MFSA Identifies Areas for Improvement in ICAAP and Stress-Testing Frameworks

Review Highlights Gaps Between Self-Assessments and Supervisory Findings

The Malta Financial Services Authority (MFSA) has published a Dear CEO Letter outlining the results of a review of Internal Capital Adequacy Assessment Process (ICAAP) and stress-testing frameworks across a sample of Malta’s Less Significant Institutions (LSIs).

While all institutions assessed had established core stress-testing frameworks, the MFSA found varying levels of alignment with supervisory expectations. A recurring observation was that institutions often rated their own compliance more positively than was supported by the Authority’s independent assessment, highlighting opportunities for more objective self-evaluation.

Focus on Governance, Scenario Design and Risk Management

The review examined several key areas, including governance arrangements, stress-testing methodologies, scenario development and calibration, reverse stress testing, and the use of stress-testing results in decision-making.

According to the MFSA, many of the shortcomings identified were linked not to the existence of frameworks, but to how effectively they were documented, implemented, and integrated into broader governance and risk-management processes. The assessment was conducted against applicable regulatory and supervisory requirements, including relevant EBA, ECB, and MFSA guidance.

Expectations Extend Beyond the Reviewed Institutions

Although the exercise focused on a selected group of LSIs, the MFSA emphasised that its supervisory expectations apply to all credit institutions operating under Malta’s Banking Act.

The Authority expects banks to make meaningful use of stress-testing outcomes when assessing risk appetite, planning capital needs, and supporting strategic decision-making. Institutions are also expected to address identified weaknesses in a timely manner. The thematic review forms part of the MFSA’s ongoing supervisory programme and is conducted on a three-year cycle, with the next assessment scheduled for 2027.