The Internal Liquidity Adequacy Assessment Process explained as it is actually reviewed: what it must demonstrate, its core components, and what separates a defensible ILAAP from a compliance filing.
In short
- Regulatory ratios such as the LCR and NSFR are standardised measures with fixed assumptions applied uniformly across very different institutions, so clearing them does not establish that a specific bank’s liquidity is adequate.
- Behavioural assumptions are the second component and, in practice, the place where an ILAAP is won or lost.
- A survival horizon is the length of time a bank could continue meeting its obligations under a defined stress scenario before corrective action becomes unavoidable.
- The practical test is traceability: can a reader follow a specific assumption through to a stress result, to a threshold, to a decision the institution actually took?
On this page
What ILAAP actually is#
ILAAP stands for the Internal Liquidity Adequacy Assessment Process: a bank’s own, documented assessment of whether it holds enough liquidity, of the right quality and in the right places, to meet its obligations as they fall due — in normal conditions and under stress severe enough to hurt. The word doing the work in that sentence is internal.
The process exists because prudential ratios are standardised measures applied to institutions that are not standardised, and a bank that clears every minimum can still carry a funding structure that will not survive a fortnight of concentrated withdrawals.
What it has to demonstrate#
The demonstration an ILAAP owes is therefore explanatory rather than arithmetic. Management must be able to say why liquidity is sufficient for this balance sheet, this depositor base, this funding mix and this strategy — and to show the reasoning, the evidence and the challenge behind that conclusion. Ratio compliance is an input to that argument. It is not the argument.
A supervisor reading an ILAAP is testing whether the institution understands its own liquidity risk well enough to manage it before an external metric forces the issue.
The risks that have to be named#
Its first component is the identification of material liquidity risks, which means going beyond the generic list:
- Funding concentration by depositor, product, sector and maturity
- wholesale dependency and refinancing risk
- foreign-currency mismatches where a comfortable aggregate position hides a currency the bank cannot readily source
- intraday liquidity
- asset encumbrance that quietly shrinks the usable buffer
- contingent outflows from committed lines, guarantees and collateral agreements
Materiality is a judgement, and the judgement is part of what gets reviewed.
The assumptions that carry the weight#
Behavioural assumptions are the second component and, in practice, the place where an ILAAP is won or lost. Contractual maturity describes almost nothing about how a bank’s liquidity actually behaves: sight deposits stay for years, term deposits break early, revolving lines draw down precisely when the bank would prefer they did not.
Every ILAAP therefore rests on assumptions about deposit stickiness and attrition by segment, rollover rates, early withdrawal and drawdown behaviour.
What distinguishes a credible framework is not the elegance of those assumptions but the evidence behind them:
- internal history covering a genuine stress episode where possible
- segmentation that reflects observed behaviour rather than product labels
- sensitivity analysis showing how the conclusion moves when the assumption moves
- stated limitations where the data is thin
How long would the bank last?#
Stress testing converts those assumptions into numbers that mean something. A serviceable architecture runs:
- idiosyncratic scenarios (the bank alone is in difficulty, deposits leave, counterparties step back)
- market-wide scenarios (funding markets close for everyone, haircuts widen, monetisation is slower and more expensive than assumed)
- combinations of the two, since real crises rarely arrive one at a time
Outputs are projected cash flows and cumulative gaps against stress-adjusted liquidity capacity, which yields the number most boards remember: the survival horizon, the period the bank can meet obligations under the scenario before corrective action is unavoidable.
Reverse stress testing asks the complementary question — what combination of outflows, market closure and collateral deterioration would make the position unsustainable — and it is often more informative than the scenarios chosen in advance.
Appetite, funding, warnings and contingency#
The remaining components are the ones that turn an assessment into a management framework. Liquidity risk appetite must be expressed in terms that constrain real decisions — a minimum survival horizon, concentration limits, a floor on unencumbered buffer capacity — rather than in language that could never be breached.
The funding plan must be tested against the stress results, because a business plan that assumes growth funded by wholesale markets is a liquidity assumption whether or not anyone labels it as one. Early warning indicators mark the point where deterioration should trigger action while options still exist.
The contingency funding plan sets out which actions are executed, in what sequence, by whom, and with which funding that would genuinely still be available in the scenario that triggered it.
Who gets to disagree#
Governance is what makes all of it defensible. Treasury typically owns the liquidity position, but an ILAAP in which Treasury also sets, validates and approves its own assumptions has no independent challenge in it, whatever the organisation chart says.
Effective challenge means:
- a risk function with the standing and the data to disagree
- an ALCO that records genuine debate rather than noting a paper
- a board that owns liquidity adequacy as a decision rather than receiving it as a report
- an internal audit view of the process itself
Challenge that leaves no trace did not happen, as far as any reviewer is concerned.
Filing, or assessment?#
The difference between a defensible ILAAP and a compliance filing is visible within a few pages:
- A filing describes the framework; an assessment reaches conclusions and shows what changed because of them.
- A filing states behavioural assumptions; an assessment evidences them, tests their sensitivity and admits where the data is weak.
- A filing reports the survival horizon; an assessment explains which management actions extend it, by how much, and which of those actions would not be available in the scenario that produced the number.
The practical test is traceability: can a reader follow a specific assumption through to a stress result, to a threshold, to a decision the institution actually took?
Where it goes wrong#
The weaknesses reviewers find most often are consistent enough to be worth naming:
- Behavioural assumptions carried forward for years without recalibration, or justified by reference to a historical average that no longer describes the depositor base.
- Stress scenarios calibrated to a severity the framework can comfortably survive.
- A funding plan and a business strategy that appear nowhere in the liquidity assessment.
- Early warning thresholds set so close to the limit that breaching one leaves no room to act.
- A contingency funding plan whose sources, added up, quietly rely on the same collateral or the same market twice.
- Documentation that describes a process nobody can trace to a decision.
None of these are modelling failures; all of them are governance failures, which is why they persist in banks with sophisticated liquidity systems.
Frequently asked
What does ILAAP stand for?
ILAAP stands for Internal Liquidity Adequacy Assessment Process — a bank’s own documented assessment of whether its liquidity resources are sufficient for its risk profile, business model and strategy, including under stress. It is the liquidity counterpart to the ICAAP, which performs the same role for capital, and it is assessed as a management process rather than as a single calculation.
Is the LCR enough, or does a bank still need an ILAAP?
Regulatory ratios such as the LCR and NSFR are standardised measures with fixed assumptions applied uniformly across very different institutions, so clearing them does not establish that a specific bank’s liquidity is adequate. An ILAAP exists to cover what the ratios cannot see: the bank’s own depositor behaviour, funding concentrations, currency and intraday needs, encumbrance, contingent outflows, and how long it would actually survive a stress calibrated to its own vulnerabilities. In practice the ratios are one input into the internal assessment, not a substitute for it.
What is a survival horizon in an ILAAP?
A survival horizon is the length of time a bank could continue meeting its obligations under a defined stress scenario before corrective action becomes unavoidable, calculated from projected cash flows and cumulative liquidity gaps against stress-adjusted liquidity capacity. Its usefulness depends entirely on what sits behind it: which scenario, which behavioural assumptions, which monetisation haircuts, and whether the management actions assumed to extend it would still be executable in that scenario. Boards typically set a minimum survival horizon in the liquidity risk appetite so that a shortening horizon triggers action rather than commentary.
How often should an ILAAP be updated?
Most banks refresh the full ILAAP annually, with board approval, but the annual cycle is the minimum rather than the answer. Behavioural assumptions, stress scenarios and buffer composition should be revisited whenever something material changes — a shift in the depositor base, a new funding structure, an acquisition, entry into a new currency or market, a change in encumbrance, or an actual stress episode that provides better evidence than any model. The practical signal that the cycle is too slow is an ILAAP that reads the same as last year’s while the balance sheet does not.
The programme behind this article
Work through this material with the practitioners who wrote it.