Pillar 2 capital and liquidity requirements
From the ECB’s revised ICAAP / ILAAP guidelines and the PRA’s finalization of Basel 3.1 to OSFI’s new ILAAP mandate, supervisors are sending an unmistakable message. They now require deeper integration, sophisticated forward-looking analysis, and absolute board-level accountability, elevating these Pillar 2 assessments from a compliance exercise into an urgent strategic imperative for owning and managing a firm's unique risk profile.
The Internal Capital Adequacy Assessment Process (ICAAP) is a comprehensive, forward-looking framework focused on solvency and capital adequacy. Its primary goal is to ensure a bank has sufficient capital to cover all its material risks over a medium to long-term horizon, typically 3-5 years. The ICAAP goes beyond the prescribed Pillar 1 risks (credit, market, and operational) to identify, measure, and manage "Pillar 2" risks that are specific to the institution's business model and strategy. These include complex risks like Interest Rate Risk in the Banking Book (IRRBB), credit concentration risk, and strategic or reputational risks.
The Internal Liquidity Adequacy Assessment Process (ILAAP) focuses on liquidity and funding risk. Its objective is to ensure a bank can meet all its financial obligations as they fall due, in both normal and stressed conditions. The ILAAP assesses a firm's ability to withstand liquidity shocks over various time horizons. This includes intraday liquidity needs, short-term stress scenarios (e.g., a 30-day period aligned with the Liquidity Coverage Ratio - LCR), and longer-term structural funding resilience (aligned with the Net Stable Funding Ratio - NSFR).
Connecting capital & liquidity
Regulators globally are demanding tighter integration between ICAAP and ILAAP; a crisis in one can rapidly trigger a crisis in the other. This dangerous feedback loop often unfolds as follows: a significant capital shock, such as from unexpected credit losses, damages market confidence and the bank's credit rating. This loss of confidence then triggers a liquidity drain as counterparties withdraw funding, depositors pull their money, and access to wholesale funding markets freezes. An integrated framework is the only way to model these interactions, providing a holistic view of resilience and ensuring that capital and liquidity contingency plans are consistent and effective.
While the principles are global, implementation varies significantly.
|
Region/Country |
Supervisor |
Core initiative & Guidance |
Summary and Focus Areas |
Status & Applicability |
| Eurozone | European Central Bank (ECB) | ECB Guide to ICAAP | Mandates a dual-perspective approach (normative and economic). Focuses on economic substance over book value and assessing unrealized losses. The ICAAP no longer directly sets P2R, but it still heavily influences the overall SREP score. |
Live. Overhauled for the 2026 SREP cycle. Applies to all Significant Institutions (SIs). |
| United Kingdom | Prudential Regulation Authority (PRA) | The ICAAP an SREP - SS31/15 | Principles-based, emphasizing firm-led scenario analysis. Strong link to operational resilience and climate risk. The 'Strong and Simple Framework' provides proportionality for smaller firms. |
Amended & Timeline Locked. Basel 3.1 alignment and simplified SDDT regime take effect Jan 1, 2027. |
| United States | Federal Reserve (FRB) | CCAR/DFAST serves as the ICAAP equivalent. A regulator-driven process using prescribed macroeconomic scenarios. Results directly set the Stress Capital Buffer (SCB). |
Live. Annual cycle for large banking organizations. |
|
| Canada | Office of the Superintendent of Financial Instittutions (OSFI) | OSFI Capital Adequacy Guideline (CAR) | Mandates explicit board oversight and independent review. Focuses on localized risks, such as domestic real estate and credit concentrations. |
Live. Enforced dynamically alongside Basel III/IV timelines for all Federally Regulated Financial Institutions (FRFIs). |
| Australia | Australian Prudential Regulation Authority (APRA) | Prudential Standard APS 110 | Heavy emphasis on Board ownership and accountability. Requires a detailed, forward-looking annual ICAAP report and integration of operational (CPS 230) and data (CPG 235) risk management. |
Amended & Timeline Locked. Applies to all Authorised Deposit-taking Institutions (ADIs). Final. Takes effect 1 January 2027. |
| Singapore | Monetary Authority of Singapore (MAS) | MAS Notice 637 (Risk-Based Capital Adequacy) | Enforces capital cushions well above Basel minima. Requires explicit stress modeling for technology/cyber risks, tightly linked with individual executive accountability rules. |
Live. Compulsory annual submission and board sign-off for all locally incorporated banks. |
| Hong Kong | Hong Kong Monetary Authority (HKMA) | Supervisory Policy Manual (CA-G-5) | Mandates a formal Capital Adequacy Assessment Process (CAAP). Focuses on mainland credit dependencies, cross-border asset concentrations, and property market variables. |
Live. Active for all locally incorporated Authorized Institutions (AIs). |
| India | Reserve Bank of India (RBI) | Reserve Bank of India (Commercial Banks - Prudential Norms on Capital Adequacy) Directions, 2025 | Requires a rigorous ICAAP document to be submitted annually. Focuses on ensuring capital is commensurate with the bank's specific risk profile, strategy, and economic environment. |
Live. Applies to all commercial banks. Updated as on 1 July 2026. |
| Malaysia | Bank Negara Malaysia (BNM) | Capital Adequacy Framework (Pillar 2) | Requires a comprehensive ICAAP that is integral to management and board decisions. Emphasizes a wide range of Pillar 2 risks, including concentration, strategic, and reputational risks. |
Live. Applies to all licensed banking institutions. For financial institutions applying the standardised approach for credit risk, this policy document is effective 1 July 2026. |
|
Region / Country |
Supervisor |
Core Initiative & Guidance |
Summary and Focus Areas |
Status & Applicability |
| Eurozone | European Central Bank (ECB) |
ECB clarification on ICAAPs and ILAAPs and respective package submissions |
Requires a comprehensive assessment of funding and liquidity risks, robust stress testing, and a credible liquidity contingency plan (LCP). Focus on survival periods and risk appetite. |
Live. Applies to all Significant Institutions (SIs). |
| United Kingdom | Prudential Regulation Authority (PRA) | Supervisory Statement: SS24/15 , published as part of PS4/26. | Principles-based, requiring firms to identify and manage their specific liquidity risks. The 'Strong and Simple Framework' offers a streamlined ILAAP template for SDDTs. |
Live. Applies to all PRA-regulated firms. |
| United States | Federal Reserve (FRB) | Enhanced Prudential Standards (12 CFR § 252.35 | ILAAP principles are implemented through rules requiring internal liquidity stress tests (overnight, 30-day, 90-day, 1-year) and a buffer to meet the 30-day stressed net cash flow need |
Live. Applies to large BHCs and FBOs. |
| Canada | Office of the Superintendent of Financial Institutions (OSFI) | Draft ILAAP Guideline. Under consultation. | New Mandate. A formal ILAAP framework is being introduced to complement the existing LAR guideline. Focuses on identifying Pillar 2 liquidity risks (intraday, FX, franchise viability) and robust internal stress testing. |
Phased Implementation. Begins fiscal year 2027, maturing by the end of fiscal year 2029. |
| Australia | Australian Prudential Regulation Authority (APRA) |
APRA consultation on liquidity proposals. |
Prudential Standard APS 210 APRA consultation on liquidity proposals. |
Live. Applies to all ADIs. |
| Singapore | Monetary Authority of Singapore (MAS) |
MAS Notice 649 (Liquidity Risk Management) New guidelines effective 10 July 2027 |
Mandates a robust ILAAP framework, including stress testing under a range of scenarios and a comprehensive CFP. Strong focus on managing intraday liquidity risk. There is a new explicit focus on digital-era risk |
Live. Applies to all locally incorporated banks. |
| Hong Kong | Hong Kong Monetary Authority (HKMA) |
Regulatory Framework for Supervision of Liquidity Risk: LM-1 |
Requires a formal liquidity risk management framework, including stress testing and a CFP, proportionate to the institution's nature, scale, and complexity. |
Live. Applies to all Authorized Institutions (AIs). |
| India | Reserve Bank of India (RBI) | Basel III Framework on Liquidity Standards | Requires banks to have a board-approved ILAAP, including stress testing and a CFP. The framework is aligned with the Basel III LCR and NSFR requirements. |
Live. Applies to all commercial banks. |
| Malaysia | Bank Negara Malaysia (BNM) | Liquidity Risk Policy Document | Mandates a comprehensive ILAAP that includes setting a liquidity risk tolerance, managing intraday liquidity, and conducting regular stress tests. |
Live. Applies to all licensed banking institutions. |
Banks often stumble in their Supervisory Review and Evaluation Process (SREP) evaluations and internal assessments due to common operational challenges.
Regnology offers a complete, end-to-end ecosystem that transforms ICAAP and ILAAP from a regulatory burden into a strategic advantage. Our solution combines a powerful risk analysis engine with a state-of-the-art reporting and granular data model, providing a seamless, integrated approach – from data ingestion and risk analysis to final regulatory submission.
Calculation engine: Regnology Risk Hub (RRiH) Ascend unifies Asset Liability Management (ALM), Liquidity Risk, Market Risk, and Credit Risk into a single workspace. This provides the truly holistic view of a bank’s risk profile needed to run integrated capital and liquidity stress tests. Our AI-powered tools, RGI Assist and RGI Explain, help risk teams model complex market disruptions and explain volatile stress testing results with full, human-in-the-loop auditability.
Reporting Hub: Leveraging our Straight-Through Reporting (STR) capabilities, Regnology Reporting Hub (RRH) Ascend automates the entire data-to-submission workflow. This helps institutions move away from slow, manual end-of-period reporting to a more continuous, efficient, and controlled process, ensuring speed, accuracy, and an audit-ready data lineage that satisfies the strictest regulatory scrutiny.
SREP, or the Supervisory Review and Evaluation Process, is the annual framework used by supervisors like the ECB and PRA to assess a bank's overall risk profile, governance, and its internal capital (ICAAP) and liquidity (ILAAP) assessments. The outcome can be additional, firm-specific capital and liquidity requirements (Pillar 2 add-ons).
Pillar 1 sets out the standardized, minimum capital and liquidity requirements for all banks (e.g., for credit, market, and operational risk). Pillar 2 is the supervisory review process that requires banks to conduct their own internal assessment (ICAAP/ILAAP) to cover risks not fully captured in Pillar 1.
ICAAP covers internal capital adequacy, and ILAAP covers internal liquidity under Basel Pillar 2. In the US, the Federal Reserve enforces CCAR, which combines elements of both frameworks but emphasizes quantitative, forward-looking capital planning under explicit central bank stress scenarios.
Regulators worldwide apply proportionality. Smaller banks face simpler requirements. For example, the UK's 'Strong and Simple Framework' for Small Domestic Deposit Takers (SDDTs) offers reduced reporting frequency, simplified capital buffers, and streamlined ICAAP/ILAAP templates.
The ECB has overhauled its framework for the 2026 SREP cycle. While a bank's ICAAP no longer directly determines the Pillar 2 Requirement (P2R), a high-quality ICAAP remains critical, as it heavily influences the supervisor's overall assessment of internal governance and risk management, which, in turn, affects the final SREP score and any potential capital add-ons.
No. The SRB states that the update does not create new periodic reporting deliverables. However, it raises expectations around short-notice and high-frequency liquidity and funding information. The annexed templates indicate the expected structure and level of detail, but institutions may use their own systems and formats where appropriate.
Contenu
European regulatory authorities are increasingly aligning towards a unified, interoperable, data-centric reporting infrastructure. Read our mid-year analysis to see how these initiatives are laying the groundwork for an AI-enabled regulatory ecosystem.
LireContenu
As regulatory pressures grow, risk, finance, and reporting must evolve from fragmented data silos to an intelligent, integrated value chain. Our new whitepaper with Chartis outlines the path to building a more efficient & resilient regulatory operating model.
LireContenu
Learn why financial institutions must evolve their funding liquidity strategies to thrive in a climate defined by volatility, regulatory pressure, and rising depositor stress.
Lire
© 2026 Regnology Group GmbH Tous droits réservés
EN 
DE 
