HKMA Capital Planning for Banks: The Internal Capital Adequacy Assessment Process (ICAAP)

The Hong Kong Monetary Authority (HKMA) has signalled a more intrusive supervisory stance on banks’ internal capital models. In its December 2024 Supervisory Policy Manual (SPM) update on the Internal Capital Adequacy Assessment Process (ICAAP), the HKMA explicitly flagged that it expects all authorised institutions (AIs) to demonstrate capital adequacy under a “forward-looking, stress-based framework” that goes beyond minimum regulatory ratios. This shift is not academic. The HKMA’s 2024 Banking Stability Report noted that 17% of AIs had their ICAAP submissions returned for material deficiencies in the preceding cycle. For any bank operating in Hong Kong—whether a locally incorporated lender or a foreign branch—the ICAAP is no longer a compliance box-ticking exercise. It is the primary document through which the regulator assesses whether an institution understands its own risk profile, capital needs, and contingency plans. This article sets out the regulatory framework, the procedural steps, and the common pitfalls that AIs face when preparing an ICAAP submission under the HKMA’s current requirements.

The Regulatory Foundation of ICAAP in Hong Kong

The ICAAP is a statutory requirement under the Banking Ordinance (Cap. 155). Section 68A of the Ordinance requires every AI to maintain capital resources that are “adequate, both as to amount and quality, to support the nature, scale, and complexity of its business.” The HKMA’s SPM module CA-G-1 (Supervisory Review Process), last updated in December 2024, operationalises this requirement. The module states that the ICAAP must be a “continuous process embedded in the AI’s risk management framework,” not a once-a-year report.

Pillar 2 and the Supervisory Review Process

The ICAAP is the bank’s own assessment under Pillar 2 of the Basel framework. Pillar 1 sets the minimum capital requirements (e.g., 8% of risk-weighted assets under the Banking (Capital) Rules, Cap. 155L). Pillar 2 requires the bank to identify risks that Pillar 1 does not fully capture—concentration risk, interest rate risk in the banking book (IRRBB), liquidity risk, and operational risk from new business lines. The HKMA then conducts a Supervisory Review and Evaluation Process (SREP) based on the ICAAP submission. The SREP outcome determines whether the HKMA imposes a “Pillar 2A” capital add-on above the Pillar 1 minimum. In 2024, the HKMA imposed Pillar 2A add-ons on 23 AIs, ranging from 0.5% to 2.5% of risk-weighted assets, according to the HKMA’s 2024 Annual Report.

Scope of Application: Who Must Submit

The ICAAP requirement applies to all AIs under the Banking Ordinance. This includes:

• Locally incorporated banks: Must submit a full ICAAP report annually, with a board-approved capital plan.
• Foreign bank branches: Must submit a streamlined ICAAP that addresses Hong Kong-specific risks, including cross-border contagion and home-host supervisory coordination.
• Deposit-taking companies (DTCs): Must submit an ICAAP proportionate to their business scale, but the HKMA expects the same rigour in stress testing and capital planning.

The HKMA’s SPM CA-G-1 explicitly states that the ICAAP must be “proportionate” but not “simplified.” A DTC with HK$1 billion in assets cannot submit a two-page summary. The regulator expects a documented methodology, even for smaller institutions.

Step-by-Step ICAAP Preparation

The HKMA expects the ICAAP to follow a structured, four-stage process: risk identification, capital assessment, stress testing, and capital planning. Each stage must be documented and board-approved.

Step 1: Risk Identification and Materiality Assessment

The bank must identify all material risks to which it is exposed. The HKMA’s SPM CA-G-1 lists 11 risk categories that must be assessed: credit risk, market risk, operational risk, liquidity risk, IRRBB, concentration risk, strategic risk, reputational risk, compliance risk, model risk, and contagion risk. For each risk, the bank must define a “materiality threshold.” For example, a bank with a loan portfolio of HK$50 billion might set a materiality threshold of 1% of Tier 1 capital for credit concentration risk. Any single exposure exceeding that threshold triggers a separate capital charge calculation.

The materiality assessment must be forward-looking. The HKMA’s 2024 thematic review on ICAAP found that 40% of AIs failed to update their risk register to reflect the interest rate hiking cycle of 2022–2024. The regulator expects the bank to consider “emerging risks” such as climate-related financial risks (as per the HKMA’s 2023 Supervisory Policy Manual on Green and Sustainable Banking) and geopolitical risks affecting cross-border lending.

Step 2: Capital Adequacy Assessment Under Pillar 1 and Pillar 2

The bank must calculate its capital adequacy ratio (CAR) under Pillar 1 using the Banking (Capital) Rules. As of 2025, the minimum CAR is 8% of risk-weighted assets, with a Common Equity Tier 1 (CET1) ratio of at least 4.5% and a Tier 1 ratio of at least 6%. The ICAAP must then add a “Pillar 2A” buffer for risks not captured in Pillar 1.

The HKMA provides a standardised methodology for Pillar 2A in SPM CA-G-1. For credit concentration risk, the bank must apply a granularity adjustment: the capital charge equals 0.5% of the sum of all single-name exposures exceeding 10% of Tier 1 capital. For IRRBB, the bank must calculate the impact of a 200-basis-point parallel shock on net interest income and apply a capital charge equal to the greater of the decline under the upward or downward shock.

The ICAAP must also include a “Pillar 2B” buffer for systemic risk. For banks designated as “Domestic Systemically Important Banks” (D-SIBs) by the HKMA, the Pillar 2B buffer ranges from 0.5% to 2.5% of risk-weighted assets, depending on the bank’s systemic importance score. As of the HKMA’s 2024 D-SIB list, 8 banks in Hong Kong are subject to this buffer.

Step 3: Stress Testing and Scenario Analysis

Stress testing is the core of the ICAAP. The HKMA requires the bank to run at least three scenarios:

• Baseline scenario: The bank’s internal economic forecast for the next three years.
• Adverse scenario: A moderate recession, defined by the HKMA as a 2% decline in Hong Kong GDP and a 3 percentage point rise in the unemployment rate.
• Severe adverse scenario: A systemic crisis, defined as a 6% GDP decline and a 10% unemployment rate, combined with a 30% drop in residential property prices.

The bank must project its capital ratios under each scenario over a three-year horizon. The HKMA’s 2024 stress testing circular (HKMA Circular 2024-11-15) specifies that the projections must be “dynamic”—meaning the bank must model how management actions (e.g., dividend cuts, asset sales, capital raising) would affect capital ratios under the adverse scenarios. A static projection that assumes no management response is insufficient.

The bank must also conduct reverse stress testing. This involves identifying the combination of stresses that would cause the bank to breach its minimum capital requirements. The HKMA expects the reverse stress test to identify at least three plausible but severe scenarios. For example, a bank with a large mainland China exposure might test a scenario where a 10% depreciation of the renminbi against the Hong Kong dollar, combined with a 5% default rate on mainland loans, pushes the CAR below 8%.

Step 4: Capital Planning and Contingency Funding

The ICAAP must include a capital plan that specifies how the bank will maintain capital adequacy over the next three years. The plan must include:

• Capital targets: The bank must set an internal target CAR that is at least 2 percentage points above the regulatory minimum. For example, if the regulatory minimum is 8%, the internal target should be at least 10%.
• Capital instruments: The plan must specify the type and amount of capital the bank intends to issue—CET1, Additional Tier 1 (AT1), or Tier 2—and the expected issuance timeline.
• Contingency capital plan: The bank must identify at least three contingency actions it will take if capital falls below the internal target. The HKMA’s SPM CA-G-1 lists acceptable actions: dividend suspension, asset sales, securitisation, and capital raising through rights issues or private placements. The plan must include a trigger threshold for each action. For instance, if the CET1 ratio falls to 6%, the bank must suspend dividends immediately.

The capital plan must be approved by the board of directors. The HKMA’s 2024 SPM update added a requirement that the board must demonstrate “challenge” to the management’s assumptions. A board that simply rubber-stamps the ICAAP without documented discussion will receive a negative SREP assessment.

Common Pitfalls and Regulatory Expectations

The HKMA’s supervisory practice reveals recurring deficiencies in ICAAP submissions. Understanding these pitfalls is essential for any compliance officer or board member.

Inadequate Documentation of Assumptions

The HKMA’s 2024 thematic review found that 25% of AIs failed to document the key assumptions underlying their stress test scenarios. For example, a bank might assume that a 10% decline in property prices would cause a 2% default rate on its mortgage portfolio, but the ICAAP would not explain why that relationship holds. The HKMA expects the bank to provide empirical evidence—historical data from the 2008 financial crisis or the 2020 pandemic period—to support each assumption. Without this, the ICAAP is considered “unsupported” and may be returned.

Failure to Address Emerging Risks

The HKMA has made climate risk a priority. Its 2023 SPM on Green and Sustainable Banking requires AIs to incorporate climate-related financial risks into their ICAAP by 2025. This includes physical risk (e.g., flood damage to collateral) and transition risk (e.g., carbon tax impacts on corporate borrowers). As of early 2025, the HKMA reported that only 30% of AIs had fully integrated climate risk into their stress testing. The regulator expects all AIs to have at least a qualitative assessment of climate risk in their ICAAP by the 2025 submission cycle.

Weak Board Oversight

The HKMA has publicly criticised boards that treat the ICAAP as a compliance document rather than a strategic tool. In a 2024 speech, the HKMA Deputy Chief Executive stated that the regulator expects board members to “understand the assumptions, challenge the results, and approve the plan with full knowledge of the risks.” The HKMA now requires the board to hold a separate meeting dedicated to the ICAAP, with minutes that record the board’s specific questions and management’s responses. A board that delegates ICAAP review to a subcommittee without full board discussion risks a downgrade in the SREP score.

Misapplication of Proportionality

Smaller AIs often misuse the proportionality principle to submit an ICAAP that is too brief. The HKMA’s SPM CA-G-1 states that proportionality applies to the “depth of analysis, not the breadth of coverage.” A DTC with HK$500 million in assets must still cover all 11 risk categories, but it may use simpler models—for example, a single-factor sensitivity analysis instead of a multi-factor Monte Carlo simulation. The regulator expects a documented rationale for any simplification. A DTC that omits concentration risk entirely because it has only 20 borrowers will be required to resubmit.

Actionable Takeaways

1. The HKMA expects all AIs to submit an ICAAP that is forward-looking, stress-based, and board-approved, with the 2025 submission cycle requiring full integration of climate-related financial risks.
2. Banks must document every assumption in their stress test scenarios with empirical evidence, as the HKMA’s 2024 thematic review found that 25% of submissions lacked this support.
3. The board of directors must hold a dedicated ICAAP review meeting with documented challenge to management’s assumptions, or risk a negative SREP assessment.
4. Foreign bank branches must address cross-border contagion risk and home-host supervisory coordination in their streamlined ICAAP, not simply copy their parent bank’s global report.
5. Smaller AIs must cover all 11 risk categories in the HKMA’s SPM CA-G-1, using proportionate but not simplified methodologies, with a documented rationale for any modelling simplifications.

This does not constitute legal advice. Consult a solicitor for your specific case.