New expectations for financial services firms on climate risk: everything you need to know on CP10/25

The Prudential Regulation Authority (PRA) released on 30^th April 2025 its new Consultation Paper (CP) 10/25 “Enhancing banks’ and insurers’ approaches to managing climate-related risks[1]”. This publication seeks to update and build upon the guidance outlined in the earlier Supervisory Statement (SS) SS3/19[2]. The new paper reflects the PRA’s ongoing commitment to strengthening the resilience of UK firms (banks, (re)insurers, building societies and other PRA-regulated firms) against the growing financial, operational, and strategic risks posed by climate change. It forms part of the wider regulatory initiative aimed at embedding climate risk considerations more deeply into firms’ governance, risk management and capital adequacy frameworks, in alignment with evolving expectations and global best practices.

Three points to consider when thinking of CP10/25

• The consultation paper is relevant to all UK firms which is consistent with SS3/19, to ensure continuity in the regulatory expectations.
• CP10/25 brings useful insights and clarity to the PRA’s more prescriptive expectations focusing on the importance of data, the reliance on climate risk quantification for risk management, the use of Climate Scenario Analysis (CSA) as a decision-making tool, and the needed incorporation into capital adequacy assessment and financial risks.
• The consultation period will be open until 30^th July 2025 with an expected final SS publication by the end of 2025. Firms will then have six months to submit their roadmaps including internal assessments, gap analyses and action plans to the PRA. As such, firms are strongly encouraged to start working on their roadmaps as soon as possible.

Discover our analysis of the upcoming changes to SS3/19 

• Key changes to SS3/19.
• Summary of changes by section: SS3/19 vs CP10/25.
• The role of proportionality.
• What does it mean for firms.

Key changes to SS3/19

SS3/19 outlined the PRA's expectations in four areas:

• Governance.
• Risk management.
• Scenario analysis.
• Disclosures.

Building on the PRA’s feedback in its Dear CEO and CFO Letters[3], its climate-risk related reports[4] and climate scenario exercise[5], CP10/25 expands on these areas with more detailed expectations and introduces three new areas:

Data

The PRA emphasises climate risk-related data quality and availability issues among firms. The updated statement highlights the importance of adequate data and data architecture to the development of robust climate risk management. The PRA therefore encourages firms to identify data gaps, quantify the uncertainty arising from them and to update their risk appetite and risk management accordingly. Specifically, the PRA urges firms to establish plans to identify and address data gaps through investment in data tools and capabilities. Where this is not possible, the PRA recommends firms establish contingency plans to rely on assumptions and proxies to meet risk management requirements.

Additionally, the PRA stresses the importance of establishing effective governance processes to oversee the integration and use of externally sourced data in internal models and systems. It is recommended that firms plan the strategic development of their own internal data handling capabilities, supported by the implementation of data governance and IT infrastructure processes to collect and aggregate climate-related data and ensure its accuracy and reliability.

Banking-specific issues:

• Financial reporting: The updated statement highlights the importance of high quality and consistent accounting for climate-related risks, recommending that firms develop robust processes, policies and controls to ensure climate-related disclosures are complete, accurate and timely. Internal Capital Adequacy Assessment Process (ICAAP): Banks should include detailed information on the methodologies, assumptions, judgements, proxies and uncertainties used in assessing climate risk for ICAAP. This will enable more complete consideration of climate-related risks and ensure banks are adequately capitalised where material climate risks are identified.
• Internal Liquidity Adequacy Assessment Process (ILAAP): Where material and appropriate, banks should incorporate climate risks into the calibration of liquidity buffers and into their liquidity risk management frameworks under the ILAAP framework. Banks should also consider the impact of climate risks on the net cash outflows or the value of assets comprising their liquidity buffer to ensure the level of liquidity meets the appropriate levels required under stressed conditions.
• Credit risk: The PRA expects banks to integrate climate risks into their credit risk assessments through the development of clear processes and policies for the identification, measurement, monitoring and mitigation of climate-related credit risks to enable more effective overall credit risk management.
• Market risk: The PRA recommends that firms develop a clear understanding of how climate-related risks may develop into market risks for their business and utilise scenario analysis to measure the potential impact of climate-related market risks.
• Reputational risks: Linking to the issues raised in the governance section, the PRA emphasises the need for banks to consider the impact climate risks may have on the firms’ strategic, reputational and regulatory compliance risks, as these can have a significant impact on business strategy setting and testing for firms.

Insurance-specific issues:

• Embed climate risk in Own Risk and Solvency Assessment (ORSA): The PRA expects insurers to incorporate climate-related risks into their ORSA. This includes assessing the potential impacts of climate change and detailing the investment and underwriting changes insurers would make in response to these risks.
• Adjust underwriting policies based on long-term climate projections: Insurers should adjust their underwriting policies based on long-term climate projections. This involves embedding climate risks within their risk appetite statements and using both qualitative and quantitative measures to ensure these risks are adequately managed.
• Factor climate change into investment strategies and valuation models: The PRA emphasises that insurers' valuations of assets and liabilities should consistently include climate-related risks. This ensures that solvency ratios accurately reflect these risks, preventing an overstatement of insurers' capital positions.
• Consider climate stress scenarios in the Solvency Capital Requirement (SCR): The PRA has observed inconsistencies in how insurers' SCRs reflect climate-related risks. It clarifies that SCRs should account for the impact of climate change on underwriting, reserving, market, credit, and operational risks.
• Encourage alignment with international initiatives under Solvency II enhancements: This includes integrating climate-related risks into the insurers’ risk management frameworks and ensuring that their regulatory balance sheets reflect these risks.

Other common issues:

• Climate risk quantification: The PRA has noted that firms struggle with identifying and agreeing on climate-related metrics that effectively inform business strategy. To address this, the PRA proposes that firms develop and periodically review quantitative risk appetite metrics and limits for each material climate-related risk, considering various factors and evolving practices. The PRA emphasises that appropriate and targeted metrics are crucial for effective risk management.
• CSA: As firms struggle with the complexity of constructing and implementing CSA and often fail to adequately understand and account for climate-related risks in their decision-making, the PRA proposes that firms capture all material climate-related risks in the CSA, document how CSA informs their decision-making, and are aware of the limitations and uncertainties of CSA models. The PRA pushes firms to design internal scenarios, including more severe assumptions and tipping points. These proposals aim to improve firms' risk management and decision-making by ensuring CSA is robustly designed and aligned with international standards.
• Operational resilience: The PRA proposes that firms assess the impact of climate-related risks on their operational resilience, ensuring they can continue critical operations and manage the negative effects of physical climate-related risks.

Summary of changes by section: SS3/19 vs CP10/25

The role of proportionality

In the CP, the PRA highlights the significance of proportionality in managing climate-related risks. This principle ensures that regulatory expectations are tailored to the specific characteristics of each firm, in particular the firm’s business model and the geographical concentration of its balance sheet, rather than just the size of the firm. By adopting a proportional approach, firms can develop effective risk management strategies that are both practical and suitable for their unique situations. The proposals are in line with the PRA’s Supervisory Approach to Banking and Insurance[6]. The PRA expects firms to apply a two-step process for managing climate-related risks:

1. Risk Identification and Assessment: Firms should identify and assess material climate-related risks and understand their impact on business resilience over time and under different scenarios. Smaller firms may use less sophisticated scenario analysis to avoid disproportionate costs.
2. Risk Management Response: Firms should tailor their risk management response to the materiality of the climate-related risks they face. More sophisticated tools are needed as the magnitude and likelihood of risks increase.

The PRA seeks to ensure that all firms develop a comprehensive understanding of their climate-related risks and adjust their management strategies to match the level of exposure. Firms facing substantial risks should implement more extensive measures, while those with lower exposure should still be able to substantiate their approaches.

Firms that have already been enhancing their risk identification and assessment capabilities may not require significant additional actions but can benefit from the increased clarity provided. Conversely, firms that have made less progress may need to undertake more initial steps, guided by the detailed proposals.

What does it mean for firms

The final SS will replace SS3/19 entirely upon publication. Firms are expected to conduct an internal review to assess their compliance with the updated expectations and address any gaps. The policy will take effect immediately, but firms will have six months to transition before supervisors require evidence of their internal assessments and action plans. During this period firms should continue to manage climate-related risks appropriately. Given the short timeline, firms are strongly encouraged to start working on their roadmaps as soon as possible.

The proposed updates in CP10/25 signal a clear shift from awareness to action. Firms must now demonstrate tangible progress in managing climate-related financial risks by integrating climate considerations into governance structures, risk management practices, and strategic planning. This involves allocating resources to develop data capabilities, conduct scenario analysis, and enhance disclosure practices. Ultimately, these updates raise regulatory expectations and place greater accountability on boards and senior management to ensure their institutions are resilient to climate-related disruptions.

Get in touch with our experts

We understand the importance of SS3/19 and CP10/25 for firms and offer comprehensive support in understanding and implementing the new requirements.

Contact us today 
 

Sources 

[1]CP10/25 – Enhancing banks’ and insurers’ approaches to managing climate-related risks – Update to SS3/19 | Bank of England

[2]Understanding PRA’s SS3/19 - Forvis Mazars - United Kingdom

[3]UK regulator sets clear climate risk management expectations for UK financial institutions in 2024 - Forvis Mazars - United Kingdom; Letter from David Bailey ‘Thematic feedback on accounting for IFRS 9 ECL and climate risk’ | Bank of England; Letter from Victoria Saporta ‘Thematic feedback from the 2022/2023 round of written auditor reporting’ | Bank of England; Thematic feedback from the 2021/2022 round of written auditor reporting

[4]PRA Climate Change Adaptation Report 2025 | Bank of England; Bank of England report on climate-related risks and the regulatory capital frameworks | Bank of England; PRA Climate Change Adaptation Report 2021 - Climate-related financial risk management and the role of capital requirements | Bank of England

[5]The Bank of England shares useful insights to measure climate-related financial risks using scenario analysis - Forvis Mazars - United Kingdom; Key elements of the 2021 Biennial Exploratory Scenario: Financial risks from climate change | Bank of England

[6]PRA’s approach to supervision of the banking and insurance sectors | Bank of England