Basel II's structure is built upon three pillars. Under Pillar 1, minimum capital requirements are calculated based on explicit calculation rules in respect of credit, market and operational risks. However, in Pillar 2, other risks are to be identified and risk management processes and mitigation assessed from a wider perspective, to supplement the capital requirements calculated within the scope of Pillar 1. Pillar 2 involves a proactive assessment of unexpected losses and a methodology to set aside sufficient capital. Effectively, Pillar 2 is the creation of a wider, flexible and risk-sensitive system, and this imposes a major challenge on banks in meeting such requirements. In many respects it involves a new approach to risk assessment and risk management.

One of the cornerstones of the Basel II framework, which very specifically and tangibly affect banks, is the requirement that, within the scope of Pillar 2, they develop their own Internal Credit Adequacy Assessment Plan – ICAAP. This is a tool which ensures that the banks must possess risk capital which is commensurate with their selected risk profile and risk appetite, as well as appropriate governance and control functions, and business strategies. Essentially, an ICAAP is derived from a formal internal process whereby a bank estimates its capital requirements in relation to its risk profile, strategy, business plans, governance structures, internal risk management systems, dividend policies, etc. Consequently, the ICAAP process includes a strategic review of a bank's capital needs and as to how these capital requirements are to be funded, i.e. through internal profits, IPOS, Sukuks, right issues, other debt issues, etc.

It is essential that the ICAAP process involves an assessment of a bank capital needs beyond its minimum capital requirements. Accordingly, it assesses risk beyond the Pillar I risks and, therefore, addresses both additional Pillar I and Pillar II risks. Pillar 2 risks include financial and nonfinancial risks such as strategic, reputational, liquidity, concentrations, interest rate, etc. Consequently, ICAAP allows a bank to attribute and measure capital to cover the economic effects of all risk taking activities by aggregating Pillar 1 and Pillar 2 risks.

While SAMA has formulated these guidelines with which banks must comply within the scope of their internal capital adequacy assessment process, it is the banks themselves that are to select and design the manner in which these requirements are met. Consequently, SAMA will not prescribe any standard methodology but a set of minimum requirements with respect to the process and disclosure requirements.