Pillar 2 Guidelines: Supervisory Review & ICAAP for Banks
No longer current — withdrawn, no replacement on file yet
Source: Reserve Bank of India · RBI/2007-2008/266 · issued 26 Mar 2008 · ~2 min read
Quick answerRBI issued Pillar 2 guidelines under Basel II, requiring banks to have a Board-approved ICAAP policy. Banks must assess capital for risks not fully captured under Pillar 1, such as interest rate risk in banking book, concentration risk, and liquidity risk, and maintain adequate capital cushions.
What changed
RBI provided detailed guidance on the Supervisory Review Process (SRP) and Internal Capital Adequacy Assessment Process (ICAAP) under the New Capital Adequacy Framework. Banks are now required to assess capital adequacy for risks beyond the three Pillar 1 risks (credit, market, operational), including interest rate risk in banking book, credit concentration risk, liquidity risk, and others. An illustrative ICAAP document format was also furnished.
What it means for you
Banks must go beyond regulatory minimum capital ratios and conduct their own comprehensive risk assessments. This ensures they hold adequate capital for all material risks, including those not fully captured or omitted by Pillar 1. It encourages better risk management practices and a proactive dialogue with RBI, potentially leading to capital augmentation or risk reduction interventions.
Historical instruction — do not use for current compliance. This is what was required at the time; it no longer reflects current RBI requirements. If no replacement rule is linked above, that only means none is recorded on our register yet — it does not prove no later applicable rule exists. Confirm on the official RBI source below.
What banks were required to do at the time
Ensure your bank has a Board-approved ICAAP policy in place as required by earlier circulars.
Conduct a thorough internal capital adequacy assessment covering all risks listed, including interest rate risk in banking book, concentration risk, liquidity risk, and others.
Prepare the ICAAP document as per the illustrative format provided in Annex II and maintain it for supervisory review.
Engage in active dialogue with RBI supervisors to demonstrate capital adequacy and risk management processes.
Who it affects
All commercial banks (excluding Local Area Banks and Regional Rural Banks), Risk management departments, Board of Directors and senior management, Compliance and internal audit teams
❓ Common questions
Regulatory timeline
Decoded by BankPulse2026-06-19 14:24 IST
repealed_by — Consolidation of Regulations — Withdrawal of circulars (28 Nov 2025)
Status change: withdrawn05 Aug 2026, 04:00 IST
Built from our lineage records — each fact carries its provenance; missing history simply is not shown (never guessed).
What is the purpose of the Supervisory Review Process (SRP)?
The SRP ensures banks have adequate capital to support all business risks and encourages better risk management techniques. It involves a well-defined internal assessment process (ICAAP) and active dialogue with RBI to allow timely intervention if needed.
Which risks must banks assess under ICAAP that are not fully covered by Pillar 1?
Banks must assess risks like interest rate risk in the banking book, credit concentration risk, liquidity risk, settlement risk, reputational risk, strategic risk, model risk, and residual risk of securitization, among others.
Is there a single prescribed approach for conducting ICAAP?
No, RBI recognizes that no single approach exists and best practices are still evolving. The guidelines provide broad principles, and banks can develop their own methodologies, especially for non-quantifiable risks like reputational and strategic risks.
📜 This document’s life story (1 recorded event, each backed by RBI’s own words)
Repealed byRBI/2025-26/100 — Consolidation of Regulations — Withdrawal of circulars (28 Nov 2025)
RBI’s words: “Official withdrawal register entry #2280: DBOD.No.BP.BC.66/21.06.001/2007-08 — "Supervisory Review Process Under the New Capital Adequacy Framework - Guidelines for Pillar 2" dated March 26, 2008”
📜 Read the original circular — full text as issued by RBI
RBI/2007-2008/266
DBOD.No.BP.BC 66 / 21.06.001 / 2007-08
March 26, 2008
The Chairman/ Chief Executive Officer
All Commercial banks
(Excluding Local Area Banks and Regional Rural banks)
Dear Sir,
Supervisory Review Process under the New Capital Adequacy Framework –Guidelines for Pillar 2
The New Capital Adequacy Framework (NCAF), based on the Basel II Framework evolved by the Basel Committee on Banking Supervision, has been adapted for India vide our Circular DBOD.No.BP.BC 90/ 20.06.001/ 2006-07 dated April 27, 2007. In this regard, a reference is also invited to paragraph 2.4 (iii)(c) of the Annex to the aforesaid circular in terms of which the banks are required to have a Board-approved policy on ICAAP and to assess the capital requirement as per ICAAP. We presume that the banks would have formulated the policy and also undertaken the capital adequacy assessment accordingly. These guidelines are being issued by way of further guidance to the banks.
2. The Basel II Framework has three components or three Pillars. The Pillar 1 is the Minimum Capital Ratio while the Pillar 2 and Pillar 3 are the Supervisory Review Process (SRP) and Market Discipline, respectively. While the guidelines on the Pillar 1 and Pillar 3 have already been issued by the RBI vide the aforesaid circular, the guidelines in regard to the SRP and the Internal Capital Adequacy Assessment Process (ICAAP) are furnished at Annex - I . An illustrative outline of the format of the ICAAP document is furnished at Annex – II .
3. The objective of the SRP is to ensure that the banks have adequate capital to support all the risks in their business as also to encourage them to develop and use better risk management techniques for monitoring and managing their risks. This in turn would require a well-defined internal assessment process within the banks through which they assure the RBI that adequate capital is indeed held towards the various risks to which they are exposed. The process of assurance could also involve an active dialogue between the bank and the RBI so that, when warranted, appropriate intervention could be made to either reduce the risk exposure of the bank or augment / restore its capital. Thus, ICAAP is an important component of the SRP.
4. The main aspects to be addressed under the SRP, and therefore, under the ICAAP, would include:
(a) the risks that are not fully captured by the minimum capital ratio prescribed under Pillar 1;
(b) the risks that are not at all taken into account by the Pillar 1; and
(c) the factors external to the bank.
Since the capital adequacy ratio prescribed by the RBI under the Pillar 1 of the Framework is only the regulatory minimum level, addressing only the three specified risks (viz., credit, market and operational risks), holding additional capital might be necessary for the banks, on account of both – the possibility of some under-estimation of risks under the Pillar 1 and the actual risk exposure of a bank vis-à-vis the quality of its risk management architecture. Illustratively , some of the risks that the banks are generally exposed to but which are not captured or not fully captured in the regulatory CRAR would include:
(a) Interest rate risk in the banking book;
(b) Credit concentration risk;
(c) Liquidity risk;
(d) Settlement risk;
(e) Reputational risk;
(f) Strategic risk;
(g) Risk of under-estimation of credit risk under the Standardised approach;
(h) "Model risk" i.e., the risk of under-estimation of credit risk under the IRB approaches;
(i) Risk of weakness in the credit-risk mitigants;
(j) Residual risk of securitisation, etc.
It is, therefore, only appropriate that the banks make their own assessment of their various risk exposures, through a well-defined internal process, and maintain an adequate capital cushion for such risks.
5. It is recognised that there is no one single approach for conducting the ICAAP and the market consensus in regard to the best practice for undertaking ICAAP is yet to emerge. The methodologies and techniques are still evolving particularly in regard to measurement of non-quantifiable risks, such as reputational and strategic risks. These guidelines, therefore, seek to provide only broad principles to be followed by the banks in developing their ICAAP.
6. The banks are advised to develop and put in place, with the approval of their Boards, an ICAAP commensurate with their size, level of complexity, risk profile and scope of operations. The ICAAP would be in addition to a bank’s calculation of regulatory capital requirements under Pillar 1 and must be operationalised with effect from March 31, 2008 by the foreign banks and the Indian banks with operational presence outside India, and from March 31, 2009 by all other commercial banks, excluding the Local Area Banks and Regional Rural banks.
7. The banks are advised to transmit to the RBI (i.e., to the CGM-in-Charge, Department of Banking Supervision, Reserve Bank of India, Central Office, Centre I, World Trade Centre, Cuffe Parade, Colaba, Mumbai – 400 005) a copy of their Board-approved ICAAP document. The document should, inter alia , include the capital adequacy assessment and projections of capital requirement for the ensuing year, along with the plans and strategies for meeting the capital requirement. An illustrative outline of a format of the ICAAP document is furnished at Annex – II , for guidance of the banks though the ICAAP documents of the banks could vary in length and format, in tune with their size, level of complexity, risk profile and scope of operations. The first ICAAP document should reach the RBI not later than June 30, 2008 or March 31, 2009, as applicable, and thereafter, before the end of March every year, covering the capital assessment and projections for the following financial year.
Yours faithfully,
(Prashant Saran)
Chief General Manager-in-Charge
Reproduced for reference with acknowledgment — Source: Reserve Bank of India · RBI/2007-2008/266 · issued 26 Mar 2008. The plain-English explanation above is BankPulse’s own independent summary.
Discuss this circular with fellow bankers — reply, upvote what helps, report what doesn’t belong. Be professional; no client data. Views are the commenter’s own, not BankPulse’s.
BankPulse Compliance Evidence Pack — generated 05 Aug 2026 · status cross-checked against RBI’s official withdrawal register (refreshed weekly). Official RBI source: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=4087&Mode=0 — Plain-English summary by BankPulse (bankpulse.ai), reviewed by our expert reviewer, CA Amit Jain. Independent platform, not affiliated with the Reserve Bank of India; is our own plain-English paraphrase, not RBI’s original wording.
Help us keep this accurate
Found an inaccuracy or have an improvement? Tell us. Every report is reviewed by our team before any change is made — nothing goes live unverified.
Public beta — plain-English informational summaries. Always verify against the official RBI source (circular number cited on every page) before making compliance, credit, treasury, audit, or operational decisions. · Join our WhatsApp channel ↗
BANKPULSE · FREE DAILY BRIEF
Get RBI updates for your role
Every important RBI update, decoded in plain English — for your career, exams & financial awareness.
We collect only your email, name and role, used solely to send your brief — never sold or shared. Withdraw anytime via the unsubscribe link in any email. Independent platform, not affiliated with the RBI. Information, not legal advice.
REPORT AN ERROR · BETA
Spotted an error? Earn 500 BankPulse Credits
Help us stay accurate. If your correction is verified true and approved by our founder, you earn 500 BankPulse Credits — redeemable when the platform monetises.
Reviewed by a human before any credit is awarded. We never change the site from crowd input without verification.
WANT A NEW FEATURE · BETA
What would make BankPulse more useful for you?
Tell us what to build next — a tool, a data view, a role page, anything. We read every suggestion.
Thank you — your ideas directly shape what we build.