Learn how to implement ICARA & SREP in 2025, through practical examples
As regulatory standards continue to evolve across Europe, Cyprus Investment Firms (CIFs) are under growing pressure to prove their risk management capabilities, capital adequacy and operational resilience. These exact notions are encompassed under the Internal Capital Adequacy and Risk Assessment (ICARA) process which was introduced under the EU’s Investment Firms Regulation (IFR) and Investment Firms Directive (IFD) now lying at the cornerstone of CySEC’s supervisory focus. ICARA is not just a technical reporting requirement but rather a strategic compliance framework which requires Investment Firms to identify material risks, assess their capital and liquidity needs under both normal and stressed conditions. CySEC guidelines make it clear that regulators will evaluate and assess not only the robustness of the framework but how deeply the process is embedded within the firm’s governance, decision-making, and strategic planning.
In this article, the SALVUS Regulatory Compliance team shall explore practical steps and key considerations for implementing ICARA and SREP effectively within the CySEC regulatory landscape in 2025. In particular the following outline shall be utilized:
1. Introductory Provisions: ICARA, ICAAP and ILAAP.
2. CySEC Circular C600 and the Joint EBA & ESMA Guidelines on common procedure and methodologies for SREP.
3. ICARA Report- Internal Governance.
4. Investment Firms Regulation and Directive (IFR &IFD) on Capital Requirements.
5. ICARA report- Risk Management Framework, Practical examples: Stress Testing & Capital Planning.
We regularly share bite-sized insights on LinkedIn such as those found in this article
1. Introductory Provisions: ICARA, ICAAP and ILAAP
The Internal Capital Adequacy and Risk Assessment (ICARA) is the cornerstone of the prudential framework under the Investment Firms Regulation (IFR) and Directive (IFD). It integrates the former ICAAP (capital adequacy) and ILAAP (liquidity adequacy) into a unified process.
ICARA ensures that each Cyprus Investment Firm (CIF) maintains sufficient capital and liquidity in proportion to its size, activities, and risk profile. It combines quantitative capital planning with qualitative governance assessment, emphasizing continuous risk identification, monitoring, and mitigation.
2. CySEC Circular C600 and the Joint EBA & ESMA Guidelines on SREP
CySEC Circular C600 adopts the EBA/ESMA Joint Guidelines (EBA/GL/2022/09; ESMA35-36-2621) on the Supervisory Review and Evaluation Process (SREP). This framework standardizes supervisory assessment across the EU and ensures consistent evaluation of investment firms’ governance, capital, and liquidity adequacy.
The SREP follows a proportional approach, analyzing firms’ business models, risk management systems, and internal controls. It establishes nine assessment components, including categorization, governance review, and capital and liquidity adequacy evaluations.
Through this process, CySEC forms an overall SREP score, guiding supervisory actions such as additional capital buffers or governance improvements. The Circular reinforces the importance of integrating ICARA outcomes into regulatory dialogue and strategic decision-making.
3. ICARA Report – Internal Governance
Effective internal governance is central to ICARA. Firms must establish clear organizational structures, independent control functions, and transparent decision-making processes under the three lines of defense model.
The Board of Directors (BoD) bears the ultimate responsibility for setting up the firm’s risk appetite, approving capital strategies, and overseeing compliance and internal audit functions. The Risk Management, Compliance, and Internal Audit functions operate independently but collaboratively to ensure sound oversight and adherence to CySEC’s principles of proportionality, independence, and accountability.
Regular review and BoD approval of the ICARA report ensures that governance remains dynamic and responsive to potential emerging risks.
4. Investment Firms Regulation and Directive (IFR & IFD) on Capital Requirements
The IFR/IFD framework modernizes prudential supervision for investment firms, replacing the banking-based Basel approach with a more proportionate, activity-driven model.
Firms are classified from Class 1A (systemically important) to Class 3 (small, non-interconnected), with capital requirements determined by K-Factors that measure risks to clients (RtC), markets (RtM), and firms (RtF).
Own funds must meet the higher of the initial capital, fixed overheads, or K-factor requirements, ensuring adequate buffers against business-specific exposures. This system better reflects the actual operational risks of investment firms while maintaining regulatory flexibility and proportionality.
5. ICARA Report – Risk Management Framework, Stress Testing & Capital Planning
The Risk Management Framework forms the operational core of ICARA, guiding the identification, assessment, and mitigation of all material risks. Firms must document risks within a Risk Register, evaluating their likelihood, potential impact, and residual exposure after controls.
Stress testing enhances resilience by simulating adverse but plausible events using sensitivity, scenario, and reverse stress analyses. The results inform the capital planning process, ensuring firms maintain sufficient own funds to absorb losses and sustain operations under stress.
Through this integration of governance, risk assessment, and capital adequacy, ICARA transforms regulatory compliance into a proactive tool for long-term financial stability and strategic planning.
Final Thoughts
The ICARA and SREP frameworks are central to CySEC’s mission of fostering financial stability and market integrity. As regulatory scrutiny intensifies in 2025, CIFs must embrace ICARA as a strategic asset, not just as a regulatory obligation. By embedding robust governance, stress testing, and forward-looking capital planning into the ICARA process, CIFs not only meet CySEC’s compliance expectations but also place themselves for sustainable growth and operational resilience.
The SALVUS Regulatory Compliance team , our team is dedicated to helping investment and financial institutions meet regulatory requirements while smoothly transitioning toward a more risk-based approach. We support the development and enhancement of policies and procedures, ensuring business continuity. Using a structured project management approach, we consistently deliver high-quality outcomes.
On that account, SALVUS Funds in cooperation with the Institute for Professional Excellence (IforPE) has designed a self-study, self-paced course titled ‘Learn how to implement ICARA & SREP through practical examples in 2025’. The course is suited and recommended for Continuous Professional Development (CPD) units for Compliance officers, Brokerage and Dealing on Own Account officers. Furthermore, the course can be of significant value for members of the Board of Directors, responsible for the review and approval of the ICARA report.
Contact us at compliance@salvusfunds.com if you require support with your ICARA regulatory requirements and reporting obligations or if you have any questions about our titled ‘Learn how to implement ICARA & SREP through practical examples in 2025’ course with IforPE.
#StayAhead
The information provided in this article is for general information purposes only. You should always seek professional advice suitable for your needs.