PRA Guidance

Key dates

Second half of 2017

- Proposed implementation date for superseding SS18/13 (achieved with December 2017 publication)

21 September 2017 Deadline

- PRA consultation deadline for CP9/17 (the consultation paper preceding this statement)

11 December 2017

- SS9/17 first published and became effective

Ongoing Deadline

- Firms must maintain and test recovery plans continuously; the PRA notes this statement "may be revised as recovery planning becomes further embedded in firms' risk management practices"

Suggested considerations

• *Develop comprehensive recovery plans containing all minimum elements specified in the Recovery Planning Part of the PRA Rulebook and detailed in SS9/17
• *Establish governance frameworks documenting how recovery plans are produced, reviewed, approved by the board, and how recovery options would be implemented
• *Conduct fire drill exercises that simulate recovery scenarios, test governance arrangements, and validate management information capabilities
• *Create implementation playbooks (for complex plans) that enable rapid execution by senior management during stress
• *Perform detailed impact analysis for each recovery option, quantifying capital and liquidity impacts with realistic timelines

What changed

SS9/17 introduced several material enhancements to recovery planning requirements: Governance and Integration: Recovery planning must be embedded within firms' risk management frameworks, with board-level oversight and integration with stress testing and ICAAP processes. The PRA expects clear governance documentation showing how plans are produced, reviewed, signed off, and implemented. Fire Drill Exercises: Firms must conduct regular fire drill exercises that simulate recovery scenarios in a live environment, testing governance arrangements, management information systems, and the...

Key dates

18 March 2026

- Publication date of SS1/26

18 March 2027 Deadline

- Effective date; firms must comply with reporting requirements

Within 24 hours

- Expected submission of initial phase report after determining threshold met (as soon as practicable)

Each significant change

- Intermediate phase update(s), including at resolution

Within 30 working days of resolution

- Final phase report (extendable to 60 working days if impracticable)

Suggested considerations

• Assess incidents against PRA thresholds (e.g., risk to stability/soundness/policyholders, considering contagion, disruptions > thresholds, data loss, media impact); report if met, even if internally high-priority.
• Submit phased reports using specified fields: Initial (basic details promptly); Intermediate (updates on changes like impact, strategy shifts, resolution); Final (full details post-resolution).
• Maintain processes for prompt classification, data gathering, and submission while prioritizing resolution; continue ad-hoc supervisory notifications if needed.
• Review internal policies to align severity ratings with PRA thresholds; document assessments.
• For critical third-party (CTP) incidents, both firms and CTPs report uniquely.

What changed

• - Introduces clear reporting thresholds in Regulatory Reporting Rule 24.2: Firms must report if an incident poses risks to UK financial stability, firm safety/soundness, or (for insurers)...
• Mandates a phased reporting approach (Rule 24.1-24.4): Initial report as soon as practicable (expected within 24 hours of threshold determination); intermediate updates for significant changes (e.g.,...
• Excludes near-misses (potential events without disruption/data loss to external users); aligns with but does not replace Fundamental Rule 7 or Notification Part Chapter 2 obligations.
• Specifies reporting via a "Reporting Fields Document"; firms balance reporting with incident resolution.

Suggested considerations

• Immediate Review (by Q1 2026): Conduct gap analysis of all existing SPV portfolios against SS2/25 criteria, documenting ERT evidence and collateral adequacy.
• Governance Updates: Enhance board policies for SPV approvals, including mandatory stress testing (e.g., 1-in-200 year events) and independent validation by external actuaries.
• Pre-Transaction Processes: Implement PRA notification templates for transfers >10% SCR; prepare deal packs with legal opinions on SPV independence.
• Reporting Enhancements: Update internal systems for RFR disclosures on SPV exposures; train Senior Insurance Managers (SIMs) on accountability under SIMR.
• Remediation: For non-compliant legacy SPVs, unwind or restructure by June 2027, notifying PRA of plans by March 2027.

What changed

• - Risk Transfer Validation: Firms must demonstrate that SPV risk transfers provide genuine economic risk transfer (ERT), not just accounting or regulatory capital relief, with PRA emphasizing...
• Capital Relief Criteria: Introduces stricter tests for recognizing capital relief, including full collateralization requirements, independent third-party guarantees, and prohibitions on circular...
• Governance and Documentation: Mandates robust board-level oversight, detailed transaction documentation (including stress testing and scenario analysis), and pre-transaction PRA notification for...
• SPV Oversight: SPVs must be structured to operate independently, with PRA reserving rights to challenge approvals if governance is inadequate or conflicts of interest arise.
• Alignment with Solvency II: Builds on existing rules (e.g., Article 211-213) but provides PRA-specific interpretations, including updated expectations on limited risk appetite and post-transfer...

Key dates

April 2025

Consultation paper CP10/25 issued (feedback incorporated in final policy)

Within 6 months of 3 December 2025 (by ~3 June 2026)

Firms assess gaps against new expectations and develop implementation plans

3 December 2025

Publication of PS25/25 and SS5/25; replaces SS3/19 effective immediately

Suggested considerations

• Conduct materiality assessment of climate risks to scope proportionality (leverage TCFD/CSRD work).
• Embed climate risks in governance: Define risk appetite, update SM&CR responsibilities, ensure board MI/challenge.
• Integrate into risk frameworks: Update risk registers, ICAAP/ILAAP/ORSA/SCR with quantitative metrics, scenarios, and controls; adjust underwriting/pricing/collateral.
• Perform climate scenario analysis: Model impacts on capital/liquidity/solvency using plausible pathways.
• Enhance data: Source/assess granular data (e.g., location/sector/hazards), document proxies/limitations.

What changed

• - Replaces SS3/19 entirely: Introduces a more mature, consolidated framework reflecting international standards (e.g., BCBS), with detailed transmission channels for climate risks across credit,...
• Governance enhancements: Emphasizes board accountability, integration into business strategy, climate risk appetite statements, and linkage to Senior Managers & Certification Regime (SM&CR) without...
• Risk management integration: Requires embedding climate risks into existing frameworks with quantitative metrics/limits where material; detailed mapping of risks (e.g., physical/transition via...
• Scenario analysis: Firms must conduct climate scenario exercises capturing plausible pathways, impacts on capital/liquidity/solvency, with transparent assumptions and management challenge;...
• Data expectations: Critical assessment of data sources/quality (e.g., geographic/sectoral for banks, hazard/vulnerability for insurers); use proxies with documented limitations.

Key dates

24 November 2025

- PRA published roundtable summary and slides. https://www.bankofengland.co.uk/prudential-regulation/publication/2025/november/pra-holds-model-risk-management-roundtable-on-ai

20

22 October 2025; - PRA held CRO roundtable sessions with 21 firms on AI/ML MRM

Suggested considerations

• Review and strengthen board-level model risk appetite statements to explicitly cover AI/ML opacity and uncertainty; integrate into governance triggers like re-validation.
• Enhance model inventories for completeness, aggregate risk assessment, and cross-jurisdictional tiering challenges.
• Update model development policies to evaluate AI/ML trade-offs (e.g., explainability vs. performance) and ensure datasets prevent overfitting.
• Revise ongoing monitoring policies for more frequent, quantitative checks on AI/ML (e.g., beyond six months); define degradation triggers, fallback models, and kill switches.
• Participate in PRA initiatives like MRM roundtables or AI Consortium for dialogue; align first/second-line defenses per SS1/23.

What changed

• This is not a formal rule change but supervisory guidance via roundtable insights reinforcing SS1/23 principles (effective since 2023). Key emphases include:
• Risk appetite: Boards must articulate AI/ML-specific model risk appetite pre-deployment to avoid exceeding tolerances, given higher uncertainty from opacity.
• Model inventories and tiering: Address inaccurate/incomplete inventories and aggregate risks from deploying similar AI/ML across portfolios/jurisdictions; challenge tiering for complexity.
• Model development: Assess trade-offs in performance vs. explainability/reliability; prefer simpler models where AI/ML gains are marginal; mitigate overfitting via representative datasets.
• Ongoing monitoring: Increase frequency beyond tier-dependent intervals (e.g., six months may suffice for traditional models but not dynamic AI/ML); define quantitative triggers for re-validation.

Key dates

29 July 2015

- SS31/15 first published, replacing PRA SS5/13 and PRA SS6/13

1 July 2026

- Effective date for updates to SS31/15 (as referenced in recent amendments)

Ongoing Deadline

- Firms must carry out ICAAP on a continuous basis in accordance with PRA ICAA rules

Suggested considerations

• *Immediate Compliance Actions
• *Establish ICAAP Framework: Implement a comprehensive ICAAP that covers all material risks identified by the firm and the PRA, including those specific to the firm's business model and risk profile
• *Risk Identification and Assessment: Conduct thorough identification of all material risks (IRRBB, market risk, operational risk, concentration risk, group risk, pension obligations, foreign currency lending) and assess capital adequacy against these risks
• *Stress Testing and Scenario Analysis: Develop and maintain robust stress testing and scenario analysis capabilities, including:
• Results of stress tests carried out in accordance with CRR requirements for firms using IRB approaches or internal models

What changed

• The supervisory statement establishes several core regulatory expectations: ICAAP Requirements
• Firms must assess on an ongoing basis whether they hold sufficient capital to cover all material risks, including interest rate risk in the banking book (IRRBB), market risk, operational risk,...
• Firms must implement stress testing and scenario analysis as integral components of capital planning
• The management body must be actively involved and engaged in all relevant stages of the ICAAP process SREP Assessment Framework The PRA reviews and evaluates:
• Arrangements, strategies, processes and mechanisms implemented by a firm to comply with regulatory requirements

Key dates

25 October 2016

- Original SS15/16 publication

31 December 2018

- Document updated (referenced in original guidance)

September 2025

- Most recent update to SS15/16 published, clarifying expectations for firms with material non-life technical provisions

30 September 2026 Deadline

- Implementation deadline for liquidity reporting rules (related Solvency II development)

Four weeks after annual quantitative reporting submission Deadline

- Deadline for standard formula SCR reporting

Suggested considerations

• *Maintain Dual Calculation Capability: Preserve the technical ability to calculate SCR using the standard formula, regardless of internal model approval status.
• *Establish Annual Reporting Process: Implement procedures to calculate and submit standard formula SCR results annually through XBRL-enabled Excel or full XBRL format via BEEDS portal.
• *Integrate into Risk Management: Incorporate standard formula SCR calculations into own risk and solvency assessment (ORSA), risk management, and model validation cycles.
• *Obtain Senior Management Approval: Ensure standard formula submissions are reviewed and approved by appropriately authorized senior management before submission.
• *Maintain Supporting Documentation: Retain quantitative and qualitative documentation supporting standard formula calculations to demonstrate appropriateness for model drift monitoring purposes.

What changed

• The supervisory statement introduces several core regulatory expectations:
• Internal Model Maintenance Requirement: Firms with approved internal models must maintain the capability to calculate SCR using the standard formula, even if they primarily use internal models for...
• Standard Formula SCR Reporting: Firms using approved internal models to calculate solo SCR are expected to report standard formula SCR results privately to the PRA on an annual basis.
• Model Drift Monitoring Framework: The PRA uses model drift ratios calculated at model approval and re-based following material changes in risk profile or major model changes to monitor whether...
• Submission Format and Timing: Standard formula SCR information must be submitted through XBRL-enabled Excel files or full XBRL format, four weeks following firms' annual quantitative reporting...