ICAAP and the SREP in Germany

The internal capital adequacy assessment process is the set of processes by which a bank identifies its material risks, measures them, holds capital against them and plans forward. Article 73 of Directive 2013/36/EU requires it; in Germany the obligation runs through section 25a of the Kreditwesengesetz and the MaRisk, with the ECB guide to the ICAAP setting the detail for significant institutions.

The ECB guide organizes its expectations into seven principles: the management body is responsible for sound governance of the process; the ICAAP forms an integral part of the management framework; it contributes to the continuity of the institution by assessing capital adequacy from complementary perspectives; all material risks are identified and included; internal capital is of high quality and clearly defined; risk quantification methods are adequate, consistent and independently validated; and stress testing ensures capital adequacy under adverse circumstances.

A capital adequacy statement sits at the front of the submission, signed by the management body, stating that the institution considers its capital adequate and why. That statement is what a supervisor holds the board to in the following year's dialogue.

German supervision requires a bank to run two views of capital adequacy at once, and the ECB guide does the same. The normative perspective asks whether the institution can meet all its regulatory and supervisory capital requirements and constraints over a multi-year horizon, under a baseline and under adverse scenarios. It works in the accounting and regulatory metrics: own funds, risk-weighted assets, the buffers, the leverage ratio.

The economic perspective asks whether the institution's economic value is sufficient to cover its risks, measured in its own terms, over a one-year horizon and generally at a high confidence level. It leaves the accounting conventions behind: hidden reserves and hidden burdens count, a pension obligation is measured economically, and a risk with no Pillar 1 charge, such as interest rate risk in the banking book, appears at its own measured size.

BaFin's supervisory statement on risk-bearing capacity sets out this split for German institutions, and the point of having both is that each catches what the other misses. A bank can meet every ratio while its economic value has been eroded by an unhedged interest rate position, which is the lesson of 2022 and the reason IRRBB is a Pillar 2 risk.

The ICAAP begins with a risk inventory, which asks what could cause a loss and whether it is material, and it has to be complete in the bank's own terms and not limited to the risk types the regulation names. Credit, market and operational risk are there by construction. The ones a supervisor checks for are the Pillar 2 risks: interest rate risk in the banking book, credit spread risk, concentration risk by borrower, sector and geography, model risk, reputational risk, business and strategic risk, and pension risk.

Measurement follows, and the guide expects methods appropriate to the risk and reviewed independently of the people who built them. Aggregation is where the judgment concentrates, because adding economic capital figures across risk types assumes something about their correlation. A bank that assumes diversification benefits has to justify them with data, and a supervisor that does not accept the justification will set the requirement as if the benefit did not exist.

The supervisory review and evaluation process is how the authority forms its own view. The EBA SREP guidelines, EBA/GL/2022/03, structure it into four elements: the business model analysis, which asks whether the bank's model is viable and sustainable; the assessment of internal governance and institution-wide controls; the assessment of risks to capital and the capital adequacy that follows; and the assessment of risks to liquidity and funding and the liquidity adequacy that follows.

Each element produces a score, and the scores combine into an overall SREP score that drives the intensity of supervision and the measures imposed. The ICAAP feeds the capital element directly, and the ILAAP feeds the liquidity element, which our liquidity stress testing page covers. Where a supervisor rates an ICAAP as weak, it does not merely note the weakness; it adds capital to compensate for the uncertainty.

The SREP ends in two numbers. The Pillar 2 requirement is binding: an additional own funds requirement set above Pillar 1 to cover risks that are underestimated or not covered by Pillar 1, with a composition rule on how much must be common equity. Breaching it is a breach of a requirement, with the consequences that follow.

The Pillar 2 guidance is not binding in the same sense. It sits above the P2R and the combined buffer requirement, expresses the supervisor's expectation of the capital needed to withstand a stress scenario, and a bank that falls below it is expected to explain and to restore its position. Falling below the guidance does not itself trigger the automatic distribution restrictions.

The order of the stack matters for that reason: Pillar 1 minimum, then P2R, then the combined buffer, then the P2G on top. A bank reading its SREP decision calculates the distance to each level separately, because the consequences differ at each one.

Distributions are restricted automatically. Article 141 of Directive 2013/36/EU applies where an institution fails to meet the combined buffer requirement, which stacks the capital conservation buffer, any countercyclical buffer, the systemic risk buffer and the buffers for globally or other systemically important institutions.

The institution then calculates a maximum distributable amount from its distributable profits and a factor that falls in quartiles as the shortfall deepens, and in the lowest quartile the factor is zero. Until the position is restored, the institution may not pay dividends on common equity, may not pay variable remuneration or discretionary pension benefits, and may not make payments on Additional Tier 1 instruments, beyond that amount. It also has to submit a capital conservation plan to the authority.

This is the mechanism that makes capital planning in the ICAAP concrete: a bank manages a distance to the MDA trigger, not only a distance to the minimum, because the trigger affects the dividend and the bonus pool before it affects anything else.

The split runs through the significance classification of the Single Supervisory Mechanism. ECB Banking Supervision directly supervises significant institutions, which are those above 30 billion euro in assets, those above 20 percent of their member state's GDP, those among the three largest in their member state, and those receiving direct assistance from the European Stability Mechanism. For those banks the ECB runs the SREP and sets the P2R and the P2G.

BaFin, working with the Deutsche Bundesbank, supervises the less significant institutions, which in Germany is most of them by number: the savings banks, the cooperative banks and the smaller private banks. The Bundesbank conducts the ongoing monitoring and the audits, BaFin takes the sovereign measures, and the ECB retains oversight of how the national authorities apply the standards. Our page on risk management in Frankfurt covers the supervisory landscape in its local setting.

From two directions. Internally, the bank designs its own adverse scenarios for the ICAAP, covering its own vulnerabilities, and uses them in the normative perspective to project capital over the planning horizon. The scenarios have to be severe enough to be informative, which is the usual supervisory finding: a scenario calibrated to a mild recession tests nothing.

Externally, the EBA runs the EU-wide stress test with a common macroeconomic scenario and a prescribed methodology, with the ECB running a parallel exercise for significant institutions not in the EBA sample. Its results feed the supervisory assessment and inform the P2G. The two exercises answer different questions: the EU-wide test compares banks against each other on a common scenario, while the internal test examines what would actually hurt this bank.

The ECB reviewed how it conducts the SREP and moved to a more focused process: a multi-year assessment in which not every risk area is examined at full depth every year, shorter and clearer decisions, earlier integration of the supervisory findings, and a stronger link between the findings and the measures that follow from them. The intention is that supervisors spend their time on the risks that matter at each bank instead of repeating a full cycle annually.

For a bank the practical effect falls on the dialogue. A multi-year cycle means a finding raised in one year carries into the next with an expectation of progress, and the risk areas selected for deep assessment are the ones the supervisor already considers weak. The ECB continues to publish its aggregate SREP results each year, which lets a bank see where its own score and P2R sit against the distribution.