PRA Guidance | Prudential Regulation Authority

March 26th 2026

SS9/17 - Recovery planning

Supervisory Statement 9/17

AI Analysis

**SS9/17 - Recovery Planning** is the PRA's supervisory statement establishing expectations for how UK banks, building societies, and designated investment firms must prepare and maintain recovery plans to ensure financial stability during periods of stress. This guidance supersedes the previous SS18/13 and represents a substantial tightening of recovery planning requirements, making credible, testable, and executable recovery plans a core component of prudential regulation rather than a compliance checkbox.

What Changed

SS9/17 introduced several material enhancements to recovery planning requirements: Governance and Integration: Recovery planning must be embedded within firms' risk management frameworks, with board-level oversight and integration with stress testing and ICAAP processes. The PRA expects clear governance documentation showing how plans are produced, reviewed, signed off, and implemented. Fire Drill Exercises: Firms must conduct regular fire drill exercises that simulate recovery scenarios in a live environment, testing governance arrangements, management information systems, and the...

Suggested Considerations

*Develop comprehensive recovery plans containing all minimum elements specified in the Recovery Planning Part of the PRA Rulebook and detailed in SS9/17
*Establish governance frameworks documenting how recovery plans are produced, reviewed, approved by the board, and how recovery options would be implemented
*Conduct fire drill exercises that simulate recovery scenarios, test governance arrangements, and validate management information capabilities
*Create implementation playbooks (for complex plans) that enable rapid execution by senior management during stress
*Perform detailed impact analysis for each recovery option, quantifying capital and liquidity impacts with realistic timelines

Key Dates

Second half of 2017

- Proposed implementation date for superseding SS18/13 (achieved with December 2017 publication)

21 September 2017 DEADLINE

- PRA consultation deadline for CP9/17 (the consultation paper preceding this statement)

11 December 2017

- SS9/17 first published and became effective

Ongoing DEADLINE

- Firms must maintain and test recovery plans continuously; the PRA notes this statement "may be revised as recovery planning becomes further embedded in firms' risk management practices"

Compliance Impact

Urgency: HIGH

References

AI-generated analysis. May contain errors or omissions — verify with the original PRA source before acting. Full disclaimer.

Sectors:

Banking & Credit Capital Markets & Trading

Topics:

Prudential / Capital Requirements Operational Resilience / Outsourcing Senior Managers / Governance

BankAll Firms

View Original

🇬🇧 PRA Guidance high

March 18th 2026

SS1/26 – Operational resilience: Incident reporting

Supervisory statement 1/26

AI Analysis

SS1/26 outlines the PRA's expectations for firms to report operational incidents via a structured three-phase process (initial, intermediate, final) as mandated in the PRA Rulebook's Regulatory Reporting Part, Chapter 24, to enhance UK financial sector resilience by capturing incidents risking firm safety, policyholder protection, or stability. This matters because it standardizes reporting, enabling timely PRA oversight and reducing inconsistencies in incident data collection across regulated entities.

What Changed

- Introduces clear reporting thresholds in Regulatory Reporting Rule 24.2: Firms must report if an incident poses risks to UK financial stability, firm safety/soundness, or (for insurers)...
Mandates a phased reporting approach (Rule 24.1-24.4): Initial report as soon as practicable (expected within 24 hours of threshold determination); intermediate updates for significant changes (e.g.,...
Excludes near-misses (potential events without disruption/data loss to external users); aligns with but does not replace Fundamental Rule 7 or Notification Part Chapter 2 obligations.
Specifies reporting via a "Reporting Fields Document"; firms balance reporting with incident resolution.

Suggested Considerations

Assess incidents against PRA thresholds (e.g., risk to stability/soundness/policyholders, considering contagion, disruptions > thresholds, data loss, media impact); report if met, even if internally high-priority.
Submit phased reports using specified fields: Initial (basic details promptly); Intermediate (updates on changes like impact, strategy shifts, resolution); Final (full details post-resolution).
Maintain processes for prompt classification, data gathering, and submission while prioritizing resolution; continue ad-hoc supervisory notifications if needed.
Review internal policies to align severity ratings with PRA thresholds; document assessments.
For critical third-party (CTP) incidents, both firms and CTPs report uniquely.

Key Dates

18 March 2026

- Publication date of SS1/26

18 March 2027 DEADLINE

- Effective date; firms must comply with reporting requirements

Within 24 hours

- Expected submission of initial phase report after determining threshold met (as soon as practicable)

Each significant change

- Intermediate phase update(s), including at resolution

Within 30 working days of resolution

- Final phase report (extendable to 60 working days if impracticable)

Compliance Impact

Urgency: High – With effectiveness just over one year away (18 March 2027), firms must urgently map incident management frameworks to new thresholds/phases, update policies, train staff, and test reporting (e.g., via simulations), as non-compliance risks enforcement under PRA rules and heightened scrutiny on resilience amid rising cyber/operational threats. This elevates operational resilience from preparation (e.g., IMT testing by March 2025) to active reporting, demanding integrated tech/governance upgrades.

References

AI-generated analysis. May contain errors or omissions — verify with the original PRA source before acting. Full disclaimer.

Sectors:

Banking & Credit Insurance & Pensions Capital Markets & Trading

Topics:

Operational Resilience / Outsourcing Reporting & Disclosure

BankInsuranceAll Firms

View Original

🇬🇧 PRA Guidance high

December 19th 2025

SS2/25: Prudential considerations for insurance and reinsurance undertakings when transferring risk to Special Purpose Vehicles

Supervisory statement 2/25

AI Analysis

Supervisory Statement SS2/25 from the Prudential Regulation Authority (PRA) provides guidance on prudential considerations for UK insurance and reinsurance undertakings transferring risk to Special Purpose Vehicles (SPVs). It clarifies expectations for ensuring such transfers comply with Solvency II requirements, focusing on risk transfer validity, capital relief recognition, and supervisory approval processes. This matters because it aims to enhance transparency and risk management in reinsurance arrangements, reducing potential regulatory arbitrage while supporting efficient risk mitigation for insurers amid evolving market dynamics.

What Changed

- Risk Transfer Validation: Firms must demonstrate that SPV risk transfers provide genuine economic risk transfer (ERT), not just accounting or regulatory capital relief, with PRA emphasizing...
Capital Relief Criteria: Introduces stricter tests for recognizing capital relief, including full collateralization requirements, independent third-party guarantees, and prohibitions on circular...
Governance and Documentation: Mandates robust board-level oversight, detailed transaction documentation (including stress testing and scenario analysis), and pre-transaction PRA notification for...
SPV Oversight: SPVs must be structured to operate independently, with PRA reserving rights to challenge approvals if governance is inadequate or conflicts of interest arise.
Alignment with Solvency II: Builds on existing rules (e.g., Article 211-213) but provides PRA-specific interpretations, including updated expectations on limited risk appetite and post-transfer...

Suggested Considerations

Immediate Review (by Q1 2026): Conduct gap analysis of all existing SPV portfolios against SS2/25 criteria, documenting ERT evidence and collateral adequacy.
Governance Updates: Enhance board policies for SPV approvals, including mandatory stress testing (e.g., 1-in-200 year events) and independent validation by external actuaries.
Pre-Transaction Processes: Implement PRA notification templates for transfers >10% SCR; prepare deal packs with legal opinions on SPV independence.
Reporting Enhancements: Update internal systems for RFR disclosures on SPV exposures; train Senior Insurance Managers (SIMs) on accountability under SIMR.
Remediation: For non-compliant legacy SPVs, unwind or restructure by June 2027, notifying PRA of plans by March 2027.

Compliance Impact

Urgency: High – This is not a full regime shift but imposes immediate review obligations on firms with SPV exposure (estimated 20-30% of PRA-regulated insurers). Non-compliance risks capital add-ons, transaction disapprovals, or enforcement under PRA's Fundamental Rules, especially as PRA ramps up thematic supervision post-2025. Matters for capital efficiency in a high-interest-rate environment where SPVs are popular for cat risk.

AI-generated analysis. May contain errors or omissions — verify with the original PRA source before acting. Full disclaimer.

Sectors:

Insurance & Pensions

Topics:

Prudential / Capital Requirements

Insurance

View Original

🇬🇧 PRA Guidance high

December 3rd 2025

SS5/25 – Enhancing banks’ and insurers’ approaches to managing climate-related risks

Supervisory statement 5/25

AI Analysis

SS5/25 is the PRA's updated supervisory statement, published on 3 December 2025, replacing SS3/19 and setting enhanced expectations for banks and insurers to manage climate-related risks through governance, risk management, scenario analysis, data quality, and disclosures. It matters because it represents a step change from awareness-raising to embedding robust, proportionate practices that integrate climate risks into core prudential processes like ICAAP, ILAAP, ORSA, and capital planning, aligning with the PRA's objectives for firm safety and soundness amid evolving physical and transition risks.

What Changed

- Replaces SS3/19 entirely: Introduces a more mature, consolidated framework reflecting international standards (e.g., BCBS), with detailed transmission channels for climate risks across credit,...
Governance enhancements: Emphasizes board accountability, integration into business strategy, climate risk appetite statements, and linkage to Senior Managers & Certification Regime (SM&CR) without...
Risk management integration: Requires embedding climate risks into existing frameworks with quantitative metrics/limits where material; detailed mapping of risks (e.g., physical/transition via...
Scenario analysis: Firms must conduct climate scenario exercises capturing plausible pathways, impacts on capital/liquidity/solvency, with transparent assumptions and management challenge;...
Data expectations: Critical assessment of data sources/quality (e.g., geographic/sectoral for banks, hazard/vulnerability for insurers); use proxies with documented limitations.

Suggested Considerations

Conduct materiality assessment of climate risks to scope proportionality (leverage TCFD/CSRD work).
Embed climate risks in governance: Define risk appetite, update SM&CR responsibilities, ensure board MI/challenge.
Integrate into risk frameworks: Update risk registers, ICAAP/ILAAP/ORSA/SCR with quantitative metrics, scenarios, and controls; adjust underwriting/pricing/collateral.
Perform climate scenario analysis: Model impacts on capital/liquidity/solvency using plausible pathways.
Enhance data: Source/assess granular data (e.g., location/sector/hazards), document proxies/limitations.

Key Dates

April 2025

Consultation paper CP10/25 issued (feedback incorporated in final policy)

Within 6 months of 3 December 2025 (by ~3 June 2026)

Firms assess gaps against new expectations and develop implementation plans

3 December 2025

Publication of PS25/25 and SS5/25; replaces SS3/19 effective immediately

Compliance Impact

Urgency: High – Effective immediately with a 6-month window (~June 2026) for gap closure, this demands significant operational uplift (e.g., data, scenarios, integration) amid PRA's shift to enforcement; non-compliance risks supervisory action, given climate risks' materiality to prudential stability and alignment with global standards.

References

AI-generated analysis. May contain errors or omissions — verify with the original PRA source before acting. Full disclaimer.

Sectors:

Banking & Credit Insurance & Pensions

Topics:

Prudential / Capital Requirements ESG Senior Managers / Governance

BankInsurance

View Original

🇬🇧 PRA Guidance medium

November 24th 2025

The PRA holds model risk management roundtable on artificial intelligence and machine learning technologies

The PRA held roundtable meetings on artificial intelligence and machine learning (AI and ML) in the context of Supervisory Statement (SS)1/23 ‘Model risk management principles for banks’

AI Analysis

The Prudential Regulation Authority (PRA) held roundtable sessions on 20 and 22 October 2025 with 21 regulated firms to discuss AI and machine learning (AI/ML) adoption under Supervisory Statement SS1/23 on model risk management (MRM) principles for banks. This matters because it highlights PRA's strategic supervisory focus on AI/ML model risks, urging firms to enhance governance, risk appetite, monitoring, and validation to mitigate opacity, overfitting, and rapid performance degradation in these models. https://www.bankofengland.co.uk/prudential-regulation/publication/2025/november/pra-holds-model-risk-management-roundtable-on-ai | https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/publication/2025/november/ai-roundtable-oct-2025.pdf

What Changed

This is not a formal rule change but supervisory guidance via roundtable insights reinforcing SS1/23 principles (effective since 2023). Key emphases include:
Risk appetite: Boards must articulate AI/ML-specific model risk appetite pre-deployment to avoid exceeding tolerances, given higher uncertainty from opacity.
Model inventories and tiering: Address inaccurate/incomplete inventories and aggregate risks from deploying similar AI/ML across portfolios/jurisdictions; challenge tiering for complexity.
Model development: Assess trade-offs in performance vs. explainability/reliability; prefer simpler models where AI/ML gains are marginal; mitigate overfitting via representative datasets.
Ongoing monitoring: Increase frequency beyond tier-dependent intervals (e.g., six months may suffice for traditional models but not dynamic AI/ML); define quantitative triggers for re-validation.

Suggested Considerations

Review and strengthen board-level model risk appetite statements to explicitly cover AI/ML opacity and uncertainty; integrate into governance triggers like re-validation.
Enhance model inventories for completeness, aggregate risk assessment, and cross-jurisdictional tiering challenges.
Update model development policies to evaluate AI/ML trade-offs (e.g., explainability vs. performance) and ensure datasets prevent overfitting.
Revise ongoing monitoring policies for more frequent, quantitative checks on AI/ML (e.g., beyond six months); define degradation triggers, fallback models, and kill switches.
Participate in PRA initiatives like MRM roundtables or AI Consortium for dialogue; align first/second-line defenses per SS1/23.

Key Dates

24 November 2025

- PRA published roundtable summary and slides. https://www.bankofengland.co.uk/prudential-regulation/publication/2025/november/pra-holds-model-risk-management-roundtable-on-ai

20

22 October 2025; - PRA held CRO roundtable sessions with 21 firms on AI/ML MRM

Compliance Impact

Urgency: Medium - Not critical as no new rules or deadlines, but high relevance for AI/ML users amid PRA's strategic MRM focus; non-compliance risks supervisory actions, given observations of gaps in monitoring and governance. Matters for banks scaling AI (rising adoption per industry views), as unaddressed risks like rapid degradation could amplify losses (e.g., historical model failures cost billions). https://www.articsledge.com/post/model-risk-management | https://www.finextra.com/blogposting/30372/the-pras-latest-view-on-ai-governance-implications-for-uk-banks

References

AI-generated analysis. May contain errors or omissions — verify with the original PRA source before acting. Full disclaimer.

Sectors:

Banking & Credit

Topics:

Prudential / Capital Requirements Technology & Cyber Senior Managers / Governance

BankAll Firms

View Original

🇬🇧 PRA Guidance high

October 28th 2025

SS31/15 - The Internal Capital Adequacy Assessment Process (ICAAP) and the Supervisory Review and Evaluation Process (SREP)

Supervisory statement 31/15

AI Analysis

SS31/15 is the PRA's foundational supervisory statement establishing expectations for how UK-regulated banks and large investment firms must conduct their Internal Capital Adequacy Assessment Process (ICAAP) and how the PRA will evaluate these assessments through its Supervisory Review and Evaluation Process (SREP). This guidance is critical because it directly determines the capital requirements firms must maintain and establishes the supervisory framework through which the PRA assesses whether firms hold sufficient capital to cover material risks.

What Changed

The supervisory statement establishes several core regulatory expectations: ICAAP Requirements
Firms must assess on an ongoing basis whether they hold sufficient capital to cover all material risks, including interest rate risk in the banking book (IRRBB), market risk, operational risk,...
Firms must implement stress testing and scenario analysis as integral components of capital planning
The management body must be actively involved and engaged in all relevant stages of the ICAAP process SREP Assessment Framework The PRA reviews and evaluates:
Arrangements, strategies, processes and mechanisms implemented by a firm to comply with regulatory requirements

Suggested Considerations

*Immediate Compliance Actions
*Establish ICAAP Framework: Implement a comprehensive ICAAP that covers all material risks identified by the firm and the PRA, including those specific to the firm's business model and risk profile
*Risk Identification and Assessment: Conduct thorough identification of all material risks (IRRBB, market risk, operational risk, concentration risk, group risk, pension obligations, foreign currency lending) and assess capital adequacy against these risks
*Stress Testing and Scenario Analysis: Develop and maintain robust stress testing and scenario analysis capabilities, including:
Results of stress tests carried out in accordance with CRR requirements for firms using IRB approaches or internal models

Key Dates

29 July 2015

- SS31/15 first published, replacing PRA SS5/13 and PRA SS6/13

1 July 2026

- Effective date for updates to SS31/15 (as referenced in recent amendments)

Ongoing DEADLINE

- Firms must carry out ICAAP on a continuous basis in accordance with PRA ICAA rules

Compliance Impact

Urgency Rating: HIGH

References

AI-generated analysis. May contain errors or omissions — verify with the original PRA source before acting. Full disclaimer.

Sectors:

Banking & Credit Capital Markets & Trading

Topics:

Prudential / Capital Requirements Senior Managers / Governance Reporting & Disclosure

BankBroker Dealer

View Original

🇬🇧 PRA Guidance high

September 30th 2025

SS15/16 – Solvency II: Monitoring model drift and standard formula SCR reporting for firms with permission to use an internal model

Supervisory Statement 15/16

AI Analysis

SS15/16 establishes the PRA's expectations for UK insurance firms using approved internal models to calculate their Solvency Capital Requirement (SCR), requiring them to maintain the ability to calculate SCR using the standard formula and submit standard formula SCR calculations for regulatory monitoring purposes. This guidance is critical because it ensures capital requirements remain reflective of actual firm risks and protects policyholder security by preventing model drift—where internal models diverge from underlying risk realities over time.

What Changed

The supervisory statement introduces several core regulatory expectations:
Internal Model Maintenance Requirement: Firms with approved internal models must maintain the capability to calculate SCR using the standard formula, even if they primarily use internal models for...
Standard Formula SCR Reporting: Firms using approved internal models to calculate solo SCR are expected to report standard formula SCR results privately to the PRA on an annual basis.
Model Drift Monitoring Framework: The PRA uses model drift ratios calculated at model approval and re-based following material changes in risk profile or major model changes to monitor whether...
Submission Format and Timing: Standard formula SCR information must be submitted through XBRL-enabled Excel files or full XBRL format, four weeks following firms' annual quantitative reporting...

Suggested Considerations

*Maintain Dual Calculation Capability: Preserve the technical ability to calculate SCR using the standard formula, regardless of internal model approval status.
*Establish Annual Reporting Process: Implement procedures to calculate and submit standard formula SCR results annually through XBRL-enabled Excel or full XBRL format via BEEDS portal.
*Integrate into Risk Management: Incorporate standard formula SCR calculations into own risk and solvency assessment (ORSA), risk management, and model validation cycles.
*Obtain Senior Management Approval: Ensure standard formula submissions are reviewed and approved by appropriately authorized senior management before submission.
*Maintain Supporting Documentation: Retain quantitative and qualitative documentation supporting standard formula calculations to demonstrate appropriateness for model drift monitoring purposes.

Key Dates

25 October 2016

- Original SS15/16 publication

31 December 2018

- Document updated (referenced in original guidance)

September 2025

- Most recent update to SS15/16 published, clarifying expectations for firms with material non-life technical provisions

30 September 2026 DEADLINE

- Implementation deadline for liquidity reporting rules (related Solvency II development)

Four weeks after annual quantitative reporting submission DEADLINE

- Deadline for standard formula SCR reporting

Compliance Impact

Urgency: HIGH

References

AI-generated analysis. May contain errors or omissions — verify with the original PRA source before acting. Full disclaimer.

Sectors:

Insurance & Pensions

Topics:

Prudential / Capital Requirements Reporting & Disclosure

Insurance

View Original