What is the ICARA process and what is an ICARA document?

The new Investment Firm Prudential Regime introduces an internal capital and risk assessment (ICARA) process for both small and non-interconnected investment firms (SNI firms) and non-SNI firms. The Financial Conduct Authority (FCA) has highlighted that the introduction of this new regime is an opportunity to re-establish the expectations for firms' internal governance and risk management that reflects and builds upon the framework previously established in FCA guidance.

The intention is that the ICARA process will be the centerpiece of MIFID investment firms' risk management processes. The process will incorporate business model assessment, forecasting and stress testing, recovery planning and wind-down planning. The new regime also introduces the Overall Financial Adequacy Rule (OFAR), which establishes the standard the FCA will apply to determine if an FCA investment firm has adequate financial resources.

As part of the ICARA process, firms will also be expected to identify whether they comply with the OFAR.

What is the ICARA process, and what is an ICARA document?

The FCA has highlighted that the ICARA process is a continuing risk management process within the firm, although a formal ICARA review will usually only be required annually or immediately following a material change in the firm's business or operating model. It is an end-to-end assessment to make sure that the firm holds appropriate financial resources in accordance with the threshold conditions, and to meet the requirements under Principle 4 of the Principles for Business.

The firm's ICARA process should be proportionate to the nature, scale and complexity of the business carried on by the firm.

The overall purpose is to make sure that the firm has appropriate systems and controls in place to identify, monitor, and, where proportionate, reduce all potential material harms that may result from the ongoing operation of its business or the winding down of its business.

It should also ensure that the firm holds financial resources adequate for the business it undertakes. All in scope firms must undertake an ICARA process in relation to their entire business, including their regulated and unregulated activities (MIFIDPRU 7.4.9(3)). There are no transitional provisions for the ICARA process on the basis that firms will need to use it to determine the amount of financial resources they need to hold to meet the OFAR (see PS21/9).

Firms will not normally be required to operate an ICARA process on a consolidated basis, even in the event the group is subject to prudential consolidation. SNI and non-SNI firms may, however, conduct a group ICARA if they meet certain criteria.

A firm will need to have in place an ICARA document in order to record all of its findings from the ICARA process. Importantly, the ICARA document does not need to be one central document, it can be made up of a number of different documents. For example, recovery planning may be provided in a separate document. However, all documents encompassing the ICARA process must be consistent with one another. For simplicity in this article, we imagine it as one comprehensive document.

What does the ICARA document need to contain?

The FCA has set out prescriptive rules in respect of what the ICARA process needs to encompass, and therefore by proxy what the ICARA document needs to contain. The steps that have to be taken to create this document are:

• identify all of the harms that arise from the on-going operation of the business and the wind down of the business (including wind down planning and wind down triggers) (MIFIDPRU 7.4.13);

• put in place appropriate systems and controls to identify, monitor and, if proportionate, reduce all material potential harms (MIFIDPRU 7.4.3(1)(a));

• clearly articulate the business model and risk appetite, and identify any material risks that are misaligned between the firm's business model and the interests of its clients (MIFIDPRU 7.5.2(1));

• consider own funds requirements and liquid assets on a forward-looking basis (MIFIDPRU 7.5.2(4));

• consider plausible stresses that could affect the business (MIFIDPRU 7.5.2(5)); and

• use stress testing to test stresses that could affect the business (MIFIDPRU 7.5.4(1)).

The FCA has set out specific elements that the ICARA document must contain (MIFIDPRU 7.8.7(3)), which includes:

• a clear description of the firm's business model and strategy and how it aligns with the firm's risk appetite (MIFIFPRU 7.8.7(3)(a));

• an explanation of the activities carried on by the firm, with a focus on the most material activities (MIFIFPRU 7.8.7(3)(b));

• an analysis of the effectiveness of the firm's risk management processes during the period covered by the review (MIFIFPRU 7.8.7(3) (f));

• a summary of the material harms identified by the firm and any steps taken to mitigate them (MIFIFPRU 7.8.7(3)(g));

• a clear explanation of how the firm is complying with the OFAR, including a clear breakdown of each component as at the review date (MIFIFPRU 7.8.7(3)(i));

• a summary of any stress testing and reverse stress testing carried out by the firm (MIFIFPRU 7.8.7(3)(j));

• the levels of own funds and liquid assets that, if reached, the firm has identified may indicate that there is a credible risk that the firm will breach its threshold requirements (MIFIFPRU 7.8.7(3)(k));

• the potential recovery actions that the firm has identified (MIFIFPRU 7.8.7(3)(l)); and

• an overview of the firm's wind-down planning (MIFIFPRU 7.8.7(3)(m)).

Senior manager responsibility

One of the key points to note as part of the ICARA process is that the governing body is responsible for reviewing and approving the contents of this document. In particular it has to review and approve the key assumptions in the document.

The FCA has made it clear through the drafting of the rules that senior managers are expected to make a meaningful contribution to the ICARA process. The FCA has highlighted that as part of the reasonable steps responsibility that senior managers have under the Senior Managers & Certification Regime, the senior managers will need to actively engage in the ICARA process and in embedding the requirements of the ICARA process into their respective business areas.

Practical difficulties for firms

In respect of practical issues that we have seen for firms, these include:

• how they go about undertaking the harm assessment and which harms are relevant to the business;

• how the harm assessment integrates into the firm's more general risk assessment;

• getting representatives from across the business to work toward making the ICARA process as comprehensive as possible, and ensuring that documentation is consistent;

• planning a timeline so that the first submission of the ICARA return may be made within the regulator's deadline, which will be based on the data submitted in the MIFIDPRU questionnaire;

• ensure senior managers are appropriately briefed to understand the process so that they may provide challenge as necessary;

• address recovery planning in a comprehensive manner, and in some cases for the first time, due to the firm not historically being subject to recovery planning; and

• consider plausible and appropriate wind down scenarios and plan accordingly for such an event.