What are the Pillar 2 risks a CIF must assess in its ICAAP?

The exam material follows CySEC's 2012 ICAAP guidelines, Circular C026, which CySEC still publishes. Most CIFs have been under the IFR since 26 June 2021. Since 5 November 2021, Class 2 CIFs have assessed their internal capital and liquid assets together under section 18 of Law 165(I)/2021, and Class 3 CIFs only if CySEC asks. This does not replace the ICAAP but widens it: the joint EBA and ESMA guidelines call the whole process the ICARAP, made up of an ICAAP for capital and an ILAAP for liquidity, and CySEC's January 2022 practical guide to the IFR and IFD calls it the ICAAP and ILAAP.

Liquidity risk is the risk that a CIF lacks the financial resources to pay its present and future obligations when they fall due, or can raise them only at an excessive cost. It can come from failing to manage unplanned falls or changes in funding, or from failing to see or respond to market changes that affect how quickly, and at what loss, assets can be sold. A CIF must assess its exposure, its ability to cope with liquidity drying up in the market and its ability to repay clients at all times, and it needs a contingency plan for shortages. IFR firms must also hold liquid assets of at least one third of their fixed overheads requirement; see What processes must a CIF have for credit, market, liquidity, operational and leverage risk?.

Business risk reflects the fact that capital needs change with business and economic conditions, and a downturn may call for more capital just when it is hardest to raise. A CIF projects its financial position three to five years ahead, allowing for its strategy, expected growth, changes in the economic cycle, competition and weaker than expected performance, and checks that its expected resources can meet the projected capital requirement. It is also exposed to performance risk: how it keeps client relationships in periods of poor performance, and how that affects its income.

Legal and compliance risk arises from breaches of laws, regulations, market practice or ethical standards. For investment advice, it includes the legal risk of giving unsuitable advice; see How must an investment firm assess suitability for advice and portfolio management?. For execution-only services, it is the risk of not executing orders properly; see What do best execution and client order handling require?. The firm also weighs possible CySEC penalties and the quality of its anti-money laundering compliance.

Reputational risk is an adverse perception of the firm by its customers, counterparties, investors or regulators. Poor customer service, or a fine from CySEC that damages the market's view of the firm, can trigger it.

Strategic risk arises when a firm takes bad business decisions, carries decisions out badly, or does not adapt as its business environment changes. Examples are a firm that ignores a lasting change in how its clients want to trade, or one that launches a service without the systems to run it. A CIF assesses how its business plans affect its capital over the horizon of that plan.

Group risk applies to CIFs in a group, whether the other entities are in Cyprus, elsewhere in the EU or outside it. It covers risks arising from the firm's relationships with other members of its group. For example, a CIF whose parent is in a third country that does not apply Basel standards, and is exposed to high political risk, must consider how a political event affecting the parent could harm it indirectly. CySEC treats this risk as highly important and expects each CIF in that position to evaluate it properly.

The ICAAP should also consider external factors. Material risks found during the ICAAP review itself are described in the report, with their nature and possible impact. The firm then considers how effective its controls are and, for Pillar 2 purposes, holds an adequate amount of capital where controls are not enough.