How ICAAP is changing the way ASEAN banks think about capital

Written by Russell Pereira

Aug 3, 2026
12 min

Across ASEAN, ICAAP is becoming a more consequential test of how banks judge future capital needs, challenge assumptions and show who owns the decisions behind them.

A bank can sit comfortably above its regulatory capital minimum today and still face a harder supervisory question: whether it can remain adequately capitalised when the risks embedded in its business plan crystallise. That distinction is increasing the importance of the Internal Capital Adequacy Assessment Process (ICAAP), through which a bank forms its own view of how much capital it needs for the risks it actually runs. The issue is no longer simply whether the board approved the ICAAP, but whether the institution can show that its assessment rests on credible assumptions, reliable information and sound governance.

Recent banking failures have reinforced why supervisors look beyond headline capital ratios. The Basel Committee’s review of the 2023 banking turmoil found that the failed banks had different business models but shared weaknesses in business strategy, governance and risk management, despite apparently stronger quantitative positions before stress intensified. Subsequent Basel work has continued to emphasise forward-looking business-model analysis, sound governance and effective supervisory judgement alongside regulatory capital and liquidity ratios.

That wider development provides useful context for the growing importance of ICAAP across major ASEAN banking markets. The five jurisdictions examined here are not applying an identical approach, nor are supervisors simply turning an annual capital document into an enforcement mechanism. Taken together, however, their frameworks point towards a common direction in which banks are expected to connect risk identification, stress testing, capital planning, management action and board oversight more clearly than a mechanical capital ratio can.

The legal minimum has stopped being the whole supervisory test
The roots of this approach lie in Basel’s Pillar 2 framework. Pillar 1 establishes standard minimum capital requirements, but standardised ratios cannot capture every concentration, interest-rate exposure, business-model vulnerability or emerging risk specific to an individual bank. ICAAP therefore requires the bank to form its own assessment of capital needs, while the supervisory review process gives regulators a basis for judging whether that assessment, and the process behind it, are credible.

The statutory frameworks across major ASEAN banking markets reflect that principle through different institutional arrangements. The Bangko Sentral ng Pilipinas places ICAAP within its Pillar 2 framework and requires its methodology and assumptions to receive board approval as part of an active supervisory dialogue. Indonesia’s prudential framework requires "active oversight" by the board of directors and board of commissioners and allows the Financial Services Authority to assess and require improvements to a bank’s ICAAP through the supervisory review process.

Thailand places stress testing within the bank’s ICAAP and broader Pillar 2 framework, with the Bank of Thailand (BOT) describing its supervisory approach as forward-looking and preventive. Singapore combines capital and risk-governance expectations with an individual-accountability framework that seeks clearer identification of senior managers responsible for core functions. Malaysia combines internal capital-planning requirements with a newer Responsibility Mapping framework designed to clarify significant responsibilities within financial institutions.

The five regimes should not be treated as a single ASEAN rulebook. Their legal structures, board models and supervisory mechanisms differ materially, but they share several features around bank ownership of capital assessment, board oversight, supervisory review and clearer responsibility for material decisions.
Active board involvement is not new. Since the global financial crisis, Basel has expected stress testing to provide a forward-looking assessment of risk and form an integral part of capital and liquidity planning, while current guidance calls for clear responsibilities and "credible challenge" of assumptions, scenarios, methodologies and results. Recent supervisory developments point to greater emphasis on whether institutions can demonstrate that these longstanding expectations work in practice, particularly where management judgement and bank-specific assumptions materially influence the outcome.

Stress outcomes can matter more than today’s capital ratio
The commercial consequence follows from the forward-looking nature of the exercise. A bank can meet every statutory capital ratio on the reporting date and still have an inadequate capital plan if a severe but plausible scenario causes capital to deteriorate below the level needed to support its risk profile, strategy or regulatory buffers over the planning horizon. Basel’s stress-testing principles explicitly expect results to inform capital planning, risk appetite and strategic decision-making, placing the stress path alongside the starting capital ratio rather than beneath it.

That creates a direct link between ICAAP and the deployment of capital. A proposed dividend, acquisition, period of rapid lending growth or balance-sheet restructuring can consume resources the bank may need later under stress. Forward-looking capital adequacy can therefore influence the supervisory assessment of distributions, growth plans and other capital-consuming decisions. The precise consequence will depend on the jurisdiction, the institution and the weakness identified, so an adverse ICAAP result should not be treated as an automatic trigger for a restriction or additional capital requirement.

Supervisors also assess the credibility of scenarios, risk identification, governance, data quality and proposed management responses. The European Central Bank’s (ECB) 2026 geopolitical reverse stress test illustrates the distinction: it runs through banks’ ICAAP processes but does not directly determine Pillar 2 Guidance. A severe result may reflect honest identification of vulnerabilities and a demanding scenario, while a comfortable result may be more concerning if it rests on optimistic assumptions, incomplete data or management actions that would be difficult to execute in a crisis.

The growing supervisory importance of ICAAP does not change a central feature of the framework: the bank remains responsible for forming its own view of capital adequacy. The ECB’s revised 2026 ICAAP guidance reinforces that principle by treating management buffers as part of banks’ own forward-looking capital planning rather than an additional supervisory capital requirement. Precisely because management chooses the assumptions, methodologies and internal thresholds, supervisors scrutinise whether those choices were reasonable and whether the institution understood their consequences.

Individual accountability makes responsibility more visible
A separate regulatory development is making that governance trail more consequential. Singapore’s individual-accountability framework emphasises clear identification of senior managers responsible for core functions and appropriate definition of their responsibilities and authority. Malaysia’s Responsibility Mapping framework similarly seeks clearer allocation of significant responsibilities within financial institutions, although it operates within Malaysia’s own governance and supervisory architecture rather than an ASEAN-wide accountability regime.

These frameworks should not be confused with automatic personal liability for an adverse ICAAP outcome. A stress scenario that proves too optimistic, a model that requires remediation or an internal capital assessment that a supervisor considers inadequate can still primarily generate an institutional supervisory response. Individual accountability works differently by clarifying which senior managers own particular functions and whether the institution has appropriately allocated responsibility for material decisions.

The interaction between the two developments nevertheless raises the stakes for governance. ICAAP can provide a record of the risks management considered material, the assumptions it used, the capital it considered adequate and the actions it expected the institution to take under stress. Accountability frameworks can make responsibility for relevant functions more visible, although the extent to which a particular ICAAP judgement can be attributed to an individual will depend on the institution’s governance arrangements and the jurisdiction’s legal framework.

The regional development is therefore better understood as a narrowing of the distance between an institution’s capital judgement and the people responsible for relevant parts of that process. That does not mean every failed assumption becomes misconduct, nor does it eliminate collective board responsibility. It does mean banks need clearer governance around who owns material decisions and how those responsibilities are discharged.

What this changes for boards and risk committees
The board’s role consequently extends beyond checking whether the bank meets its minimum capital requirement or whether management completed the annual ICAAP process. Directors need enough understanding of the business model, risk concentrations, stress scenarios and capital assumptions to decide whether the overall assessment is credible. They do not need to become shadow risk executives or reconstruct the underlying models themselves, because governance frameworks maintain distinct roles for boards, senior management, risk management, internal audit and other control functions.

Effective challenge instead means understanding the material judgements on which management relies and asking whether they are reasonable. A board needs to understand whether stress scenarios capture the bank’s actual vulnerabilities, whether model limitations affect the conclusion and whether proposed management actions remain realistic under the same conditions that created the stress.

A unanimous approval does not in itself signal weak governance. Directors can challenge management rigorously and still agree on the final assessment once management has addressed their concerns and the board considers the conclusion supportable. The more meaningful indicator is the quality of the decision process, including whether questions changed assumptions, triggered additional analysis, exposed weaknesses or led management to reconsider planned actions.
Management action is becoming as important as the stress result

Supervisory stress testing is also moving beyond the question of how much a bank loses under stress. Recent exercises increasingly ask whether management understands how a shock would affect solvency, liquidity, funding and the business model, and what credible actions remain available in response. The ECB’s 2026 geopolitical exercise is one recent example of this broader supervisory focus.

That approach changes the usefulness of ICAAP for senior management. The process can connect an identified risk to its financial consequences, the available management response and the strategic choices that remain viable after those actions are used. A credible capital plan therefore depends not only on forecasting losses but also on demonstrating that proposed mitigants can operate at the time and scale assumed.

The result is a direct line from risk identification and stress testing to capital planning, management action and strategic flexibility. Accountability becomes relevant because different senior decision-makers own parts of that chain, but the broader purpose remains institutional resilience rather than the allocation of blame after failure.

The binding constraint often sits underneath the boardroom
Greater board challenge only works if directors and management can trust the information they are challenging. Fragmented risk data, inconsistent definitions, weak reconciliation and poor data lineage can undermine a sophisticated ICAAP regardless of the quality of committee discussion. Basel continues to identify risk-data aggregation and reporting as an area requiring improvement across parts of the banking industry, indicating that data weaknesses are not confined to institutions with obviously poor governance.

Poor data should not automatically be characterised as evidence that directors ignored their responsibilities. The governance question is whether management understands material limitations in the underlying information, escalates them appropriately, invests in remediation and adjusts its confidence in capital conclusions where the data remain incomplete.

Responsibility mapping makes that connection more important. A senior executive who owns a material risk or capital-management function needs to understand significant limitations in the information supporting that function’s decisions and ensure they receive appropriate attention. Effective accountability, therefore extends beyond recording who signed a document to whether the institution identified, communicated and acted on the limitations surrounding the decision.

Where ASEAN sits against international practice
ASEAN has not converged on one legal or supervisory model. The ECB provides one example of a more formalised mechanism through its Capital Adequacy Statement, which separates the management body’s conclusion on capital adequacy from the technical material supporting the ICAAP. That structure makes ownership of the final judgement more visible while preserving the principle that the underlying assessment belongs to the bank.

ASEAN regulators use different institutional mechanisms to pursue related outcomes. Indonesia distinguishes between the responsibilities of the board of directors and board of commissioners, Thailand integrates stress testing into its Pillar 2 and risk-management approach, Singapore combines prudential governance with an individual-accountability framework, Malaysia has introduced responsibility mapping, and the Philippines places board-approved ICAAP within an active Pillar 2 supervisory dialogue. Supervisory expectations also remain proportionate to institutions’ size, complexity and risk profiles, as reflected in frameworks including BOT’s Pillar 2 approach and the PRA’s Strong and Simple regime. Taken together, these developments suggest that regional commonality lies more in the supervisory outcome sought than in any single legal mechanism used to reach it.

What senior bankers may be underpricing
Directors and executives can easily treat ICAAP scrutiny primarily as a model-quality problem: improve the data, recalibrate the stress, strengthen the documentation and produce a more defensible number. Those improvements remain necessary, but the post-2023 supervisory discussion points towards a wider question about whether management can identify vulnerabilities before they become acute and act while the institution still has strategic choices.

That makes ICAAP commercially relevant well beyond the risk function. A dividend, acquisition, aggressive growth plan or material change in the balance sheet can look reasonable against today’s capital ratios and considerably less comfortable once management considers how its capital position changes under severe but plausible conditions. ICAAP therefore links risk assumptions to the capital plan, the capital plan to management actions and those actions to the institution’s ability to pursue strategy.

The significance of ICAAP is consequently becoming broader than the document through which a bank explains how much capital it needs. It increasingly records how the institution understands its vulnerabilities, what evidence management used, how the board challenged the assessment and what actions remain available if the stress becomes real. Taken together, developments across major ASEAN banking markets suggest that forward-looking capital judgement is becoming more integral to how banks govern themselves, while responsibility for the decisions behind that judgement is becoming increasingly difficult to leave undefined.