What is the ICAAP for, who owns it, and what principles must it follow?

Through the ICAAP, a CIF uses its own processes, procedures and measures to make sure that it identifies and measures its risks properly, that it holds internal capital appropriate to its risk profile, and that it applies and keeps improving suitable systems of risk management and internal control. Its result is the firm's own view of how much capital it ought to hold in view of its risks and the complexity of its business, and it is an input to CySEC's SREP. Its aims are about risk and capital; other duties such as anti-money laundering have their own frameworks, although weaknesses in them count as a risk the ICAAP must assess; see What makes a strong AML compliance culture?.

The exam material follows CySEC's 2012 ICAAP guidelines, Circular C026, which CySEC still publishes. Most CIFs have been under the IFR since 26 June 2021. Since 5 November 2021, Class 2 CIFs have assessed their internal capital and liquid assets together under section 18 of Law 165(I)/2021, and Class 3 CIFs only if CySEC asks. This does not replace the ICAAP but widens it: the joint EBA and ESMA guidelines call the whole process the ICARAP, made up of an ICAAP for capital and an ILAAP for liquidity, and CySEC's January 2022 practical guide to the IFR and IFD calls it the ICAAP and ILAAP. Section 18 requires sound, effective and comprehensive arrangements to assess and maintain, on an ongoing basis, the amounts, types and distribution of internal capital and liquid assets that the firm considers adequate. They must cover the risks the firm may pose to others and the risks it faces itself, be proportionate and be subject to regular internal review. Class 1-minus CIFs keep the ICAAP under section 34 of Law 97(I)/2021; banks keep it under the CRD rules for credit institutions. The exam material says every CIF must prepare an ICAAP report. Today the legal duty is the section 18 assessment described above, and C027 describes the report as submitted to CySEC on request.

The CIF is responsible for implementing its ICAAP and for setting its own funds targets to fit its risk profile and operating environment. If it outsources part or all of the work, for example to consultants, it remains fully responsible, and C026 places the ultimate responsibility on the board; see What rules apply when an investment firm outsources critical or important functions?. The board and senior management initiate and design the ICAAP. The board approves the design and senior management implements it in detail. The design is fully specified, the capital policy is documented, and the results are reported to management and the board.

C026 also shares out the work. The risk management function identifies the risks, prepares the ICAAP, applies the stress tests and proposes the capital to set aside for Pillar 2 risks. The finance function prepares budgets in line with the strategy approved by the board, and the capital plan in coordination with risk management. The business functions provide data and cooperate. Internal audit, or another function or person with no part in the process, checks the work independently. It reviews how risks were assessed, how the stress tests were run and how capital was allocated, and confirms that the process meets the board's requirements.

The ICAAP must be an integral part of the firm's management processes and decision-making culture, so that the board and senior management assess material risks continuously rather than once a year for CySEC. It is reviewed at least annually, or more often where needed, and any material change in strategy, business plan, operating environment or assumptions should lead to adjustments. It is risk-based: the extra capital a firm needs depends on its risk profile and environment, and every factor used to set the internal capital target is explained and documented in the dialogue with CySEC.

It is comprehensive, covering all material risks: those under Pillar 1, those Pillar 1 does not fully capture, such as concentration risk, and Pillar 2 risks such as strategic, liquidity and reputational risk. It is forward-looking, closely tied to the strategic plan, with a capital plan for three to five years and stress tests that show how material risks would affect future capital needs. Measurement may be quantitative or qualitative, depending on the complexity of the business and the resources available, and a non-complex firm is not expected to have a sophisticated ICAAP. The outcome must be a reasonable overall capital figure that the firm can support with evidence.