Updates to SS3/19: Changes for banks, building societies and insurers

Firms should begin preparing immediately to meet the PRA’s heightened expectations. Here are the key steps they should be taking now:

1. Respond to the Consultation

• Carefully review the PRA’s consultation paper.
• Prepare and submit a considered response that reflects your firm’s perspective and readiness.

2. Conduct a Gap Analysis

• Assess your current position against the PRA’s proposed requirements.
• Identify where your business model, risk management practices, and portfolio exposures may fall short.
• Challenge assumptions and stress-test your current frameworks.

3. Develop a Roadmap

• Create a detailed roadmap outlining how you will address identified gaps.
• Include realistic timelines for closing those gaps, prioritising high-risk areas.

4. Engage with External Support

Begin early engagement with external providers who can assist with:

• Data collection and management.
• Scenario analysis and modelling.
• Independent assessments or assurance.

5. Build Internal Awareness and Capability

• Ensure internal stakeholders, including risk team and the board, understand the implications of the consultation.
• Invest in training and resources to build the necessary capabilities.

The current geopolitical context is influencing regulatory approaches globally, but the PRA appears to be aligning more closely with European principles-based frameworks rather than the more fragmented or prescriptive approaches seen elsewhere, such as in the United States. This suggests a continued emphasis on flexibility and proportionality, allowing firms to tailor their responses based on risk exposure rather than rigid rules. 

Compared to some European regulators, the PRA is taking a more gradual approach, giving firms more time to adapt to evolving expectations. This reflects an understanding of the operational and strategic challenges posed by the current global environment. While some US states (e.g., California) are moving ahead with prescriptive climate-related measures, this has not significantly influenced the PRA’s direction. The UK remains focused on a coherent, long-term regulatory strategy that balances ambition with practicality.

Climate risk can be a driver of and impacting macro-related risks. For example, shocking the GDP and other macroeconomic variables is common practice for climate scenario analysis purpose.

A proportionate approach would be to review, challenge and make sure that the data is of sufficient quality and credibility for the building society’s key climate risks, both physical and flooding) and core portfolio (e.g. residential mortgage). This process should be documented and reiterated yearly.

A way to approach it is to engage with board members and give them more accountability in the business strategy around this topic.

CP10/25 introduces a more nuanced approach to proportionality, which is particularly relevant for smaller firms. The PRA has made it clear that proportionality is based on the level of risk exposure, not simply the size of a firm’s balance sheet or assets under management. Some key implications for smaller firms:

• Focus on risk, not size
  Smaller firms should not assume they are automatically subject to lighter requirements. Instead, they must critically assess their business models, investment strategies, and underwriting practices to understand their actual risk exposures.
• Tailored approaches are acceptable
  The PRA acknowledges that qualitative scenario analysis may be appropriate for firms with limited resources. This flexibility can help smaller firms meet expectations without the need for extensive quantitative modelling.

• Use the PRA’s cost-benefit analysis
  The consultation includes a cost-benefit analysis with estimated investment levels for firms of different sizes. Smaller firms should review this to understand what the PRA considers a reasonable level of effort and investment.
• Document and justify decisions
  It’s essential for smaller firms to document their risk assessments and proportionality decisions, ensuring these are discussed at the appropriate governance levels (e.g., committees, IAP, or ORSA). This transparency will help demonstrate compliance and sound judgment to the regulator.

It varies a lot across the sector, but all FS companies will have to perform the gap analysis against updated expectations and submit their roadmaps including action plan within six months after the publication of the final text.

The PRA remains vague in its guidance but it all depends on the type of data, the level of granularity that you need and that will all be linked to your risk identification process. An example of proportionality is about climate scenario analysis. A building society would be expected to focus on the most relevant and impactful physical risks, like flooding, in the predominant geographical area of the mortgage portfolio and most impactful transition risk, like rising energy prices.

By the end of 2025 or beginning of 2026.

The CP 10/25 introduces several expectations that will require life and general insurers to make meaningful changes. The top three areas of impact are:

1. Alignment across risk management, balance sheet, and STR

Life insurers will need to ensure consistency between their risk management frameworks, balance sheet assumptions, and Strategic Technical Resilience (STR). Historically, there have been disconnects between teams—such as investment teams and risk functions—particularly in how they approach climate risk and Matching Adjustment (MA) strategies. The CP emphasises the need for joined-up thinking across functions to ensure coherent and integrated risk assessments.

2. Enhanced scenario analysis capabilities

Many firms currently rely on publicly available climate scenarios (e.g., NGFS), which have limitations—especially in capturing non-linear risks and tipping points. The CP encourages firms to develop more sophisticated, tailored scenario analysis or, at a minimum, clearly communicate the limitations of existing scenarios to decision-makers, such as the board.

3. Implementation of reverse stress testing

The PRA has previously signalled the importance of reverse stress testing through Dear CEO letters, but uptake has been limited. The CP reinforces this expectation, meaning firms will need to build or strengthen their reverse stress testing frameworks to identify vulnerabilities and potential failure points under extreme but plausible conditions.

The consultation period will be open until 30th July 2025 with an expected final SS publication by the end of 2025. Firms will then have six months to submit their roadmaps including internal assessments, gap analyses and action plans to the PRA. As such, firms are strongly encouraged to start working on their roadmaps as soon as possible.

To meet the PRA’s heightened expectations around climate scenario analysis, firms should focus on improving both the quality of their models and the relevance of the scenarios they use, guided by a risk-based and proportionate approach. This means prioritising efforts on the areas of the business most exposed to climate risk—whether physical or transition-related—regardless of firm size. 

Firms must ensure that the models they use, especially those sourced externally, are well understood, appropriately calibrated, and aligned with their specific business models. This includes challenging assumptions, conducting validation and back-testing, and maintaining robust documentation. On the scenario side, the PRA has emphasised the limitations of widely used frameworks like those from the NGFS and IPCC, particularly their failure to account for tipping points and tail risks. 

As a result, firms are expected to enhance their scenario analysis by incorporating these elements where relevant, potentially using stochastic rather than deterministic approaches to better capture uncertainty. The PRA’s April 2024 paper provides valuable insights into these expectations and should be used as a reference point for firms looking to strengthen their scenario analysis frameworks.