UK banks are working through one of the most concentrated periods of regulatory change since the post-2008 reforms. Basel 3.1 changes capital calculations from 1 January 2027, operational resilience has moved from implementation to proof, new incident reporting rules arrive in March 2027, and financial crime, the Consumer Duty and data quality remain central to supervision.
Banks are also managing economic uncertainty, geopolitical tension, the adoption of AI and digital assets, and the government's expectation that regulation supports growth while banks remain safe and sound. The prudential side of this agenda is covered in more depth in the guide to PRA compliance for banks and insurers.
The table lists the dates that should anchor every bank's change plan for 2026 and 2027.
| Date | Change | Source |
|---|---|---|
| 31 March 2025 | Operational resilience implementation deadline passed | FCA and PRA |
| 24 April 2026 | Most SM&CR changes take effect | FCA PS26/6 |
| 28 April 2026 | 90 days' notice and reasons for ending indefinite payment account contracts entered into from this date | Payment Services Regulations 2017, regulation 51B |
| 1 January 2027 | Basel 3.1 rules apply | PRA |
| 1 January 2027 | First complaints reporting period under new FCA rules begins | FCA PS25/19 |
| 18 March 2027 | Operational incident and third-party reporting rules apply | FCA PS26/2 and PRA |
| 1 January 2028 | Internal models approach for market risk (FRTB) | PRA |
Basel 3.1 is the UK implementation of the final Basel III standards agreed by the Basel Committee on Banking Supervision. It applies to PRA-regulated banks, building societies, PRA-designated investment firms and their holding companies. The effect on each bank's capital depends on its business model and on whether it uses internal models.
Risk weights become more granular and more risk-sensitive. Corporate exposures are weighted using external ratings in finer bands; residential mortgages are weighted by loan-to-value ratio; commercial real estate and land acquisition, development and construction lending attract higher weights; and a new specialised lending class covers project, object and commodities finance. Unconditionally cancellable commitments, such as unused credit card limits, receive a credit conversion factor for the first time, and the SME supporting factor is removed, with the PRA adjusting Pillar 2A to offset the SME change.
Banks using their own models (the internal ratings-based, or IRB, approach) can no longer use advanced modelling for some portfolios, including exposures to banks and other financial institutions and to the largest corporates. Minimum values, known as input floors, apply to modelled probability of default and loss given default. IRB banks are rebuilding and recalibrating models, obtaining PRA permission for material changes and updating validation frameworks.
The output floor limits the capital benefit of internal models. Once fully phased in, a bank's risk-weighted assets calculated with its models cannot be lower than 72.5% of the amount calculated under the standardised approaches. The floor is phased in over a transitional period set by the PRA.
A single standardised approach replaces the existing methods. It is based on a business indicator, a measure of the size of the bank's business derived from its income statement.
The Fundamental Review of the Trading Book (FRTB) introduces a revised standardised approach based on sensitivities, and an internal models approach based on expected shortfall rather than value at risk, which follows on 1 January 2028. Pillar 3 disclosures become more standardised and new regulatory reporting templates apply.
With the rules applying from 1 January 2027, the remaining months of 2026 are about delivery and assurance. Banks that run the new calculations in parallel before go-live give their boards the clearest view of the outcome.
| Workstream | What good looks like by year end |
|---|---|
| Data | Every new data field sourced, validated and reconciled, with lineage documented |
| Models | IRB changes approved or submitted, recalibrated and validated |
| Systems | Calculation engines and reporting templates tested end to end |
| Parallel running | Several reporting cycles run on old and new rules, with variances explained |
| Capital planning | ICAAP, capital plan and pricing updated for the new requirements |
| Governance | Board sign-off of policies and methodologies, with internal audit assurance |
| People | Finance, risk and business teams trained on the new rules |
Pillar 2A is the additional capital the PRA sets for risks not fully captured by the minimum requirements. The PRA is rebasing Pillar 2A so that it reflects the new Basel 3.1 calculations, and it has collected data from firms for this purpose. Where Basel 3.1 adds risk sensitivity, firm-specific add-ons can be expected to fall; where it removes the SME supporting factor, the PRA has said it will adjust Pillar 2A to avoid an unwarranted increase.
Smaller domestic banks and building societies that meet the PRA's criteria for a small domestic deposit taker (SDDT) can use the Strong and Simple framework, a simpler set of prudential rules designed for firms with straightforward business models and limited international activity. Eligible firms should compare the outcomes of the SDDT regime and full Basel 3.1 before choosing their route, using the PRA's published criteria and timetable.
Basel 3.1 feeds through to every part of capital management. The internal capital adequacy assessment process (ICAAP), the bank's own assessment of the capital it needs for its risks, should be rerun on the new basis, and stress testing, risk appetite limits and the capital plan should all use Basel 3.1 risk-weighted assets.
Product pricing and portfolio strategy may also change. Exposures that attract higher risk weights under the new standardised approach, such as some commercial real estate or unrated corporate lending, carry a higher capital cost, while others become cheaper. Banks that have modelled the change at product level can adjust pricing and origination before 1 January 2027 rather than after.
Banks in scope had until 31 March 2025 to show that they could keep their important business services within impact tolerances. The rules are set out in the FCA's PS21/3 and the PRA's SS1/21.
Supervisors are testing the quality of scenario testing and challenging optimistic recovery assumptions. Areas of focus include cloud and concentration risk, critical third-party dependencies, cyber resilience, legacy technology and contingency plans for key staff. The FCA, the PRA and the Bank of England have begun jointly overseeing the services that designated critical third parties provide to the financial sector, which strengthens, but does not replace, each bank's own third-party risk management.
The FCA's PS26/2, published on 18 March 2026, introduces standard thresholds and a single submission for operational incidents, and requires banks to notify material third-party arrangements and submit an annual register of them. The PRA published its own equivalent rules at the same time. Banks should map their incident classification and supplier inventory to the new requirements during 2026.
Financial crime remains a leading priority for both regulators. For banks, the main risk areas are well established.
| Business line | Main risk and control |
|---|---|
| Correspondent banking | Money laundering and sanctions evasion through respondent banks; enhanced due diligence and monitoring of nested relationships |
| Trade finance | Trade-based money laundering; checks on pricing, goods, routes and parties |
| Private banking and wealth | Politically exposed persons and complex structures; source of wealth verification |
| Payments and sanctions | Screening of customers, owners, counterparties and payment messages against UK (OFSI), US (OFAC), EU and UN lists |
The FCA's Financial Crime Guide sets out the expected components: a business-wide risk assessment, customer due diligence with enhanced checks for higher-risk customers, calibrated transaction monitoring, sanctions screening, timely and well-written suspicious activity reports to the National Crime Agency, and governance with an MLRO who has the authority and resources to act. Where controls fall short, the regulators can require a skilled person review under section 166 of FSMA, agree voluntary requirements that restrict business, or take enforcement action. The full picture is in FCA financial crime compliance in 2026.
The Consumer Duty has applied since July 2023 and remains a central part of FCA supervision of retail banking. It requires good outcomes across products and services, price and value, consumer understanding and consumer support.
Banks must track product performance, complaints and root causes, value measures and outcomes for different customer groups, and act quickly where outcomes are poor. The wider expectations are covered in Consumer Duty compliance in 2026.
The FCA's PS26/6 made SM&CR more proportionate, with most changes taking effect on 24 April 2026 and further stages on 10 July, 30 July and 1 September 2026. Banks should update statements of responsibilities, management responsibilities maps and certification processes, and confirm that responsibility for Basel 3.1 delivery, operational resilience and financial crime sits clearly with named senior managers. More detail is in SM&CR explained.
The PRA has repeatedly identified data quality as the foundation of sound risk management and accurate reporting. Basel 3.1 raises the bar further, since risk weights now depend on more granular data about each exposure.
| Risk area | Data Basel 3.1 needs |
|---|---|
| Credit risk | Exposure detail, loan-to-value ratios, corporate revenue, external ratings, default and loss history |
| Market risk | Trading book positions, risk factor sensitivities, daily valuations |
| Operational risk | Financial statement items for the business indicator |
| Counterparty credit risk | Derivative exposures and collateral values |
| Reporting | Inputs to new, more granular regulatory templates |
Common weaknesses include fragmented legacy systems, inconsistent definitions, missing or duplicated data, unclear ownership and manual processing. Supervisors expect an end-to-end data model with common definitions, automated flows, reconciliation and clear lineage; board-level data governance with named owners and quality metrics; and data that is complete, accurate, timely and consistent. Good data also underpins the safe use of AI in credit decisions, fraud detection and customer service.
Basel 3.1 model changes coincide with wider use of AI in credit decisions, fraud detection, transaction monitoring and customer service. The PRA's supervisory statement SS1/23 sets out model risk management principles for banks that use internal models to calculate regulatory capital, covering model identification, governance, development, independent validation and the use of model risk mitigants.
For AI and machine learning models, the same disciplines apply with added attention to explainability, data bias and monitoring for drift. The FCA applies its existing rules, including the Consumer Duty and SM&CR, to AI-driven outcomes, so a named senior manager should own each material model and its customer outcomes.
Each area of the agenda translates into a small number of decisions for the board.
| Area | Board action |
|---|---|
| Basel 3.1 | Approve methodologies, review parallel-run results and confirm capital plans before 1 January 2027 |
| Operational resilience | Challenge scenario test results and fund remediation of vulnerabilities |
| Incident reporting | Confirm readiness for PS26/2 by 18 March 2027 |
| Financial crime | Review the MLRO report, monitoring effectiveness and resourcing |
| Consumer Duty | Approve the annual outcomes report and the actions arising from it |
| Data | Set data quality targets and track remediation of material gaps |
The firm's regulatory compliance and financial crime services support banks with gap analysis, independent testing and remediation across these areas.
The PRA's Basel 3.1 rules apply from 1 January 2027, with the internal models approach for market risk following on 1 January 2028.
A limit on the capital benefit of internal models: once fully phased in, modelled risk-weighted assets cannot be lower than 72.5% of the standardised calculation.
Small domestic deposit takers that meet the PRA's criteria, broadly firms with straightforward business models and limited international activity, can choose the simpler regime.
Yes. Firms in scope had until 31 March 2025 to be able to stay within impact tolerances; supervisors now focus on the quality of testing and remediation.
The FCA's PS26/2 and the parallel PRA rules apply from 18 March 2027, covering operational incidents and material third-party arrangements.
For indefinite payment account contracts entered into from 28 April 2026, at least 90 days, with specific reasons and information on how to complain.
Correspondent banking, trade finance, private banking and sanctions, each requiring risk-based due diligence, monitoring and screening.
Buckingham Capital Consulting has worked on UK financial services regulation since 2013, supporting banks, payment firms and other regulated businesses with authorisation, governance, financial crime and regulatory change. For banks, the firm provides independent gap analysis and testing across operational resilience, financial crime, Consumer Duty and regulatory data.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.