ICAAP, ILAAP and stress testing: everything banks need to know about the new CSSF circular ICAAP, ILAAP and stress testing: everything banks need to know about the new CSSF circular ICAAP, ILAAP and stress testing: everything banks need to know about the new CSSF circular

Banks in Luxembourg are facing new supervisory expectations as regards their ICAAP, ILAAP and stress testing frameworks following the latest CSSF publication.

What are the key changes introduced by the new circular? And how will they affect your bank? Get started by reading this digest.

On 23 October 2020, the CSSF released Circular CSSF 20/753, which amends Circular CSSF 07/301 on ICAAP/ILAAP and Circular CSSF 11/506 on stress testing. The circular provides banks under CSSF supervision with updated supervisory expectations on these regulatory requirements in line with the latest guidance and expectations issued by the EBA and ECB.

The circular applies from 31 October 2020 and the new provisions must be reflected within the banks’ governance and operating frameworks from 31 December 2020.

The CSSF’s actions follow continued efforts on these topics at an EU level:

• ICAAP, ILAAP and stress testing have been on the list of SSM supervisory priorities for three years in a row.
• The EBA published guidelines on stress testing in July 2018 and guidelines on ICAAP and ILAAP information collected for SREP purposes in November 2016.
• The ECB released guides to ICAAP and ILAAP in November 2018, and a report on banks’ ICAAP practices in August 2020.

The ICAAP/ILAAP circular 07/301 was fundamentally revised and streamlined. It introduces the following key changes: References to the circular are shown in square brackets.

1. Requiring the authorised management to document a clear and concise capital adequacy statement (CAS) and liquidity adequacy statement (LAS), which shall be endorsed by the management body in its supervisory function [points 8 and 19].
2. Formally introducing the so-called normative and economic perspectives [points 14 and 15], known from the ECB Guides on ICAAP and ILAAP. Under the economic perspective, the bank is expected to identify and quantify all material risks and ensure that these risks are covered by internal capital and/or liquidity. The normative perspective is a multi-year assessment of the bank’s ability to fulfil its capital- and liquidity-related regulatory and supervisory requirements and to cope with other external financial constraints.
3. Aligning reporting requirements with EBA Guidelines 2016/10, notably with respect to ILAAP information, and clarifying that the ICAAP and ILAAP reports can be separated or combined, yet shall include all required information, possibly by cross-referencing to other internal documents [points 16 – 18].
4. Stressing the role that the ICAAP and ILAAP play in implementing and monitoring the bank’s business strategy and risk appetite, and in setting up an “adequately granular limit system that allocates specific limits to, for example, individual risks, sub-risks, entities and business areas” [Annex I].
5. Postulating a minimum list of risks to assess as part of the internal risk identification process, including IRRBB from both EVE and NII perspective, concentration risk, risks related to money laundering and terror financing [Annex II].
6. Confirming that the informational needs or technical infrastructures necessary for the operation of the ICAAP and ILAAP may be subject to outsourcing, but only under the condition “that the outsourcing arrangements are sound, robust and tailored such as to guarantee the continuity and effectiveness of ICAAP and ILAAP” [point 3]. Management decisions, risk and internal capital/liquidity management and monitoring may not be outsourced.
7. Promoting consistency between ICAAP/ILAAP and recovery plans “in terms of early warning signals, indicators, escalation procedures following breaches of these thresholds and potential management actions” [Annex IV].

Changes to the stress testing circular 11/506 are smaller and more incremental than those in the ICAAP and ILAAP circular. References to the circular are shown in square brackets.

1. Proportionality: Maintaining and further specifying the principle of proportionality [point 6], while explicitly requiring the authorised management to understand and critically assess “the application of the principle of proportionality” [point 12].
2. Coverage: Highlighting that stress testing aims at:
   • promoting the stability of the institution under severely adverse conditions, taking into account potential systemic implications [point 23]; and
   • supporting a time-consistent management of risks and capital/liquidity over the long run, which notably covers “longer term risks, where the materialization of risks spans longer time horizons” (e.g. climate-related risks) [points 24 and 25].
3. Data infrastructure: Introducing a formal requirement that ”the stress testing programme is supported by a data (management) infrastructure that permits the timely production of all required data points and their processing (including aggregation) so as to ensure the integrity, comprehensiveness and accuracy of the stress test results” [point 30] in line with the “Principles for effective risk data aggregation and risk reporting” published by the Basel Committee of Banking Supervision (BCBS 239)

Now is the time for you to assess the maturity levels of your ICAAP, ILAAP and stress testing programme and bring them up to speed with the new and tightened supervisory expectations.

We can support you in this challenge. KPMG has a proven track record successfully designing, implementing and reviewing internal risk management frameworks in Luxembourg and across Europe. Get in touch with myself on +352 22 51 51 6819.