ICAAP Report Template (Pillar 2, CRD Art. 73, ECB Guide)

ICAAP Report: [Institution name] [Reference date, e.g. 2026-12-31]

Internal Capital Adequacy Assessment Process (ICAAP) report for a credit institution under Pillar 2: the capital adequacy statement, business model and strategy, risk identification, risk quantification under the normative and economic perspectives, the three-year capital plan, adverse scenarios and reverse stress testing, buffers, management actions, data and validation, and the board sign-off. Based on Directive 2013/36/EU (CRD) Article 73 as amended by Directive (EU) 2024/1619 (CRD6), Regulation (EU) No 575/2013 (CRR) as amended by Regulation (EU) 2024/1623 (CRR3, applying from 2025-01-01), the ECB Guide to the ICAAP (November 2018, revised July 2026), EBA Guidelines on ICAAP and ILAAP information collected for SREP purposes (EBA/GL/2016/10), and the revised EBA SREP Guidelines (EBA/GL/2026/06, applying from 2027-01-01). Requirements are referenced by article and guideline number; obtain the regulation, directive or guideline for the normative text and check the consolidated text. Replace every [bracketed] value and every row marked Example. This is a document format, not financial, investment, legal, regulatory or accounting advice.

Document control

Approvals

Revision history

Contents

1. Capital adequacy statement and executive summary
2. Business model and strategy
3. ICAAP governance
4. Risk identification and materiality
5. Capital position and requirements
6. Economic perspective
7. Normative perspective and capital plan
8. Adverse scenarios and reverse stress test
9. Management buffer and management actions
10. Data, models and validation
11. Regulatory map and jurisdiction notes
12. Internal audit review and sign-off
13. Glossary and references
14. Standard and licence note

1. Capital adequacy statement and executive summary

1.1 Capital adequacy statement

Example: The management body of Fernhollow Bank has reviewed the ICAAP for the reference date 2026-12-31 and concludes that the bank's capital is adequate to cover its material risks and to carry out its strategy for 2027 to 2029. This conclusion rests on four findings. First, the CET1 ratio of 15.0% exceeds the overall CET1 requirement of 9.125% by 5.875 percentage points (EUR 1,175 million). Second, under the economic perspective internal capital of EUR 3,600 million covers the quantified risks of EUR 2,350 million by 153.2%, above the internal minimum of 120%. Third, the CET1 ratio stays above the overall capital requirement and the Pillar 2 guidance in every year of the adverse scenario, with a trough of 11.9% in 2028 before management actions and 12.35% after them. Fourth, the reverse stress test shows that only a combination of a deep commercial real estate crash and the default of the two largest borrower groups would bring the bank to its MDA threshold.

The management body accepts two vulnerabilities and has decided on actions: the adverse trough falls just below the risk appetite floor of 12.0% CET1, so the pre-approved management actions in section 9 are confirmed; and commercial real estate concentration is the largest driver of adverse losses, so the sector limit is lowered in steps from 14% to 12% of the loan book (13.5% at end-2027, 12.5% at end-2028, 12.0% at end-2029); on the plan assumptions the CRE share falls from 14.1% to 13.1%, 12.2% and 11.3% over the three years.

Signed for the management body: [Chair], [Chief Executive Officer], date YYYY-MM-DD.

1.2 Key figures

The coverage headroom is computed as internal capital minus 120% of quantified risk: 3,600 minus (1.2 x 2,350 = 2,820) = 780.

1.3 Changes since the previous ICAAP

Describe what changed in the business, the risk profile, the methodology, the supervisory requirements and the findings from the last SREP letter, and how each prior finding was closed.

2. Business model and strategy

Describe the business model in terms the supervisor can test against the numbers: the customer segments, products, geographies, funding model and the main sources of income and of risk. Link every strategic initiative to its effect on risk-weighted exposure, earnings and capital, so the capital plan in section 7 can be traced back to the strategy.

Example: Fernhollow Bank is a retail and commercial bank with total assets of EUR 47,400 million, operating in two EU Member States. It lends to households (residential mortgages EUR 22,000 million) and to small and medium-sized enterprises and mid-corporates (EUR 15,000 million, including commercial real estate of EUR 5,200 million). It is funded mainly by retail and SME deposits (EUR 33,000 million) and senior preferred bonds (EUR 5,000 million). Net interest income is about 75% of revenue. The 2027 to 2029 strategy grows SME lending by 4% a year, keeps mortgage growth at 3% and reduces commercial real estate as a share of the book.

Check the sum: 4,400 + 7,400 + 4,200 + 1,400 + 100 = 17,500, which equals credit risk RWEA 16,400 (4,400 + 7,400 + 4,200 + 300 + 100) plus market risk 1,000 plus CVA 100 in section 5.1; operational risk RWEA of 2,500 is not allocated to business lines in this table. The leasing subsidiary's credit RWEA of 1,575 sits within SME and mid-corporate lending; the Risk Appetite Statement (finance/risk-appetite-statement, section 7) shows it separately and allocates operational risk by share of revenue.

3. ICAAP governance

Set out the roles, the committees, the annual calendar and the use of ICAAP results. The ECB Guide to the ICAAP expects the management body to take responsibility for a sound ICAAP and for the ICAAP to be integrated into the overall management framework (Principles 1 and 2); describe here how that is achieved in practice, not in general terms.

Use of the ICAAP: list each decision the results fed into during the year, for example the risk appetite limits, the capital allocation to business lines, the risk-adjusted pricing hurdle, the dividend recommendation and the recovery plan indicators. Record the board's challenge (questions raised, changes made) in the minutes and summarise it here.

4. Risk identification and materiality

Run the risk identification at least annually and whenever the business or the environment changes materially. Start from a broad taxonomy, assess each risk gross (before mitigation) and net, and apply a documented materiality threshold. Explain every risk judged immaterial so the supervisor can follow the reasoning.

Treat climate and environmental risks as drivers of existing risk types rather than as a separate bucket, and explain how they affect credit, operational and business risk over the horizon. Do the same for ICT and third-party risk, which usually sit inside operational risk.

5. Capital position and requirements

5.1 Own funds and risk-weighted exposure

$\text{CET1 ratio} = \frac{\text{CET1 capital}}{\text{TREA}} = \frac{3{,}000}{20{,}000} = 15.0\%$

$\text{Leverage ratio} = \frac{\text{Tier 1 capital}}{\text{Total exposure measure}} = \frac{3{,}400}{50{,}000} = 6.8\%$

Check the TREA: 16,400 + 1,000 + 100 + 2,500 = 20,000. Market risk RWEA follows the current CRR internal model approach (CRR Articles 364 and 365) for general market risk and the standardised approach for specific risk, converted to RWEA at 12.5 times the own funds requirement (CRR Article 92(4)). Example: the 60-business-day average ten-day VaR is EUR 8.20 million and the 60-day average ten-day stressed VaR is EUR 13.80 million; with the multiplication factor of 3.50 that applies after the 2026-09-30 backtest (see the VaR Backtesting Report (finance/var-backtesting-report), section 7) and each multiplied average higher than the previous day's ten-day VaR and stressed VaR (CRR Article 364(1) takes the higher of the two), the IMA requirement is 3.50 x 8.20 + 3.50 x 13.80 = 28.70 + 48.30 = EUR 77.00 million. Standardised specific risk on the bond inventory adds EUR 3.00 million. Total market risk own funds EUR 80.00 million x 12.5 = RWEA 1,000 (IMA 962.5, standardised 37.5). Market risk is therefore 5% of TREA; keep this figure equal to the own funds return (COREP) at the reference date.

5.2 Requirement stack

The overall capital requirement combines the Pillar 1 minimum (CRR Article 92), the Pillar 2 requirement (CRD Article 104a) and the combined buffer requirement (CRD Articles 128 to 140, with distribution restrictions under Articles 141 and 142); Pillar 2 guidance (CRD Article 104b) sits above it and is not part of the MDA calculation (CRD Article 141).

Check the arithmetic: CET1 share of P2R is 56.25% x 2.0% = 1.125%; Tier 1 share is 75% x 2.0% = 1.5%. The combined buffer is 2.5% + 0.5% + 0.5% = 3.5%. OCR for CET1 is 4.5% + 1.125% + 3.5% = 9.125%, which is EUR 1,825 million on TREA of EUR 20,000 million, so the MDA headroom is 3,000 minus 1,825 = EUR 1,175 million. The leverage ratio requirement is 3.0% under CRR Article 92(1)(d); Fernhollow Bank has no leverage ratio buffer because it is not a G-SII.

5.3 Output floor test (CRR3)

CRR3 introduced the output floor (CRR Article 92(3) and the transitional factors in Article 465). Banks using internal models compare TREA with a floor equal to a percentage of the TREA calculated using only standardised approaches. The transitional factor rises each year from 50% in 2025 (check the consolidated text of Article 465 for the current schedule and any transitional relief).

Recompute: 55% x 23,500 = 12,925; 60% x 24,400 = 14,640; 65% x 25,300 = 16,445; 70% x 26,200 = 18,340. The gap between standardised and modelled TREA (3,500 in 2026) comes mainly from the IRB mortgage book (standardised risk weights under CRR3 loan-splitting against IRB risk weights of about 20%) and the IMA for market risk. The floor is not binding in any plan year; the headroom narrows from 7,075 to 4,060, so re-test it each year and whenever an IRB model is recalibrated.

6. Economic perspective

Under the economic perspective, the institution assesses whether its internal capital covers the economic value effects of all material risks. Define internal capital (typically starting from CET1 and adjusting for items such as hidden losses on amortised cost assets, deferred tax and items with no loss-absorbing capacity in a going-concern view), the risk measure (for example value at risk or expected shortfall), the confidence level and the time horizon. Explain the choices; the guide does not prescribe a single method.

Example: Fernhollow Bank quantifies risks at a 99.9% confidence level over one year and takes no diversification benefit between risk types. Internal capital of EUR 3,600 million starts from CET1 of 3,000, adds Additional Tier 1 of 400 because it absorbs losses while the bank continues as a going concern, adds unrecognised fair value gains on the fixed-rate mortgage portfolio net of tax (EUR 320 million) and deducts unrealised losses on held-to-collect bonds net of tax (EUR 120 million): 3,000 + 400 + 320 minus 120 = 3,600. Tier 2 is excluded because it absorbs losses only when the bank is no longer viable, so the methodology treats it as a liability in this perspective.

$\text{Economic capital coverage} = \frac{\text{Internal capital}}{\text{Quantified risk}} = \frac{3{,}600}{2{,}350} = 153.2\%$

Check the sum: 1,300 + 150 + 300 + 80 + 280 + 120 + 90 + 30 = 2,350.

Explain every risk type where economic capital is below the Pillar 1 requirement, because the ECB Guide to the ICAAP expects the bank to justify it. Example: credit economic capital (1,300) is slightly below the Pillar 1 credit requirement (1,312) because the IRB mortgage PDs are point-in-time and the portfolio model recognises collateral more granularly than the regulatory formula; the difference is explained in the methodology annex and is never used to reduce the normative view, where Pillar 1 applies in full. Assess the economic perspective over time as well: project how internal capital and quantified risk evolve under the baseline and the adverse scenario, and explain how the results inform the normative perspective (for example, an IRRBB economic value loss that is not visible in regulatory ratios but will flow into future earnings).

7. Normative perspective and capital plan

The normative perspective is a multi-year view of the institution's ability to meet all regulatory and supervisory capital requirements and to keep its management buffer. The ECB Guide to the ICAAP expects a forward-looking horizon of at least three years. Use the approved budget and strategic plan for the baseline, include every known regulatory change and planned capital action, and reconcile with the economic perspective.

7.1 Baseline capital plan

Payouts: 110 / 260 = 42.3%; 140 / 270 = 51.9%; 160 / 280 = 57.1%. Recompute every ratio: 3,150 / 20,800 = 15.14%; 3,280 / 21,600 = 15.19%; 3,400 / 22,400 = 15.18%. Tier 1: 3,550 / 20,800 = 17.07%; 3,680 / 21,600 = 17.04%; 3,800 / 22,400 = 16.96%. Leverage: 3,550 / 51,500 = 6.89%; 3,680 / 53,000 = 6.94%; 3,800 / 54,500 = 6.97%.

7.2 Key assumptions

8. Adverse scenarios and reverse stress test

Design the adverse scenario in the Stress Testing Programme (finance/stress-testing-programme) and report its capital effects here. The scenario must be severe but plausible, cover the whole horizon, reflect the bank's specific vulnerabilities and capture interactions between risks. Show results before and after management actions, and compare them with every layer of the requirement stack.

8.1 Adverse scenario results (SCN-002, stagflation with CRE correction)

Recompute: 3,000 + 380 minus 520 minus 110 minus 40 + 60 = 2,770; 2,770 + 300 minus 480 minus 20 + 50 = 2,620; 2,620 + 340 minus 200 minus 40 = 2,720. Ratios: 2,770 / 21,400 = 12.94%; 2,620 / 22,000 = 11.91%; 2,720 / 21,800 = 12.48%. Leverage: (2,770 + 400) / 51,000 = 6.22%; (2,620 + 400) / 51,000 = 5.92%; (2,720 + 400) / 52,000 = 6.0%. Cumulative impairments are 520 + 480 + 200 = EUR 1,200 million. The maximum CET1 depletion is 15.0% minus 11.9% = 3.1 percentage points. The 2028 trough remains 1.775 percentage points above OCR plus P2G (10.125%) and 2.775 points above the MDA threshold (9.125%), but 0.1 points below the risk appetite floor of 12.0%, which triggers the management actions in section 9.

8.2 Reverse stress test

The reverse stress test starts from an outcome and works backwards to the scenarios that would cause it. Define the outcomes (for example breach of the MDA threshold and breach of TSCR as a proxy for non-viability), find the loss size that causes each, and describe plausible combinations of events that would produce that loss.

Recompute: 9.125% x 22,000 = 2,007.5 and 5.625% x 22,000 = 1,237.5. Conclude whether the scenarios are implausible enough to accept or whether they call for action; feed the results into the recovery plan indicators (finance/recovery-plan).

9. Management buffer and management actions

9.1 Management buffer

The management buffer is the institution's own view of the capital it needs above regulatory and supervisory minima to keep its business model sustainable; the July 2026 revision of the ECB Guide to the ICAAP makes clear it is not a supervisory requirement and is separate from Pillar 2 guidance. Explain how the buffer was calibrated, for example from the adverse scenario depletion, earnings volatility and the time needed to execute actions.

Example: Fernhollow Bank sets its CET1 management buffer at 1.875 percentage points above OCR plus P2G, giving the risk appetite floor of 12.0% (10.125% + 1.875% = 12.0%). The buffer is calibrated at about 60% of the 3.1 percentage point CET1 depletion in the adverse scenario (1.875 / 3.1 = 60.5%), because the board judges that the pre-approved actions in section 9.2 can restore part of any larger loss within the horizon. The actual CET1 ratio of 15.0% sits 3.0 points above the floor; the adverse depletion would take the bank 0.1 points below it, and MA-002 and MA-003 restore about 0.44 points (12.35% minus 11.91%).

9.2 Management actions

After MA-002 and MA-003 the 2028 adverse position becomes CET1 2,620 + 60 = 2,680 and TREA 22,000 minus 300 = 21,700, a ratio of 2,680 / 21,700 = 12.35%, back above the risk appetite floor. MA-004 is held in reserve and is not counted because it depends on investor appetite in a stress.

10. Data, models and validation

List every model and data set used in the ICAAP quantification and projections, with its owner, validation status and known limitations, and the overlay applied where a limitation is material. Model governance follows the Model Risk Management Policy (finance/model-risk-management-policy); validation results are recorded in Model Validation Reports (ai-data/model-validation-report).

Describe data quality controls (reconciliation with accounting and COREP, completeness checks, manual adjustments with approval) and how the ICAAP data architecture meets the bank's risk data aggregation principles.

11. Regulatory map and jurisdiction notes

12. Internal audit review and sign-off

Internal audit reviews the ICAAP process at least periodically under the bank's audit plan: governance and use, completeness of risk identification, methodology and data quality, the integrity of the projections and the follow-up of supervisory findings. Summarise the scope, the opinion and the findings; attach the full report as an annex.

Sign-off: confirm that the management body discussed the report, challenged the key assumptions and approved the capital adequacy statement in section 1.1. Record the date of the meeting and the minute reference.

13. Glossary and references

References (cited by number and title; obtain the official text):

• Directive 2013/36/EU (CRD), Articles 73, 74, 104a, 104b, 128 to 142, as amended by Directive (EU) 2024/1619 (CRD6). EUR-Lex.
• Regulation (EU) No 575/2013 (CRR), Articles 92 and 465, as amended by Regulation (EU) 2024/1623 (CRR3). EUR-Lex.
• ECB, Guide to the internal capital adequacy assessment process (ICAAP), July 2026 (revision of the November 2018 guide). ECB Banking Supervision.
• EBA, Guidelines on ICAAP and ILAAP information collected for SREP purposes, EBA/GL/2016/10.
• EBA, Guidelines (revised) on common procedures and methodologies for SREP and supervisory stress testing, EBA/GL/2026/06, 26 June 2026, applying from 2027-01-01.
• EBA, Guidelines on institutions' stress testing, EBA/GL/2018/04.
• Basel Committee on Banking Supervision, Basel Framework, supervisory review process chapters (SRP) (name only).

14. Standard and licence note

Based on Directive 2013/36/EU (CRD) and Regulation (EU) No 575/2013 (CRR) as amended by CRD6 and CRR3, the ECB Guide to the ICAAP (July 2026) and EBA Guidelines EBA/GL/2016/10, EBA/GL/2018/04 and EBA/GL/2026/06. EUR-Lex, ECB and EBA material is reused with acknowledgement; article and guideline numbers are cited and no normative text is reproduced. Basel Committee material is cited by name only. The structure, guidance and the Fernhollow Bank example are original; Fernhollow Bank and every figure are fictional. Check the current official versions and the consolidated texts before use, as requirements and supervisory expectations change. This is a document format, not financial, investment, legal, regulatory or accounting advice.

Template licence: MIT.