The ICARA Process Step by Step: Owners, Timetable and Review
Every MIFIDPRU investment firm has to run an Internal Capital Adequacy and Risk Assessment, and the FCA expects it to be a live process the board understands, not a document a consultant produces once a year. This guide sets out the ICARA as a sequence of practical steps: what each one involves, who usually owns it, when it tends to happen in the year, and where the FCA has found firms falling short.
What the ICARA Is
The Investment Firms Prudential Regime (IFPR) came into force on 1 January 2022 and replaced the old ICAAP for most FCA-authorised MiFID investment firms. Its internal assessment is the ICARA process, set out in chapter 7 of the MIFIDPRU sourcebook. The FCA’s IFPR pages collect the policy statements, newsletters and reporting guidance that sit around it.
Everything in the ICARA serves one rule. The overall financial adequacy rule, MIFIDPRU 7.4.7R, requires a firm at all times to hold own funds and liquid assets that are adequate, in amount and quality, so that it can remain financially viable through the economic cycle while addressing any potential harm from its activities, and so that its business can be wound down in an orderly way that minimises harm to consumers and other market participants.
The ICARA is how the firm shows itself, and the FCA, that it meets that rule. For the board-level view of IFPR as a whole, see our ICARA and IFPR guide for investment firm boards.
The ICARA Process in Seven Steps
MIFIDPRU does not number the steps, but in practice a sound ICARA runs in this order:
- Business model and strategy. Start with what the firm does, how it makes money, where it is going over the planning horizon and what could change.
- Identify and assess potential harms. Work through harms to clients, to markets and to the firm itself, assess the controls, and decide whether extra own funds or liquid assets are needed for what remains.
- Set the own funds threshold requirement. Work out the own funds needed for ongoing operations and for an orderly wind-down.
- Set the liquid assets threshold requirement. Do the same for liquidity, including intra-month and intra-day peaks.
- Stress test. Test capital and liquidity against severe but plausible scenarios that fit the business, and use the results to calibrate thresholds and triggers.
- Recovery and wind-down planning. Set early warning indicators and intervention points, decide what recovery actions are realistic, and build a wind-down plan that would work under stress.
- Document, approve, review and report. Record the process in the ICARA document, have the governing body review and approve it, review it at least annually and on material change, and submit the annual ICARA questionnaire (MIF007).
Own funds and liquid assets thresholds in more detail
The FCA’s September 2025 IFPR newsletter spelled out how the two thresholds are built, because firms were reporting them wrongly. The own funds threshold requirement is the highest of the permanent minimum requirement, the own funds needed to support ongoing operations (no lower than the K-factor requirement), and the own funds needed for an orderly wind-down (no lower than the fixed overheads requirement). The liquid assets threshold requirement is the basic liquid assets requirement plus the higher of the liquid assets needed for ongoing operations and the additional liquid assets needed to start an orderly wind-down.
The point for boards is that both thresholds come out of the harms assessment and the wind-down analysis. A threshold that simply equals the regulatory minimum suggests the earlier steps were not done properly.
Step-by-Step Table: Owners and Typical Timing
Timings below are typical for a firm on an annual cycle; the rules require at least an annual review, not a particular calendar. In smaller firms one person may hold several roles.
| Step | Typical owner | Typical timing | Output |
|---|---|---|---|
| 1. Business model and strategy | CEO and executive team, CFO | Start of cycle, aligned to budget | Business plan and planning horizon |
| 2. Harms assessment | Risk function or CRO, with business heads | Months 1 to 2 | Harms register, control assessment, residual risk |
| 3. Own funds threshold | CFO and finance | Month 2 | Own funds threshold requirement and calculations |
| 4. Liquid assets threshold | CFO and finance, treasury where there is one | Month 2 | Liquidity assessment and threshold |
| 5. Stress testing | Risk function with finance | Months 2 to 3 | Scenarios, results, reverse stress test |
| 6. Recovery and wind-down | CFO and COO, with risk | Months 2 to 3 | Indicators, intervention points, wind-down plan |
| 7. Document and approve | Governing body, drafted by CFO or risk | Month 3 to 4 | Approved ICARA document |
| MIF007 submission | Finance or regulatory reporting | Annually, on the firm’s chosen date | ICARA questionnaire via RegData |
| Ongoing monitoring | CFO and risk, reported to the board | Monthly or quarterly | Threshold and indicator MI |
Documentation: the ICARA Document
MIFIDPRU 7.8 covers reviewing and documenting the ICARA process. The firm must record the outcome in an ICARA document that its governing body reviews and approves. It should show how the firm reached its conclusions, not only the numbers.
The FCA’s concluding report on IFPR implementation noted ICARA documents that lacked a clear summary of what drove the thresholds and which stresses were used, and significant reductions in requirements that were not explained. Write the document so that a supervisor, or a new non-executive, can follow the reasoning without the author in the room.
Timing also matters. The September 2025 newsletter reminded firms, under MIFIDPRU 7.8.8R, that the gap between completing the ICARA and the governing body approving it must be reasonable, because the longer it takes, the more out of date the information becomes.
Review and Reporting
The firm must review its ICARA process at least once every 12 months, and also when there is a material change in its business or operating model. Examples include a new business line, an acquisition, a significant loss or a change in group structure.
Firms also submit the ICARA questionnaire, MIF007, once a year. Each firm chose its own reporting date when IFPR started, and a firm that wants to change it must notify the FCA. The FCA has repeatedly flagged MIF007 quality: its concluding report found contents inconsistent with the ICARA document, annual reports and management information, and data points left blank. The September 2025 newsletter found frequent errors in how firms reported both threshold requirements.
SNI and Non-SNI Firms: What Changes
The ICARA applies to all MIFIDPRU investment firms, including small and non-interconnected (SNI) firms, but it is applied proportionately. An SNI’s own funds requirement is the higher of its permanent minimum requirement and fixed overheads requirement, and its ICARA can be shorter and simpler if its business is simple. It still needs a real harms assessment and a credible wind-down plan.
Non-SNI firms also calculate a K-factor requirement and face fuller governance requirements. The largest non-SNI firms must set up risk, remuneration and nomination committees under MIFIDPRU 7.3. Broadly, a non-SNI firm is in scope if its on- and off-balance sheet assets average £100 million or more over the preceding four years, unless that average is no more than £300 million and its trading book and derivatives business are below £150 million and £100 million respectively. Check the current application rules in MIFIDPRU 7.1 against your own figures. Where there is a risk committee, it should challenge the ICARA before the board approves it. See our guide to SMF10 and SMF11 risk and audit committee chairs.
Common FCA Findings
The FCA published initial observations from its IFPR implementation reviews in February 2023 and a concluding report in November 2023. The weaknesses it found are a practical checklist:
- Harms confined to K-factors: own funds assessments that only covered harms captured by K-factors, without a holistic view of the firm’s harms.
- Intervention points copied from the rules: internal thresholds that simply used MIFIDPRU levels with no link to the firm’s own risks, and uncertainty about what crossing an intervention point actually triggers.
- Wind-down triggered too late: plans that only activated once resources had already fallen below what wind-down needed, with no allowance for further losses while decisions were made.
- Wind-down under normal conditions: plans that assumed a calm market, ignored fire sales and faster client outflows, or had not been updated or tested for years.
- Weak liquidity analysis: monthly or quarterly cashflows that missed intra-day and inter-day peaks, and stresses that did not fit the business.
- Group issues: wind-down resources allocated by proxies such as revenue share, and dependencies on shared services not assessed.
- Operational risk models: group models used without checking fit for the individual firm, errors in inputs, and unjustified diversification benefits.
- Data quality: MIF007 inconsistent with the ICARA, and blank data points.
The FCA’s earlier guidance, FG20/1 on assessing adequate financial resources, is still a useful framework for the harms and wind-down thinking behind these findings.
Scenario: A non-SNI discretionary manager’s ICARA sets its wind-down trigger at the point where own funds reach the regulatory minimum. A new non-executive asks what would happen to a six-month wind-down if markets were falling and clients were leaving at the same time. Nobody has modelled it. The CFO reworks the wind-down plan under stressed conditions, the cost rises, and the intervention points move up so that recovery actions start while there is still room to act.
Who Owns the ICARA
The governing body owns the ICARA and must be able to explain its conclusions. Delegating the drafting is fine; delegating the judgement is not.
Below the board, ownership usually splits like this:
- The CFO builds the thresholds, the liquidity analysis and much of the wind-down cost model, and usually coordinates MIF007. In enhanced SMCR firms this person is approved as SMF2; in core firms the finance director is often an SMF3 executive director. See CFO recruitment (SMF2) and SMF3 explained.
- The CRO or head of risk runs the harms assessment, stress testing and the monitoring of indicators. In enhanced firms this is the SMF4 chief risk function; in smaller firms the risk lead is often a certified employee or the role sits with an executive director. See CRO recruitment (SMF4).
- The COO owns the operational side of wind-down: systems, outsourcing, client transfers and staff retention.
- Compliance contributes the conduct and client harm view and checks consistency with the firm’s wider regulatory obligations.
Our guide to prescribed responsibilities under the SMCR explains how firms allocate these.
The Hiring Angle
An ICARA is only as good as the people running it. The firms that do it well usually have a CFO who understands prudential regulation, not just statutory accounts, and a risk lead who can lead a harms workshop with business heads and then turn it into numbers.
Common gaps are a CFO who has never built a wind-down plan and a smaller firm with no risk function. Firms often bring in interim help when the annual review is due and a key person has left, after a material change such as an acquisition, or when the FCA has raised questions about the last ICARA. A fractional or interim senior manager can carry a cycle while the permanent hire is made. Whether to use an outside specialist or hire in-house is covered in our companion post, ICARA consultant or in-house hire?
We recruit CFOs, CROs and prudential specialists for investment managers and wealth managers. For current pay levels, see our SMF and compliance salary guide.
Prudential and Risk Leadership
The people who run the ICARA. Every search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate
Finance
CFOs who know prudential.
→ CFO recruitment (SMF2) → Executive director (SMF3)Why SMF2 needs a CFO recruiter →
Risk
Risk leads for the harms work.
→ CRO recruitment (SMF4) → Risk committee chairsSMF4 explained →
Investment Firms
MIFIDPRU firms we recruit for.
→ Investment managers → Wealth managementICARA guide for boards →
Interim Cover
Cover for an ICARA cycle.
→ Fractional and interim SMFs → Retained executive searchWhen interim works →
Every SMF Capital search is overseen by Adrian Lawrence FCA
Frequently Asked Questions
How often must the ICARA be reviewed?
At least once every 12 months, and whenever there is a material change in the firm’s business or operating model.
What is MIF007?
The ICARA questionnaire, submitted to the FCA once a year on the reporting date the firm chose. It summarises the ICARA, so its figures should match the approved ICARA document.
Do SNI firms need an ICARA?
Yes. All MIFIDPRU investment firms must run an ICARA process, but it is proportionate, so a simple SNI’s ICARA can be shorter.
Who approves the ICARA?
The governing body. It should review and approve the ICARA document within a reasonable time of the assessment being completed.
Does every firm need a risk committee?
No. Only the largest non-SNI firms that exceed the MIFIDPRU 7.1 thresholds must have risk, remuneration and nomination committees.
About the Author
Adrian Lawrence FCA is the founder of SMF Capital. He is a Chartered Accountant and Fellow of the ICAEW, holds a practising certificate in his own name, and is a former listed-company Finance Director with a BSc from Queen Mary College, University of London. He founded FD Capital in 2018 and has since built a network of five specialist recruitment practices. He oversees every SMF Capital search. View Adrian’s ICAEW profile.
Need Someone to Run Your Next ICARA?
Tell us about your firm, your ICARA timetable and the gap you need to fill. We’ll come back with a plan the same working day.
Adrian Lawrence FCA is the founder of SMF Capital and a Fellow of the Institute of Chartered Accountants in England and Wales and holds an ICAEW practising certificate in his own name. He holds a BSc from Queen Mary College, University of London, and has over 25 years of experience working with boards, investors and business owners across the UK. He founded SMF Capital to help FCA and PRA-regulated firms appoint the Senior Managers the regulators expect, with the fit and proper assessment built into every search, and personally leads every Senior Manager Function search.