SS4/25 - The Internal Capital Adequacy Assessment Process (ICAAP) and the Supervisory Review and Evaluation Process (SREP) for Small Domestic Deposit Takers (SDDTs)

2. Expectations of SDDTs undertaking an ICAAP

2.1 An SDDT must carry out an ICAAP in accordance with the PRA’s ICAA rules. These include requirements on the SDDT to assess on an ongoing basis the amounts, types, and distribution of capital that it considers adequate to cover the level and nature of the risks to which it is or might be exposed. This assessment should cover the major sources of risks to the SDDT’s ability to meet its liabilities as they fall due and should incorporate stress testing and scenario analysis. If an SDDT is merely attempting to replicate the PRA’s own methodologies, it will not be carrying out its own assessment in accordance with the ICAA rules.

2.2 The ICAAP should be documented and updated in full at least every two years by SDDTs; annually for SDDTs that are new and growing banks in scope of SS3/21 – Non-systemic UK banks: The PRA’s approach to new and growing banks;^{footnote [8]} or more frequently in the case of a material change in circumstance or if changes in the business, strategy, nature or scale of its activities or operational environment suggest that the current level of financial resources is no longer adequate. 

2.3 As stated above, the ICAAP should be documented and updated more frequently than every two years in the case of a material change in circumstance. This includes but is not limited to: material balance sheet growth, change in business model (eg focus on higher loan to value (LTV) lending, change in product offering), or material changes to the operational environment such as changes to market conditions or interest rates. In addition, to ensure that SDDT resilience is maintained, the PRA may request an annual update from an SDDT if it judges it to be necessary. For example, if an SDDT’s ICAAP is of poor quality, supervisors could ask the SDDT to remediate issues in the next year, and evidence this through submission of an updated ICAAP document. 

2.4 The PRA expects SDDTs, in the first instance, to take responsibility for ensuring that the capital they maintain is adequate given their balance sheet risks, with the ICAAP being an integral part of meeting this expectation. The PRA expects an ICAAP to be the responsibility of an SDDT’s management body, that it is approved by the management body, and that it is used as an integral part of the SDDT’s management process and decision making. The processes and systems used to produce the ICAAP document should ensure that the assessment of the adequacy of an SDDT’s financial resources is reported to its management body as often as is necessary.

2.5 The ICAAP, and internal processes and systems supporting it, should be proportionate to the nature, scale and complexity of the activities of an SDDT, as set out in ICAA 3.3 in the PRA’s Rulebook. Where an SDDT has identified risks as not being material, it should be able to provide evidence of the assessment process that determined this conclusion and discuss why it has been reached.

2.6 Liquidity risk should also be assessed, including in relation to potential losses arising from the liquidation of assets and increases in the cost of funding during periods of stress. The requirements in relation to liquidity risk may be found in policy statement (PS) 11/15 – CRD IV: Liquidity^{footnote [9]} and SS24/15 – The PRA’s approach to supervising liquidity and funding risks.^{footnote [10]} The PRA considers SDDTs should be able to draw on work done in the Internal Liquidity Adequacy Assessment Process (ILAAP) in their assessment of liquidity risk.

2.7 If the ILAAP highlights liquidity concerns, the PRA would expect the ICAAP to build on this analysis to consider how liquidity risks could lead to potential losses and capital adequacy implications. If there are no such concerns, SDDTs would not be expected to do anything more.

2.8 As set out in further detail below, the PRA also expects SDDTs to develop a framework for stress testing, scenario analysis and capital management that captures the full range of risks to which they are exposed and enables these risks to be assessed against a range of plausible yet severe scenarios. The ICAAP document should outline how stress testing supports capital planning for the SDDT.

2.9 Where an SDDT uses a model to aid its assessment of the level of capital adequacy, it should be appropriately conservative and should contribute to prudent risk management and measurement. The SDDT should expect the PRA to investigate the structure, parameterisation and governance of the model, and the PRA will seek reassurance that the SDDT understands the attributes, outputs and limitations of the model, and that it has the appropriate skills and expertise to operate, maintain and develop the model.

Credit risk

2.10 The PRA expects an SDDT which meets any of the following criteria to provide in their ICAAP document a detailed assessment of the capital needed to support their credit risk exposures:

• new and growing banks as defined in SS3/21;
• predominantly engaged in unsecured retail lending; or
• engaged in other bespoke or non-standard lending where additional capital may be required to ensure the firm is capitalised appropriately.

2.11 The PRA considers that bespoke or non-standard lending may include the following:  

• lending to niche markets which are more susceptible to economic fluctuations and industry-specific challenges; 
• lending which consists of product types that are new to the market; 
• lending with higher than typical market pricing due to elevated risk factors;  
• portfolios where a SDDT observes a high variance in the rate of default over the previous 12 months; or
• for mortgages: sub-prime and near prime lending, shared equity, lifetime mortgages and retirement interest only mortgages.

2.12 Lending which meets the 'bespoke or non-standard' criteria but is assessed to be 'immaterial' would not trigger the requirement to undertake a detailed assessment, unless that lending is cumulatively material.

2.13 The PRA does not consider the criteria for a firm to conduct a detailed assessment to be exhaustive. Therefore, the PRA may request an SDDT that does not meet these to undertake a detailed assessment where it deems the firm to be at risk of being undercapitalised. The PRA also expects an SDDT that is not engaged in these types of lending but considers that its Pillar 1 capital requirement is inadequate, to conduct a detailed assessment of its portfolio as part of its ICAAP.

2.14 The PRA has set out the general approach it takes to setting Pillar 2A add-ons for credit risk in SoP5/25. While the PRA anticipates that the expectations set out in this section will help firms produce an ICAAP document which meets the PRA’s expectations, it does not constitute an exhaustive account of everything which a firm must do to satisfy themselves that they are adequately capitalised for credit risk in accordance with the PRA’s ICAA rules. Firms remain responsible for considering how best to assess the adequacy of their own capital and should undertake any analysis they deem necessary to ensure they have assessed the major credit risks to which they are exposed.

Credit scenarios

2.15 The PRA expects an SDDT meeting the above criteria to make use of credit scenarios as the core methodology to conduct this detailed assessment. The PRA expects SDDTs to design their own credit scenarios for this purpose. This assessment should be used to ensure that minimum requirements across Pillar 1 and Pillar 2A provide sufficient capacity to absorb losses incurred in high-severity tail events, over a 12-month horizon, with particular focus on how these events may result in credit losses that are not captured under Pillar 1. This is more severe than – and different from – the assessment of the SCB, which is intended to ensure that firms maintain sufficient capital to withstand a severe but plausible stress over a longer time horizon and maintain minimum capital requirements. SDDTs should ensure their own credit scenarios are more severe than the SDDT scenarios published by the PRA (please see paragraphs 3.16–3.19 for more details about these scenarios).

2.16 An SDDT should conduct credit scenario analysis on all material standardised approach portfolios, including off-balance sheet exposures. The PRA does not expect firms to undertake credit scenario analysis for portfolios which are immaterial. In these cases, the PRA considers that firms may assume that the Pillar 1 risk weights are sufficient and would be indicative of the losses observed in a credit scenario. Firms should include information on the portfolios considered immaterial, and the rationale for excluding these from credit scenario analysis, in the ICAAP document. Firms should not artificially subdivide their book into a high number of parts such that they are individually immaterial but collectively material.

2.17 The PRA expects that the product of firms’ credit scenario analysis will be a whole balance sheet assessment of capital adequacy for their exposures on the standardised approach in terms of credit risk. Other risks in Pillar 2A will still be capitalised separately. In assessing whether the credit risk exposures are adequately capitalised, the PRA expects firms to substantiate the idiosyncratic factors in portfolios which they consider result in any undercapitalisation and/or excess conservatism in Pillar 1.

2.18 The PRA expects an SDDT meeting the criteria in paragraph 2.10 above to detail its credit scenario analysis in its ICAAP, including a clear description of the following:

• the type, characteristics, and severity of stress that its credit portfolio is vulnerable to;
• the way in which the SDDT's credit portfolio may be impacted by the range of macroeconomic variables set out in the scenario; and
• the steps taken to derive the figures presented.

2.19 The SDDT should ensure accuracy and consistency in these descriptions (eg that figures are consistent with returns submitted to the PRA).

2.20 As an alternative to using credit scenario analysis, an SDDT meeting the criteria in paragraph 2.10 may conduct the assessment using proxy internal ratings based (IRB) models^{footnote [11]} and detail these assessments in their ICAAP. However, given concerns on the potential over-reliance on non-approved models, the PRA expects this option would be limited to exceptional cases. If an SDDT uses a proxy IRB approach instead of a credit scenario in its ICAAP, it should provide sufficient details to enable the PRA to understand the modelling methodology and assumptions. The PRA also expects SDDTs to take responsibility to ensure any models used to assess capital requirements are robust and comprehensive.

2.21 Where an SDDT meets the criteria in paragraph 2.10, but does not provide an adequate assessment of credit risk in its ICAAP along the lines set out above, the PRA will apply supervisory judgement and may assess the SDDT’s Pillar 2A credit risk add-on based on sufficiently conservative assumptions to ensure capital requirements cover risks the SDDT may be exposed to in accordance with paragraph 2.5 of SoP5/25.

Credit risk mitigation: guarantees and credit derivatives qualifying as unfunded credit protection

2.22 For SDDTs using the Risk-Weight Substitution Method, the Credit Risk Mitigation (CRR) Part of the PRA Rulebook allows SDDTs to recognise guarantees or credit derivatives qualifying as unfunded credit protection. SDDTs are expected to assess whether there are any residual risks and evidence this assessment within the ICAAP document. As part of this assessment, SDDTs should consider the risk that, notwithstanding the fulfilment of eligibility criteria under Pillar 1 for qualifying guarantees or credit derivatives, the credit protection could in practice become ineffective due to any reason other than the default of the protection provider. As part of this consideration, the PRA expects SDDTs to consider in particular the:

• risk, if any, that in practice the protection provider would seek to reduce or be released from liability under the credit protection, for example through lengthy settlement or disputes processes; and
• operational risk that the SDDT may breach its obligations under the terms of the guarantee in a manner that might entitle the guarantor not to pay out.

2.23 Where SDDTs assess that there are residual risks and apply the Risk-Weight Substitution Method, the PRA expects such SDDTs to consider whether a Pillar 2A add-on is appropriate.

Operational risk

2.24 As set out in ICAA 10.1 in the PRA rulebook, SDDTs must implement policies and processes to evaluate and manage their exposure to operational risk, and to cover low-frequency and high-severity events.

2.24A As part of meeting this requirement, the PRA expects SDDTs to use scenario analysis, which should be part of the SDDT’s operational risk management framework and inform the SDDT’s risk mitigations and tail risk management. The PRA expects all SDDTs to have a robust approach, proportionate to the nature, size and complexity of their business, to capture potentially severe operational risk exposures, achieving a soundness standard comparable to a 99.9% confidence interval over a one year. The approach should be well defined and documented.

2.24B The PRA expects a SDDT to use the scenario analysis to evaluate high severity events to inform their capital assessment. The PRA expects a SDDT to tailor its analysis, to ensure this is aligned to the risks to which it is most exposed. The PRA applies a proportionate approach when reviewing a SDDT’s operational risk assessment and expects the scenario analysis should:

• be informed by the SDDT’s risk register and represent key risks;
• be informed by a combination of a top-down approach, to identify the key risks to the SDDT, and a bottom-up approach, to gather detailed information to provide a more granular view of the issues, to ensure a holistic view of operational risks;
• where relevant, cover at least all the Basel event types, as set out in Annex 2 of the Operational Risk Part of the PRA Rulebook, which include internal fraud, external fraud, employment practices and workplace safety, clients, products and business practices, damage to physical assets, business disruption and system failures;
• evaluate the potential impact of failures in risk mitigations^{footnote [12]} and controls in selecting scenarios – for each scenario, estimate at least one operational loss assuming potential failures in risk mitigations and control;
• assess potential or probable operational risk events that have not yet materialised;
• consider relevant changes in the business model and external environments that could affect the firm's operational risk exposure to high severity event; and
• include a clear explanation of the approach to the operational risk assessment and justify the scenario analysis used, including how individual scenarios are considered in aggregate, how dependencies or correlations between scenarios have been taken into account, and why the resulting capital assessment is appropriate.

2.24C Firms’ scenario analysis should be commensurate with their size, complexity, and risk profile. For SDDTs, the PRA considers it proportionate to use a simplified approach to aggregate individual scenarios, provided that the approach is justified and the resulting capital assessment remains prudent.

2.24D The PRA expects SDDTs to provide the following information in the ICAAP document as a minimum:

• brief information on their management of operational risk;
• information on the operational risk scenarios they have considered in their ICAAP, covering a description of such scenarios and an assessment of their impact and likelihood; and
• available data on historical loss events, expected losses and/or forecast losses.

2.25 [Deleted]

2.26 [Deleted]

2.27 [Deleted]

2.28 Business continuity plans are also a key component of operational risk management. Plans should include consideration of:

• resource requirements such as people, systems and other assets, and arrangements for obtaining these resources;
• the recovery priorities of the SDDT’s operations;
• communication arrangements for internal and external concerned parties (including the PRA, clients and the media);
• escalation and invocation plans that outline the processes for implementing the business continuity plans, together with relevant contact information;
• processes to validate the integrity of information affected by the disruption; and
• regular stress testing of the business continuity plan in an appropriate and proportionate manner.

2.29 The PRA will use the SDDT’s ICAAP assessment along with supervisory judgement to set the Pillar 2A requirement in line with SoP5/25.

Credit concentration risk

2.30 An SDDT should ensure that its internal risk measurement system allows it to address and control all material sources of credit concentration risk in compliance with ICAA 6.1.

2.31 For sector concentration risk, the PRA expects SDDTs with significant wholesale exposures to reflect the concentration risks from these exposures in their stress testing, in accordance with Chapter 3 - Stress testing, scenario analysis and capital planning.

2.32 The PRA’s approach to setting Pillar 2A capital requirements for credit concentration risk, including calculating add-ons and reviewing single-name concentrations, is outlined in Chapter 4 of SoP5/25.

IRRBB

2.33 All SDDTs must have appropriate systems and processes, proportionate to the nature, scale and complexity of their business, to identify, evaluate and manage IRRBB.

2.34 The PRA expects an SDDT to include small trading book business (as identified under Article 94 Derogation for Small Trading Book of the Trading Book (CRR) Part of the PRA Rulebook) as part of its identification, evaluation and management of IRRBB unless its interest rate risk is captured in another risk measure.

Supervisory Actions

2.35 An SDDT must, under ICAA 9.4A, immediately notify the PRA if its economic value of equity (EVE) would decline by more than 15% of its Tier 1 capital as a result of the application of the interest rate scenarios in ICAA 9.7. In that case, it shall be considered an outlier firm. The PRA will review each outlier firm to determine whether the PRA considers that the SDDT has excessive IRRBB or inadequate management of IRRBB. The PRA may also conduct such a review for firms that are not outlier firms.

General Requirements on IRRBB

2.36 An SDDT’s management body should oversee and approve the SDDT’s risk appetite and framework for managing IRRBB. This framework should be consistent across consolidated and sub-consolidated entities (if relevant). The risk appetite should be expressed in terms of the risk to economic value and the risk to earnings.

2.37 Where the review in paragraph 2.36 leads the PRA to consider that an SDDT's risk management of IRRBB is inadequate for the purposes of its obligations in the PRA Rulebook, or that the risk is excessive relative to the SDDT's capital or earnings, the PRA is likely to expect the SDDT to take one or more of the following actions:

• take steps to reduce its IRRBB exposures;
• hold additional capital for its IRRBB;
• implement constraints to internal risk parameters; or
• make other corrective actions to address deficiencies in its models or risk management framework.

2.38 The systems and processes should allow the SDDT to:

• identify and quantify the major sources of IRRBB exposures;
• retrieve accurate information in a timely manner;
• compute economic value and earnings measures of IRRBB for different scenarios;
• incorporate constraints specified by the PRA on the SDDT's internal risk parameter estimates;
• compare risk figures over different periods (eg by monitoring the impact of changes to the way the repricing dates are determined for the purpose of calculating IRRBB);
• assess all material cash flows from relevant interest rate sensitive instruments, including non-performing exposures (net of provisions), interest rate derivatives and off-balance sheet items such as interest rate sensitive loan commitments;
• measure the exposure and sensitivity of its activities, if material, to gap risk, yield curve risk, basis risk and risks arising from embedded optionality (eg pipeline risk and prepayment risk) as well as changes in assumptions (eg those relating to customer behaviour);
• consider whether a purely static analysis of the impact on its current portfolio of a given shock or shocks should be supplemented by a more dynamic simulation approach;
• model scenarios in which different interest rate paths are computed and in which some of the assumptions (eg about behaviour, contribution to risk and balance sheet size and composition) are themselves functions of interest rate levels; and
• measure the exposure and sensitivity of its fair value exposures to changes in value resulting from yield curve and basis risk.

2.39 The PRA expects an SDDT to set and apply policy limits for IRRBB that are consistent with the SDDT’s risk appetite. When setting policy limits, an SDDT should ensure that:

• policy limits are appropriate to the nature, size, complexity and capital adequacy of the SDDT;
• policy limits are reviewed at least annually; and
• gap risk, basis risk and positions with explicit and embedded options are considered in the setting of policy limits where the SDDT has significant exposures to these risks and positions.

2.40 The PRA expects an SDDT’s management body to have the appropriate expertise to understand:

• the nature and the level of IRRBB;
• the implications of an SDDT's strategies for managing IRRBB, including the potential linkages with and impact on market, liquidity, credit and operational risk; and
• the most significant behavioural and modelling assumptions and their implications, including for hedging strategies.

2.41 An SDDT’s management body may delegate the management and monitoring of IRRBB to senior management, the SDDT’s Asset and Liability Committee or to one or more individuals with sufficient expertise. The relevant delegate(s) should include members with clear lines of authority over the units responsible for establishing and managing positions.

2.42 An SDDT's management body should regularly review timely and sufficient information for assessing the performance of its delegates in monitoring and controlling IRRBB and credit spread risk in the non-trading book in accordance with its framework and its risk appetite.

2.43 An SDDT’s management body or its delegates should establish and maintain an adequate risk management framework for IRRBB. The PRA expects that the framework should include measures to establish, apply and maintain at least the following:

• appropriate limits on IRRBB;
• procedures for ensuring compliance with the limits in (i);
• an approvals process for exceptions from the limits in (i);
• adequate systems, standards and controls for measuring IRRBB;
• standards for measuring IRRBB, valuing positions and measuring performance;
• an appropriate reporting and review process for IRRBB;
• adequate internal controls and management information systems for IRRBB;
• an adequate approval process for approving major hedging or risk-taking initiatives prior to implementation;
• appropriate governance processes for ensuring the adequacy of the models;
• a formal policy process for the validation of IRRBB measurement methods and assessment of corresponding model risk; and
• a process to regularly measure IRRBB based on outcomes of economic value and earnings-based measures.

2.44 An SDDT's management body or its delegates should approve major hedging or risk-taking initiatives relating to IRRBB in advance of their implementation.

2.45 An SDDT should ensure that the functions responsible for identification, measurement, monitoring and control of IRRBB are, where appropriate to its nature, size and complexity as well as business activities and overall risk profile, sufficiently independent from risk-taking functions and report directly to the management body or its delegates.

2.46 An SDDT should review and evaluate the effectiveness of its framework on a regular basis, and at least annually. Where appropriate to its nature, size and complexity as well as business activities and overall risk profile, the reviews and evaluations should be carried out by individuals that are sufficiently independent of the individuals responsible for designing and implementing the framework.

2.47 An SDDT should have its framework reviewed by an independent internal auditing function on a regular basis.

Measurement of IRRBB

2.48 An SDDT should ensure that the internal risk measurement system used to comply with the obligation in the PRA Rulebook capture all material sources of IRRBB exposures. If the PRA determines the internal risk measurement systems of an SDDT inadequate in risk capture or for other reasons, the SDDT should take such steps as the PRA may direct or require, including use of the Basel Committee on Banking Supervision’s standardised framework under ICAA 9.13 when performing the evaluation under ICAA 9.2 and 9.4A.

2.49 Under ICAA 9.4A, an SDDT is required to calculate the impact of the change in interest rates described in ICAA 9.7 on the economic value of equity of an SDDT’s non-trading book activities. An SDDT should perform this calculation regularly, and at least quarterly. When performing the calculation, an SDDT should, where appropriate to its nature, size and complexity as well as business activities and overall risk profile, apply the following principles:

• the calculation should exclude the SDDT’s own equity;
• the change in EVE (DEVE) should be computed with the assumptions of a run-off balance sheet;
• a maturity-dependent post-shock interest rate floor should be applied for each currency starting with -100 basis points for immediate maturities and increase by 5 basis points per year, eventually reaching 0% for maturities of 20 years and more (where the observed rates are lower than the current lower reference rate of -100 basis points, an SDDT should apply the lower observed rates);
• when calculating the aggregate DEVE for each interest rate shock scenario, an SDDT should add together any negative and positive DEVE occurring in each currency and any positive changes should be weighted by a factor of 50%;
• the automatic and behavioural options, including the assumptions identified in 2.57, should be reflected in the calculation;
• the assumed behavioural repricing date for retail and non-financial wholesale deposits without any specific repricing dates (non-maturing deposits) should be constrained to a maximum average of 5 years for each individual currency;
• the calculation should include all cash flows from all interest rate-sensitive assets (assets which are not deducted from Common Equity Tier 1 capital and which exclude (i) fixed assets such as real estate or intangible assets as well as (ii) equity exposures in the non-trading book), liabilities and off-balance sheet items in the non-trading book in the computation of their exposure; and
• if commercial margins and other spread components are included in the cash flows calculated for measurement of IRRBB, the SDDT should also include commercial margins and other spread components in the rates used for discounting those cash flows.

2.50 Alongside the requirement to monitor and evaluate the potential impact of changes in interest rates on economic value, the PRA expects firms to monitor and evaluate the potential impact on earnings volatility. As appropriate to its nature, size and complexity as well as business activities and overall risk profile, an SDDT should include in its evaluation:

• assessment based on an appropriate timeframe of three to five years;
• the SDDT’s forward-looking view of product volumes and pricing, based on its proposed business model during the scenario, and the projected path of interest rates;
• careful consideration should be given to how any resulting volatility is managed;
• consideration on the effects on its cash flow (ie interest income and expenses), and for SDDTs with complex IRRBB exposures, the projected cash flow under different interest rate scenarios;
• consideration on the effects of the market value changes of interest rate sensitive instruments; and
• the SDDT’s careful consideration to managing any resulting volatility on its’ earnings.

2.51 The models used to comply with the obligation in the PRA Rulebook should incorporate a wide and appropriately prudent range of interest rate shock and stress scenarios by currency. Those scenarios should include:

• interest rate shock scenarios selected by the SDDT reflecting its risk profile in accordance with ICAA 9.2;
• historical and hypothetical interest rate stress scenarios;
• the interest rate shock scenarios in ICAA 9.7; and
• any additional interest rate shock scenarios required by the PRA.

2.52 For the range of interest rate shock scenarios, an SDDT should ensure:

• they encompass a wide range of severe and plausible interest rate shock scenarios relevant to the SDDT's material sources of IRRBB;
• where relevant to the SDDT's own material sources of IRRBB, the scenarios consider gap risk, basis risk, and option risk (including sensitivity to interest rate movements); concentrated risks; and interaction with other risks;
• the scenarios consider vulnerability to reduced economic value or earnings under stressful market conditions – including the breakdown of key assumptions;
• they assess the effect of adverse changes in the spreads of new assets/liabilities replacing those assets/liabilities maturing over the horizon of the forecast on its earnings-based measures; and
• the scenarios consider potential changes in the SDDT's non-trading book activities.

2.53 In addition to considering the range of interest rate shock scenarios in 2.52 for the purpose of ongoing management, an SDDT should also use other larger and more extreme shifts and changes in interest rates for testing vulnerabilities under stressed condition.

2.54 Under ICAA 9.12, an SDDT should either determine the interest rate shock scenarios for material positions in currencies not listed in ICAA 9.11 by considering the following, or use interest rate shock scenarios produced by a third party that are consistent with the following:

• a sufficiently long time-series of daily ‘risk-free’ interest rates for each currency for relevant maturities;
• the baseline global shock parameters on the average interest rate, which comprises: (a) 60% for parallel shocks; (b) 85% for short rate shocks; and (c) 40% for long rate shocks; and
• a floor of 100 basis points and caps of: (a) 500 basis points for the short-term; (b) 400 basis points for the parallel; and (c) 300 basis points for the long-term interest rate shock scenario.

2.55 An SDDT should develop and implement an effective stress testing framework that:

• is commensurate with its nature, size and complexity as well as business activities and overall risk profile;
• is performed regularly, at least annually and more frequently in times of increased interest rate volatility and increased IRRBB levels;
• where relevant, stress testing should incorporate the risks identified in 2.52;
• includes relevant qualitative and quantitative reverse stress tests in order to: (a) identify interest rate scenarios that could significantly threaten the SDDT’s capital and earnings; and (b) reveal vulnerabilities arising from the SDDT’s hedging strategies and the behavioural reactions of its customers.

2.56 An SDDT should reflect in its risk management framework how an instrument’s actual maturity or repricing behaviour may vary from the instrument’s contractual terms because of behavioural optionalities.

2.57 An SDDT should establish and maintain documentation setting out the key behavioural assumptions and modelling assumptions it uses in measuring IRRBB.

2.58 For the documentation of behavioural and modelling assumptions, an SDDT should set out:

• expectations for the exercise of explicit and embedded interest rate options by both the SDDT and its clients under specific interest rate shock and stress scenarios;
• treatment of balances and interest flows arising from non-maturity deposits;
• the treatment of fixed rate loan commitments;
• the treatment of fixed term deposits with risk of early redemption;
• treatment of own equity in economic value measures;
• the implications of accounting practices for IRRBB; and
• how the assumptions in 2.57 may affect the SDDT's hedging strategies.

2.59 An SDDT should review significant assumptions at least annually, and when market conditions change significantly. These assumptions should be aligned with the SDDT’s business strategies.

2.60 For the assumptions identified in 2.57, an SDDT with significant exposure to products with embedded customer optionality should consider and identify the following:

• the potential impact on current and future loan prepayment speeds arising from the interest rate scenario, underlying economic environment, and contractual features;
• the responsiveness of product rates to changes in market interest rates; and
• the migration of balances between product types as a result of changes in their features, terms and conditions.

2.61 For the assumptions identified in 2.57, an SDDT with significant exposure to products without specific repricing dates should consider and identify the following:

• the proportion of 'core' balances that are stable and unlikely to reprice even under significant changes in interest rate environment;
• the depositor characteristics (eg retail/wholesale) and account characteristics (eg transactional/non-transactional);
• the potential migration between deposits without specific repricing dates and other deposits that could modify, under different interest rate scenarios, key behavioural modelling assumptions;
• the potential constraints on the repricing of retail deposits in low or negative interest rate environment;
• ensure that assumptions about the decay of core and other modelled balances are prudent and appropriate in balancing the benefits to earnings against the additional economic value risk entailed in locking in a future interest rate return on the assets financed by these balances, and the potential forgone revenue under a rising interest rate environment; and
• the impact of the assumptions on the SDDT’s own chosen risk measurement outputs and internal capital allocation decisions, including by periodically calculating sensitivity analyses on key parameters (eg percentage and maturity of core balances on accounts and pass-through rate) and the measures using contractual terms rather than behavioural assumptions to isolate the impact of assumptions on both economic value and earnings.

2.62 An SDDT should have assumptions which are conceptually sound and reasonable, and consistent with historical experience, and establish and apply a robust process for testing the validity of the assumptions. The testing process should include sensitivity analyses to monitor the impact of the assumptions on economic value and earnings-based measures.

2.63 Where an SDDT decides to adopt a policy intended to stabilise earnings arising from its own equity, it should:

• have an appropriate methodology for determining what elements of equity capital should be considered eligible for such treatment;
• determine what would be a prudent investment maturity profile for the eligible equity capital that balances the benefits of income stabilisation arising from taking longer-dated fixed-return positions against the additional economic value sensitivity of those positions under an interest rate stress, and the risk of earnings underperformance should rates rise;
• include appropriate documentation of these assumptions in its policies and procedures, and include a process for keeping them under review;
• understand the impact of the chosen maturity profile on the SDDT’s own chosen risk measurement outputs, including by regular calculation of the measures without inclusion of the equity capital to isolate the effects on both EVE and earnings perspectives; and
• undertake stress testing to understand the sensitivity of risk measures to changes in key assumptions for equity capital, taking the results of such tests into account in its IRRBB internal capital allocation decisions.

2.64 The data on which an SDDT’s measurement systems and models for IRRBB are based should be sufficiently accurate and appropriately documented.

2.65 An SDDT should set up appropriate processes to ensure that the data referred to in 2.64 is consistent with the data used for financial planning.

2.66 An SDDT should establish, maintain and apply appropriate governance processes for ensuring the ongoing adequacy of the models. This includes ensuring models are subject to adequate controls and testing, including any data mapping, to provide assurance on the accuracy of their calculations. An SDDT should ensure that its internal audit function annually reviews the integrity and effectiveness of the risk management system and the model risk management process.

2.67 Prior to deployment, and on a regular basis, the model should be reviewed and validated independently of model development.

2.68 An SDDT should establish exception trigger events that require notification to the management body or its delegates under 2.41 in a timely manner if those events occur.

2.69 When using third-party models, an SDDT should:

• document and explain model specification choices as part of the validation process;
• ensure the models can be adequately customised to properly reflect the specific characteristics of the SDDT; and
• determine if inputs to models that are provided by third parties are reasonable for its business and the risk characteristics of its activities.

2.70 The management body or its delegates should receive:

• the outcomes of the SDDT’s measurement of IRRBB; and
• reports on the level and trend of the SDDT's IRRBB. This should be at least quarterly, and more frequently for firms with greater or more complex risk profiles.

2.71 The reporting referred to in 2.70 (ii) should be broken down by the appropriate levels of consolidation and currency and include at least:

• summaries of the SDDT’s aggregate exposures to IRRBB, including information on exposures to gap risk, basis risk and option risk;
• explanation of assets, liabilities, cash flows and strategies that are driving the level and direction of the SDDT’s IRRBB;
• reports showing the extent of compliance of current exposures with policies and limits in 2.38 and 2.39;
• the key modelling assumptions, such as characteristics of non-maturity deposits, prepayments on fixed rate loans, early withdrawals of fixed term deposits, drawing of commitments, currency aggregation and treatment of commercial margins;
• the results of stress tests and measurements from the scenarios referred to in 2.51, including sensitivity analysis for key model assumptions and parameters;
• the results of the calculation under ICAA 9.4A;
• comparisons of past forecasts or risk estimate with actual results to inform potential modelling shortcomings on a regular basis; and
• identification of portfolios that may be subject to significant mark-to-market movements.

2.72 Under ICAA 13.1, an SDDT is required to make a written record of its assessments made under those rules. An SDDT’s record of its approach to evaluating and managing interest rate risk as it affects the SDDT’s non-trading book activities should cover the following issues as appropriate:

• the internal definition of the boundary between ‘banking book’ and ‘trading activities’;
• the definition of economic value and its consistency with the method used to value assets and liabilities (eg discounted cash flows);
• the size and the form of the different shocks to be used for internal calculations;
• the use of a dynamic and/or static approach in the application of interest rate shocks;
• the treatment of commonly called ‘pipeline transactions’ (including any related hedging);
• the aggregation of multi-currency interest rate exposures;
• the inclusion (or not) of non-interest bearing assets and liabilities (including capital and reserves);
• the treatment of current and savings accounts (ie the maturity attached to exposures without a contractual maturity);
• the treatment of fixed-rate assets or liabilities where customers still have a right to repay or withdraw early;
• the extent to which sensitivities to small shocks can be scaled up on a linear basis without material loss of accuracy (ie covering both convexity generally and the non-linearity of pay-offs associated with explicit option products);
• the degree of granularity employed (eg offsets within a time bucket);
• whether all future cash flows or only principal balances are included;
• the results of the calculation under ICAA 9.4A;
• the use of conditional or unconditional cash flow modelling approaches;
• the internal definition of commercial margins and adequate methodology for internal treatment of commercial margins;
• the definition of earnings risk and its consistency with the method used for developing financial plans and financial forecasts;
• the size and tenor of internal limits on IRRBB, and whether these limits are reached at the point of capital calculation;
• the effectiveness and expected cost of hedging open positions that are intended to take advantage of internal expectations of the future level of interest rates;
• the sensitivity of the internal measures of IRRBB to key modelling assumptions;
• the impact of shock and stress scenarios on positions priced off different interest rate indices (basis risk);
• the impact on economic value and earnings of mismatched positions in different currencies;
• the impact of embedded losses;
• the distribution of capital relative to risks across legal entities that form part of a capital consolidation group, in addition to the adequacy of overall capital on a consolidated basis;
• the drivers of the underlying risk; and
• the circumstances under which the risk might crystallise.

2.73 SDDTs implementing the standardised framework under ICAA 9.13 should generally consider the most recent 10 years of data when determining the core portion of non-maturing deposits under ICAA 9.34(1).

Pension obligation risk

2.74 [Deleted]

2.75 [Deleted]

2.76 The PRA expects SDDTs to carry out their own assessment of the appropriate level of Pillar 2A pension obligation risk capital in their ICAAP. SDDTs should use methodologies and assumptions that are consistent with their approach to risk management and are therefore not restricted to using their relevant accounting basis (IAS 19 or similar) in carrying out this assessment.

2.76A The assessment should be proportionate to the nature, scale and complexity of the SDDT’s activities, considering factors such as the size of the scheme, the scheme’s funding level, investment strategy and the presence of secured benefits.

2.77 In carrying out their assessment, SDDTs should consider risks to the financial position of their pension schemes consistent with a stress event that has no more than a 1 in 200 probability of occurring over a one-year period.

2.78 For the purpose of SDDTs’ own assessment of Pillar 2A pension obligation risk capital, the PRA expects SDDTs to use stress testing and scenario analysis where appropriate to quantify the gross impact on the existing scheme surplus or deficit. The PRA does not necessarily favour a stochastic approach over a deterministic one. Firms should decide which approach is most appropriate.

2.78A Following a buy-in, as part of the firm’s ICAAP assessment, the PRA would expect consideration to be made for the residual risks remaining, such as counterparty risk to the insurer. The ICAAP should document the firm’s assessment of these risks.

2.78B The firm’s own assessment can be reduced by:

offsets and management actions; and

any pension scheme deficit reflected in Common Equity Tier 1 (CET1).

2.79 [Deleted]

2.80 [Deleted]

2.81 [Deleted]

2.82 [Deleted]

2.83 The PRA expects SDDTs to explain any offsets or management actions they propose. When considering management actions and offsets, SDDTs must clearly demonstrate that offsets are valid and that management actions are realistic. They must also demonstrate that both offsets and management actions do not result in double counting and would be effective under stressed conditions. Where practical, management actions will be formulated after discussion with pension scheme trustees.

Pension obligation risk in SDDTs and groups

2.84 Firms should ordinarily hold pension obligation risk capital against the total liability resulting from past or present employment:

• with the SDDT (including any legacy or overseas entities); and
• outside the SDDT, pro-rated according to whether the pension fund principal beneficiaries’ service was performed for the benefit of the SDDT.

2.85 Firms should also consider whether they may be exposed to pension obligation risk greater than that captured by these general criteria, given the potential for The Pensions Regulator to impose a contribution notice or a financial support direction on any company associated with an employer.

2.86 When Pillar 2A pension obligation risk capital is calculated at group level, these expectations apply to the group as a whole. Accordingly, SDDTs must allocate Pillar 2A pension obligation risk capital to entities within the group in a way that adequately reflects the nature, level and distribution of the risks to which the group is subject.

Pension obligation risk: addressing the risk of increased pension losses near the point of resolution

2.87 There are situations where liabilities related to a defined benefit pension fund may, as the sponsor firm’s financial condition deteriorates, increase substantially and unexpectedly above the stressed deficit which is covered under Pillar 2A.^{footnote [13]}

2.88 Should such events materialise as an SDDT’s financial condition deteriorates, unexpected losses well in excess of Pillar 2A capital already set aside might crystallise prior to the point of resolution.

2.89 In order to address the risk of increased pension losses near the point of resolution, the PRA expects SDDTs to articulate in their ICAAP document how they intend to deal with the defined benefit pension scheme under relevant firm-specific extreme scenarios, bearing in mind the potential for additional loss and describing available management actions. The analysis should be sufficient to demonstrate the institution’s awareness around this tail risk and the adequacy of its mitigating actions. The actions should be consistent with the SDDTs’ recovery and resolution plans. Additionally, under rule 2.6 in the Reporting Pillar 2 Part in the PRA Rulebook,^{footnote [14]} SDDTs with defined benefit pension schemes must calculate and report to the PRA their defined benefit pension scheme deficit if a debt became due under section 75 of the Pensions Act 1995, unless the data required in that data item have already been reported to the PRA by other means.

Counterparty credit risk

2.90 Counterparty credit risk (CCR) is not captured under Pillar 1 capital requirements for SDDTs for derivatives (except in some specific cases).^{footnote [15]} However, the PRA expects SDDTs to have appropriate governance, risk management and internal control mechanisms for the purpose of measuring and mitigating CCR.

2.91 When an SDDT is assessing their risks to counterparty credit risk as part of meeting the general standards referred to in Internal Capital Adequacy Assessment 4, it should consider the following:

Governance of CCR

2.92 SDDTs are expected to have robust risk management and governance procedures in place that include:

• a risk management framework that considers the identification, measurement, active management, approval, and internal reporting of CCR;
• active involvement from senior management in overseeing the risk management processes, and allocating sufficient resources as required;
• a documented set of internal policies, standard operating procedures and internal risk controls.

Risk Measurement and Risk Management of CCR

2.93 SDDTs should have in place appropriate arrangements to measure and manage the risks to the SDDT from counterparty credit risk. These arrangements should include:

• a process to measure exposures and/or risks to counterparties;
• consideration of how such exposures and/or risks may change during periods of stress;
• consideration of the credit quality of counterparties, including processes to monitor credit quality and set counterparty limits where appropriate;
• use of collateralisation to minimise exposure, either via bilateral arrangements or use of central clearing; and
• comprehensive documentation of contractual terms and conditions with their counterparties.

Reviews

2.94 An SDDT should review and evaluate the effectiveness of its framework on a regular basis, and at least annually.

Exposures to securitisation

2.95 When an SDDT assesses risks associated with exposures to securitisation as part of its ICAAP, it should consider the following:

• the risk characteristics and structural features of a securitisation, including those of the underlying exposures, which could materially impact the performance of any positions in that securitisation held by the SDDT;
• whether the application of another method, namely SEC-IRBA, SEC-ERBA or SEC-SA, insofar as that method may be used, would result in material differences in risk weights for a position relative to the method applied; and
• the extent to which differences in risk-weights identified in (ii) may be caused by the risk characteristics and structural features identified in (i) as well as the approach taken by an External Credit Assessment Institution (ECAI) in rating a particular asset class.

2.96 An SDDT’s record under ICAA 13.1 of its approach to evaluating and managing securitisation risk (or credit risk arising from securitisation exposures) should cover the following, as appropriate, taking into account SS9/13 ’Securitisations: Significant Risk Transfer’:

• the appropriateness of the credit risk weight calculated for the asset classes to which the SDDT is exposed via securitisation;
• risk characteristics and structural features exhibited by securitisations to which the SDDT is exposed, that may materially impact the performance of the securitisation position, and are not explicitly taken into account by the method applied;
• a breakdown of the SDDT’s aggregate securitisation exposure, split by asset class, risk characteristic or other feature as appropriate, with the following information: (a) for the aggregate exposure risk-weighted under the SEC-IRBA, risk-weighted exposure amounts split by asset class, risk characteristic or other feature as appropriate, which would be arrived at under the SEC-IRBA, SEC-ERBA (for rated positions only) and the SEC-SA insofar as each method may be used; and (b) for the aggregate exposure which is both risk-weighted under the SEC-SA and rated, risk-weighted exposure amounts which would be arrived at under the SEC-ERBA insofar as that method may be used.
• The SDDTs’ aggregate exposure and aggregate risk-weighted exposure amounts to unrated securitisation positions.

Financial risks from climate change

2.97 The PRA expects SDDTs to understand the financial risks from climate change and how these will affect their business model. SDDTs should use scenario analysis and stress testing to inform the risk identification process and to understand the short- and long-term financial risks to their business model from climate change.

2.98 SDDTs should refer to SS5/25 – Enhancing banks’ and insurers’ approaches to managing climate-related risks^{footnote [16]} for the PRA’s expectations for ICAAPs in relation to financial risks from climate change.

Market risk

2.99 Market risk is the risk of losses resulting from adverse changes in the value of positions arising from movements in market prices across commodity, credit, equity, FX and interest rates risk factors.

2.100 The PRA considers that market risk is generally not relevant for SDDTs. However, the PRA expects SDDTs to adequately capitalise against risks they are exposed to. If an SDDT is exposed to market risk, it will be subject to the relevant expectations set out in SS31/15.

Group risk

2.101 Group risk, as defined in the PRA Rulebook,^{footnote [17]} means the risk that the financial position of a firm may be adversely affected by its relationships (financial or non-financial) with other entities in the same group or by risk which may affect the financial position of the whole group, including reputational contagion.

2.102 The PRA considers that group risk is generally not relevant for SDDTs. However, the PRA expects SDDTs to adequately capitalise against risks they are exposed to. If an SDDT is exposed to group risk, it will be subject to the relevant expectations set out in SS31/15.

Foreign currency lending to unhedged retail and SME borrowers

2.103 The PRA considers that risks arising from foreign currency lending to unhedged retail and SME borrowers is generally not relevant for SDDTs. However, the PRA expects SDDTs to adequately capitalise against risks they are exposed to. If an SDDT is exposed to foreign currency lending to unhedged retail and SME borrowers, it will be subject to the relevant expectations set out in SS31/15.

Risk of excessive leverage

2.104 Excessive leverage risk is defined as the risk resulting from a firm’s vulnerability to leverage or contingent leverage that may require unintended corrective measures to its business plan, including distressed selling of assets which might result in losses or in valuation adjustments to its remaining assets.

2.105 The PRA considers that the risk of excessive leverage is generally not relevant for SDDTs. However, the PRA expects SDDTs to adequately capitalise against risks they are exposed to. If an SDDT is exposed to the risk of excessive leverage, it will be subject to the relevant expectations set out in SS31/15.

3. Stress testing, scenario analysis and capital planning

3.1 Both stress testing and scenario analysis are forward-looking analytical techniques, which seek to anticipate possible losses that might occur if an identified economic downturn occurs, or a risk event crystallises.

3.2 Stress testing typically refers to shifting the values of individual parameters that affect the financial position of a firm and determining the effect on the firm’s financial position.

3.3 Scenario analysis typically refers to a wider range of parameters being varied at the same time. Scenario analyses often examine the impact of adverse events on the firm’s financial position, for example, simultaneous movements in a number of risk drivers affecting all of a firm’s business operations, such as business volumes and investment values.

3.4 There are three broad purposes of stress testing and scenario analysis:

• as a means of quantifying how much capital might be absorbed if an adverse event(s) occurs;
• to provide a check on the outputs and accuracy of risk models, particularly in identifying non-linear effects when aggregating risks; and
• to explore the sensitivities in longer-term business plans and how capital needs might change over time.

3.5 The general stress test and scenario analysis rule in ICAA 12.1 requires an SDDT to carry out stress tests and scenario analyses as part of its obligations under the overall Pillar 2 rule in ICAA 3.1. Both stress tests and scenario analyses are undertaken by an SDDT to improve its understanding of the vulnerabilities that it faces under adverse conditions. They are based on the analysis of the impact of a range of events of varying nature, severity, and duration. These events can be economic, financial, operational, or legal, or relate to any other risk that might have an impact on the SDDT. Under the Recovery Plans Part of the PRA Rulebook, a recovery plan must contain a comprehensive range of options setting out actions that could be taken in a number of different scenarios and stresses.

Overall approach

3.6 As part of its obligation under the general stress and scenario testing rule in ICAA 12.1, an SDDT should undertake a broad range of stress tests which reflect a variety of perspectives, including sensitivity analysis, scenario analysis and stress testing on individual portfolios as well as at a firm-wide level.

3.7 An SDDT should use the results of its stress testing and scenario analysis not only to assess capital needs, but also to decide if measures should be put in place to minimise the adverse effect on the SDDT if the risks covered by the stress test or scenario analysis actually materialise. Such measures might be a contingency plan or more concrete risk mitigation steps.

3.8 Stress tests and scenario analyses should be carried out at least every two years, and annually for SDDTs that are new and growing banks. An SDDT should, however, consider whether the nature of the major sources of risks identified by it in accordance with the overall Pillar 2 rule in ICAA 3.1 and their possible impact on its financial resources suggest that such tests and analyses should be carried out more frequently. For instance, a sudden change in the economic outlook may prompt the SDDT to revise the parameters of some of its stress tests and change its scenario analyses. Similarly, if an SDDT has recently become exposed to a particular sectoral concentration, it may wish to amend and/or add some stress tests and scenario analyses in order to reflect that concentration.

3.9 The PRA expects an SDDT to project its capital resources and capital requirements over a three-to-five-year horizon, taking account of its business plan and the impact of relevant adverse scenarios. In making its capital estimate, the SDDT should consider both the capital resources required to meet its capital requirements under the PRA Rulebook the capital resources needed to meet the overall financial adequacy rule.^{footnote [17A]} The SDDT should make these projections in a manner consistent with its risk management processes and systems.

3.10 The SDDT should document its stress testing and scenario analysis policies and procedures, as well as the results of its tests in accordance with ICAA 13.1. These results should be included within the SDDT’s ICAAP document.

Governance

3.11 The PRA expects an SDDT’s management body to be actively involved and engaged in all relevant stages of the SDDT’s stress testing and scenario analysis programme. This would include establishing an appropriate stress testing programme, reviewing the programme’s implementation (including the design of scenarios) and challenging, approving and taking action based on the results of the stress tests.

3.12 The PRA expects SDDTs to assign adequate resources, including IT systems, to stress testing and scenario analysis, taking into account the stress testing techniques employed, so as to be able to accommodate different and changing stress tests at an appropriate level of granularity.

Scenarios

3.13 SDDTs should develop a range of firm-wide scenarios including some based on macroeconomic and financial market shocks for the purposes of their own stress testing. These scenarios should be developed so as to be relevant to the circumstances of each SDDT, including its business model, and the market(s) in which it operates (eg reflect any particular sectoral concentration, especially for SDDTs with significant wholesale exposures).

3.14 In identifying an appropriate range of adverse circumstances and events in accordance with ICAA 12.1, an SDDT will need to consider:

• the nature, scale and complexity of its business and of the risks that it bears;
• its risk appetite, including in light of the adverse conditions through which it expects to remain a going concern;
• the behaviour of counterparties, and of the SDDT itself, including the exercise of choices (for example, options embedded in financial instruments or contracts of insurance); and
• for the purposes of ICAA 12.1, the amplitude and duration of the relevant cycle which should include a severe downturn scenario based on forward-looking hypothetical events, calibrated against the most adverse movements in individual risk drivers experienced over a long historical period.

3.15 The calibration of stress testing and scenario analyses should be reconciled to a clear statement setting out the premises upon which the SDDT’s internal capital assessment under the overall Pillar 2 rule in ICAA 3.1 is based.

Common stress scenarios

3.16 The PRA publishes annually two non-cyclical stress testing scenarios, the SDDT scenarios, to serve as a guide and, where relevant, as a severity benchmark, for SDDTs designing their own stress scenarios.

3.17 These stress testing scenarios are non-cyclical, with a relatively constant impact, meaning that an SDDT’s single capital buffer (SCB) (see para 5.16) is relatively insensitive to the C-SREP timing and to the point in the economic cycle when SCB setting occurs. The scenarios are set in such a way that as the economy moves through the economic and financial cycles, the generated stress impact remains, on average, at a relatively constant level (if the SDDT’s risk profile and balance sheet remain broadly unchanged). But the stress impact and thereby the SCB, will vary by SDDT, in accordance with their risk profile and balance sheet. It may also, on rare occasions, change in response to material changes in the structure (ie not related to the economic or financial cycle) of the economy or financial system that are relevant for SDDTs.

3.18 SDDTs should continue to develop their own scenarios and consider the relevance of the PRA’s stress scenarios in the context of their business and specific risk drivers and use these scenarios as a severity benchmark to build and calibrate their own scenarios. The severity of the scenarios through which SDDTs assess their ability to maintain minimum specified capital levels should be at least as severe as the PRA’s scenarios.

3.19 In identifying adverse circumstances and events in accordance with ICAA 12.1, an SDDT should consider the results of any reverse stress testing conducted in accordance with ICAA 15. Reverse stress testing may be expected to provide useful information about the SDDT’s vulnerabilities for the purpose of meeting the SDDT’s obligations under ICAA 12.1. In addition, such a comparison may help an SDDT to assess the sensitivity of its financial position to different stress calibrations.

Forward-looking, multi-year risk assessment

3.20 In carrying out the stress tests and scenario analyses required by the general stress and scenario testing rule in ICAA 12.1, the PRA expects an SDDT to consider any impact of the adverse circumstances on its capital resources. In determining whether it would have adequate financial resources in the event of each identified severe adverse scenario, the SDDT should:

• only include financial resources that could reasonably be relied upon as being available in the circumstances of the identified scenario; and
• take account of any legal or other restriction on the use of financial resources.

3.21 In making the estimate required by ICAA 12.3, an SDDT should project both its capital resources and its required capital resources over a time horizon of three to five years, taking account of its business plan and the impact of relevant adverse scenarios. The SDDT should consider both the capital resources required to meet its capital requirements under the PRA Rulebook and the capital resources needed to meet the overall financial adequacy rule. The PRA’s approach to projecting the Pillar 2A component of capital requirements is described in SoP5/25. The SDDT should make all these projections in a manner consistent with its risk management processes and systems as set out in ICAA 3.1.

3.22 When deciding the planning horizon over which to conduct their analysis, SDDTs should consider how long it might take to recover from any loss. The time horizon over which stress tests and scenario analyses should be carried out will depend on, among other things, the maturity and liquidity of the positions stressed. For example, the market risk arising from the holding of investments will depend upon the extent to which there is a regular, open and transparent market in those assets, which would allow fluctuations in the values of the investments to be more readily and quickly identified.

3.23 In projecting its financial position over the relevant time horizon, an SDDT should:

• reflect how its business plan would respond to the adverse events being considered, taking into account factors such as changing consumer demand and changes to new business assumptions;
• consider the potential impact on its stress testing of dynamic feedback effects and second-order effects of the major sources of risk identified in accordance with the overall Pillar 2 rule in ICAA 3.1;
• estimate the effects on its financial position of the adverse event without adjusting for management actions;
• separately, identify any realistic management actions that the SDDT could, and would, take to mitigate the adverse effects of the stress scenario; and
• estimate the effects of the stress scenario on its financial position after taking account of realistic management actions.

3.24 The PRA expects SDDTs to identify any realistic management actions intended to maintain or restore capital adequacy. An SDDT should reflect management actions in its projections only where it could, and would, take such actions, taking account of factors such as market conditions in the stress scenario and any effects upon the firm’s reputation with its counterparties and investors. The combined effect on capital and retained earnings should be estimated.

3.25 To assess whether prospective management actions in a stress scenario would be realistic, and to determine which actions the SDDT could and would take, the PRA expects an SDDT to take into account any preconditions that might affect the value of management actions as risk mitigants. It should then analyse the difference between the estimates of its financial position over the time horizon, both gross and net of management actions, in sufficient detail to understand the implications of taking different management actions at different times, particularly where they represent a significant divergence from the SDDT’s business plan.

4. Reverse stress testing

4.1 Reverse stress testing is a risk management tool used to increase a firm’s awareness of its business model vulnerabilities. Firms in scope of Chapter 15 of the ICAA Part of the PRA Rulebook must carry out reverse stress testing in accordance with Chapter 15 of that Part. This includes requirements on the firm to reverse stress test its business plan; that is, to carry out stress tests and scenario analyses that test its business plan to failure. SDDTs are required to undertake reverse stress tests at least every two years. However, the PRA may request an annual update from an SDDT if necessary. For example, if an SDDT’s reverse stress test is of poor quality, supervisors could ask the SDDT to remediate issues in the next year, and evidence this through submission of an updated reverse stress test.

4.2 Business plan failure in the context of reverse stress testing should be understood as the point at which the market loses confidence in a firm and, as a result, the firm is no longer able to carry out its business activities. Examples of this would be the point at which all or a substantial portion of the firm’s counterparties are unwilling to continue transacting with it or seek to terminate their contracts, or the point at which the firm’s existing shareholders are unwilling to provide new capital. Such a point may be reached well before the firm’s financial resources are exhausted.

4.3 Smaller firms often lack the capabilities to run a full quantitative reverse stress test. Therefore, SDDTs can perform a more qualitative reverse stress test. The PRA would expect an SDDT to consider, for example, scenarios in which the failure of a major market participant or a significant market disruption would cause it to fail. And an SDDT should describe the scenario and the stress testing approach. The PRA considers that SDDTs could include (but not be limited to) the following analysis as part of a qualitative reverse stress test:

• identification of the risks, events or scenarios that could cause the firm to fail or cause its business plan to become unviable;
• assessment of remedial actions; and
• identification and assessment of mitigants that could either prevent such risks from crystallising or mitigate their impacts.

4.4 The PRA may request an SDDT to quantify the level of financial resources which, in the firm’s view, would place it in a situation of business failure should the identified adverse circumstances crystallise.

4.5 In carrying out the stress tests and scenario analyses required by rule 15.2 of the ICAA Part of the PRA Rulebook an SDDT should at least take into account each of the sources of risk identified in accordance with ICAA 3.1.

4.6 Reverse stress testing should be appropriate to the nature, size and complexity of the SDDT’s business and of the risks it bears. Where reverse stress testing reveals that the SDDT’s risk of business failure is unacceptably high, the SDDT should devise realistic measures to prevent or mitigate the risk of business failure, taking into account the time that the SDDT would have to react to these events and implement those measures. As part of these measures, the SDDT should consider if changes to its business plan are appropriate. These measures, including any changes to the SDDT’s business plan, should be documented as part of the results referred to in rule 15.4 of the ICAA Part of the PRA Rulebook.

4.7 In carrying out its reverse stress testing, the SDDT could consider scenarios in which the failure of one or more of its major counterparties or a significant market disruption arising from the failure of a major market participant, whether or not combined, would cause the SDDT’s business to fail.

4.8 SDDTs may choose to use reverse stress testing as a starting point for their recovery plan scenarios.

5. The Capital Supervisory Review and Evaluation Process (C-SREP)

5.1 The C-SREP is a process by which the PRA, taking into account the nature, scale and complexity of an SDDT’s activities, reviews and evaluates the:

• arrangements, strategies, processes and mechanisms implemented by the SDDT to comply with its regulatory requirements laid down in PRA rules and other relevant legislation;
• risks to which the SDDT is or might be exposed; and
• further risks revealed by stress testing.

5.2 As part of the C-SREP, the PRA will review each SDDT’s ICAAP and have regard to the risks outlined in the overall Pillar 2 rule in ICAA 3.1, the SDDT’s vulnerabilities under reverse stress testing, the SDDT’s governance arrangements, its corporate culture and values, and the ability of members of the management body to perform their duties. The degree of involvement of the management body of the SDDT will be taken into account by the PRA when assessing the ICAAP, as will the appropriateness of the internal processes and systems for supporting and producing the ICAAP document. The PRA will consider whether it has reasonable grounds to suspect that money laundering or terrorist financing is being undertaken, or has been committed or attempted, or there is increased risk thereof in connection with that institution. If the PRA has reasonable grounds to suspect such activity or increased risk, it will take appropriate steps.

5.3 When the PRA reviews an ICAAP as part of the C-SREP, it does so as part of the process of determining whether all of the material risks have been identified and that the amount and quality of capital identified by the firm is sufficient to cover the nature and level of the risks to which it is or might be exposed.

5.4 The PRA may request an SDDT to submit the design and results of its reverse stress tests and any subsequent updates as part of its risk assessment.

5.5 The C-SREP will also consider:

• the exposure to, and management of, concentration risk by the SDDT, including their compliance with the requirements set out in Chapter 6 of the ICAA rules;
• the robustness, suitability and manner of application of policies and procedures implemented by the SDDT for the management of the residual risk associated with the use of credit risk mitigation techniques;
• the extent to which the capital held by the SDDT in respect of assets which it has securitised is adequate, having regard to the economic substance of the transaction, including the degree of risk transfer achieved;
• the exposure and management of liquidity risk by the SDDT, including the development of alternative scenario analyses, the management of risk mitigants (including the level, composition and quality of liquidity buffers), and effective contingency plans;
• the impact of diversification effects and how such effects are factored into the SDDT’s risk measurement systems;
• the geographical location of the SDDT’s exposures;
• whether the SDDT has provided implicit support to a securitisation;
• the exposure to and management of foreign currency lending risk to unhedged retail and SME borrowers by firms;
• the extent to which the allocation of the total amount of financial resources, own funds and internal capital between different parts of the consolidation group reflects the nature, level, and distribution of the risks to which the consolidation group is subject; and,
• the extent to which any capital requirements or buffers set on an entity established outside the United Kingdom, on an individual or sub-consolidated basis, exceed the requirements or buffers applicable at the consolidated group level to cover the same risk.

5.6 The PRA may need to request further information and meet with the management body and other representatives of an SDDT in order to evaluate fully the comprehensiveness of the ICAAP and the adequacy of the governance arrangements around it. The management body should be able to demonstrate an understanding of the ICAAP consistent with its taking responsibility for it. And the appropriate levels of the SDDT’s management should be prepared to discuss and defend all aspects of the ICAAP, covering both quantitative and qualitative components.

5.7 On the basis of the C-SREP, the PRA will determine whether the arrangements implemented by an SDDT and the capital held by it provide sound management and adequate coverage of its risks. If necessary, the PRA will require the SDDT to take appropriate actions or steps at an early stage to address any future potential failure to meet its prudential regulatory requirements.

5.8 There are two main areas that the PRA considers when assessing an SDDT’s capital adequacy under a C-SREP: (i) risks to the SDDT which are either not captured, or not fully captured, under the PRA Rulebook (eg, IRRBB and concentration risk); and (ii) risks to which the SDDT may become exposed over a forward-looking planning horizon. The PRA refers to the first area as Pillar 2A and the second as Pillar 2B.

5.9 To assess the capital adequacy of an SDDT under Pillar 2A, the PRA has developed capital methodologies. The methodologies are published in SoP5/25.

5.10 The PRA will set Pillar 2A capital requirements taking into consideration its own methodologies and using an SDDT’s ICAAP as an input where judged appropriate. Setting a Pillar 2A capital requirement may be subject to peer group reviews to help ensure consistency of decisions across firms.

5.11 The PRA will review the SDDT’s records referred to in ICAA 13.1 as part of its C-SREP to judge whether a firm will be able to continue to meet its capital requirements under the PRA Rulebook and the overall financial adequacy rule in ICAA 2.1 throughout the time horizon used for the capital planning exercise.

The setting of Pillar 2A capital requirements and the Single Capital Buffer

Pillar 2A Capital Requirements

5.12 Following the C-SREP, including both a review of the ICAAP and any further interactions with each SDDT, the PRA will normally set a Pillar 2A capital requirement for the SDDT on an individual basis for the amount and quality of capital that the PRA considers the firm should hold, in addition to the capital it must hold to comply with the PRA Rulebook(Pillar 1 capital) to meet the overall financial adequacy rule in ICAA 2.1. The PRA will additionally set Pillar 2A capital requirements for SDDT consolidation entities which must comply with the overall financial adequacy rule in ICAA 2.1 on a consolidated basis.

5.13 Where the PRA sets a firm-specific Pillar 2A capital requirement, it will generally specify an amount of capital (Pillar 2A) that the SDDT should hold at all times in addition to the capital it must hold to comply with the PRA Rulebook (Pillar 1 capital). It will usually do so by stating that the SDDT should hold capital of an amount equal to a specified percentage of the firm’s Pillar 1 RWAs (the total risk exposure amount calculated in accordance with the PRA Rulebook), plus one or more static add-ons in relation to specific risks in accordance with the overall Pillar 2 rule in ICAA 3.1. The PRA requires SDDTs to meet Pillar 2A with at least 56.25% CET1 capital, no more than 43.75% additional Tier 1 (AT1) capital and no more than 25% Tier 2 capital. For these purposes, firms should follow the provisions on the definition of capital set out in the Definition of Capital Part of the PRA Rulebook and SS7/13 – Definition of capital (CRR firms).^{footnote [18]}

5.14 SDDTs must comply with the overall financial adequacy rule in ICAA 2.1. If an SDDT holds the level of capital required under its TCR, that does not necessarily mean that it is complying with the overall financial adequacy rule. Falling below the level of capital required under TCR does not automatically mean that the firm is in breach of the overall financial adequacy rule or that the PRA will consider the SDDT is failing, or likely to fail, to satisfy the Threshold Conditions (TCs). However, firms should expect the PRA to investigate whether any firm is failing, or likely to fail, to satisfy the TCs, with a view to taking further action as necessary.

5.15 If an SDDT agrees with its TCR, the PRA will expect the SDDT to apply for a requirement under section 55M of the Financial Services and Markets Act 2000 (FSMA) to set the amount and quality of the Pillar 2A capital requirement. The SDDT will normally be invited to apply for such a requirement at the same time as it is advised of its proposed Pillar 2A capital requirement. If an SDDT does not apply for such a requirement the PRA will consider using its powers under section 55M(3) to impose one of its own initiative.

Pillar 2B Single Capital Buffer

5.16 Following the C-SREP, the PRA will also notify each SDDT of an amount of capital that it should hold as an SCB, over and above the level of capital required to meet its TCR. The SCB, based on a firm-specific supervisory assessment, should be of a sufficient amount to allow the firm to continue to meet the overall financial adequacy rule in ICAA 2.1. This should be the case even in adverse circumstances, after allowing for realistic management actions that the SDDT could, and would, take in a stress scenario.

5.17 In setting the SCB for an SDDT, the PRA will consider whether the SDDT would meet its CET1 TCR (Pillar 1 and Pillar 2A) in the SDDT scenarios and the maximum change in capital resources and requirements under the stress. The PRA’s expectations for Pillar 2B of new and growing banks are set out in SS3/21.

5.18 The SCB will be set at a level no lower than 3.5% of each SDDT’s RWAs before considering the Risk Management and Governance (RMG) assessment. This level will support the resilience of SDDTs, on average across SDDTs and through-the-cycle.

5.19 Where the PRA assesses a firm’s RMG to be significantly weak, it may also adjust the SCB to cover the risks posed by those weaknesses until they are addressed. This will generally be calibrated in the form of a scalar applied to the amount of CET1 required to meet the firm’s TCR. The scalar could be to up to 40% of the total CET1 TCR (variable). ^{footnote [19]} If the PRA sets the SCB to cover the risk posed by significant weaknesses in risk management and/or governance or applies a suspended scalar,^{footnote [20]} the PRA will identify those weaknesses to the SDDT and expect the SDDT to address those weaknesses within an appropriate timeframe. Once the identified weaknesses have been remedied, the PRA will remove the scalar. If new weaknesses emerge that are not adequately addressed by the scalar or if remedial action taken by the SDDT has led to its removal a new scalar may be applied.

5.20 Where the PRA sets an SCB it will generally do so stating that the SDDT should hold capital of an amount equal to a specified percentage of the SDDT’s Pillar 1 RWAs. The PRA expects SDDTs to meet the SCB with 100% CET1. The PRA expects an SDDT not to meet the SCB with any CET1 capital maintained to meet its TCR.

5.21 The PRA may set an SDDT’s SCB either as an amount of capital which it should hold from the time of the PRA’s notification following the firm’s C-SREP or, in exceptional cases, as a forward-looking target that the SDDT should build up over time. The SCB will apply at each level of consolidation which applies to an SDDT. Where the SDDT is not part of a group with an SDDT consolidation entity, the PRA will set the SCB on an individual basis; and where the SDDT is a subsidiary of an SDDT consolidation entity, the PRA will set the SCB both on an individual basis and consolidated level. In all cases, the PRA will set the SCB at a level no lower than 3.5% of the RWAs for the entity or group, as relevant, before the RMG assessment. PRA’s expectations over the level of application of the SCB are set in SoP5/25.

5.22 If the SDDT, instead, considers that the proposed Pillar 2A or the SCB advised to it by the PRA is inappropriate to its circumstances it should notify the PRA of this, consistent with Fundamental Rule 7.^{footnote [21]} If, after discussion, the PRA and the SDDT do not agree on an adequate level of capital, the PRA may consider using its own initiative powers under section 55M of FSMA to impose a requirement on the SDDT to hold capital in accordance with the PRA’s view of the capital necessary to comply with the overall financial adequacy rule in ICAA 2.1. In deciding whether it should use its powers under section 55M, the PRA will take into account the amount of capital that the SDDT should hold for its SCB.

Failure to meet TCR and use of the Single Capital Buffer

5.23 The PRA expects every SDDT to hold at least the level of capital required to meet its TCR at all times. If an SDDT’s capital has fallen or is expected to fall below that level it should inform the PRA as soon as practicable explaining why this has happened or is expected to happen. The SDDT will also be expected to discuss the actions that it intends to take to increase its capital and/or reduce its risks (and therefore capital requirement), and any potential modification that it considers should be made to the Pillar 2A capital requirement.

5.24 Where this has happened, the PRA may ask the SDDT for alternative and more detailed proposals or further assessments of capital adequacy and risks faced by the SDDT. The PRA will seek to agree with the SDDT the appropriate timescales and the scope for any such additional work.

5.25 Use of the SCB is not itself a breach of capital requirements or TCs. SDDTs are expected and encouraged to use their SCB to manage a stress. Use of the SCB is what SDDTs and the PRA model as part of their stress tests. The PRA does not expect or require SDDTs to finance themselves with more capital than the total of their regulatory requirements and SCB. However, an SDDT should not use the SCB in the normal course of business or enter into it as part of its base business plan. In a scenario where an SDDT has identified the need to draw down on its SCB, and in line with Fundamental Rule 7, the SDDT should notify the PRA as early as possible. An SDDT which does not meet its SCB can expect enhanced supervisory scrutiny and should prepare a capital restoration plan. The PRA’s expectations on the use of the SCB are set in SoP5/25.

Disclosure

5.26 SDDTs should disclose the PRA’s SREP feedback letter setting Pillar 2A capital requirements and the SCB to their auditors. The PRA expect SDDTs to publicly disclose the amount and quality of TCR which apply to them at the highest level of consolidation in the UK. The PRA expects the SCB to be treated as confidential unless it is required to be disclosed by law. If SDDTs wish to disclose the PRA’s SREP feedback letter or any part of it to any third parties (other than their auditors) they should, consistent with Fundamental Rule 7, provide appropriate prior notice to the PRA of the proposed form, timing, nature and purpose of the disclosure.

5.27 Where an immediate market disclosure obligation exists, prior notification to the PRA should not lead to any delay in disclosure. But any SDDT intending to disclose information relating to TCR (except the total figure) or the SCB should (consistent with Fundamental Rule 7), where reasonably practicable, provide appropriate notice in advance of the proposed disclosure and the reasons for it. The PRA does not advise SDDTs on their market disclosure obligations and SDDTs should seek their own advice on this matter. The FCA is responsible for oversight of issuers’ compliance with their market disclosure obligations.

Annex 1 – ICAAP optional structure

The ICAAP is owned by the SDDT and it is therefore for the SDDT to decide how best to structure the document. The below optional structure has been produced by the PRA in order to aid SDDTs in structuring their ICAAP, should they choose to use it. There is no expectation that SDDTs use this structure; doing so is entirely optional.

Further, it is the responsibility of the SDDT to include all relevant risks in their ICAAP. The below optional structure is not exhaustive and responsibility for ensuring the ICAAP document is comprehensive remains with the Board.

Small Domestic Deposit Takers (SDDTs) can cross-reference existing documents where possible and are therefore not required to duplicate information provided in other regulatory documents such as the Corporate Strategy, Internal Liquidity Adequacy Assessment Process (ILAAP), or Recovery Plan.

Table 1: ICAAP optional structure

Footnotes added post-publication

17A. References to capital requirements required under the PRA Rulebook in this SS should, where relevant and unless otherwise specified, be taken to include the effects of other legislation such as the Overseas Prudential Requirements Regime (Credit Institutions and Investment Firms) Regulations 2026.