Guidance for the application of

Internal Capital Adequacy Assessment

Process (ICAAP)
Version 1.0

Central Bank of the UAE ICAAP guideline

A.

Preface

This guidance is intended to outline the Central Bank of the UAEs (CBUAE) Pillar 2 assessment
framework as initially mandated under the Basel Accord (June 2006) and amended through the
Enhancements to the Basel II Framework (July 2009). In addition, the guidance is designed to be
compliant and consistent with the Basel III guidelines.
The ICAAP document has a dual purpose, both to inform the board and senior management of the
bank as well as the CBUAE of the on-going assessment of the banks risks, how the bank intends
to mitigate those risks and the impact on both internal and regulatory capital where relevant.
The purpose of the guidelines is to enhance the standard of the Internal Capital Adequacy Assessment
Process (ICAAP) for banks in the UAE, whilst recognising that an individual banks ICAAP should be
commensurate and relevant in relation to the risk profile of the institution concerned.
The revised Basel Accord establishes the following four guiding principles for Pillar 2:
1: Internal capital adequacy assessment process (ICAAP): Banks should have a process for
assessing their overall capital adequacy in relation to their risk profile and have a strategy for
maintaining adequate levels of capital.
2: Supervisory review and evaluation process (SREP): Supervisors should review and evaluate a
banks internal capital assessment and strategies for maintaining adequate capital, as well as their
ability to monitor and ensure compliance with the relevant prudential ratios. Appropriate supervisory
measures would be undertaken if the supervisor is not fully satisfied with the outcome of the process.
3: Capital above the minimum requirements: Supervisors should expect banks to operate above the
minimum regulatory capital ratios and should have the ability to require institutions to hold capital in
excess of the minimum.
4: Early intervention system: Supervisors should seek to intervene at an early stage to prevent
capital from falling below the minimum levels required to support the risks the institution is undertaking
and require remedial action to restore an adequate level of capital.

Central Bank of the UAE ICAAP guideline

The information contained in the ICAAP should be sufficient for the CBUAE to gain an understanding
and make an informed judgment about the risk profile of the bank and the appropriate level of capital a
bank should hold.

Section B describes the principles and process underpinning the Supervisory Review and
Evaluation Process (SREP) in the UAE

Section C gives further guidance on CBUAEs expectation for the ICAAP process

ICAAP reference manual: The Central Bank will also publish an ICAAP reference manual which
contains further guidance on aspects of the ICAAP process (this will be an informal guide and
does not reflect official policy of the CBUAE)

Material changes: If there is a material change to a banks ICAAP subsequent to its submission,
affecting the capital plan, stress testing programme or any other relevant matter related to the ICAAP,
the bank should formally notify the Central Banks Basel Unit at the Banking Supervision Department
immediately.

These guidelines supersede the requirements set out in section 6 Pillar 2-Supervisory Review and
Annex 3: ICAAP suggested format contained in the CBUAE Capital Adequacy Standards- the
Standardised Approach (November 2009).
The requirements set out in this guideline are effective as of the date of this circular.
These guidelines are applicable to all banks operating in the United Arab Emirates
All Banks must submit an ICAAP annually to the CBUAE no later than 15 April each year.
The ICAAP can be submitted as Word, PowerPoint or PDF file.

Central Bank of the UAE ICAAP guideline

Table of Contents
A.
Preface .............................................................................................................................2
B.
Pillar 2 & the ICAAP process in the UAE ..........................................................................5
B.1 Executive Summary ....................................................................................... 5
B.2 Pillar 2 & the ICAAP process in the UAE ..................................................... 10
B.3 CBUAE Supervisory Review and Evaluation Process (SREP) Principles .... 11
B.4 CBUAE ICAAP Principles............................................................................. 11
C.
ICAAP guidelines ............................................................................................................13
C.1 Executive Summary and conclusions .......................................................... 13
C.2 Overview of ICAAP process & the USE test ............................................... 13
C.3 Business background and group structure ................................................... 14
C.4 Governance and risk management arrangements ....................................... 15
C.5 Risk appetite ................................................................................................ 16
C.6 Pillar 1 Risks and Calculation Methodologies .............................................. 16
C.7 Pillar 2 Risk Assessment.............................................................................. 17
C.8 Guidance on Pillar 2 Risk ............................................................................. 18
C.9 Capital planning ........................................................................................... 20
C.10 Stress and scenario testing ........................................................................ 22
C.11 Business Model Analysis (BMA) ................................................................ 25
C.12 Risk and diversification benefits ................................................................. 25
C.13 Ratings Risk ............................................................................................... 25
C.14 Islamic banks ............................................................................................. 26
D. Annexes .................................................................................................................................I
Annex 1: ICAAP: Mandatory disclosure form ................................................... I
Annex 2: ICAAP projection tables (n.b. this table is for illustrative purposes only) II
Annex 3: Capital planning summary .................................................................... III
Annex 4: References The following are for reference purposes only .................. IV
Annex 5: Glossary ................................................................................................ V

Central Bank of the UAE ICAAP guideline

B.

Pillar 2 & the ICAAP process in the UAE

B.1 Executive Summary

The ICAAP as an internal process is a tool for better risk management and ensuring the bank
has sufficient capital to meet its current and future business plan and related risks. The ICAAP
should reflect the risk management approach embedded in the bank. Processes undertaken in
this regard should not be implemented merely to meet the regulatory requirements.
The minimum capital requirements (Pillar 1) contain restrictive or simplifying assumptions and hence a
bank should assess the total level of capital it requires as part of the Pillar 2 process on a forward
looking basis correspondent to its individual risk profile. The ICAAP should produce a level of capital
adequate to support the nature and level of risk facing an individual bank.
The key element of the capital adequacy assessment process is the forward looking capital plan, in
which the bank determines the level of capital required (accounting for material risks and stress
events). The capital plan should be based on the forecast business plan of the bank. Another essential
component is embedding forward looking stress testing to determine if the bank has sufficient capital
to meet a severe but plausible stress scenario. The ICAAP should not be undertaken as a purely
regulatory exercise and if undertaken properly it can help a bank implement a range of risk
management tools and forward planning to manage and control future risk.
The Central Bank does not prescribe or recommend any particular model or underlying methodology
whether in relation to capital concept (e.g. Pillar 1 plus versus bottom-up etc.) or modelling of any
other aspect of the ICAAP.
The ICAAP should indicate:

Regulatory capital requirements on a current and forecast basis

Demand in capital due to business growth, market shock/stress and other risks
Available capital supply and capital raising options
The adequate level of capital to support the current and projected risk profile

Key principle: Proportionality

A fundamental concept under these guidelines is proportionality. The ICAAP should be relevant to the
complexity, size and risk profile of the entity concerned.
The ICAAP should also have due regard to the Pillar 1 approach undertaken by the bank i.e.
Standardised Approach for Credit Risk (CSA) or Internal Ratings Based Approach (IRB) for Credit Risk.
If a bank uses a more sophisticated approach/framework in relation to any aspect of the ICAAP
process, internal capital modelling or stress testing than indicated by these guidelines the CBUAE will
permit this. The critical issue will be for the bank to be transparent and demonstrate the relevance of
the approach taken in relation to the nature of their activities and risk profile.

Central Bank of the UAE ICAAP guideline

There may be cases where branches of a foreign bank and smaller, less complicated local banks have
a different approach to some elements of the requirements outlined in this guideline. This may be
acceptable under the concept of proportionality so long as they are able to demonstrate the relevance
of their approach in the key aspects of the ICAAP such as risk management, identification of material
risks, capital planning and stress testing. The bank should indicate this clearly in the ICAAP document
and the reasons for any alternative approach.
Foreign banks may adhere to group policies/guidelines and may not conduct stress testing on a standalone basis. The CBUAE has no objection to these alternative approaches so long as the reasons for
doing so are clearly articulated.
Pillar 2 Process
Pillar 2 is one of the three fundamental Pillars underpinning the Basel Accord. As per Circular 27/2009
regarding the implementation of Basel II in the UAE, all banks must have a process for assessing the
overall capital adequacy in relation to their risk profile and a strategy for maintaining adequate capital. A
thorough and comprehensive internal capital adequacy assessment process (ICAAP) is a vital
component of a robust risk management programme. This guidance is intended to assist banks in
better identifying and managing risks in the future and in appropriately capturing risks in their internal
assessments of capital adequacy.
As part of the Pillar 2 process the CBUAE will undertake a Supervisory Review and Evaluation Process
(SREP) in order to review a banks ICAAP assessment and provide feedback as relevant.
The suggested summary contents for an ICAAP are set out in the ICAAP reference manual
The key components of the ICAAP are as follows:
1. Senior management and board oversight
2. Relevance of the ICAAP in identifying all material risks and the aggregate capital requirement
3. Level of disclosure to the Central Bank
4. Specific Pillar 2 risks
5. Capital Planning and Capital Management Plan (CMP)
6. Stress testing
1: Senior management and board oversight
Oversight: The ICAAP report is an internal document; the ICAAP should be approved by the board of
directors or relevant risk/governance committee. There should be sufficient challenge by the board or
senior management on material issues (and the bank should evidence this). The bank should specify
the individual responsible for the ICAAP process (this may or may not be the CRO).

Central Bank of the UAE ICAAP guideline

The board or relevant risk/governance committee bears final responsibility for the assessment and for
any corresponding disclosures. Any deviation from these guidelines should be disclosed and discussed
with the CBUAE. The Bank should specify who signed-off the ICAAP (in addition to the CRO who must
sign the mandatory disclosure form). The ICAAP should be submitted on an annual basis. The ICAAP
submission should include the mandatory disclosure form set out in the Annex.
Senior management and board understanding: It is imperative that the bank establishes a
programme to ensure all senior management and board members understand the purpose and nature
of the ICAAP report (especially in terms of capital planning). All senior management and board
members are expected to demonstrate an understanding of the ICAAP process and familiarity with the
content of the executive summary of the ICAAP guidelines by means of relevant training and or
workshops. The Central Bank will review and verify senior management and board understanding of
the ICAAP during the SREP review.
2: Relevance of the ICAAP in identifying all material risks and the aggregate capital requirement.
The Basel Accord acknowledges that Pillar 1 regulatory capital may not necessarily be sufficient to
cover all the risks a bank is facing. ICAAP is the process that enables a prudent bank to identify the
material risks it is facing and assess the capital impact.
The CBUAE considers that a key element of the ICAAP process is for a bank to identify, disclose and
assess the capital impact of all material risks. Banks should carefully consider all risks affecting their
business and derive their individual risk profile accordingly.
In order to assess whether or not a risk is to be deemed material, bank management has to obtain an
overview of the institutions risks at regular intervals and on an event-driven basis. The risks are to be
identified at the level of the individual bank as a whole regardless of which organisational unit the risks
were caused.
For each material risk identified, the bank should provide an explanation of how the risk has been
assessed, the quantitative results (if relevant), and the additional capital set aside for these risks.
3: Level of disclosure to the Central Bank
The CBUAE will be basing the ICAAP review (or SREP) predominantly on the information contained in
the ICAAP. The information contained in the ICAAP should therefore be sufficient for the CBUAE to
gain an understanding and make an informed judgment about the risk profile of the bank and the
appropriate level of capital a bank should hold.
4: Specific Pillar 2 risks
Concentration risk
The CBUAE considers concentration risk a material Pillar 2 Risk in the UAE. Basel II is calibrated to
large diversified, internationally credit institutions. It is clear that a majority of banks in the UAE are
inherently more concentrated than large diversified international banks. In the context of Pillar 2 a bank
is required to assess and monitor sector, obligor and product concentrations. A bank may use its credit
portfolio models if relevant.

Central Bank of the UAE ICAAP guideline

Interest Rate Risk in the Banking Book (IRRBB)

Interest rate risk in the banking book (IRRBB) refers to the risk of potential losses from balance sheet
and off-balance sheet exposures due to adverse changes in interest rates. The Basel committee
recognizes IRRBB as a significant risk that merits support from capital. As per the Basel
recommendations banks are required to:
Conduct an IRR stress test
Ascertain whether additional capital is required
The test should be based on a banks own internal measurements systems or IRR analysis. The bank
should asses if any additional capital is required.
Liquidity risk
The ICAAP is primarily focused on capital; in certain circumstances banks have the option to use
capital as a mitigant for liquidity risk. The bank should have robust measures for managing liquidity risk,
a high level overview of how this risk is managed is sufficient for the purposes of the ICAAP. The
CBUAE is enhancing its liquidity framework separately.
5: Capital Planning and Capital Management Plan (CMP)
The objective of capital planning is to ensure the bank can meet its minimum capital requirements at all
times. The bank must detail how it would manage its business and capital over the medium term (2 - 3
year period) whilst maintaining the minimum capital requirements and the financial projections should
be based on the business plan/strategy of the bank. The bank may also consider the impact of an
economic downturn on:
The banks capital resources and future earnings
The banks RWA (taking into account future changes to the balance sheet).
A Capital Management Plan should explain how the bank will continue to meet its minimum capital
requirements. The bank should provide a description of how capital is managed and the main
considerations involved in the banks capital planning.
The Capital Management Plan should include disclosure of the following:

Capital raising: to maintain an appropriate level of capital

The possibility of holding a capital buffer if required
Corrective measures: recourse to credible action which could reduce the need for capital
(lowering the capital requirement)
Identification of sources of additional capital if required

For local banks with foreign operations the CBUAE expects the capital planning to include the risks in
the foreign operations.

Central Bank of the UAE ICAAP guideline

6: Stress testing
This is a vital tool and is a critical element of risk management. Stress testing is acknowledged by
regulators as a key regulatory tool and board and senior management involvement in the stress testing
programme is essential. All banks should consider the impact on their business when adverse
circumstances arise.
The bank must:

Implement a comprehensive stress testing programme/ framework

Undertake stress testing on a forward-looking basis
Have clearly documented policies and procedures to enable effective implementation of a stress
testing programme.
Ensure senior management take ownership and responsibility for the implementation of an
effective stress testing programme

The bank should provide a high level summary of the banks approach to stress testing. Banks are be
required to define a number of relevant idiosyncratic, market wide and combination (idiosyncratic and
market wide) stresses and disclose the results of these.
Capital buffer for stress testing:
A bank should decide whether a capital buffer is required for stress testing, the bank should have a
clear process in this regard which has been formally approved by relevant management/board
committee.
If a capital buffer is maintained the bank should indicate for what particular level of stress capital is kept
(where no capital buffer is maintained the bank will need to clearly indicate how it will meet its
regulatory capital requirements in the medium term with due regard to stressed economic conditions).
Mandatory CB UAE ICAAP disclosure form
All banks are required to submit the mandatory ICAAP disclosure form which must be signed by the
CRO (the actual ICAAP should be signed off by the relevant risk/board committee as outlined above).
The disclosure form is set out in the annex.

Central Bank of the UAE ICAAP guideline

B.2 Pillar 2 & the ICAAP process in the UAE

ICAAP Submission and CBUAE review process
The CBUAE reserves the right to set a higher minimum capital requirement for an individual bank as a
result of the SREP (Supervisory Review and Evaluation Process). Where relevant the Central Bank
may issue the bank with Supervisor Capital Guidance (SCG). The setting of a SCG would be to raise
the minimum regulatory capital requirement for an individual bank. The setting of a higher SCG is not
automatic and will be subject to internal review.
Step 1: Submission of the ICAAP
The process begins with the submission of the ICAAP document to the Central Bank of the UAE within
the relevant timeframe. The ICAAP should be signed by the board or relevant risk/other committee (the
CRO is required to sign-off the mandatory disclosure form set out in annex 1). The submission should
highlight key items in the ICAAP which warrant immediate CBUAE attention, such as a projected
shortfall in capital.
Step 2: Supervisory Review and Evaluation Process (SREP)
The CBUAE will perform a review and evaluation of the ICAAP. The scope and depth of a review will
depend on the size of the bank and quality of the ICAAP process, and may involve both on-site visits
and desk-based review work in order to better understand the ICAAP and seek further background
information and evidence where necessary.
Step 3: issuance of Recommended Action Plan (RAP)
The review team will discuss with the bank the key findings, observations and where relevant provide
recommendations. The Central Bank will issue a Recommended Action Plan (RAP) based on the
findings of the review. The bank must then set out a plan to implement the recommendations in a
suitable time frame for each recommendation.
Step 4: Issuance of Supervisory Capital Guidance
This is in line with the Basel Committees recommendations and international best practises and gives
meaning to the ICAAP process. The issuance of SCG will be phased in over time and more details will
follow as deemed necessary
1

Submission of
ICAAP

Supervisory Review
and Evaluation
Process (SREP)
CBUAE review

Central Bank of the UAE ICAAP guideline

Recommended
Action Plan (RAP)
Discuss findings &
issue RAP

Issue Supervisory
Capital Guidance
CBUAE to set a bank
specific capital ratio

10

B.3 CBUAE Supervisory Review and Evaluation Process (SREP) Principles

In order to ensure a fair, consistent and relevant approach to the Supervisor Review Process in the
UAE, the CBUAE will implement the Pillar 2 SREP in line with the following principles:

Risk-based assessment: When considering the ICAAP the focus will be on material risks and
issues, and making comparisons with peer group banks where relevant.

Systemic risk: The Central Bank will also consider the size and importance of the bank within
the UAEs financial system

Scope of review: The scope and depth of a review will depend on the size of the bank and
quality of the ICAAP document

Diversification: The Central Bank will only consider diversification benefits on a case-by-case
basis if the bank can demonstrate the relevance to their individual portfolio.

Regulatory adjustments: Regulatory adjustments may be considered to reflect underlying

weakness or strengths in governance, oversight, risk management and controls.

B.4 CBUAE ICAAP Principles

Banks should observe and be mindful of the following principles in the design and implementation of
their ICAAP framework:
Key principle: Proportionality
A fundamental concept under these guidelines is proportionality. The ICAAP should be relevant to the
complexity, size and risk profile of the bank concerned. The ICAAP should also have due regard to the
Pillar 1 approach undertaken by the bank i.e. Standardised Approach (SA) or Internal Ratings Based
Approach (IRB) for Credit Risk.
CP 1: Every banking institution in the UAE must implement a process for assessing the
adequacy of its capital in relation to its risk profile (ICAAP).
This process is referred to as the Internal Capital Adequacy Assessment Process (ICAAP). The
CBUAEs minimum requirements are set out in this document.
CP 2: The ICAAP should constitute an integral part of the risk management process of a bank
and not just be developed to comply with regulatory obligations.
The bank should ensure that the ICAAP forms an integral part of its risk management process. The
bank should articulate how the ICAAP is used in risk management processes and the ICAAP should
not be viewed as a task undertaken merely to meet regulatory requirements.

Central Bank of the UAE ICAAP guideline

11

CP 3: The ICAAP should be risk-based, comprehensive and forward looking.

The ICAAP should be consistent with the risk profile and business model of the bank. The ICAAP
should capture all material risks and should cover Pillar 1 risks, risks not fully captured under Pillar 1,
Pillar 2 (non-Pillar 1) risks, and risk factors external to the bank (economic and business environment).
The ICAAP should be forward looking and factor in the banks strategic plans, the wider economic and
business cycle and other relevant scenarios. The institution should have an explicit, approved capital
plan. The bank should also set out a general contingency plan to deal with unexpected capital shortfalls
or events. Institutions should conduct appropriate stress testing taking into account jurisdiction specific
risks.
CP 4: The ICAAP is the responsibility of the bank and its Board of Directors and senior
management.
Each bank is responsible for its ICAAP and demonstrating how the ICAAP meets the relevant
supervisory standards. The responsibility for implementing the ICAAP is with the management body.
The ICAAP should be fully documented should be approved by the board of directors or relevant
risk/governance committee. There should be sufficient challenge by the board or senior management
on material issues.
CP 5: The ICAAP should be a comprehensive assessment of risks the bank is exposed to.
The bank has to identify risks on the basis of relevance and materiality. As a general rule, risks inherent
in the banking business, e.g. Credit Risk, Market Risk, Operational Risk, Credit Concentration Risk and
Liquidity Risk are to be considered material under any circumstances.
CP 6: The outcome of the ICAAP should provide a sound capital assessment.
The bank should identify the relevant amount of capital in relation to its business plan, strategies and
risk profile.
CP 7: The ICAAP should be actively used by the bank for risk management purposes.
CP 8: The ICAAP framework and capital policy should be disclosed and documented.
CP 9: The ICAAP should be subject to regular review.
The ICAAP should be reviewed at least annually and/or as often as circumstances dictate i.e. any
material change that may impact the capital position of the bank e.g. acquisitions, mergers, significant
changes to the business plan or strategy, the crystallisation of a material risk event etc.
CP 10: The ICAAP should be based on adequate measurement and assessment processes
Any new assessment techniques or revised measurement approaches are to be taken into
consideration with immediate effect on the ICAAP.
CP 11: The ICAAP should contain both quantitative and qualitative information.
CP 12: All business units and operations should be covered.
Central Bank of the UAE ICAAP guideline

12

C.

ICAAP guidelines

The bank should complete and sign the mandatory disclosure form set out in the annex.

C.1 Executive Summary and conclusions

The purpose of the executive summary is to provide a summary of the ICAAP methodology and key
findings.
The overview should include:

The purpose of the report and summary of the ICAAP approach/ methodology
The key findings of the ICAAP in particular with respect to the Pillar 2 risk assessment, the
capital plan and stress testing
Other relevant matters
Senior management challenge of the ICAAP process

C.2 Overview of ICAAP process & the USE test

ICAAP Role and responsibilities
A high level outline of the roles and responsibilities of relevant committees/individuals etc. with
reference to the ICAAP process (see relevant section of reference manual for example of ICAAP
process outline)
Status and use of ICAAP
Demonstrate how and to what extent the ICAAP process is embedded in the risk management
framework of the bank
Detail future refinements to the ICAAP process which may be of relevance
Challenge and adoption
Outline details of how the ICAAP has been challenged within the bank and how the ICAAP has been
tested or evaluated. Include information on the relevant testing and control processes applied to any
ICAAP models or calculations.
Detail the nature of the process and challenge undertaken by the bank (see relevant section of
reference manual). The CBUAE will ask for evidence of challenge (e.g. relevant meeting minutes, or
copies of presentations circulated to board/senior management) or may conduct interviews with
relevant members of senior management/board to ascertain their understanding and the nature of the
challenge performed.
Provide details of how the board and senior management reviewed and signed-off the ICAAP.

Central Bank of the UAE ICAAP guideline

13

Reliance on third parties

If the bank engages with any third parties, such as external consultants or suppliers, while
implementing or enhancing the capital adequacy process, it must disclose the level of reliance on or the
use of those third parties. If the Internal Audit has reviewed the document and/or any processes, the
bank should provide a high level summary of any relevant reports or reviews.
ICAAP methodology
The ICAAP should also have due regard to the Pillar 1 approach undertaken by the bank i.e.
Standardised Approach (CSA) or Internal Ratings Based Approach (IRB) for Credit Risk. If a bank uses
a more sophisticated approach/framework in relation to any aspect of the ICAAP process, internal
capital modelling or stress testing then indicated by these guidelines the Central Bank will permit this.
The critical issue will be for the bank to be transparent and demonstrate the relevance of the approach
taken in relation to the nature of their activities and risk profile.
Modelling freedom: The Central Bank does not prescribe or recommend any particular model or
methodology whether in relation to capital concept (e.g. Pillar 1 plus versus economic capital) or
modelling of any other aspect of the ICAAP (e.g. interest rate risk in the banking book, concentration
risk). Where banks use any particular model or approach for any aspect of the ICAAP they must be
transparent, explain the relevance of their approach and expect challenge from the Central Bank. Any
references to a specific model or methodology in the guidance or the reference manual are for
illustrative purposes and to act as a guide for banks but need not determine the approach undertaken
for an individual bank.
Caution must be applied when considering the use of Economic Capital (EC) models. The CB has no
objection but in general EC models are designed as a relevant measure of risk to be used for
- Pricing,
- Performance measurement.
The assumptions underlying these models typically hold under normal conditions, although useful
inputs into the ICAAP, they may have limitations under stressed conditions which the ICAAP must
consider.

C.3 Business background and group structure

This section should contain an overview of the business activities of the bank and an overview of the
structure/organisational details of the bank.

Central Bank of the UAE ICAAP guideline

14

C.4 Governance and risk management arrangements

Governance and risk arrangements
Provide a high level summary of the governance arrangements of the bank. The following issues
should be considered:
1)
2)
3)
4)

Board and senior management oversight.

How the board and senior management define bank wide risk appetite
Ensure appropriate policies, controls and risk monitoring systems are effective
Identify and review the changes in risks arising from new products and activities

Organisation and reporting lines

Provide a high level summary of the organisational structure and reporting lines
Functions and responsibilities of the Board of Directors and Board committees
Provide a high level summary of the functions and responsibilities of the Board of directors, board
committees and other relevant committees
Risk management framework
The bank need only set these out at a high level and cross refer to the relevant policies, procedures
and limits where relevant;
Provide a summary of the banks approach to risk management, and the following issues should be
considered:

Organisation of the Risk function including powers, responsibilities and areas where
responsibility has been delegated.
How the bank identifies, measures, monitors and reports material risks
Details of relevant policies, procedures and limits (these do not need to be set out in detail in the
ICAAP, the document should simply cross refer to the relevant policies, procedures and limits
where relevant)
Risk Management Information Systems (MIS), issues to consider:
o How the bank disseminates regular, accurate and timely information on the banks
aggregate risk profile internally
o The nature, frequency and distribution on risk management information

Internal control and audit function in relation to risk management.

The function of Internal Audit with respect to reviewing risk management
Overview of any relevant internal/external audit reviews of risk management and conclusion of these
reports

Central Bank of the UAE ICAAP guideline

15

C.5 Risk appetite

The banks risk appetite sets out the level of risk that the bank is willing to take in pursuit of its business
objectives.
Banks should summarise their risk appetite statement or equivalent. The bank need only set these out
at a high level or cross refer to the relevant policies, procedures and limits where relevant. Banks
should avoid generic statements such as our risk tolerance is low and should set out the appetite in
quantitative terms where relevant.

C.6 Pillar 1 Risks and Calculation Methodologies

Pillar 1 risks considered in ICAAP
The table below sets out the projected Pillar 1 capital requirements, based on the internal approaches
for the next three years based on the base case balance sheet for the bank.
(AED million)
Credit risk
Market risk
Operational risk
Capital requirement

Year 1

Year 2

Year 3

Risk Type & Disclosure

Credit risk
Description of what the risk is and how it affects the bank
The Pillar 1 approach used
The internal assessment approach (ICAAP approach), e.g. credit portfolio model
Use of credit risk mitigation techniques for Pillar 1 and/or ICAAP purposes
Summary of the risk policy
Market risk
Description of what the risk is and how it affects the bank
The Pillar 1 approach used
The internal assessment approach (ICAAP approach), e.g. VaR model
Summary of the risk policy
Operational risk
Description of what the risk is and how it affects the bank
The Pillar 1 approach used
The internal assessment approach (ICAAP approach), e.g. loss data analysis
Summary of the risk policy

Central Bank of the UAE ICAAP guideline

16

C.7 Pillar 2 Risk Assessment

The CBUAE considers that a key element of the ICAAP process is for a bank to identify, disclose and
assess the capital impact of all material Pillar 2 risks in addition to Pillar 1 risks. Banks should carefully
consider all risks affecting their business. The CBUAE considers concentration risk as a key Pillar 2 risk
for all UAE based institutions.
Pillar 2 risks can be divided into three types:
Risks not fully captured by Pillar 1: These are risks inherent to Pillar 1 that are not fully captured by
the Pillar 1 process. An example of this is credit concentration risk; other examples include risks arising
from various risk mitigation and transfer techniques
Non-Pillar 1 Risks: These are risks that are not captured by Pillar 1 and include Interest Rate Risk in
the Banking Book Risk (IRRBB), strategic risk, liquidity risk, etc. The second category also includes the
potential for a reduction in aggregate risk exposure due to imperfect correlations between risk types.
Pillar 1 calculation does not allow for a cross-risk diversification benefit but under the Basel framework
supervisors are able to recognise diversification benefits under Pillar 2.
Qualitative risk factors This include a number of qualitative issues such as corporate governance, risk
management systems and controls, external factors such as the business cycle and the wider
economy.
The bank should disclose the following:
1: General -The Pillar 2 Risk framework
The banks approach to identifying material Pillar 2 Risks (how has the risk assessment been
arrived at?)
What are the material risks, including a definition of materiality used by the bank?
How is the banks risk profile going to change (over the reporting period)?
How has the capital requirement been determined for each material risk?
2: Summary table
The bank should disclose a summary of Pillar 2 Risks and capital impact (similar to the table below).
The material risks should be relevant to the bank, and the list below is illustrative.

Pillar 2 risks
Capital required (AED 000s)
e.g. Credit Concentration risk
Interest rate risk in the banking book
Liquidity risk
Business risk
..
Total Pillar 2 add-on

Central Bank of the UAE ICAAP guideline

17

3: Disclosure for each material Pillar 2 risk

For each risk provide an explanation of how the risk has been assessed, the quantitative results and
relevant mitigating actions and/or controls. The following issues should be considered.

Characteristics: Risk characteristics and how the risk might affect the bank;
Methodology: In assessing/quantifying risk
Crystallisation: Likelihood of crystallisation of risk (net of controls) where possible
Capital impact: Whether the capital held under Pillar 1 in respect of that risk is sufficient and if
additional capital will be held with respect to the individual risk concerned

C.8 Guidance on Pillar 2 Risk

1: Concentration Risk (CR)
Issue: The CBUAE considers concentration risk a material Pillar 2 Risk in the UAE. Concentration risk
is predominantly a subset of credit risk. Concentration Risk is a fairly broad term that references to an
exposure with the potential to produce losses large enough to amplify banks losses by increasing its
exposure to credit risk.
Types of Concentration risk: Large exposures and high correlation between exposures could
increase the amount of losses for a bank, and can arise from the following:
Lending to particular geographical regions/jurisdictions
Large exposures
Specific products
Lending to particular industry or economic sectors
Trading exposures/market risk
Basel II Calibration: In the context of Pillar 2 a bank is required to assess and monitor sector,
geographic and product concentrations. Basel II is calibrated to large diversified, internationally credit
institutions.
Methodology approach: The Central Bank does not specify any particular methodology. A bank may
use credit portfolio modelling where appropriate but the relevance and methodology of the approach
taken should be disclosed.
Information disclosure: In its analysis the bank may disclose the following with respect to
concentration risk:
An outline of key concentration risks the bank is exposed to, for example product type, large exposure,
geography, sectoral exposure etc.
Summary of relevant concentration risk policies and limits
The level of additional capital set aside to cover these risks
See further guidance in the ICAAP reference manual

Central Bank of the UAE ICAAP guideline

18

2: Interest Rate Risk in the Banking Book.

Interest rate risk in the banking book (IRRBB) refers to the risk of potential losses from balance sheet
and off-balance sheet exposures due to adverse changes in interest rates.
In the context of Pillar 2 IRR refers to the banking book as interest rate risk in the trading book is
captured by the Pillar 1 market risk calculations. The approach undertaken for this risk should be
commensurate with the size and complexity of the bank.
Banks should consider the relevance of the 15 principles set out in Principles for the Management and
Supervision of Interest Rate Risk, BCBS (July 2004) in particular Principle 12 banks must hold capital
with the level of interest rate risk they take.
Requirements and Information disclosure
The Basel committee recognizes IRRBB as a significant risk that merits support from capital. As per the
Basel standards banks are recommended to:
Evaluate and manage IRR: a bank shall implement systems to evaluate and manage risks
arising from potential changes in interest rate (in terms of the banking book)
Conduct an IRR stress test: (recommended to model at least a 200 basis point shock)
Interest income models: as an alternative to interest shock models a bank may use interest
income models.
Required capital: asses if any additional capital for stress testing is required. In instances where the
economic value of an institution declines by more than 20% under stressed conditions the bank should
consider setting aside additional capital for this purpose
In this regard the bank should disclose in the ICAAP:
The methodology and approach used in calculating IRRBB
Results of the analysis
The level of capital maintained, if any.
3: Liquidity Risk
The bank should set out at a high level how this risk is managed and assessed and define if additional
capital is required. A bank has the option to set a capital buffer as a mitigant if relevant.

Central Bank of the UAE ICAAP guideline

19

C.9 Capital planning

Capital summary and financial projections
The bank should disclose at a minimum a summary of following financial projections:

Table

Forecast period

Details

Reference

Capital adequacy
summary

2-3 year projection

The capital adequacy summarises the capital position

of the bank on a forward looking basis.

ICAAP reference
manual

The Pillar 1 + Pillar 2 charge should also be

expressed as percentage of Pillar 1 (e.g. 120%)
The Pillar 1 + Pillar 2+Stress test charge should also
be expressed as percentage of Pillar 1 (e.g. 125%)
It is likely that the bank will use data from banks
business plan to populate the projections. The bank
should also disclose a summary of the key
assumptions and key developments over the forecast
period (e.g. level of business growth, penetration into
new product lines etc.)

ICAAP reference
manual

P&L

(2 year historical data

should also be included
for comparative
purposes)
2-3 year projection
(2 year historical data
should also be included
for comparative
purposes)

Balance sheet

2-3 year projection

(2 year historical data
should also be included
for comparative
purposes)

It is likely that the bank will use data from banks

business plan to populate the projections. The bank
should also disclose a summary of the key
assumptions and key developments over the forecast
period (e.g. level of business growth, penetration into
new product lines etc.)

ICAAP reference
manual

The projected capital adequacy summary table is set out in the annex. All Banks should include this
table or equivalent in the ICAAP document.
The tables setting examples of the above for all the aforementioned projections are set out in the
ICAAP reference manual.
Historic Disclosure
Provide a summary of historic capital base, aggregate RWAs and CAR ratio for a minimum of five years
or more if data is available (as per the table highlighted in the annex)
Capital Planning: Objective
Capital planning and stress testing are interrelated topics and a bank should approach these
two elements of the ICAAP in a holistic manner. The base case capital plan can be used as the
base case for stress testing.
The objective of capital planning is to ensure the bank can meet its minimum capital requirements at all
times, hence it may be prudent for a bank to keep capital for a reasonably severe economic recession.
The bank must detail how it would manage its business and capital whilst maintaining the minimum
capital requirements.
An economic downturn would impact both
The banks capital resources and future earnings
The banks RWA (taking into account future changes to the balance sheet).

Central Bank of the UAE ICAAP guideline

20

Capital planning and stress testing are related, a bank need not explicitly consider an economic
downturn or other types of scenario in its formal capital plan if this is considered in the scenario and
stress testing analysis.
The CBUAE disclosure requirements
The bank should summarise the capital management plan and relevant management actions (see
guidance below). The level of information should be sufficient for the Central Bank to gain an
understanding of:
(A) The capital management plan. The plan should include the following (to maintain minimum capital
requirements)
(B) Contingency buffer
(C) Relevant management actions
(D) Access to additional capital
Process used to identify capital requirements in a stressed scenario
A fundamental feature of any Pillar 2 assessment is that it is forward-looking in nature. We would
expect banks to assess the adequacy of capital (by projecting their capital requirements and available
capital) for at least 2-3 years.

In order to facilitate understanding of the capital requirements over the medium term the bank should
take the following steps:
1) Take the base case scenario: projections of key financial data (from the business plan)
2) Apply relevant stresses and analyse the effect on the base case (projections prior to any
management actions)
3) Identification of the capital requirement
Central Bank of the UAE ICAAP guideline

21

4) Outline relevant management actions

Capital management plan: should explain how the bank will continue to meet its minimum capital
requirement. The bank should provide a description of how capital is managed and the main
considerations involved in the banks capital planning, a Capital Management Plan should be included
to describe the assumed management action and allows us to assess the credibility and impact
Contingency buffer
The bank should explain if it holds a buffer to absorb losses to meet the higher capital requirements
during adverse external circumstances after allowing for realistic management actions. It may be
prudent for a bank to calculate how it will maintain the minimum capital level in stressed conditions.
Relevant management actions
Outline corrective measures: recourse to credible action which could reduce the need for capital
(lowering the capital requirement).
Access to additional capital
Identification of sources of additional capital if required
The CBUAE will provide further guidance on the interaction between capital buffers under Pillar
2 and the Basel III buffers (pro-cyclical capital buffer and the contingency capital buffer) as
required

C.10 Stress and scenario testing

Overview
The recent financial crisis highlighted material failures in banks approach to stress testing. The period
of relative stability in financial markets prior to the crisis led to banks underestimating or not fully
considering the impact of severe shocks. The nature of stress testing undertaken by banks was found
wanting and the impact and nature of feedback effects and other factors which amplified the initial
shocks in the financial system was also underestimated. Stress testing is now acknowledged by
regulators as a key regulatory tool and board and senior management involvement in the stress
testing programme is essential.
Stress testing describes a range of techniques used by banks to gauge their potential vulnerability to
exceptional but plausible events.
Stress testing is an important risk management tool that is used by banks as part of their internal risk
management. Stress testing alerts bank management to adverse unexpected outcomes related to a
variety of risks and provides an indication of how much capital might be needed to absorb losses
should large shocks occur. While stress tests can provide an indication of the appropriate level of
capital necessary to endure deteriorating economic conditions, a bank may employ other actions in
order to help mitigate increasing levels of risk. Stress testing is a tool that supplements other risk
management approaches and measures.

Central Bank of the UAE ICAAP guideline

22

Stress testing

Banks own stress tests: Banks will be required to define a number of relevant idiosyncratic, market
wide and combination (idiosyncratic and market wide) stresses and disclose the results of these.
The bank should:
Undertake stress testing on a forward-looking basis.
Have clearly documented policies and procedures to enable effective implementation of a stress
testing programme
Ensure senior management take ownership and responsibility for the implementation of an
effective stress testing programme
Stress testing principles The CBUAE considers that banks should have a comprehensive stress
testing programme/ framework and should be mindful of the principles below:

Stress testing should form an integral part of the overall governance and risk management
culture of the bank
Senior management should take an active interest in the development in and operation of stress
testing
Stress testing should be forward-looking
Stress tests should measure the impact on regulatory capital
The nature of the stress testing programme/framework should be commensurate to the nature,
size and complexity of the bank
Banks may find it useful to consider the principles outlines in the BIS Principles for sound stress
testing practices and supervision (May 2009).

Central Bank of the UAE ICAAP guideline

23

Capital add-on for stress testing:

Banks do not necessarily need to set aside capital as a result of stress testing; this is entirely at the
discretion of the banks management.
Whilst this is not mandatory a bank will have to demonstrate that it has sufficient capital to meet its
capital requirements in the medium term and this may include a buffer for a downturn scenario. If a
bank does not set aside a buffer it must be clear why this is the case. The CB will review the
assumptions and challenge the bank accordingly.
In the future this issue may be linked to the maintenance of a capital contingency buffer and a
countercyclical capital buffer under Basel 3. These issues will need to be clarified over time.
Stress testing framework:
Provide a high level summary of the banks approach to stress testing. Including a description of the
following:
1)
2)
3)
4)

The nature and objectives

Governance and oversight
Senior management involvement
The use of stress testing results within the institutions (e.g. setting risk appetite, limit setting
etc.)
5) Weaknesses/limitations in the process (in particular to enable senior management/board to
understand the limitations of the process.
Disclosure requirements for each stress/scenario conducted
1) Nature of the stress test conducted
2) Key assumptions/metrics underlying each stress test
3) Summary table
4) Summary of results of stress testing including the impact of the capital position of the bank and
any relevant management actions
Foreign branches/smaller local banks: Foreign branches are not necessarily required to have a
stand-alone stress testing methodology, and the approach taken may be part of the group stress test
but banks must explain the relevance of the approach.
Smaller local banks should undertake a stress testing approach in relation the size and nature of the
banks activities
An Excel version of the summary tables should also be submitted to the CBUAE electronically
to bsed.basel@cbuae.gov.ae
.

Central Bank of the UAE ICAAP guideline

24

C.11 Business Model Analysis (BMA)

We require a bank to analyse their business model and articulate any material weaknesses in the
model. This will enable the bank and the CBUAE to understand the nature of the business model and
the inherent risks. The BMA is a useful tool for increasing awareness of the vulnerability of a business
model. The exercise should be proportionate to the size, nature and complexity of the bank.
We require the bank to:
Explicitly identify and assess the scenarios that renders a business unviable
Analyse the likelihood of those scenarios occurring
Performed at least annually in conjunction with the ICAAP process
Consider Reverse Stress Testing as part of this analysis
For example, a bank with a large real estate portfolio may identify a significant drop in real estate prices
would impact the viability of their business model. Another bank may be reliant on deposits from a
handful of large depositors, and the withdrawal of deposits from one of these parties would lead to a
significant liquidity shortfall for the bank and would impact the viability of their business model.
The scenarios would vary from bank to bank and depend on the underlying business model and
structure of the bank.
Branches of foreign banks may not be able to perform BMA on a stand-alone basis but aspects of the
requirements may be relevant.

C.12 Risk and diversification benefits

Diversification benefits, if relevant, are likely to be an integral to the overall approach and assessment
undertaken by the bank in determining its capital requirements (as part of the Pillar 2 assessment). In
principle inter-risk diversification will be accepted as long as a bank can demonstrate the relevance and
robustness of their approach.

C.13 Ratings Risk

If the bank is externally rated provide a summary of recent ratings and the name of the rating agency
(for a period of three years).
Rating reports should be made available to the CBUAE on request.

Central Bank of the UAE ICAAP guideline

25

C.14 Islamic banks

ICAAP process: Islamic banks should follow the same disciplines as conventional banks. The revised
ICAAP guidelines are applicable to all firms including Islamic financial institutions.
Capital assessment: How much capital a risk would absorb were it to materialise. All banks must have
a process for assessing the overall capital adequacy in relation to their risk profile and a strategy for
maintaining appropriate levels of capital. A thorough and comprehensive internal capital adequacy
assessment process (ICAAP) is a vital component of a strong risk management programme.
Flexible approach: The CBUAEs Pillar 2 and ICAAP regime is sufficiently flexible to capture risks of
individual institutions depending on their business models and other idiosyncratic risks. This is equally
true for both Islamic and conventional banks.
Islamic Banking Windows1
For non standalone Islamic banks that provide Islamic banking services:
Summary of Islamic banking services and products offered
RWAs for Islamic banking activities
Islamic customer deposits
Please also refer to the Islamic Capital Guidelines to ascertain if the bank meets the disclosure
reporting thresholds

Islamic banking windows: conventional banks which also offer Islamic financial services or products

Central Bank of the UAE ICAAP guideline

26

D. Annexes
Annex 1: ICAAP: Mandatory disclosure form
All banks are required to disclose the following information as a separate cover sheet when submitting the ICAAP document to the Central Bank:
Bank
Date
Relevant contact point and contact details
Scope of ICAAP (entities included)

XXXX
20XX

I (_________) CRO have reviewed the ICAAP and confirm that :

(a) We have identified all material risks and allocated
[tick box if completed]
capital accordingly
(b) Set out a 2-3 year forward looking capital plan based
[tick box if completed]
on the strategic/ financial plan of the bank
(c) have implemented a 2-3 year forward looking stress
[tick box if completed]
test and measured the impact on the capital position of
the bank
(d) The ICAAP has been signed off by:
[relevant board/ committee details]
(e) The ICAAP [has/will be] challenged by the board and
[tick box if completed]
the nature of the challenge will be communicated to
the Central Bank
CRO signature

Central Bank of the UAE ICAAP guideline

[date]

Annex 2: ICAAP projection tables (n.b. this table is for illustrative purposes only)

Central Bank of the UAE ICAAP guideline

II

Annex 3: Capital planning summary

Capital Planning Summary of XYZ Bank for the Year XXXX

2
RATIO

ORDINARY PLANNING

Financial Year +1
3

Estimated Regulatory Estimated Regulatory

capital requirement
Capital

5
RATIO

Financial Year + 2
6

Estimated Regulatory Estimated Regulatory

capital requirement
Capital

8
RATIO

Financial Year + 3
9
Estimated Regulatory
capital requirement

10
Estimated Regulatory
Capital

1. Expected period-end regulatory capital according to planning

1.1 Tier 1
1.2 Tier 2

2
RATIO

Regulatory Capital under Stress Scenarios

Financial Year +1
3

Estimated Regulatory Estimated Regulatory

capital requirement
Capital

5
RATIO

Financial Year+2
6

Estimated Regulatory Estimated Regulatory

capital requirement
Capital

1
2
3
4
5

ALTERNATIVE SOURCES OF CAPITAL

FY
1
Amount

FY+1
2
Amount

FY+2
3
Amount

FY+3
4
Amount

1.Total Alternative sources of capital

1
2
3
4

Central Bank of the UAE ICAAP guideline

III

8
RATIO

Financial Year+3
9
Estimated Regulatory
capital requirement

10
Estimated Regulatory
Capital

Annex 4: References The following are for reference purposes only

Basel II, Pillar 2

CEBS - Guidelines on Supervisory Review Process, January 2006

& Basel III

BIS Basel II: International Convergence of Capital Measurement and Capital Standards: A Revised Framework Comprehensive
Version, June 2006.

BIS Enhancements to the Basel II framework, July 2009

BIS, Basel III: A global regulatory framework for more resilient banks and banking systems, December 2010

BIS Basel III: International framework for liquidity risk measurement, standards and monitoring, December 2010
Stress testing

BIS, Principles for sound stress testing and supervision, May 2009

Liquidity

BIS, Basel III: International framework for liquidity risk measurement, standards and monitoring, December 2010

Other

BIS, Range of practices and issues in economic capital frameworks, March 2009

Central Bank of the UAE ICAAP guideline

IV

Annex 5: Glossary
The following abbreviations are used in this guideline
AD

Abu Dhabi

BIS

Bank of International Settlements

BB

Banking Book

CBUAE

Central Bank of United Arab Emirates

CEBS

Committee for European Banking Supervisors (now EBA European Banking Authority)

CDS

Credit Default Spread

DXB

Dubai

GCC

Gulf Cooperation Council

ICAAP

Internal Capital Adequacy Assessment Process

LGD

Loss Given Default

PD

Probability of Default

RST

Reverse Stress Test

RWA

Risk Weighted Assets

SREP

Supervisory Review and Evaluation Process

SRP

Supervisory Review Process

TB

Trading Book

UAE

United Arab Emirates

SCG

Supervisory Capital Guidance

IRRBB

Interest Rate Risk in the Banking Book

BMA

Business Model Analysis

Central Bank of the UAE ICAAP guideline

For further information please contact:

Ali Ravalia, Banking Supervision Department

ali.ravalia@cbuae.gov.ae

Wolfgang Gerken, Banking Supervision Department

wolfgang.johann@cbuae.gov.ae

Or
bsed.basel@cbuae.gov.ae

Central Bank of the UAE ICAAP guideline

VI