HomeCirculars › RBI/2007-2008/266

Pillar 2 Guidelines: Supervisory Review & ICAAP for Banks

No longer current — withdrawn, no replacement on file yet
Source: Reserve Bank of India · RBI/2007-2008/266 · issued 26 Mar 2008 · ~2 min read
Quick answerRBI issued Pillar 2 guidelines under Basel II, requiring banks to have a Board-approved ICAAP policy. Banks must assess capital for risks not fully captured under Pillar 1, such as interest rate risk in banking book, concentration risk, and liquidity risk, and maintain adequate capital cushions.

What changed

RBI provided detailed guidance on the Supervisory Review Process (SRP) and Internal Capital Adequacy Assessment Process (ICAAP) under the New Capital Adequacy Framework. Banks are now required to assess capital adequacy for risks beyond the three Pillar 1 risks (credit, market, operational), including interest rate risk in banking book, credit concentration risk, liquidity risk, and others. An illustrative ICAAP document format was also furnished.

What it means for you

Banks must go beyond regulatory minimum capital ratios and conduct their own comprehensive risk assessments. This ensures they hold adequate capital for all material risks, including those not fully captured or omitted by Pillar 1. It encourages better risk management practices and a proactive dialogue with RBI, potentially leading to capital augmentation or risk reduction interventions.

Historical instruction — do not use for current compliance. This is what was required at the time; it no longer reflects current RBI requirements. If no replacement rule is linked above, that only means none is recorded on our register yet — it does not prove no later applicable rule exists. Confirm on the official RBI source below.

What banks were required to do at the time

Who it affects

All commercial banks (excluding Local Area Banks and Regional Rural Banks), Risk management departments, Board of Directors and senior management, Compliance and internal audit teams

❓ Common questions

Regulatory timeline

Built from our lineage records — each fact carries its provenance; missing history simply is not shown (never guessed).

What is the purpose of the Supervisory Review Process (SRP)?

The SRP ensures banks have adequate capital to support all business risks and encourages better risk management techniques. It involves a well-defined internal assessment process (ICAAP) and active dialogue with RBI to allow timely intervention if needed.

Which risks must banks assess under ICAAP that are not fully covered by Pillar 1?

Banks must assess risks like interest rate risk in the banking book, credit concentration risk, liquidity risk, settlement risk, reputational risk, strategic risk, model risk, and residual risk of securitization, among others.

Is there a single prescribed approach for conducting ICAAP?

No, RBI recognizes that no single approach exists and best practices are still evolving. The guidelines provide broad principles, and banks can develop their own methodologies, especially for non-quantifiable risks like reputational and strategic risks.

📜 This document’s life story (1 recorded event, each backed by RBI’s own words)
Repealed by RBI/2025-26/100 — Consolidation of Regulations — Withdrawal of circulars (28 Nov 2025)
RBI’s words: “Official withdrawal register entry #2280: DBOD.No.BP.BC.66/21.06.001/2007-08 — "Supervisory Review Process Under the New Capital Adequacy Framework - Guidelines for Pillar 2" dated March 26, 2008”
📜 Read the original circular — full text as issued by RBI
RBI/2007-2008/266 DBOD.No.BP.BC 66 / 21.06.001 / 2007-08 March 26, 2008 The Chairman/ Chief Executive Officer All Commercial banks (Excluding Local Area Banks and Regional Rural banks) Dear Sir, Supervisory Review Process under the New Capital Adequacy Framework –Guidelines for Pillar 2 The New Capital Adequacy Framework (NCAF), based on the Basel II Framework evolved by the Basel Committee on Banking Supervision, has been adapted for India vide our  Circular DBOD.No.BP.BC 90/ 20.06.001/ 2006-07  dated April 27, 2007. In this regard, a reference is also invited to paragraph 2.4 (iii)(c) of the Annex to the aforesaid circular in terms of which the banks are required to have a Board-approved policy on ICAAP and to assess the capital requirement as per ICAAP. We presume that the banks would have formulated the policy and also undertaken the capital adequacy assessment accordingly. These guidelines are being issued by way of further guidance to the banks. 2. The Basel II Framework has three components or three Pillars. The Pillar 1 is the Minimum Capital Ratio while the Pillar 2 and Pillar 3 are the Supervisory Review Process (SRP) and Market Discipline, respectively. While the guidelines on the Pillar 1 and Pillar 3 have already been issued by the RBI vide the aforesaid circular, the guidelines in regard to the SRP and the Internal Capital Adequacy Assessment Process (ICAAP) are furnished at  Annex - I . An illustrative outline of the format of the ICAAP document is furnished at  Annex – II . 3. The objective of the SRP is to ensure that the banks have adequate capital to support all the risks in their business as also to encourage them to develop and use better risk management techniques for monitoring and managing their risks. This in turn would require a well-defined internal assessment process within the banks through which they assure the RBI that adequate capital is indeed held towards the various risks to which they are exposed. The process of assurance could also involve an active dialogue between the bank and the RBI so that, when warranted, appropriate intervention could be made to either reduce the risk exposure of the bank or augment / restore its capital. Thus, ICAAP is an important component of the SRP. 4. The main aspects to be addressed under the SRP, and therefore, under the ICAAP, would include: (a) the risks that are not fully captured by the minimum capital ratio prescribed under Pillar 1; (b) the risks that are not at all taken into account by the Pillar 1; and (c) the factors external to the bank. Since the capital adequacy ratio prescribed by the RBI under the Pillar 1 of the Framework is only the regulatory  minimum  level, addressing only the three specified risks (viz., credit, market and operational risks), holding additional capital might be necessary for the banks, on account of both – the possibility of some under-estimation of risks under the Pillar 1 and the actual risk exposure of a bank vis-à-vis the quality of its risk management architecture.  Illustratively , some of the risks that the banks are generally exposed to but which are not captured or not fully captured in the regulatory CRAR would include: (a) Interest rate risk in the banking book; (b) Credit concentration risk; (c) Liquidity risk; (d) Settlement risk; (e) Reputational risk; (f) Strategic risk; (g) Risk of under-estimation of credit risk under the Standardised approach; (h) "Model risk" i.e., the risk of under-estimation of credit risk under the IRB approaches; (i) Risk of weakness in the credit-risk mitigants; (j) Residual risk of securitisation, etc. It is, therefore, only appropriate that the banks make their own assessment of their various risk exposures, through a well-defined internal process, and maintain an adequate capital cushion for such risks. 5. It is recognised that there is no one single approach for conducting the ICAAP and the market consensus in regard to the best practice for undertaking ICAAP is yet to emerge. The methodologies and techniques are still evolving particularly in regard to measurement of non-quantifiable risks, such as reputational and strategic risks. These guidelines, therefore, seek to provide only broad principles to be followed by the banks in developing their ICAAP. 6. The banks are advised to develop and put in place, with the approval of their Boards, an ICAAP commensurate with their size, level of complexity, risk profile and scope of operations. The ICAAP would be in addition to a bank’s calculation of regulatory capital requirements under Pillar 1 and must be operationalised with effect from March 31, 2008 by the foreign banks and the Indian banks with operational presence outside India, and from March 31, 2009 by all other commercial banks, excluding the Local Area Banks and Regional Rural banks. 7. The banks are advised to transmit to the RBI (i.e., to the CGM-in-Charge, Department of Banking Supervision, Reserve Bank of India, Central Office, Centre I, World Trade Centre, Cuffe Parade, Colaba, Mumbai – 400 005) a copy of their Board-approved ICAAP document. The document should,  inter alia , include the capital adequacy assessment and projections of capital requirement for the ensuing year, along with the plans and strategies for meeting the capital requirement. An illustrative outline of a format of the ICAAP document is furnished at  Annex – II , for guidance of the banks though the ICAAP documents of the banks could vary in length and format, in tune with their size, level of complexity, risk profile and scope of operations. The first ICAAP document should reach the RBI not later than June 30, 2008 or March 31, 2009, as applicable, and thereafter, before the end of March every year, covering the capital assessment and projections for the following financial year. Yours faithfully, (Prashant Saran) Chief General Manager-in-Charge
Reproduced for reference with acknowledgment — Source: Reserve Bank of India · RBI/2007-2008/266 · issued 26 Mar 2008. The plain-English explanation above is BankPulse’s own independent summary.
🧰 Tools — save, print, templates & related

💬 Banker Discussion

Discuss this circular with fellow bankers — reply, upvote what helps, report what doesn’t belong. Be professional; no client data. Views are the commenter’s own, not BankPulse’s.

Loading comments…
BankPulse Compliance Evidence Pack — generated 05 Aug 2026 · status cross-checked against RBI’s official withdrawal register (refreshed weekly).
Official RBI source: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=4087&Mode=0 — Plain-English summary by BankPulse (bankpulse.ai), reviewed by our expert reviewer, CA Amit Jain. Independent platform, not affiliated with the Reserve Bank of India; is our own plain-English paraphrase, not RBI’s original wording.
Public beta — plain-English informational summaries. Always verify against the official RBI source (circular number cited on every page) before making compliance, credit, treasury, audit, or operational decisions. · Join our WhatsApp channel ↗