Internal Capital Adequacy and Risk Assessment (ICARA) Process

The European Parliament has adopted a new regulatory regime for investment firms: the Investment Firm Directive (“IFD”) and the Investment Firm Regulation (“IFR”).

The IFR and IFD were implemented on June 26, 2021, at EU-wide level and subsequently transposed into national Laws. On November 5, 2021, Cyprus transposed them into Law 165(I)/2021 “The Prudential Supervisions for Investment Firms Law of 2021” and Law 164(I)/2021, both of which amended Law 97(I)/2021, “The Capital Adequacy Investment Firms Law of 2021”.

Following the implementation of the new prudential regulatory framework, Investment Firms are required to replace their existing Internal Capital Adequacy Assessment Process (ICAAP) with the new Internal Capital Adequacy and Risk Assessment (ICARA) process. This involves establishing new assessments with respect to the liquidity adequacy of the company, designing new financial projections and stress tests to reflect the new K-Factors requirement, and drafting a new report that reflects all of the provisions under the new regulation.

As per Law 165(I)/2021, investment firms should establish sound, effective, and comprehensive arrangements, strategies, and processes to assess and maintain, on an ongoing basis, the amounts, types, and distribution of internal capital and liquid assets that they consider adequate to cover the nature and level of risks they may pose to others and to which the investment firms are or might be exposed to. These arrangements, strategies, and processes shall be appropriate and proportionate to the nature, scale, and complexity of the activities of the investment firm and they shall be subject to regular internal review.

ICARA includes a Liquidity Adequacy Assessment and a Contingent Funding Plan. Internal Liquidity Adequacy Assessment Process (ILAAP) and its components, including risk elaboration on liquidity risks that are applicable to the firm and liquidity stress testing, will be included in the process. This requirement is conceptually the same as the ICAAP and the ILAAP required by the CRR/CRD framework.

Learn More About the Author of this Article, Panayiotis Antoniou and View all Courses he Delivers

The process will incorporate business model assessment, forecasting, stress testing, recovery planning, and wind-down planning, as well as a new concept on the calculation of the additional capital and liquidity requirements (thresholds). Furthermore, within the ICARA process, the company’s exposure to various risks is analysed, as well as its capacity to mitigate those risks, through policies and risk management tools.

ICARA can be described as the foundation of an investment firm’s operations, which comprises of:

• The Corporate Governance Framework, Board of Directors, Senior Management, and a well-defined and updated organisational structure.

• Internal Control systems.

• Risk Management systems.

• The definition of the financial budget and corporate strategy, and their alignment with the available capital and risks faced.

 ICARA is the centrepiece of the company’s risk management, and it is a continuous process through which firms will:

• Identify and Monitor Harms: Operate systems and controls to identify and monitor all material potential harm.

• Undertake Harm Mitigation: Consider and put in place appropriate financial and non‑financial mitigants to minimise the likelihood of crystallisation and/or impact of the material harm.

• Undertake Business Model Assessment, Planning and Forecasting: Forecasting capital and liquidity needs, both on an ongoing basis and if they have to be wind-down. This must include expected and stressed scenarios.

• Undertake Recovery Action Planning: Determine appropriate and credible recovery actions to restore own funds or liquid resources where there is a risk of breaching threshold requirements tied to specific intervention points.

• Undertake Wind‑down Planning: Set out at entity-level credible wind-down plans, including timelines for when and how to execute these plans.

• Assess the Adequacy of Own Funds and Liquidity Requirements: Where, in the absence of adequately mitigating risks through systems and controls, the investment firm assesses that additional own funds and liquid assets are required to cover the risk.

CySEC is responsible for the implementation of the Supervisory Review and Evaluation Process (SREP) under Pillar II. SREP is the tool that competent authorities use to review whether an Investment Firm complies with the IFR/IFD and evaluate the following, so as to ensure sound management and coverage of their risks:

• Risks referred to in Law 165 (Risk to Client, Risk to Market, Risk to Firm).

• Geographical location of an investment firm’s exposures.

• Business model of the investment firm.

• Assessment of systemic risk, considering the identification and measurement of systemic risk under Article 23 of Regulation (EU) No 1093/2010 or recommendations of the ESRB.

• Risks posed to the security of investment firms’ network and information systems to ensure confidentiality, integrity and availability of their processes, data, and assets.

• Exposure of investment firms to the interest rate risk arising from non‐trading book activities.

• Governance arrangements of investment firms and the ability of members of the management body to perform their duties.