ICAAP and ILAAP
ICAAP and ILAAP for banks in Germany: normative and economic perspectives, a worked example, SREP and the ECB's July 2026 clarifications.
Solvency II combines quantitative capital requirements with governance and reporting. This overview explains SCR, MCR and the role of ORSA in managing an insurer.
Solvency II is the EU’s risk-based prudential regime for insurance and reinsurance undertakings. Germany’s Insurance Supervision Act, the VAG, provides the principal national framework. Applicability depends on the undertaking and statutory exceptions. A banking MaRisk or ICAAP concept therefore cannot simply be transferred to an insurer.
The pillars assess the same insurer from different perspectives. Capital calculations need to be consistent with its risk profile and published information.
| Pillar | Subject | Typical work products |
|---|---|---|
| 1: Quantitative requirements | Valuation, own funds and capital requirements | Solvency balance sheet, SCR, MCR |
| 2: Governance and risk | Organisation, controls and own risk assessment | Policies, control evidence, ORSA |
| 3: Reporting and disclosure | Information for supervisors and the public | Supervisory reports and SFCR |
The Solvency Capital Requirement (SCR) addresses quantifiable risks and is calibrated to a 99.5% confidence level over one year. It must be covered by eligible own funds. The Minimum Capital Requirement (MCR) represents a lower intervention threshold below which continued business would expose policyholders and beneficiaries to unacceptable risk. It requires eligible basic own funds. SCR and MCR coverage are therefore distinct measures.
ORSA covers overall solvency needs, continuous compliance with capital and technical-provision requirements, and material differences between the risk profile and calculation assumptions. It must connect with business strategy and be repeated without delay following material changes in risk. VAG section 27 requires the supervisor to be informed within 14 days of completion. Internally, keep the data version, scenarios, management decisions and follow-up actions traceable.
Both connect an organisation’s own assessment of risk with planning and management decisions. Their legal bases and supervisory systems differ. In particular, ORSA does not itself impose an additional statutory capital requirement. ICAAP is also an internal assessment; supervisory capital decisions arise through the SREP.
| Question | ORSA | ICAAP |
|---|---|---|
| Sector | Insurers within the Solvency II framework | Banks under the applicable supervisory framework |
| Focus | Overall solvency needs, continuous requirements and model assumptions | Internal capital adequacy and risk coverage |
| Strategic connection | Insurance and risk strategy, future business | Business strategy, capital and risk planning |
| Supervisory context | Part of governance and risk management | Input to supervisory assessment through SREP |
| Additional capital | No automatic capital requirement imposed by ORSA | No automatic P2R amount derived from an ICAAP figure |
The SFCR is the public Solvency and Financial Condition Report. It differs from supervisory reporting and internal management reports. Shared data still require audience-specific approvals and distinct publication permissions. Each figure should have a clear source version and an accountable person who can explain differences from other reports.
EIOPA identifies 30 January 2027 as the application date for the rules changed by Directive (EU) 2025/2. Keep future and current requirements in separate change-register records. Useful preparation includes reviewing applicability, affected data and reporting content, and changes to policies and approvals. Existing risk management continues during the transition.
It is an important indicator. MCR coverage, the quality of own funds, governance, risk management and reporting also require attention.
The approaches share features of internal risk assessment. Their legal bases, questions and supervisory consequences differ. An existing banking approach needs substantive reassessment.
ORSA is an internal and supervisory assessment. The public SFCR is a separate reporting instrument.
ICAAP and ILAAP for banks in Germany: normative and economic perspectives, a worked example, SREP and the ECB's July 2026 clarifications.
Bank data has no single retention period. A deletion policy connects record type, legal basis, start date and justified exceptions with the data actually held.
Bring a concrete task. Together, we will define what the application needs to do.
Discuss your project