MFSA Review of ICAAP and Stress Testing: Key Considerations for Malta’s Credit Institutions

The review forms part of the MFSA’s Compliance Outcomes-Based Supervision approach and follows its recent thematic work on the Internal Liquidity Adequacy Assessment Process (ILAAP). Together, these reviews signal continued supervisory attention to how effectively credit institutions assess and manage their capital and liquidity resilience.

While the MFSA found that institutions had established the foundations of their ICAAP and stress-testing frameworks, its assessment identified a recurring theme: institutions generally assessed themselves as being more compliant than the MFSA’s own review indicated.

This is an important message for credit institutions. Having a framework in place is not, on its own, sufficient. Institutions need to be able to demonstrate that their arrangements are appropriately documented, subject to effective challenge and, importantly, used in practice to support risk management and decision-making.
 

From a regulatory requirement to practical risk management tool

A central theme emerging from the MFSA’s review is the need for stress testing to move beyond being viewed primarily as an annual regulatory exercise.

The Authority expects stress testing to provide a forward-looking view of an institution’s resilience and to influence capital planning, risk appetite, strategic decisions and management actions. This means that the value of a stress testing framework should not be measured solely by whether the required exercise has been completed, but also by how its results are used.

The MFSA identified instances where stress testing results were reported to management and governance bodies, but there was limited evidence of how those results had actually influenced decisions. Similarly, management actions identified under stressed scenarios were not always sufficiently assessed for their feasibility, timing and effectiveness under adverse conditions.

For institutions, this raises a practical question: if a stress test identifies a vulnerability, what changes as a result?
 

Governance and effective challenge remain important

The MFSA also highlighted the importance of effective governance around ICAAP and stress testing.

While Board approval was generally evident, documentation did not always demonstrate active Board challenge of assumptions, methodologies, scenarios and results. Institutions should therefore consider not only whether stress testing is presented to the Board, but also whether there is sufficient evidence of meaningful discussion, challenge and follow-up.

The review also identified opportunities to strengthen the definition of responsibilities across the Three Lines Model and the independent assurance provided by Internal Audit. Although Internal Audit reviews of ICAAP were generally being undertaken, their scope did not always extend sufficiently to cover the end-to-end stress-testing framework.

This suggests that institutions may benefit from reconsidering whether their assurance arrangements adequately cover the design, governance, implementation and ongoing effectiveness of stress testing, rather than focusing predominantly on the ICAAP document itself.
 

Stress scenarios should reflect the institution

Another significant finding relates to the design and calibration of stress scenarios.

The MFSA observed reliance on broad macroeconomic or externally prescribed scenarios. While these provide useful benchmarks, institutions are expected to consider vulnerabilities specific to their own business models and risk profiles.

These may include concentrations in particular sectors, geographic regions, customer segments or counterparties, as well as operational, cyber, funding, market and emerging risks.

The underlying principle is straightforward: stress testing should address the risks that matter most to the particular institution. Proportionality can influence the complexity of the methodology, but should not result in material risks being excluded.

The MFSA also highlighted the need to consider risk interdependencies, solvency-liquidity interactions and emerging risks, including environmental and climate-related risks.
 

Reverse stress testing requires further attention

Reverse stress testing emerged as one of the less mature areas identified during the review.

Rather than starting with an adverse scenario and assessing its impact, reverse stress testing considers the conditions that could make an institution’s business model unviable or threaten its continued operation.

The MFSA identified cases where reverse stress testing was limited or insufficiently integrated with capital planning and recovery planning. Institutions should be able to identify credible failure or near-failure scenarios, understand the interaction between different risk drivers and demonstrate how the results influence their wider risk management framework.

This is an area where institutions may wish to critically reassess whether their existing approach genuinely identifies their potential breaking points or simply fulfils a procedural requirement.
 

What should credit institutions consider next?

Although the MFSA’s assessment covered a selected sample of LSIs, the supervisory expectations communicated through the Dear CEO Letter apply more broadly to credit institutions operating under Malta’s Banking Act.

Institutions should therefore consider benchmarking their existing ICAAP and stress testing arrangements against the MFSA’s findings, with particular attention to whether:

• governance and Board challenge are adequately evidenced;

• stress testing captures all material and institution-specific risks;

• scenarios are sufficiently severe, forward-looking and appropriately calibrated;

• reverse stress testing is meaningful and linked to recovery planning;

• management actions under stress are credible and feasible;

• stress testing outcomes influence risk appetite, capital planning and strategic decisions; and

• Internal Audit provides sufficiently comprehensive assurance over the stress-testing framework.

The broader supervisory message is clear: the focus is increasingly on demonstrating outcomes rather than simply showing that processes exist.

For Malta’s credit institutions, this provides an opportunity to assess whether ICAAP and stress testing are genuinely embedded within the organisation and contribute to better decisions, stronger capital planning and greater resilience.

The MFSA has indicated that it will continue to monitor progress in this area, with the next thematic review expected in 2027. Institutions therefore have an opportunity to identify and address weaknesses before those arrangements are tested again through supervisory scrutiny.

Institutions therefore have an opportunity to identify and address weaknesses before those arrangements are tested again through supervisory scrutiny.
 

How BDO Malta can help you?

BDO Malta can support credit institutions in assessing and strengthening their ICAAP and stress-testing arrangements in line with supervisory expectations.

Our support can include:

• reviewing ICAAP and stress-testing frameworks against the MFSA’s findings;

• assessing governance arrangements, Board oversight and the effectiveness of challenge;

• evaluating the design, severity and calibration of stress scenarios;

• reviewing reverse stress-testing methodologies and their links to capital and recovery planning;

• assessing whether management actions are credible and feasible under stressed conditions;

• reviewing how stress-testing outcomes inform risk appetite, capital planning and strategic decision-making; and

• providing independent assurance over the design and effectiveness of the overall framework, subject to applicable independence requirements.

By identifying gaps and areas for improvement, BDO Malta can help institutions develop an approach that meets regulatory expectations while supporting stronger risk management, capital planning and organisational resilience.

To discuss how your institution can strengthen its ICAAP and stress-testing arrangements, get in touch with our team.