Capital and Liquidity Management in Banks
The Internal Capital Adequacy Assessment Process (ICAAP) and the Internal Liquidity Adequacy Assessment Process (ILAAP) are key mechanisms through which banks ensure they maintain sufficient capital and liquidity to cover all material risks to which they are exposed.
They represent integral components of a bank’s overall risk management framework. ICAAP is established to identify and manage the bank’s material risks and to ensure that it holds enough high‑quality capital to cover them. Similarly, ILAAP plays a crucial role in managing liquidity risks within credit institutions. Regulators expect ILAAP to be conducted in a prudent and conservative manner, supported by a clear assessment of liquidity risks and a strong governance structure.
The environment in which banks operate is evolving. Banks face numerous emerging and shifting risks, including macroeconomic and geopolitical risks, climate and environmental risks, as well as intensified competition driven by increased digitalization. The room for policy interventions that could mitigate future shocks has, one might say, become more limited. The better capitalized a bank is, the more resilient and capable it becomes in navigating changing risks and uncertainties.
In other words, high‑quality ICAAP and ILAAP processes enable a bank to ensure—on a forward‑looking basis—that its capital and liquidity buffers are strong enough to withstand stress scenarios, thereby enhancing the resilience and stability of the entire banking system.
Regulatory Framework in Bosnia and Herzegovina and Banks’ Obligations
ICAAP and ILAAP were incorporated into the regulatory framework of Bosnia and Herzegovina as early as 2017/18.
In 2019, the Banking Agencies (FBiH and RS), as part of the alignment with EU regulatory standards, adopted the Decision on the Internal Capital Adequacy Assessment Process and the Internal Liquidity Adequacy Assessment Process in Banks, which remains in force today. Banks are required to establish internal ICAAP and ILAAP processes, document their methodologies and results, and submit annual Reports on the implementation of these processes to the Agency. Alongside the Decision, the Agencies also issued Guidelines for ICAAP and ILAAP Reporting, which set out detailed requirements for the content of the Report.
The responsibilities and authorities of the bank’s highest governing bodies are specifically regulated: the Supervisory Board and the Management Board actively participate in ICAAP and ILAAP. The Supervisory Board, based on the proposal of the Management Board, adopts the Report before it is submitted to the Agency. The regulatory Guidelines also include explicit requirements for the roles of control functions (risk management, internal audit, compliance). This means that the bank must define and document how risks are identified and measured (within the risk management function), how policy compliance is ensured (compliance function), and how internal audit independently reviews the entire IC(L)AAP framework. The Guidelines particularly emphasize that the bank must describe the results of regular internal audit reviews of ICAAP and ILAAP, including a summary of findings, recommendations, and planned actions (if any).
As part of the ongoing update of the local regulatory framework and its alignment with the SREP (Supervisory Review and Evaluation Process), the Banking Agencies have adjusted reporting deadlines and procedures.
Previously, control functions submitted reports with data as of 31 December by the end of April/June of the following year.
According to regulatory amendments adopted in December 2025, effective from 1 January 2026, this obligation will shift to 31 March for the risk management function (submission of the ICAAP and ILAAP Implementation Report with accompanying documentation), and 30 April for the internal audit report. The aim is to align with new European practices as well as with the regulator’s SREP implementation timeline.
These regulatory changes, together with the revised deadlines, are intended to give banks sufficient time to prepare comprehensive reports, while also enabling the regulator to gain earlier insight into the risk assessment process.
Key Principles of IC(L)AAP
Regulatory guidelines and EU practice establish several fundamental principles that banks must apply within the IC(L)AAP framework.
- First and foremost, the principle of responsibility requires that the establishment and implementation of the IC(L)AAP process is solely the bank’s responsibility. The Management Board and the Supervisory Board must ensure that processes for quantifying capital and liquidity requirements are aligned with the bank’s risk profile, and must clearly document the methodologies and results for the Agency.
- The second is the principle of proportionality: the bank must approach reporting in a manner consistent with its size, complexity, and systemic importance. This allows for an efficient assessment without imposing unnecessary burdens on smaller or less complex institutions.
- The third principle is continuity and a forward‑looking perspective. ICAAP and ILAAP must be reviewed regularly—at least annually, and more frequently when significant changes occur in the business or operating environment. Banks are encouraged to incorporate sophisticated stress tests and multi‑year planning into their processes to identify potential future capital or liquidity shortfalls in a timely manner. This ensures that internal assessments are forward‑looking, focused on emerging risks rather than solely on current indicators.
- Additional principles include materiality of risks and comprehensiveness. The bank must include all material risks to which it is exposed—not only those explicitly covered by regulatory capital, but also risks not directly visible on the balance sheet, such as reputational risk, geopolitical risk, business risk, and others. The resulting capital and liquidity assessments from IC(L)AAP should be aligned with the bank’s risk profile, ensuring that external factors (such as macroeconomic shocks or strategic shifts) are also adequately covered.
Applying these principles means that ICAAP and ILAAP are integrated into the bank’s strategy—from strategic planning and annual budgeting, to remuneration policies and internal management reporting. Altogether, this creates a unified framework that links the bank’s business model with its risk‑bearing capacity.
Regulatory Alignments and Recent Developments
Banking Agencies continuously work on harmonizing local regulations with EU regulatory practices.
At the European level, the ECB (European Central Bank) published the ICAAP and ILAAP Guidelines for the euro area in 2018, and has recently issued additional guidance and clarifications.
A strong regulatory environment is essential for the Agencies to ensure that banks’ capital requirements are aligned with the level of risk to which they are exposed, and that banks remain solvent.
Both of these objectives lie at the very core of the Basel framework, which is built on three main pillars:
- Pillar 1 – Minimum Capital Requirements
- Pillar 2 – Supervisory Review
- Pillar 3 – Market Discipline
Pillar 1 – Minimum Capital Requirements
clearly defines the minimum amount of capital that banks must hold: the riskier a bank’s assets are, the higher its capital must be. The level of risk is measured through risk‑weighted assets (RWA). Under Pillar 1 requirements, banks in Bosnia and Herzegovina must maintain a minimum capital requirement of 12% + capital buffers of their RWA. Risk weights are determined primarily using simple or standardized approaches. Pillar 1 requirements apply to credit risk, market risk, and operational risk.
Pillar 2 – Supervisory Review (SREP) includes the assessment of both ICAAP and ILAAP. It grants supervisors the authority and obligation to evaluate a bank’s overall risk management strategy and processes. If it is determined that the minimum capital is insufficient, supervisors may require additional measures or additional capital.
Pillar 3 – Market Discipline
This pillar focuses on transparency: banks must disclose relevant information about their risks, capital, and governance. This enables the market and investors to discipline banks through data‑driven pressure and confidence.
Pillar 2: The ICAAP and ILAAP Implementation Report has undergone significant evolution from 2018 to today.
With the ECB’s 2025 initiative, greater emphasis has been placed on proactive and effective assessment of ICAAP and ILAAP, with the aim of better understanding how banks establish and manage their capital and liquidity buffers.
In May 2025, the ECB reiterated that it is up to banks to tailor their IC(L)AAP processes to their specific characteristics, focusing on good practices rather than introducing additional strict requirements as of 1 January 2026. It also adjusted the deadlines for submitting mandatory components (15 March 2026).
Supervisors are also implementing the SREP reform, aimed at more effective and efficient supervision. The assessment of ICAAP has become significantly more flexible. JSTs (Joint Supervisory Teams—teams formed by the ECB together with national supervisory authorities) now apply a multi‑year assessment strategy, allowing them to conduct an in‑depth review of all relevant IC(L)AAP areas over several years. However, exceptions apply to mandatory components—capital and liquidity plans, as well as baseline and adverse scenarios—which continue to be assessed annually to reflect the crucial role of capital and liquidity planning in banks’ ability to navigate long‑term economic developments and manage multiple sources of future stress events, including geopolitical risks.
Another new element of ICAAP assessment is that JSTs now receive updated or newly issued internal IC(L)AAP documentation throughout the year whenever it becomes applicable. Local regulators have already begun applying aspects of this practice to avoid duplication of activities between SREP and the IC(L)AAP assessment process.
Changes also affect P2R (Pillar 2 Requirement). ICAAP will no longer be used as the starting point for calibrating Pillar 2 requirements based on individual risks. However, the assessment of ICAAP reliability may have a significant impact on determining the level of capital requirements set through SREP.
The Role of Control Functions
The success of ICAAP and ILAAP largely depends on the engagement of the bank’s control functions.
First and foremost, the risk management function typically leads the development and maintenance of risk assessment models—identifying material risks and measuring their impact on capital and liquidity, ensuring that all significant risks are quantified and incorporated into the IC(L)AAP.
The Compliance function ensures that risk and liquidity management policies adhere to regulatory and internal standards.
Independent internal audit plays a particularly important role as the “third line of defence.” It evaluates and verifies the IC(L)AAP and the bank’s internal control system. According to regulatory guidelines, the bank must describe how internal audit organizes its independent review of capital and liquidity adequacy assessments, including a summary of internal audit findings and recommendations, as well as corrective measures taken. In this regard, internal audit is responsible for ensuring that processes produce reliable results, that improvement recommendations are implemented, and that regular validations are carried out (e.g., model back‑testing, comparison of actual versus expected outcomes). In other words, internal audit must demonstrate its own adequacy in reviewing the entire risk management and IC(L)AAP framework, as well as the availability of sufficient capacity to perform this task.
Conclusion: Stability Through Responsibility
Internal capital and liquidity assessment processes (ICAAP and ILAAP) serve as the first line of defence within banks:
they ensure that institutions proactively manage risks and maintain a safety net supported by adequate capital and liquidity. Given increasingly complex and volatile market conditions, as well as a tightening regulatory environment, it is becoming ever more important for these processes to be comprehensive, conservative, and forward‑looking.
The regulatory framework in Bosnia and Herzegovina, through banking laws and decisions issued by the Agencies, requires banks to formalize these processes and report on them transparently. Recent regulatory amendments—such as the shift of the reporting deadline to 31 March or alignment with ECB guidelines—demonstrate efforts to bring domestic practice closer to European standards.
Responsibility does not lie solely with the regulator: banks themselves are accountable for the quality of their IC(L)AAP processes and must involve all relevant functions in their development and maintenance.
Ultimately, a strong and well‑integrated ICAAP and ILAAP enhance the resilience of the entire banking system. Banks that properly implement these processes are able to withstand adverse shocks and continue providing services to the economy, even in challenging times. This is precisely why risk managers and control functions are expected to demonstrate top‑tier expertise and consistency, ensuring that the foundation of systemic stability remains solid and reliable.
Sources:
Prepared with the support of AI tools. Reference links are provided below.
If you notice any errors or inconsistencies, please let us know at: contact@riska.ba.
FBA – Agencija za Bankarstvo Federacije Bosne i Hercegovine
Капитал и адекватност капитала | Agencija za bankarstvo Republike Srpske
ICAAP: enhanced supervisory assessment for stronger capital management in banks
ECB Guide to the internal liquidity adequacy assessment process (ILAAP)
ECB clarification on ICAAPs and ILAAPs and respective package submissions
