ICAAP/ILAAP – Unlocking business value from capital and liquidity assessment

Regulators consider banks’ internal capital adequacy and assessment process (ICAAP) and internal liquidity adequacy assessment process (ILAAP) important tools in managing risk. The European Central Bank’s (ECB’s) updated guidance – which came into effect last year – highlighted gaps in existing practices and emphasised the need for robust and effective capital and liquidity planning ahead of a likely turn in the economic cycle. Burcu Guner of Moody’s Analytics and Jeff Simmons of MUFG Securities discuss the key challenges for banks and how they can maximise business value from the process

The panel

• Burcu Guner, Senior Director, Risk and Finance Specialist Team Leader, Moody’s Analytics
• Jeff Simmons, Chief Risk Officer/Chief Operating Officer, MUFG Securities (Europe) NV

 

What are the key principles of ICAAP and ILAAP, and how has the ECB’s guidance been received?

Burcu Guner, Moody’s Analytics

Burcu Guner, Moody’s Analytics: The ICAAP and ILAAP guidance is the first time in over a decade I’ve seen a supervisory authority stress the need for a robust economic perspective complementary to the regulatory and accounting view. The multi-period horizon – including baseline and adverse conditions – makes it very interesting. 

Another beneficial feature is the independent validation of the ICAAP and ILAAP frameworks, which is particularly useful for smaller institutions in deciding priorities and creating a road map. 

There’s also an emphasis on involving management teams, ensuring ICAAP and ILAAP are integrated in the risk appetite framework, and looking at their interplay with other strategic processes. Typically, these are processes governed and managed by different departments. 

Senior management becomes more involved not just in the risk and finance space, but across the business lines of the financial institutions, which is quite new. 

Many organisations are restructuring their risk functions, and refactoring their models to address the new requirements and align with the business applications. 

Jeff Simmons, MUFG Securities: I agree – capital management and liquidity management have grown up almost independently, for good organisational reasons. Capital is handled at the very top of the house – almost on a portfolio level – whereas liquidity tends to be managed close to where the cash is, in the treasury function. 

As a result, they followed different processes and different governance frameworks. Rooting them in the same economic foundation then aligning the governance structure around them means the philosophy and organisation has to evolve – especially as we are seeing closer alignment between risk and finance anyway. If you think of International Financial Reporting Standard (IFRS) 9 and the Fundamental Review of the Trading Book, for example, it’s only natural that at the top of the house capital liquidity is aligned across risk and finance spaces. 

 

What are the key challenges for banks in adhering to the new rules?

Jeff Simmons, MUFG Securities

Jeff Simmons: The main challenge is contrasting timelines. Capital impacts you over a longer duration – three or five years, for example – whereas liquidity can kill you in a period of a week. Inevitably, the timeline and the methodologies to support them are different. Then you throw into the mix different organisational structures across capital and liquidity, and consistent mitigating actions are difficult to achieve.

Burcu Guner: The scenario analysis involves different time horizons and interpretations, even in the capital domain if you are talking about supervisory rather than ICAAP stress-testing. IFRS 9 changes the picture again. The final part is the economic perspective, typically treated as unconditional and a one-year horizon, so I also see a challenge to introduce conditional scenarios and the multi-year assessments in the space of economic capital adequacy. 

You need to find a holistic methodology framework that complements these different domains, synching up the scenario analysis and the multi-year assessment, and bring different time horizons into play. 

The other key challenge is how risk concentrations and risk correlations are taken into account. There is an economic focus on these – even across different risk types – but less so with provision accounting and stress-test models, so some sort of enhancement will be required. 

Assessing variations in different domains in accounting, regulatory and economics is going to represent a challenge to banks’ analytics framework, but also to data, data quality and the processes. 

Jeff Simmons: If we put the scenarios to one side in terms of their complexity, the question being asked through ICAAP is: ‘Do you have sufficient capital resources?’ You look at where you are, you apply some pretty high-level macroeconomic stressors and throw in a bit of Pillar 2 assessment for good measure. 

For ILAAP and liquidity, it’s a question of stress-testing and ‘Can you survive the shocks?’ They are asking different questions, so they need a different skill set, organisation, governance structure and so on. The challenges exist around why the silos were there in the first place and this is where the difficulty lies.

Data and data quality is a challenge for any bank. But in terms of alignment, it again comes down to the reasons for the silos. The data you need is very different.

To take it to the extreme, to do an ILAAP, you need to go all the way down into cashflow data and time horizons and so on, whereas with ICAAP the data required is at a higher level and a different slice. Even if data quality wasn’t an issue, aligning the data is a challenge in itself. Overlaying the models is just going to compound any misalignment.

 

What are the main considerations for banks in integrating ICAAP and ILAAP alongside existing regulatory and stress-testing requirements? 

Burcu Guner: The opportunity to influence decision-making is a key factor. Whether it’s a question of data process or modelling, success will be determined by the business relevance of the metrics. 

Jeff Simmons: Embedding ICAAP and ILAAP in the business isn’t always as robust as it should be. Most ICAAPs conclude that you have enough capital. So what action do you need to take? What is its relationship to a recovery resolution plan and so on? It’s difficult to get it owned lower down the organisation. 

ILAAP takes priority in some senior-management thinking, because its impact is going to hit you quickly. However, most businesses at the lower level of organisations are not really concerned with the bigger picture and the bank’s overall liquidity position. It’s something that is handed off to treasury and soon forgotten about as long as they are compensated. 

Burcu Guner: I think the credit cycle plays a part here. The ICAAP side is overlooked to some extent because of the stage we are at. As the cycle turns, it may get more scrutiny from the supervisors as well as the boards. As I understand it, the ECB intends to use economic perspectives that do not obscure the real picture of risk, and have financial institutions prepared for the turn. 

Jeff Simmons: Stress-testing provides another lens on the organisation. It does everything the ICAAP – and, in some cases, the ILAAP – does, but the supervisors control the methodology and scenarios so they can have the ICAAP, ILAAP and stress-test results side by side to get different viewpoints of the same organisation.

IFRS 9 means accounting is also now more model-based and, similarly, becomes more stress-testable.

 

Regulatory initiatives such as Basel II and Basel III aimed to curb banks’ practice of risk-shifting and underestimating certain risks. How confident can we be that banks reveal the full picture under ICAAP/ILAAP? Are their processes sufficiently robust?

Jeff Simmons: In some respects, there is little incentive for a bank to be completely transparent. If the purpose is to demonstrate to the regulator that banks have sufficient capital resources, then no-one is likely to submit an ICAAP where the answer is: ‘No, we don’t have enough.’ The incentive is to be as positive as possible. 

But the same is true of banks’ financial statements and glossy annual reports. How confident are we that everything is revealed? You just don’t know what is not in there. 

Again, the challenge is how all these finance components are aggregated at the top of the house, and what decisions are made on those figures. 

I’m confident the processes are robust, as they have been in play for a number of years. I’m just not confident the answer is always as you would expect.

Burcu Guner: The process is conducted under an intentionally harmonised framework, so there will be an element of benchmarking and comparability across these institutions conducted by the ECB. 

If you are deviating from the norm, you might receive more scrutiny from the supervisors and the market, so it encourages discipline to look at these things more broadly. 

ICAAP brings a stronger internal view of the bank’s portfolios, considering all material risk and, from an economic view, highlights new risks that may not have been brought to the table before, such as the risk concentrations. 

 

What does a best-practice ICAAP and ILAAP process look like? What are the main considerations around data quality, modelling and governance procedures?

Burcu Guner: It’s important to have a rich and complete scenario and modelling capability across capital and liquidity domains. The emphasis needs to be on creating a complementary and interactive framework.

We never explicitly consider correlations across different risk types, and don’t always look into contagion effects such as second-order effects across the credit market and potential risk concentrations. There are definitely improvements that could be made in defining best practices. 

We may do all these great things in the risk and finance domain in terms of modelling data, scenario analysis and so on but, ultimately, it needs to be accepted by the front line as they will impact profit and loss (P&L), and volatility. It has to be perceived as a business enabler to be adopted. 

Jeff Simmons: The organisation has to ‘live’ these things. If it’s not integrated in all walks of life across the organisation, then it’s not achieving the purpose it was set out for.

At MUFG Securities, ICAAP production is a centralised function, essentially playing the conductor across the organisation for all the various comments. One advantage is the manual consistency – components are feeding into the central area, so you can see gaps or overlaps. There’s also consistency in terms of methodologies and practices. 

One drawback may be that it’s almost as though your ICAAP and ILAAP are being outsourced. It could be difficult to get senior stakeholders above this central function and contributors below it to have real and sufficiently detailed buy-in to what is happening. 

There can also be some confusion about who actually owns the ICAAP. Is it risk? Finance? The board? Who owns it – and therefore where does this co‑ordination function sit? I’ve seen it positioned in both risk and finance with equal effectiveness, because ultimately an ICAAP is stressing your business plan. It’s a finance thing with a risk overlay. ILAAP is similar – it can be confusing as to where ownership lies.

Burcu Guner: To influence decision-making, financial institutions need to invest in infrastructure, data and IT, and streamline the process by asking: ‘How does this help me enable business decisions, business engagement, and the relevance of models and metrics we use to the P&L at current, future and emerging states across multiple risk/return dimensions?’ 

Whatever you do on stress-testing from an economic or liquidity perspective needs to make sense to the front line to be really embedded. The process is a way of enabling some of this discussion, and managing the capital, liquidity and earnings volatility.

Jeff Simmons: The way to embed it in the front line is to charge it – make sure whatever measure you are trying to use has a cost and then work on allocation. 

There is now more awareness at senior levels about what is going on in stress-testing, regulatory interaction, and recovery resolution and similar areas.

When the European Banking Authority began publishing stress-test results – which had capital firmly stated at the bottom, underneath a targeted capital ratio – senior management began to take more notice. Now there is a lot more involvement, and increased governance – which is good.

 

To what extent should you adapt the process to accommodate evolving risks such as climate change?

Jeff Simmons: It depends what you are trying to measure. You need to quantify what it is you are modelling, and how it affects your clients and your business activity. It then becomes a great deal more complicated with scenario generation, causation, correlation and so on.

It comes back to the question of what the ICAAP is trying to do. If it’s saying, ‘Do you have sufficient capital resources for the next three years?’ the reality is that climate risk may not yet be considered a material risk factor – despite the fact everyone is worried about it. 

It has to be factored in in some way, but how you do it while staying true to the question you are trying to answer is difficult.

Burcu Guner: Climate risk will have material implications for credit risk, portfolio management, expected credit losses and fair valuation of assets, which are covered within ICAAP. The introduction of climate scenarios and the risk quantification will definitely happen. I see it in the stress-testing domain as well as ICAAP.

The Bank of England is introducing climate as part of its 2021 biennial exploratory scenario, and other European supervisors anticipate following suit. Apart from identifying it as a potential risk, I think the bottleneck is due to quantification. 

There is an increased frequency of severe climate events that can impose event-driven risks and climate shocks in credit portfolios. There is also a debate as to the impacts of transitioning to a low-carbon economy and whether early, late or business-as-usual transitions occur across different regions, sectors, industries and so on – which need to be managed within the credit portfolios. 

There is work to be done in the ICAAP space and stress-testing in introducing climate risk and scenario modelling. I think it’s going to happen in the next one to two years. We need to be mindful of how we are introducing these factors into the existing framework, because the horizons and the patterns could be very different.

Jeff Simmons: We already have capital and liquidity assessments and, in the Netherlands, we have the systematic integrity risk analysis. It may be that we need to have climate as a fourth pillar. The danger with any long-term issue is that it doesn’t get addressed until the last minute. We need to avoid that.

 

How can banks ensure their numbers are fully aligned with business strategy?

Jeff Simmons: The key is integration between risk and finance. Once you have a business strategy that can be modelled, you can then stress-test it. 

With that as a foundation, you can overlay different macroeconomics, stresses and so forth. Then, if you solve the time horizon issue between capital and liquidity, you have a pretty robust assessment model. 

Burcu Guner: We ran a number of studies recently, aiming to benchmark bank performance under various origination strategies, such as constrained views on regulatory accounting versus economic perspectives, and adding various balance sheet and liquidity functions to the picture. 

What we found was increased volatility among the accounting measures and provisions. Using different origination strategies with different metrics could be quite different. 

It’s essential to manage this volatility and the risk of negative earnings due to the interplay of certain measures. This is what the ECB is trying to highlight in the recent ICAAP and ILAAP guidelines, encouraging firms to assess their portfolios from an economic perspective as well as regulatory and accounting. A key factor determining successful alignment with business strategy is how well the firms deliver this combined view to the front line. 

Stress-testing in the future

Jérôme Henry, principal adviser, macroprudential policy and financial stability at the European Central Bank (ECB), discusses the evolution of capital and liquidity assessment in the wider context of stress-testing for prudential purposes.

 

What role does stress-testing play in solvency/liquidity assessment, and how is this evolving?

Jérôme Henry, ECB

Jérôme Henry, ECB: For banks, according to supervisory guidance such as that provided by the European Banking Authority (EBA) or the Bank for International Settlements, stress-testing should play a key role in defining capital and liquidity planning. In addition, it should matter for a number of firm-level decisions, from risk appetite to capital and funding increases. Beyond this, reverse stress-testing should also provide an essential input to recovery and resolution planning; it can moreover help define severity and relevance metrics for the internal capital adequacy and assessment process (ICAAPs) and internal liquidity adequacy assessment process (ILAAPs). 

Since the financial crisis that began in 2007–08, sector-wide stress-testing has become a standard supervisory tool. The objectives of such exercises now go beyond a pure recapitalisation or backstop calibration purpose. In the single supervisory mechanism (SSM), for instance, there is now greater emphasis on liquidity and sensitivity analyses. Stress-testing can also provide relevant information for profitability projections, credit risk monitoring and the accuracy of market risk modelling.

On another front, the development of macroprudential stress tests is also relatively new, building on or complementing system-wide supervisory assessments. The UK in particular includes a macroprudential perspective in their concurrent stress-test process, using the outcome to calibrate buffers on a system-wide level. The ECB published – in 2016 and 2019 – the results of their model-based exercises that use the EBA/SSM stress-test data as an input but take a more macroprudential approach, including real financial feedback, contagion elements and other features that aren’t typically covered within microprudential exercises. 

Looking ahead, using stress-testing to help calibrate macroprudential policy measures – in particular the countercyclical buffer – is an ambitious and challenging task. For that purpose, results should go beyond a pure bank-by-bank solvency and liquidity assessment to include credit supply and activity developments under stress with and without additional policy measures.  

 

To what extent does the current stress-testing framework enable an adequate view on banks’ solvency and liquidity?

Jérôme Henry: In the first place, the supervisory requirements around the framework are quite clear, asking firms to pay specific attention to scenario coverage and severity and showing the related impact on the bank’s balance sheet. Then there are additional elements that should be accounted for, including risk correlation, non-linearity, structural breaks and interaction between solvency and liquidity, as well as second-round effects on credit risk and market risk. 

To enable an adequate view from such quantitative exercises you need two things in place. First, the right infrastructure – including data and IT – which provide the flexibility to deliver numbers quickly and efficiently. And second, good governance, with senior management involvement across business areas – so the results are relevant and comprehensive. 

Although the framework and must-dos are clear, there is always the risk that some firms would depart from these – and it is difficult in practice to ensure all the boxes are checked, both internally and for the supervisors. There’s always also the chance of a surprise risk factor materialising that is an event outside the scope of risks covered in the envisaged scenarios. Stress-testing is no insurance against all odds.

A particularly difficult area to tackle for a single firm is the requirement to look at contagion and second-round effects. A given bank can of course estimate such feedback – but properly only at a micro, internal-specific level. It’s hard for a single bank to assess the externalities and the impact of others’ activities and aspects such as fire sales, funding, solvency interconnection, collateral evaluation, credit interest risk correlation and market risk correlation. Central authorities using their own tools – while not perfect – are better placed for this type of analysis.  

 

How are banks coping with the operational challenges of external/internal stress-testing?

Jérôme Henry: Banks may have a different view but once the internal setup for stress-testing is in place – with the necessary infrastructure for risk identification, modelling and governance, and an experienced enough team – the operational risks should be limited and external exercises relatively straightforward to conduct. Banks will need to run their models based on whatever new scenario and apply their judgement before finalising the results. 

Having said that, the interactions with supervisors for quality assurance purposes would require updates of the results. These will also be facilitated by having the needed internal setup in place. Where this can get more difficult is for larger, cross-border groups, dealing with many different external stress tests. Methodologies evolve and can differ greatly between supervisors. Similarly, the reporting requirements and templates can change over time, which creates challenges around data collection and availability. 

 

To what extent does the operational complexity of stress-testing hinder effective decision-making? 

Jérôme Henry: From a prudential perspective, system-wide stress tests can be complex to develop and implement, and it can also be difficult to gather and interpret the results. 

For supervisors, for instance, it’s an input to the Supervisory Review and Evaluation Process (SREP), and there’s also interaction with Pillar 2 processes, which are already complex. The stress-test results are not always comprehensive enough as an indicator for pinning down bank-specific capital needs. There’s a gap to fill between the results, the SREP requirements and the management actions, which needs to be reduced with follow-up conversations between banks and supervisors – especially when results are based on a static balance sheet assumption. 

From a macroprudential perspective, there are now two ways of using stress-testing results. The first is to inform policy measures, such as for the calibration of the countercyclical buffer, as in the UK. The second is to assess resilience and financial stability of a given banking sector subject to shocks.  

It’s also a challenge to use stress-test information in a macro policy setting. This is due partly to implementation – it’s difficult to integrate new risks such as climate change and cyber risk within an existing stress-test process, for example – and also partly to communication; stress tests typically involve multiple complex channels, so it can be hard to summarise and interpret the results and build a coherent narrative.

Stress-testing can be like a black box. Unless you can streamline and identify the main drivers of the results, it is difficult to convince policy-makers there’s a particular set of measures that can address key issues that arise unless you go deeper into the source of the impact. Other tools and assessments will likely be needed to complement the stress-test results regardless.

 

The views expressed here are strictly those of the author and do not necessarily reflect those of the ECB.

 

For more insights from Moody’s Analytics on ICAAP and ILAAP, watch the video Q&As below:

Video Q&A with Antonios Kastanas – ICAAP/ILAAP: How can banks improve the process?

Video Q&A with Burcu Guner – ICAAP/ILAAP: What’s new and what’s next?

Sponsored content