ILAAP Explained: How Banks Demonstrate Liquidity Adequacy Beyond the LCR and NSFR

This post sets out what regulators expect to find in a credible ILAAP (Internal Liquidity Adequacy Assessment Process), why it matters beyond the LCR and NSFR, and where firms most often fall short. If you are working directly with liquidity frameworks, dealing with PRA supervision, or preparing for a SREP review, this is the practical context you need alongside the video above.

What ILAAP Is and Where It Sits in the Regulatory Framework

The ILAAP is a bank's own structured assessment of whether it holds sufficient liquidity to survive a range of adverse conditions. It sits within Basel's Pillar 2 framework alongside the ICAAP, which does the same job for capital.

Under Pillar 1, firms calculate the LCR and NSFR and report them to the regulator. Under Pillar 2, the regulator goes further. It wants to understand the thinking behind the numbers, the governance that produces them, and whether the firm genuinely understands and manages its liquidity risk. That is what ILAAP is for.

In the UK, the PRA expects firms to submit an ILAAP document on a cycle agreed with their supervisor and uses it as a primary input to the Supervisory Review and Evaluation Process (SREP). In the EU, the EBA's ILAAP Guidelines set a comparable framework primarily for significant institutions supervised directly by the ECB under the Single Supervisory Mechanism, with national competent authorities setting comparable expectations for smaller firms. The details differ between jurisdictions, but the intent is consistent: the ILAAP is a firm's chance to demonstrate, not just assert, that it has liquidity under control.

Why the LCR and NSFR Only Tell Part of the Story

The LCR and NSFR are powerful tools. The LCR ensures a bank holds enough high quality liquid assets (HQLA) to cover net cash outflows over a 30 day stress window. The NSFR requires that available stable funding covers required stable funding over a one year horizon. Both ratios are standardised, based on fixed rules, and comparable across firms.

That standardisation is also their limitation.

The LCR applies a single prescribed stress scenario, with fixed run off rates for each liability category. Your bank's actual depositor behaviour, its specific product mix, its funding concentration in one currency or counterparty, or its intraday liquidity needs across multiple legal entities in a group structure: none of that is captured with any precision. A bank can report a comfortable LCR while carrying very real liquidity vulnerabilities that the ratio simply does not see.

ILAAP is designed to fill that space. It asks a bank to look at its own business model, its own funding sources, its own risk profile, and to articulate how it identifies, measures, monitors, and controls liquidity risk in that specific context. For more on the different types of liquidity risk a bank faces, see our post on liquidity risk types.

The Core Components Regulators Expect to See

A credible ILAAP is not a free form narrative. Regulators expect to find specific components, addressed with substance.

Liquidity Risk Appetite

The Board must articulate how much liquidity risk the firm is willing to accept. This should not be a generic statement. It should translate into specific, measurable limits: minimum survival horizons, HQLA thresholds, maximum reliance on short term wholesale funding. The risk appetite is the anchor for everything else.

Internal Limits Framework

Limits should cascade from the risk appetite down to desks, products, currencies, and legal entities. They should be monitored in something close to real time, and there should be a clear process for what happens when they are breached.

Liquidity Buffer Sizing

The firm must explain how it arrives at its internal liquidity buffer requirement. This includes how it considers risks that Pillar 1 does not fully capture, such as intraday liquidity, trapped liquidity in subsidiaries, or the encumbrance of assets pledged as collateral.

Funding Risk Assessment

Regulators want to see that the firm has genuinely assessed its funding structure: concentration by counterparty, by instrument, by tenor, and by currency. A firm heavily reliant on a small number of large wholesale depositors carries different risk to one with a broad, sticky retail base.

Governance and the Three Lines of Defence

The three lines of defence model is well understood across banking, but ILAAP documentation needs to show how it actually operates for liquidity specifically.

The first line, typically Treasury, owns the day to day management of the liquidity position. Treasury executes funding strategy, monitors limits, and manages the HQLA buffer.

The second line, the Risk function, sets the risk appetite framework, independently monitors the position against limits, and provides challenge to Treasury's assumptions. This challenge needs to be genuine. Regulators are sceptical of second line functions that simply validate whatever the first line proposes.

The third line, Internal Audit, provides independent assurance that the framework is operating as designed. Audit should be testing whether the governance described in the ILAAP actually matches how decisions get made in practice.

The ILAAP document itself should demonstrate that the Board and senior management actively engage with liquidity risk. Minutes of ALCO or Board Risk Committee discussions, evidence that limits have been debated and revised, and a clear escalation path from operational level monitoring to Board level awareness: these are the signals supervisors look for.

Stress Testing: Going Beyond the Standard Assumptions

The LCR stress scenario is prescribed by regulation. ILAAP stress testing must go beyond it.

Regulators expect to see at least three types of scenario:

• Idiosyncratic stress. A shock specific to your firm: a ratings downgrade, a news event that damages depositor confidence, or a product failure. How quickly do your outflows accelerate, and how long does your buffer last?
• Market wide stress. A systemic shock that dries up wholesale funding markets for all participants simultaneously. What happens to your rollover assumptions?
• Combined stress. The scenario that regulators find most instructive: both hitting at once, because that is often what happens. The 2007 to 2009 crisis is the clearest example. The events of early 2023, which showed how idiosyncratic shocks can trigger broader market anxiety even if systemic funding markets did not freeze in the same way as 2008, are a more recent reminder. For the history of how liquidity failures have played out, see our post on liquidity risk through history.

Survival horizon is one of the key outputs from stress testing. A firm should be able to articulate: under our most severe plausible scenario, how many days can we survive before exhausting our liquidity buffer? And then it should be honest about whether that horizon is sufficient given its business model.

Scenarios should be specific, documented, and reviewed at least annually. The assumptions behind each scenario, run off rates, asset haircuts, available collateral, should be justified rather than inherited from Pillar 1 defaults without examination.

The Contingency Funding Plan

Stress testing tells you how severe the problem could be. The Contingency Funding Plan (CFP) is the operational answer to what you would actually do about it.

A credible CFP sets out the options the firm would exercise at different stages of stress, roughly aligned to the escalation triggers in the liquidity risk appetite framework. Early stage actions might include reducing lending, extending liability tenor, or drawing on the HQLA buffer. More severe actions might involve asset sales, drawing central bank facilities, or activating recovery planning measures.

The CFP must be realistic. An option that requires Board approval, counterparty negotiation, and legal documentation during an acute liquidity event is not a usable contingency option unless the groundwork has been done in advance. Supervisors want to see evidence that options have been pre positioned: credit facilities that are documented and tested, central bank facilities that are established and collateral pre positioned.

And the CFP must be tested. A document that has never been walked through by the people who would actually have to execute it carries very little credibility. Many firms now run annual CFP exercises, sometimes as part of broader recovery planning drills. The outputs, including any gaps or friction points identified, should feed back into the document itself.

For a sharper picture of how fast liquidity stress can escalate when governance fails, our post on why liquidity fails fast is worth reading alongside this one.

How Supervisors Use Your ILAAP in the SREP

The SREP is the periodic regulatory assessment that determines a firm's overall capital and liquidity requirements, including any additional Pillar 2A requirements. Supervisors do not assess ILAAP in isolation. They read it alongside the ICAAP, management information, stress test results, and their own supervisory knowledge of the firm.

ILAAP quality can influence the Pillar 2 liquidity buffer requirement directly. A firm whose ILAAP demonstrates sophisticated risk identification, credible stress testing, robust governance, and an active Board will generally attract more constructive dialogue than one whose document reads as a compliance exercise completed by a small team with limited management involvement.

Supervisors also look for consistency. If the ILAAP claims that the Board reviews and challenges the liquidity risk appetite quarterly, but the Board minutes submitted separately contain no substantive discussion of liquidity, the inconsistency is noted.

What a Strong ILAAP Looks Like in Practice

The difference between a strong ILAAP and a weak one comes down to three things: specificity, evidence, and integration.

Specificity

Generic statements about "monitoring liquidity risk across the enterprise" are not useful. Regulators want to see the actual limits, the actual scenarios, the actual survival horizons, with the methodology that sits behind them.

Evidence

Claims about governance need to be substantiated. Board engagement should be evidenced by minutes and papers, not asserted in prose. Second line challenge should appear in documented model reviews and limit setting discussions.

Integration

The most important question a supervisor asks is whether the ILAAP reflects how the firm actually operates or whether it is a parallel document that describes an idealised framework bearing little resemblance to daily decisions. A strong ILAAP is written by people who run the liquidity position, reviewed by people who challenge it, and signed off by a Board that has genuinely engaged with the content.

If you are building or reviewing an ILAAP, start from what your firm actually does, document it honestly, and then use the gaps between what you do and what best practice looks like as the basis for improvement. That is what supervisors are really trying to understand.

If this post has been useful, there is more where it came from. The Academy course catalogue covers structured content across treasury, ALM, and liquidity risk management, and the learning paths offer a guided route through the material with a certificate at the end. The newsletter is free and delivers new videos and content drops straight to your inbox each week.