Circular NBB_2026_17 / Expectations regarding governance and reporting of the Internal Capital and Risk Assessment Process (ICARAP)

Public NBB_2026_17 – 13 October 2026 Circular – Page 1/6 boulevard de Berlaimont 14 – 1000 Brussels company number: 0203.201.340 RPM Brussels www.bnb.be

Circular
Public
Brussels, 13 October 2026
Reference: NBB_2026_17 your contact:
Rita Tam tel. +32 2 221 45 16
Rita.Tam@nbb.be

Expectations regarding governance and reporting of the Internal Capital and Risk Assessment Process (ICARAP)

Scope
Belgian stock exchange companies referred to in Article 2 of the Law on the status and supervision of stock exchange companies of 20 July 2022.

Summary/Objectives
This circular aims to communicate to stock exchange companies the prudential expectations of the National Bank of Belgium (hereinafter the Bank) regarding the governance of the Internal Capital Adequacy and Risk Assessment Process (ICARAP), referred to in Article 106 of the Law on the status and supervision of stock exchange companies of 20 July 2022, as well as the expectations regarding the annual ICARAP report to be submitted to the Bank.

This circular replaces Circular PPB-2007-15-CPB-CPA of 18 December 2007 on prudential expectations regarding the ICAAP applicable to stock exchange companies.

This circular enters into force on 1 January 2027. The related qualitative and quantitative reports must be submitted by the end of April each year via the Onegate application. These reports are prepared by the stock exchange companies on a solo basis and, where applicable, on a consolidated basis 1.

1 Unless Article 8 of Regulation (EU) 2019/2033 of the European Parliament and of the Council of 27 November 2019 applies.

Public NBB_2026_17 – 13 October 2026 Circular – Page 2/6

Madam,
Sir,

Pursuant to Article 106 of the Law of 20 July 2022, stock exchange companies must have a forward-looking capital and liquidity needs management policy that is appropriate to the activities they intend to carry out. To this end, the legal administrative body defines an Internal Capital Adequacy and Risk Assessment Process (ICARAP). In this framework, the body ensures the establishment of sound governance and a rigorous risk management strategy to continuously assess the amount, type, and allocation of internal capital appropriate to cover the nature and level of risks to which the stock exchange company is or may be exposed and which it may impose on third parties (such as its clients and the market). The ICARAP consists of two complementary sub-components: the Internal Capital Adequacy Assessment Process (ICAAP) and the Internal Liquidity Adequacy Assessment Process (ILAAP). The legal administrative body reviews and validates the ICARAP report annually. The ICARAP is an important component examined in the Supervisory Review and Evaluation Process (SREP). The quality and information of the ICARAP are taken into account by the Bank in determining additional own funds (under Pillar 2). The Bank evaluates in particular the strength, effectiveness, and completeness of the ICARAP, the criteria for which are established in section 5.6.2 of the guidelines on common procedures and methodologies for the supervisory review and evaluation process pursuant to Directive (EU) 2019/2034 (SREP guidelines – EBA/GL/2022/09 - ESMA35-42-1470 2) of the European Banking Authority and the European Securities and Markets Authority.

1. Prudential expectations regarding ICARAP

Holistic approach
Stock exchange companies are expected to adopt a 'holistic' approach to ICARAP. This implies a clear interaction of this process with the strategy and risk management framework as well as an integration of this process into daily management. Consequently, material strategic changes as well as changes or breaches of risk appetite are reflected in the capital and liquidity needs calculated in the ICARAP. The ICARAP and adjustments to the capital strategy must, in turn, be taken into account and reflected in the strategy and risk appetite.

Business model, strategic plan, and financial projections The ICARAP is structured around the core activities of the stock exchange company, as well as a forward-looking strategic plan, accompanied by financial forecasts over a horizon of at least three years.

Governance
The ICARAP is developed and implemented by persons participating in effective management, and where applicable, the management committee, under the supervision of the legal administrative body. The legal administrative body must perform an assessment of the ICARAP at least once a year to ensure that risk coverage remains exhaustive and appropriate to the nature, scale, and complexity of the stock exchange company's activities, in the short and medium term (3-year horizon), taking into account the strategic plan.

2 Guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) | European Banking Authority

Public NBB_2026_17 – 13 October 2026 Circular – Page 3/6

Effective management ensures that all material risks are identified and quantified. The elements of the ICARAP must be reflected in risk, capital, and liquidity management and in decision-making, and must be integrated into operational processes on a continuous basis. The three lines of defense, including operational functions as well as various control functions, are involved in the ICARAP both at the level of its implementation and its revision, regarding their specific areas of intervention and the risks associated with them. In particular, the ICARAP must be an integral part of the audit plan of the internal audit function.

The ICAAP and ILAAP
The ICAAP and ILAAP must cover all significant risks to which the company is exposed as well as those it may impose on third parties, including risks not covered by regulatory requirements (under Pillar 1), with either an explicit allocation of capital and/or liquidity or a justification, if an allocation of capital or liquidity is not deemed necessary. The assessments of capital and liquidity needs must be forward-looking (covering at least 3 years) and based on credible and conservative assumptions. The ICARAP must ensure that the company's risks are correctly quantified through quantification methodologies adapted to its specificities. In this regard, they must take into account all relevant information and ensure the relevance of the methods used. If the company experiences difficulties in precisely quantifying a risk, it must resort to sufficiently prudent estimates. In addition to this assessment (under normal conditions), stock exchange companies are expected to analyze the vulnerabilities of their capital and liquidity positions in adverse scenarios (for example, in case of unfavorable macroeconomic conditions, operational incident, or the bankruptcy of a counterparty or depositary). To this end, companies are invited to implement stress tests and/or sensitivity analyses proportionate to the nature, size, and complexity of their activities. A common best practice is to aim for a three-year horizon for stress tests.

Orderly wind-down
Within the framework of the ICARAP, stock exchange companies are expected to describe the steps and resources necessary to ensure the orderly wind-down of their activities within a realistic timeframe, as well as to assess the risks related to such cessation and determine appropriate mitigation measures.

2. Annual ICARAP Reporting

2.1. Content and submission procedures for annual ICARAP reporting
Stock exchange companies submit an ICARAP report to the Bank by 30 April each year. This report includes:
(i) a qualitative report, which describes the established ICARAP framework and provides justification regarding the adequacy of the level of own funds and liquidity of stock exchange companies, relative to the risks to which they are exposed under normal and adverse conditions (see 2.2 below); and (ii) an Excel file, with the results of the quantification of capital needs by type of risk using the structure of the table reproduced in the annex of this circular (see 2.3 below). These documents must be transmitted via the Onegate application.

Public NBB_2026_17 – 13 October 2026 Circular – Page 4/6

2.2. ICARAP Qualitative Report
The ICARAP is an internal process; the format, composition, and level of detail communicated in the internal documentation or qualitative report are left to the discretion of each stock exchange company. Nevertheless, to inform you of the information deemed relevant by the Bank during its assessment of the adequacy of the ICARAP, you will find below an example of structure as well as the various elements to take into account when drafting the qualitative ICARAP report. These elements are indicative and non-exhaustive. They must be supplemented by information that companies deem relevant to allow the assessment of the adequacy of internal capital and liquid assets. It is expected that the ICARAP is proportionate to the size, nature, and complexity of the company's activities. To lighten the content of the ICARAP report, stock exchange companies may refer in the ICARAP report to documents submitted to the Bank in other regulatory reports, including internal policy documents mentioned in Part II of Annex 2 of Communication NBB_2025_19.

2.2.1. Summary of ICARAP results
Stock exchange companies present in this section the main results and conclusions of the ICARAP, including:

• an assessment and validation of the adequacy of the current level of own funds and liquidity to meet current needs (i.e., a summary of ICAAP and ILAAP reports);
• a forward-looking view of capital and liquidity needs over the next three years;
• any significant modification of the strategy, risk management framework, or any other key function or process of the stock exchange company based on ICARAP results;
• any planned changes to the procedural framework of the ICARAP, notably based on internal audit reports and discussions with the supervisory authority.

2.2.2. Business model, strategic plan, and financial projections
Companies present in this section their current activities as well as their strategic plans and projections. It is necessary to include a description of at least:

• the main lines of activity and products;
• the forward-looking strategy for at least 3 years;
• projections of key financial indicators over the next 3 years and the underlying assumptions and expectations;
• the extent to which ICARAP results (including threats and vulnerabilities identified therein) have been taken into account in the strategic and financial planning process.

2.2.3. ICARAP governance framework and link with the risk management framework
Companies describe in this section the governance, including roles and responsibilities, in the implementation of the ICARAP as well as how the ICARAP integrates into the risk management framework.
This chapter includes at least a description:

• of the different responsibilities of the legal administrative body, the management body, and the heads of the three lines of defense in processes related to ICARAP;
• of the Risk Appetite Framework (RAF) and the underlying policies and procedures, including how this framework is integrated and reflected in management;
• of the risk indicators used in accordance with the Risk Appetite Statement, the associated limits, and the level of capital and liquidity-related risk indicators at the reference date;
• of the systems and procedures put in place to ensure that capital and liquidity amounts are adequate relative to the risks to which the stock exchange company is exposed.

Public NBB_2026_17 – 13 October 2026 Circular – Page 5/6

2.2.4. Content of the ICAAP report
Companies report in this section the results of their assessment of the adequacy of the level and quality of own funds (ICAAP) considering the various risks to which they are exposed. This section thus includes:

• the capital planning strategy of the institution;
• the description of the composition of internal capital, and where applicable, differences compared to regulatory own funds;
• the inventory of significant risks and risk sub-categories, beyond Pillar 1 risks. Companies establish the list of risk categories and sub-categories covered by the ICAAP, including their definitions and the scope of individual risk categories 3;
• the policies and control systems to manage identified risks, notably with the monitoring of capital risk limits;
• the methodologies applied to quantify capital to cover the various risks as well as the data, assumptions, and parameters used;
• the results of the quantification of capital needs, compared to the level of available internal capital, as reproduced in the summary table in the annex of this circular;
• a detail of the analysis of capital position vulnerabilities in adverse scenarios carried out within the framework of the ICAAP, comprising at least a description of the scenarios and parameters used.

2.2.5. Content of the ILAAP report
Companies report in this section the results of their assessment of the adequacy of the level and quality of liquidity (ILAAP) considering the various risks to which they are exposed. To this end, companies are invited to follow the same structure as for the content of the ICAAP report (cf. 2.2.4). It is expected that the degree of development of the ILAAP be proportionate to the nature, size, and complexity of the company's activities.

2.2.6. Description of the orderly wind-down process
Within the framework of the ICARAP and within the framework of the SREP exercise, companies are expected to identify the steps and resources necessary to ensure the orderly wind-down of their activities within a realistic timeframe, as well as to assess potential risks related to such cessation and determine appropriate mitigation measures. Stock exchange companies are invited to describe in this section:

• the decision-making process leading to the implementation of the orderly wind-down of the entity and the operational and legal steps and tasks to cease activity progressively;
• an assessment of the resources required for the implementation of the orderly wind-down;
• the consequences that a wind-down could have on clients and external markets as well as on the company itself.

2.3. ICARAP Quantitative Report
In addition to the qualitative ICARAP report, companies are invited to produce annually a synoptic quantitative ICARAP report. This reporting is performed according to the format established in the attached Excel file and presents (i) the internal capital needs for each of the risks they consider material and relevant in the management of their activities, (ii) a brief assessment of the sufficiency of the level of own funds for the next three years, and (iii) an estimate of the capital level in adverse scenarios.

3 Companies may draw inspiration from the risk categories defined in the SREP guidelines.

Public NBB_2026_17 – 13 October 2026 Circular – Page 6/6

3. Additional information
   The Bank may at any time request additional information (e.g., detailed ICARAP policies and procedures, minutes of meetings of management bodies and their relevant committees), attesting to the correct organization and good implementation of the ICAAP and ILAAP. To be able to provide this information in a short timeframe, it is expected that stock exchange companies maintain a complete ICARAP file. A copy of this circular is sent to the auditor(s), approved auditor(s) of your institution.

Please accept, Madam, Sir, the expression of my most distinguished sentiments.

Pierre Wunsch
Governor

Annex: Quantitative reporting table on the numerical results of the ICARAP
Type text here

---

Quantitative reporting table on the numerical results of the ICARAP

ICARAP - Quantitative reporting scheme
ICAAP - Synoptic table
Reference date: 31/12/Year
Evaluation of capital needs
Pillar 1 risks (cf. EBA SREP guideline - chapter 6) Prudential capital requirements Capital needs according to ICAAP Risks for clients Risks for the market Risks for the enterprise Total Pillar 1 risks according to K factors Pillar 2 risks (other risks) cf. SREP guidelines (chapter 6.6) … Total Pillar 2 risks Total Pillar 1 and 2 risks Evaluation of capital adequacy Year Year + 1 Year + 2 Year + 3 Maximum of capital requirements and needs 0 (i) Prudential capital requirements Minimum capital requirement under Pillar 1 [max(PMC, KFR, FOR)] Additional capital requirement under Pillar 2 0 (ii) Capital need to cover total Pillar 1 and 2 risks according to ICAAP (iii) Capital need to cover the risk of an unruly liquidation Surplus or deficit (-) of internal capital relative to the maximum of requirements and needs Capital level in adverse scenarios Year + 1 Year + 2 Year + 3 Internal capital level forecast (baseline) Internal capital level forecast in Scenario 1 ('X') Internal capital level forecast in Scenario 2 ('Y') … Year N/A