Geopolitical Risk in ICAAP

By Jonas Osman Abdelghafour.

Geopolitical risk has moved from the narrative section of the ICAAP to the quantitative one, and many frameworks have not caught up. The obstacle is conceptual: geopolitical risk is not a risk type with its own loss distribution. It is a source of correlated shocks that enter the balance sheet through existing channels. Modelled as a standalone add-on, it produces a number nobody trusts. Modelled as a transmission problem, it produces capital decisions.

Map the channels before calibrating anything

Start by writing down how a specific geopolitical event would actually reach the institution:

• Credit. Direct exposure to affected sovereigns, counterparties and sectors; second-order exposure through customers whose input costs, export markets or supply chains are disrupted; collateral values in affected regions.
• Market and funding. Rate and spread moves, currency dislocation, commodity spikes, flight to quality, and the funding-cost consequences of each.
• Operational and third-party. Sanctions compliance load, cyber activity associated with state actors, concentration in offshored operations or technology providers located in or adjacent to the affected region.
• Liquidity. Deposit behaviour under stress, collateral haircuts, and market access for wholesale funding.
• Strategic and business model. Revenue lines that simply cease, and the cost of exit.

This mapping is the substance of the exercise. A scenario that names an event but not its channels cannot be challenged, quantified, or acted upon.

Build few scenarios, and make them severe

Three or four well-specified scenarios beat a dozen sketches. Each should have a narrative with a plausible causal chain, an explicit time path — shock, propagation, policy response, recovery — and quantified drivers for every mapped channel. Severity should be calibrated to be severe but plausible, and the honest way to test that is reverse stress testing: identify the level of loss that would breach the capital requirement or the business model's viability, then ask what geopolitical path could produce it. If the answer is easy to describe, the baseline scenarios are too gentle.

Correlation is where geopolitical scenarios earn their keep. The defining feature of these events is that credit deterioration, market dislocation, funding stress and operational disruption occur together, at a point when diversification assumptions calibrated on ordinary data have stopped holding. Aggregating channel results with normal-times correlations silently deletes the risk being modelled.

Turn results into decisions

An ICAAP scenario that ends with a capital number is only half finished. Each scenario should carry a management action plan specifying what management would do, in what order, with what capital and liquidity effect, and how long the action takes to execute. Actions that require market access or asset sales in exactly the conditions the scenario describes should be haircut heavily or excluded.

Equally important is the set of early-warning indicators that tell management a scenario is beginning to materialise: exposure concentrations by geography and sector, sanctions-list movement, counterparty credit spreads, funding tenor, energy and freight prices, and operational dependencies in affected regions. Indicators with pre-agreed thresholds and named owners convert an annual document into a live control.

Common failure modes

• The add-on. A percentage uplift on Pillar 1 with no channel logic. It survives one supervisory conversation.
• The last-war scenario. Recalibrating on the most recent event rather than considering the exposures that have not yet been tested.
• Model-immune assumptions. Behavioural parameters — deposit stickiness, prepayment, drawdown — held at business-as-usual values inside a severe scenario.
• Actions without capacity. Mitigations assumed to be executable when markets are closed.
• No board engagement. If the board sees the output only at approval, the scenarios have not shaped the strategy they were meant to inform.

What good looks like

A board that can articulate, without notes, the two or three geopolitical developments that would most damage the institution, the approximate scale of the damage, the indicators being watched, and the actions already agreed. That is the deliverable. The capital number is evidence supporting it, not the point of the exercise.

Primary sources: EBA Risk Assessment Report, June 2026; ECB Financial Stability Review, May 2026; EBA guidelines on institutions' stress testing and the SREP.