Archive for year: 2025

-Chirag Agarwal (finserv@vinodkothari.com)

In our previous article, we discussed the expectations of the regulator along with a probable approach for NBFCs towards ICAAP. Notably, while ICAAP is applicable to banks as well as NBFCs (middle and upper layer), our present write-up focuses on ICAAP in the context of NBFCs.  The inclusion of ICAAP for NBFCs marks a significant shift, from a one-size-fits-all capital adequacy regime, towards a more tailored, risk-sensitive approach that reflects the unique risk profile of each NBFC.

While RBI has not mandated a rigid format or methodology for ICAAP, it has emphasised the need for internal capital assessments that are proportional to the nature, scale, and complexity of operations. The challenge, however, lies in the absence of detailed guidance or templates. Unlike banks that have had years to mature their ICAAP practices, most NBFCs are at the beginning of this journey.

This article attempts to fill that gap. As a sequel to our previous overview, it delves further into how different elements & each category of risk—credit, market, operational, liquidity, concentration, and others—should be considered for ICAAP. 

It may be noted that while the RBI has not issued specific guidelines for NBFCs to undertake ICAAP, they are instructed to be guided by the Master Circular – Basel III Capital Regulations to the extent applicable.

Need of ICAAP for NBFCs

The goal of ICAAP is not merely compliance, it is an internal assessment to ensure that the capital maintained by the NBFC is adequate, not just by regulation, but by the realities of its risk environment. 

The risk weights prescribed for computing the minimum capital adequacy are based on the general experience of the regulators with respect to the respective asset classes. However, risks associated with the assets also depend on the credit underwriting qualities of the originator, the geography in which it operates, concentricity, borrower composition, nature of underlying collateral,  etc. As a result, regulatory risk weights may not always reflect the true risk. This is where ICAAP comes in.

ICAAP helps NBFCs assess whether they hold enough capital based on their specific risk profile, going beyond the regulatory minimum. This self-assessment often goes beyond the basic rules. For example, an NBFC might consider capital required for additional risks, such as market risk, reputational risk, operational risk, etc, even though these aren’t always covered by the minimum capital requirements set by regulators. It might also use its own methods to evaluate more common risks like credit, market, or operational risks.

Apart from these risks, there are several other factors that are often overlooked but are essential to consider under ICAAP. These include off-balance sheet exposures, the NBFC’s future strategic plans, its compensation practices, etc.

NBFCs approach to ICAAP

An NBFC should not treat ICAAP as a mere compilation of regulatory templates such as capital adequacy, liquidity, or other prescribed formats. Doing so would reduce ICAAP to a regulatory compliance exercise, rather than a genuine internal assessment of how capital relates to the NBFC’s inherent risks.

In addition to serving as an assessment of capital adequacy, ICAAP also functions as a key decision making tool for the management. For instance, it helps evaluate whether the company’s existing capital levels are sufficient to support proposed business plans, assess the potential adverse impact of riskier asset classes on business continuity, and determine if planned growth would require capital infusion alongside debt raising. It also allows the company to assess whether its current trajectory is sustainable. In this manner, ICAAP effectively serves as a business continuity check for NBFCs.

Considering the above, the framework of ICAAP should be robust enough to assist management sufficiently. Accordingly, we discuss key elements of ICAAP in the subsequent section.

Key Elements under ICAAP

ICAAP consists of various elements. The detailed discussion on each element is discussed in subsequent sections. The various elements under ICAAP are as follows:

Listing and Assessment of Key Risk

The most critical element of ICAAP is the assessment of risks faced by the NBFC. It is important to note that there are two possible approaches: one, to consider only material risks, and the other, to consider all risks faced by the NBFC. The former approach is for NBFCs with simpler operations, while the latter is more appropriate for NBFCs with moderately complex operations, based on the management’s assessment.

Based on this assessment, a comprehensive list of risks should be identified and categorised as follows:

• Quantitative Risks: Risks that can be measured and quantified reliably should be assessed using the best available data, tools, and methodologies. The methods employed will naturally differ across NBFCs, depending on their risk profile, operational scope, and internal systems. NBFCs are exposed to various types of risks, including credit risk, market risk, operational risk, interest rate risk, credit concentration risk,  etc. 
• Qualitative Risks: While the aforementioned risks can be quantified, there are certain other risks which cannot be quantified such as reputational risk and business or strategic risk, and may be equally important for an entity and, in such cases, should be given same consideration as the more formally defined risk types. For example, an entity may be engaged in businesses for which periodic fluctuations in activity levels, combined with relatively high fixed costs, have the potential to create unanticipated losses that must be supported by adequate capital. Additionally, an entity might be involved in strategic activities (such as expanding business lines or engaging in acquisitions) that introduce significant elements of risk and for which additional capital would be appropriate.

Other key elements under ICAAP

Off-Balance Sheet Items: Off-balance sheet items represent potential obligations that do not appear directly on the institution’s balance sheet but can lead to substantial future liabilities. Examples include loan commitments, letters of credit, derivatives, securitizations, and guarantees.

While these exposures may not currently affect a firm’s capital or liquidity metrics, they carry contingent risks that can materialize under stress conditions. If not adequately monitored and incorporated into risk assessments, off balance sheet items may result in underestimated capital needs, particularly under adverse scenarios.

ICAAP Implications:

• Institutions must employ robust risk identification frameworks to capture the nature, size, and likelihood of off-balance sheet exposures becoming on-balance sheet liabilities.
  
• Stress testing should simulate adverse market or credit conditions to evaluate how these contingencies might impact capital adequacy.
  
• Capital buffers should be calibrated to reflect not just current exposure, but also potential future liabilities from these items under both baseline and stressed conditions.
  

Compensation Practices: Compensation structures have a direct influence on employee behavior and, by extension, the institution’s risk culture. When short-term incentives are misaligned with long-term stability goals, they may encourage excessive risk-taking, leading to undesirable financial outcomes and reputational damage.

ICAAP Implications:

• The capital adequacy framework must consider how incentive structures align with the institution’s risk appetite. Compensation policies should be reviewed to ensure they do not drive behaviors that conflict with prudent risk management.

• NBFCs should establish compensation deferral mechanisms (e.g., clawbacks, performance-based vesting) and ensure these are factored into risk planning to reinforce sound decision-making.

Future Strategic Plans: Strategic initiatives such as geographic expansion, launching new products, or entering new markets often involve heightened or novel risks. These initiatives may expose the institution to unfamiliar regulatory environments, new credit or operational risks, or increased competition.

ICAAP Implications:

• Future business plans must be embedded into capital planning and risk modeling. This includes estimating the impact of new initiatives on capital demand, funding needs, and operational capacity.
  
• Scenario analysis should test how strategic changes could affect capital ratios under both expected and stressed conditions, especially when entering volatile or unfamiliar sectors.
  
• Management must ensure that adequate risk mitigation strategies are in place, and that the institution holds sufficient capital to support growth without compromising its resilience.

Stress Testing: As part of the ICAAP, NBFCs must, at a minimum, conduct periodic stress tests, with a focus on material risk exposures. These tests are designed to assess the institution’s vulnerability to unlikely but plausible adverse events or significant changes in market conditions that could negatively impact its financial position. By implementing a structured stress testing framework, management gains a deeper understanding of the entity’s potential exposures under extreme but realistic scenarios—thereby improving preparedness and resilience. But what exactly is stress in this context? In ICAAP, stress refers to adverse deviations from the base case or normal operating conditions. It could be in the form of macroeconomic shocks, sector-specific downturns, or internal events—such as operational breakdowns or large-scale defaults. The purpose of stress testing is not to predict the future but to examine what could happen if things go wrong. 

There is no fixed threshold for the severity of stress scenarios. However, the scenarios should be severe enough to test the NBFC’s capital and liquidity buffers, yet plausible enough to remain relevant. For example:

• Interest rate shock of +250 basis points
• 30% increase in delinquency rates
• Sudden collapse in collateral valueNBFCs should ideally run multiple stress levels—mild, moderate, and severe—to observe performance across a range of conditions.
• Adverse regulatory action halts lending in a key segment.
• Widespread borrower fraud in a key region.
• Natural disaster (e.g., flood or earthquake) affecting multiple branches, etc

Quantitative Risks

Credit Concentration Risk 

Credit concentration risk arises when a financial institution’s exposures are not well-diversified—either across counterparties, sectors, geographies, asset classes, or even business models. In simple terms, it is  the risk of putting too many eggs in one basket. Risk concentrations are arguably the single most important cause of major problems in entities. Credit risk concentrations, by their nature, are based on common or correlated risk factors, which, in times of stress, have an adverse effect on the creditworthiness of each of the individual counterparties making up the concentration. The credit concentration risk calculations shall be performed at the counterparty level (i.e., large exposures), at the portfolio level (i.e., sectoral and geographical concentrations) and at the asset class level (i.e., liability and assets concentrations). There could be several approaches to the measurement of credit concentration in the entity’s portfolio. One of the approaches commonly used for the purpose involves the computation of Herfindahl-Hirschman Index (HHI). Under the HHI approach, an entity first decides what level of portfolio diversification it considers to be ideal—this is called the target HHI. The HHI for the actual credit portfolio is then calculated and compared with the target HHI. If the actual HHI is higher than the target, it indicates that the portfolio is more concentrated (i.e., riskier) than desired.

To compensate for this additional concentration risk, the NBFC needs to hold extra capital. The amount of additional capital is determined by using a multiplier. This multiplier increases in proportion to how far the actual HHI exceeds the target. The multiplier is the interpolated value of Loss given Default at the current HHI level where the minimum LGD is at the target HHI level and the maximum LGD occurs at the highest possible HHI level i.e. 1. Essentially, the more concentrated the portfolio is, the higher the capital buffer required.

Stress Testing: Stress scenarios for concentration risk can involve:

• Counterparty default stress, where the largest or top 20 borrowers default simultaneously.
• Sectoral collapse, where an entire sector (e.g., real estate or microfinance) underperforms.
• Geographic shocks, like drought or political disruption in a key operating region.

The stress scenarios would result in higher Loss Given Defaults and consequently higher capital requirements for stress scenarios.

Credit Risk

Credit Risk is the most important component of capital required for lending institutions. Despite implementing the most rigorous credit underwriting processes, it is impossible to completely eliminate the possibility of credit defaults. This is because certain factors can evolve over time, potentially leading to heightened strain within the portfolio. Companies use Expected Credit Loss (ECL) models to estimate credit risk. However, it’s important to understand that ECL models are designed to capture only the ‘expected’ portion of credit losses—those that are likely to occur based on current conditions and historical data. Hence, entities should also consider using additional models or approaches to estimate the capital required to cover unexpected losses—those rare, extreme events that could have a significant financial impact but are not captured by ECL models. NBFCs may apply stress scenarios to the probability of default and loss given default parameters in their Expected Credit Loss models, beyond what is assumed in the base case, in order to capture potential unexpected losses.

Stress Testing: To stress credit risk, NBFCs can alter the assumptions used in their ECL models or conduct additional simulations to capture unexpected losses. Examples include:

• Increasing default rates by 50% to 100% over historical averages.
• Reducing recovery rates by 20% to simulate distressed recoveries.
• Assuming sector-specific shocks, such as stress in MSME lending or rural portfolios.

Market Risk 

An entity should be capable of identifying risks arising from trading activities due to movements in market prices. This assessment should take into account factors such as instrument illiquidity, concentrated exposures, one-way market conditions, non-linear or deep out-of-the-money positions, and the likelihood of substantial changes in correlations. Stress testing exercises incorporating extreme events and market shocks should be specifically designed to highlight key vulnerabilities within the portfolio in relation to relevant market developments.

Stress Testing: For market risk, NBFCs should simulate movements in interest rates, exchange rates, and asset prices. Examples of stress scenarios include:

• A 250–300 bps rise in interest rates, increasing cost of funds and decreasing bond portfolio values.
• Drop in collateral prices (e.g., gold or real estate) by 20%–30%.
• Liquidity contraction in trading instruments, rendering assets difficult to exit.

The idea is to identify exposures where market volatility could result in valuation losses or income shocks.

Operational Risk 

An entity should be equipped to evaluate potential risks arising from deficiencies or failures in internal processes, personnel, and systems, as well as from external events. This assessment should also consider the impact of extreme events and shocks associated with operational risk. Such events may include a sudden surge in process failures across multiple business units or a major breakdown in internal controls. As a general practice, companies often use the Business Indicator Component Model for computing the capital requirement for operational risk. In this model, the risk is computed by multiplying the average income of the entity with a prescribed factor. 

Stress Testing: Stressing operational risk requires assumptions about adverse internal or external events. For instance:

• Simulating a cyberattack that shuts down core systems for 5–10 days.
• Widespread process failures during a system migration or staff shortage.
• Vendor risk, where a critical third-party service fails.

Qualitative Risks

Compliance Risk

NBFCs in India operate within a highly regulated environment. NBFCs usually are regulated by multiple regulators, and non-compliance with applicable norms would not only result in imposition of penalties/fines but in few cases may even threaten the continuity of operations of the business. Compliance risk may further act as a trigger factor for other risks faced by the Company, as non-compliance may threaten reputation, operations, profitability as well as other aspects of the Company’s operations. Accordingly, compliance risk is considered as a significant risk for the NBFCs. For ICAAP purposes, entities may begin by identifying the sources of risk and evaluating the internal controls and mitigation measures already in place. Based on this assessment, they can then determine the residual risk—the portion of risk that remains unaddressed—and accordingly estimate the capital required to cover it.

IT Risk

In the current business environment, almost all the businesses, including that of the NBFCs, are assisted by information technology infrastructure, while these assets assist entities in streamlining its processes and reducing risk due to human errors it also poses a significant risk, due to possibility of malfunctioning and downtime.

Off-balance sheet items

An entity may have various contingent liabilities and on occurrence of certain events if these liabilities were to materialize, they could lead to expenses / losses for the entity. 

Hence, despite the uncertainty surrounding these arrangements, it is essential that the entity maintains sufficient capital considering the likelihood of happening of these events.

Compensation practices 

An effective compensation framework plays a critical role in aligning employee behaviour with the long-term objectives of the organization to manage human resource risk. It shall be ensured that the compensation policy does not inadvertently prioritize short-term gains for senior management over the long-term interests of the organization. These measures are designed to prevent compensation practices that may incentivize excessive risk-taking or compromise the Company’s long-term goals in pursuit of short-term performance.

To strike the right balance between performance incentives and long-term business objectives, the entity shall maintain an appropriate mix of variable and fixed pay for its employees. This approach aims to encourage improved performance while safeguarding the Company’s overall long-term interests.

These practices fosters a culture of responsible decision-making and ensures that the employees are motivated to achieve sustainable success and growth, aligning individual performance with the broader objectives of the organization.

Future projections 

In ICAAP, making future projections is important to check if the institution will have enough capital to stay strong in the coming years, even if things go wrong. These projections usually cover the next 3 to 5 years and include key numbers like expected CRAR (capital to risk-weighted assets ratio), future income, asset growth, and risk levels. The CRAR should be estimated by looking at how much capital the institution will earn and keep, how much new capital it might raise, and how much its risk-weighted assets are likely to grow. Income should be projected based on how much the institution expects to earn from interest, fees, and other sources, while also considering possible loan losses and other costs. The growth in assets should reflect the business plans and also think about where and to whom loans will be given. Based on this, the risk-weighted assets should also be estimated to understand how risky the future asset base might be. 

Conclusion

ICAAP represents more than just a regulatory formality—it is a critical framework for NBFCs to understand and manage their unique risk landscape. By systematically identifying, assessing, and planning for both quantifiable and unquantifiable risks, and by applying stress testing to challenge their assumptions, NBFCs can ensure they are adequately capitalised for both expected and unexpected events. A well-executed ICAAP also considers various “blind spots” which often gets overlooked which includes off balance sheet items, compensation practices, future projections, etc. ICAAP not only strengthens financial resilience but also fosters a risk-aware culture, enabling NBFCs to navigate uncertainty with greater confidence and strategic clarity.