dialogue around it, which is why the use test matters so much: the framework is built so that a firm which can evidence its assumptions is arguing from its own analysis rather than from whatever the supervisor’s own data suggests in its absence.

What changes for the ICAAP in 2027?

The assumptions a firm defends are about to change. From 1 January 2027, a good part of the credit risk case rests on new ones. The change is PS15/26, the PRA’s finalised Phase 1 review of the Pillar 2A framework, published on 28 May 2026.

The headline change is to the Pillar 2A credit risk methodology. PS15/26 removes the internal ratings-based (IRB) benchmarking approach, under which a firm’s standardised risk weights were compared against an IRB benchmark to flag possible under-capitalisation. The PRA’s reasoning is that Basel 3.1 has made the standardised approach itself more risk-sensitive, so the old benchmark adds little.

PS15/26 replaces the IRB benchmarking approach with two targeted methodologies. The first covers exposures to central governments, central banks, regional governments and local authorities, where the PRA’s concern is not that standardised weights are uniformly low but that they are likely to under-estimate the risk; it sets minimum effective risk weights by credit quality step. The second covers unconditionally cancellable retail commitments, the undrawn card and overdraft lines a bank may withdraw at will but rarely can in time.

Separately, the PRA consulted on expecting firms to run credit scenarios for idiosyncratic credit risk, then stepped back from it. Under PS15/26 firms have "greater flexibility to choose their approach to assessing idiosyncratic credit risk, rather than being expected to undertake credit scenario analysis", and a detailed assessment is expected only for the standardised-approach exposures most likely to carry risk that Pillar 1 misses.⁷

A second change, already in force, is administrative but consequential. PS2/25 restructured how the PRA communicates firm-specific requirements, moving them into the Capital Buffers Part of the PRA Rulebook from 31 March 2025 and retiring the older mechanism of individual capital letters and directions.⁸ The value of capital did not change; the plumbing did.

What a capital team owns

For a bank’s capital and risk team, the ICAAP is a reminder that the most important capital figure the firm reports is not handed down by a formula. The Pillar 2 case is argued. Pillar 1 can be computed; the Pillar 2 case has to be built, in the firm’s own words, and then defended in front of a supervisor who has read a great many such cases and can tell a live assessment from a compliance exercise.

The practical work, then, is not only modelling the add-ons. It is owning the narrative that connects them: why these risks are the material ones, why the stresses are severe enough, and why the board believes the numbers enough to run the bank by them. With the credit-risk methodology changing for 2027, the immediate task is concrete: map the current Pillar 2A credit assessment against the PS15/26 approach, and find out where the firm’s number moves before the PRA does.

Under the ICAAP, a bank argues its own capital number. The supervisor still decides it.

Frequently asked questions