Pillar 2 Supervisory Review and Pillar 3 Market Discipline - Article

Introduction

Minimum regulatory capital alone cannot ensure that every bank is adequately protected against every risk.

Two banks may have the same Pillar 1 capital ratio but very different:

• concentration risks;

• interest-rate risks;

• liquidity profiles;

• business strategies;

• risk-management quality; and

• vulnerability under stress.

Basel therefore supplements minimum capital requirements with:

• Pillar 2 – Supervisory Review Process

• Pillar 3 – Market Discipline

The current IIBF CAIIB BFM Module B expressly includes Pillar 2 – Supervisory Review Process and Pillar 3 – Market Discipline under Risk Regulations in Banking Industry. The syllabus also covers ICAAP in greater detail, including risk appetite, stress testing, capital planning, proportionality, Board/RBI reporting and independent review.

The relationship can be understood simply:

Pillar 1 calculates minimum capital. Pillar 2 asks whether that capital is really adequate for the bank’s complete risk profile. Pillar 3 makes important risk and capital information visible to the market.

Learning Objectives

After studying this topic, you should be able to:

• explain the purpose of Pillar 2 and Pillar 3;

• understand ICAAP and supervisory review;

• identify risks that may require Pillar 2 attention;

• explain the four key Pillar 2 principles;

• understand how disclosures create market discipline; and

• distinguish ICAAP, supervisory review and Pillar 3 disclosure.

Why Pillar 2 Is Needed

Pillar 1 establishes minimum regulatory capital for prescribed risks.

However, no standardised capital formula can perfectly capture:

• every risk;

• every concentration;

• every business model;

• every control weakness; or

• every future stress situation.

The current Basel supervisory-review standard states that Pillar 2 helps ensure that banks maintain adequate capital and liquidity for all risks in their business, especially risks not fully captured through Pillar 1, while encouraging sound risk management. The current Basel SRP standard is effective from 1 January 2026.

ICAAP – Bank’s Pillar 2 Process

A central Pillar 2 concept is ICAAP – Internal Capital Adequacy Assessment Process.

ICAAP is the bank’s own process for determining whether its capital position is adequate for:

• its risk profile;

• business strategy;

• future growth;

• stress conditions; and

• material risks not sufficiently captured through Pillar 1.

The current IIBF syllabus specifically includes:

• ICAAP principles;

• risk appetite;

• actual and target risk structure;

• risk identification, measurement, monitoring and reporting;

• internal control;

• submission to the Board and RBI;

• proportionality;

• independent review;

• forward-looking assessment;

• stress tests and scenario analysis;

• material-risk identification; and

• capital planning and allocation.

ICAAP Is More than a Regulatory Document

ICAAP should not be prepared only to satisfy RBI.

It should influence real management decisions.

RBI’s ICAAP guidance explains that ICAAP should form an integral part of the bank’s management and decision-making culture and may influence:

• allocation of capital to businesses;

• credit decisions;

• product pricing;

• expansion plans;

• budgets; and

• ongoing assessment of material risks.

Therefore:

ICAAP connects Risk → Strategy → Capital → Management Action.

Main Elements of a Sound ICAAP

1. Board and Senior Management Oversight

The Board is ultimately responsible for ensuring that the bank has an appropriate capital-assessment process.

Senior management must translate the Board-approved:

• business strategy;

• risk appetite;

• limits; and

• capital objectives

into operational risk-management practices.

2. Comprehensive Risk Identification

ICAAP should consider all material risks, not only risks already measured under Pillar 1.

The bank must ask:

“What could materially damage our capital or financial position?”

3. Risk Measurement and Assessment

The bank needs appropriate methods to assess the size and importance of its risks.

Not every risk can be measured precisely in rupees.

Some risks may require:

• quantitative measurement;

• qualitative assessment;

• scenario analysis; or

• management judgement.

4. Capital Assessment

The bank determines whether available capital is sufficient relative to its total material risk profile.

This assessment can produce an internal capital target above the regulatory minimum.

5. Monitoring and Reporting

Risk and capital positions must be regularly reported to:

• senior management;

• risk committees; and

• the Board.

6. Internal Control and Independent Review

ICAAP itself must be subject to effective controls and periodic independent review.

RBI expects the Board to assess at least annually whether ICAAP processes are successfully meeting their intended objectives.

Principle of Proportionality

ICAAP should reflect the nature of the bank.

A small bank with simple activities does not necessarily need the same level of modelling complexity as a large internationally active bank with:

• derivatives;

• multiple overseas operations;

• complex trading portfolios; and

• sophisticated products.

RBI’s ICAAP guidance applies the principle of proportionality: the sophistication of risk measurement and management should be commensurate with the nature, scope, scale and complexity of the bank’s operations.

ICAAP Must Be Forward-Looking

Capital adequacy cannot be assessed only from today’s balance sheet.

Management must consider what could happen if:

• borrowers deteriorate;

• interest rates move sharply;

• deposit outflows increase;

• markets become illiquid;

• operational losses occur; or

• business expands rapidly.

Therefore, ICAAP includes:

• capital forecasting;

• stress testing;

• scenario analysis; and

• assessment of future business plans.

The current Basel framework likewise requires rigorous forward-looking stress testing as part of a sound capital-adequacy assessment process.

Stress Testing within ICAAP

Stress testing asks:

What happens to capital if severe but plausible adverse events occur?

It helps management identify:

• vulnerabilities;

• possible capital shortfalls;

• concentration problems;

• liquidity pressure; and

• actions required during stress.

A bank that comfortably meets regulatory capital today may fail its internal stress scenarios.

That is exactly why Pillar 2 is required.

Risks beyond Pillar 1

Pillar 2 becomes particularly important for risks that are:

• not captured;

• only partly captured; or

• inadequately captured

under Pillar 1.

Depending on the bank, these may include:

• concentration risk;

• residual credit risk;

• Interest Rate Risk in the Banking Book;

• strategic risk;

• reputational effects;

• weaknesses arising from risk-management systems;

• liquidity-related vulnerabilities; and

• other material bank-specific risks.

A current Basel example is Interest Rate Risk in the Banking Book (IRRBB). The Basel Framework treats IRRBB under Pillar 2 because of its heterogeneous nature; revised IRRBB provisions became effective on 1 January 2026.

Four Key Principles of Pillar 2

The Basel Committee sets out four important supervisory-review principles.

Principle 1 – Bank Must Assess Its Own Capital Adequacy

The bank should have a process for assessing its overall capital adequacy relative to its risk profile and a strategy for maintaining appropriate capital.

This is the foundation of ICAAP.

Principle 2 – Supervisor Reviews the Bank’s Assessment

The supervisor evaluates:

• the bank’s internal capital assessment;

• capital strategy;

• monitoring arrangements; and

• compliance with regulatory capital requirements.

If the supervisor is not satisfied, appropriate supervisory action can be taken.

Principle 3 – Capital above the Regulatory Minimum May Be Necessary

The minimum regulatory ratio is a floor, not necessarily the correct capital target for every institution.

The supervisor should be able to require a bank to hold capital above the minimum where its risk profile justifies it.

Principle 4 – Early Intervention

Supervisors should intervene before capital deterioration becomes critical and require prompt corrective measures where necessary.

Pillar 2: ICAAP vs Supervisory Review

These two sides must not be confused.

A useful CAIIB distinction is:

ICAAP belongs to the bank. Supervisory review belongs to the regulator.

Pillar 3 – Market Discipline

Pillar 3 addresses a different question.

Even if:

• the bank calculates capital correctly; and

• the supervisor reviews the bank,

market participants also need reliable information to evaluate the institution.

Pillar 3 therefore promotes market discipline through regulatory disclosures.

The current Basel disclosure standard, effective from 1 January 2026, aims to give market participants key information relating to a bank’s regulatory capital and risk exposures, improve transparency and make risk profiles more comparable.

How Market Discipline Works

Suppose two banks report similar profits.

Further disclosure shows:

Bank A

• strong capital;

• controlled risk concentration;

• stable liquidity; and

• sound risk-management systems.

Bank B

• weaker capital;

• higher leverage;

• concentrated exposures; and

• significant emerging risks.

Investors and counterparties can react differently to the two banks.

They may:

• demand a higher return;

• reduce exposures;

• change investment decisions; or

• question management strategy.

This creates market pressure for better risk management.

What Pillar 3 Disclosures Cover

Pillar 3 can contain information concerning areas such as:

• regulatory capital;

• Risk-Weighted Assets;

• credit risk;

• counterparty credit risk;

• market risk;

• operational risk;

• leverage;

• liquidity;

• securitisation;

• risk-management practices; and

• other prescribed prudential metrics.

The current consolidated Basel disclosure standard includes dedicated disclosure chapters covering these major areas.

Five Principles of High-Quality Basel Disclosure

The current Basel Pillar 3 framework identifies five guiding principles.

Disclosures should be:

1. Clear

2. Comprehensive

3. Meaningful to users

4. Consistent over time

5. Comparable across banks

These principles are intended to help users understand both a bank’s risks and how those risks are managed.

Materiality

Pillar 3 does not mean publishing unlimited information.

Materiality asks:

Could omission or misstatement of this information influence the decision of a user?

RBI’s disclosure framework similarly uses a user-based materiality concept when determining relevant disclosure.

Proprietary and Confidential Information

Banks sometimes hold information that:

• gives them a competitive advantage; or

• is legally confidential.

Pillar 3 recognises that disclosure requirements must balance:

• transparency; and

• protection of genuinely proprietary or confidential information.

The current Basel framework permits limited exceptions where disclosure would reveal proprietary/confidential information or conflict with legal obligations, while requiring appropriate general disclosure and explanation.

Validation and Internal Controls

Pillar 3 is not simply a marketing publication.

Basel requires Pillar 3 information to be subject to internal review and control processes. Banks should also have a formal Board-approved disclosure policy.

This supports:

• accuracy;

• consistency;

• responsibility; and

• credibility of disclosure.

Pillar 3 vs Accounting Disclosure

Pillar 3 disclosure and financial statements overlap in some areas but are not identical.

Financial Statements

Primarily show:

• financial position;

• profit and loss;

• accounting assets and liabilities; and

• other accounting disclosures.

Pillar 3

Focuses on the bank’s prudential regulatory position, including:

• regulatory capital;

• RWA;

• specific risk exposures;

• leverage;

• liquidity; and

• regulatory risk-management information.

Therefore:

Pillar 3 complements accounting disclosure; it does not simply duplicate the financial statements.

Pillar 2 vs Pillar 3

Current RBI Position and CAIIB Exam Cut-Off

RBI consolidated the commercial-bank capital framework through the Commercial Banks – Prudential Norms on Capital Adequacy Directions, 2025. In addition, RBI issued the Seventh Amendment Directions, 2026 on 30 July 2026 to update Basel Pillar 3 disclosure requirements and improve alignment with the Basel framework.

However, IIBF states that for examinations conducted from September to February, regulatory guidelines and important developments are considered only up to 30 June for question-paper inclusion. Therefore, the July 2026 Pillar 3 amendment is important for the current regulatory position, but it falls after the published cut-off applicable to the December 2026 examination cycle.

Practical Banking Application

Consider a bank that currently satisfies Pillar 1 capital requirements.

However, management finds that:

• 35% of the corporate portfolio is concentrated in one sector;

• deposit funding is becoming concentrated;

• interest-rate shocks materially reduce economic value;

• planned loan growth will sharply increase RWA; and

• stress tests show capital pressure.

Pillar 1

The bank may still technically satisfy prescribed minimum capital ratios.

Pillar 2

ICAAP should capture:

• concentration risk;

• IRRBB;

• funding vulnerability;

• future capital requirements; and

• stress losses.

Management may decide to:

• raise capital;

• slow asset growth;

• diversify exposures;

• strengthen risk limits; or

• reduce vulnerable positions.

RBI can independently assess the bank and require appropriate corrective measures where necessary.

Pillar 3

Prescribed disclosures provide market participants with information about relevant:

• capital;

• risk;

• RWA; and

• prudential metrics.

The example shows why all three Basel pillars are complementary.

CAIIB Exam Focus

Remember these high-value concepts:

• Pillar 2 is the Supervisory Review Process.

• ICAAP is the bank’s internal capital-adequacy process.

• ICAAP should cover all material risks, including those not fully captured under Pillar 1.

• ICAAP should be Board-driven and integrated with management decisions.

• ICAAP follows the principle of proportionality.

• ICAAP should be forward-looking.

• Stress testing and scenario analysis are important ICAAP elements.

• Pillar 2 permits capital expectations above the regulatory minimum.

• Early intervention is a key supervisory principle.

• IRRBB is an important current Basel Pillar 2 risk.

• Pillar 3 means Market Discipline.

• Pillar 3 works mainly through regulatory disclosure.

• Pillar 3 complements Pillars 1 and 2.

• Pillar 3 disclosure should be clear, comprehensive, meaningful, consistent and comparable.

• Materiality affects what information is important for disclosure.

• Proprietary and confidential information receives limited special treatment.

• Pillar 3 is not identical to normal accounting disclosure.

• ICAAP is performed by the bank; supervisory review is performed by RBI.

• Current RBI Pillar 3 requirements were further updated in July 2026, but that development falls after the published 30 June cut-off for the September-February IIBF exam cycle.

Common Exam Traps

Trap 1: “Pillar 2 Is Another Formula for Calculating RWA”

Incorrect.

Pillar 2 is a supervisory and internal capital-assessment process, not another Pillar 1 RWA formula.

Trap 2: “ICAAP Is Prepared by RBI”

Incorrect.

ICAAP is prepared by the bank. RBI performs supervisory review.

Trap 3: “Meeting Pillar 1 Minimum Means No Additional Capital Can Be Required”

Incorrect.

Pillar 2 allows supervisors to expect or require capital above the regulatory minimum where the bank’s risk profile warrants it.

Trap 4: “ICAAP Looks Only at Credit, Market and Operational Risk”

Incorrect.

ICAAP should consider the complete set of material risks relevant to the bank.

Trap 5: “ICAAP Is Only a Once-a-Year Compliance Report”

Incorrect.

It should be an ongoing, forward-looking process integrated with management and decision-making.

Trap 6: “Pillar 3 Means RBI Inspection”

Incorrect.

Pillar 3 concerns market discipline through disclosure.

Trap 7: “Pillar 3 and Financial Statements Are the Same”

Incorrect.

Pillar 3 focuses on prudential regulatory information and complements accounting reporting.

Trap 8: “Every Current September 2026 Regulatory Change Is Automatically Examinable in December 2026”

Incorrect.

IIBF’s published cut-off for examinations from September through February is 30 June.

Memory Technique

Remember 2 = A-S-A:

• A – Assess: Bank assesses risk and capital through ICAAP.

• S – Supervise: RBI reviews the bank.

• A – Act: Corrective action or additional capital where required.

Remember 3 = D-M:

• D – Disclose

• M – Market Discipline

So:

Pillar 2 = Assessment and SupervisionPillar 3 = Disclosure and Market Discipline