The Prudential Regulation Authority, part of the Bank of England, supervises banks, building societies, credit unions, insurers and a small number of major investment firms. Its objectives are the safety and soundness of the firms it regulates, appropriate protection for insurance policyholders, and the resilience of the financial system. That makes PRA compliance different from FCA conduct supervision: the questions are about capital, liquidity, solvency, governance, recovery and operational resilience.
Most PRA-authorised firms are dual-regulated, with the FCA supervising their conduct. Prudential and conduct duties therefore need to be governed together, so that a capital decision, an outsourcing or a product change is assessed against both sets of rules before it is made.
The PRA's Business Plan 2026/27, published on 17 April 2026, sets four strategic priorities: keeping banks and insurers safe, sound and resilient; identifying new risks and shaping international policy; supporting competitive markets and growth; and running an efficient regulator. Within these, the work firms feel most directly is Basel 3.1 implementation, the Strong and Simple regime for small banks, operational resilience and third-party risk, cyber, artificial intelligence and continued implementation of Solvency UK.
| Area | Main requirements |
|---|---|
| Banks and building societies | Capital, liquidity, ICAAP, ILAAP, stress testing, recovery planning, governance and regulatory reporting |
| Basel 3.1 firms | New capital framework from 1 January 2027 (PS1/26) |
| Small domestic deposit takers | Simplified Strong and Simple capital regime from 1 January 2027 (PS4/26) |
| Insurers | Solvency UK: solvency capital requirement, technical provisions, governance, ORSA and reporting |
| Senior Managers and Certification Regime | Senior accountability, statements of responsibilities, fitness and propriety; phase 1 changes from 24 April 2026 (PS12/26) |
| Operational resilience | Important business services, impact tolerances, mapping, scenario testing and remediation |
| Outsourcing and third parties | SS2/21 governance, due diligence, contracts, concentration and exit planning |
| Climate-related risk | SS5/25 expectations on governance, risk management and scenario analysis |
| Recovery and resolution | Recovery plans and, for smaller firms, solvent exit planning |
| Model risk | SS1/23 for banks with internal model approval; proportionate model governance elsewhere |
| Regulatory reporting | Accurate, timely returns built on governed data |
| New authorisation | Capital, business model, governance, risk management and mobilisation planning |
Rules differ by entity type, size and permissions. Compliance work should begin by identifying the PRA Rulebook parts, supervisory statements and policy statements that apply to the specific firm, and mapping each to an owner, a process and evidence.
The PRA published its final Basel 3.1 rules in PS1/26 on 20 January 2026. The standards and the related reporting requirements take effect on 1 January 2027. The internal models approach for market risk under the Fundamental Review of the Trading Book follows on 1 January 2028; until then firms keep their existing internal model permissions. The PRA states that the final rules are designed not to raise overall capital requirements across the sector.
For most banks, 2026 is the final implementation year. The changes reach every part of the risk-weighted assets calculation:
Finance, risk, regulatory reporting and technology need to work from the same data and assumptions, because inconsistencies between them surface quickly in parallel runs and in supervisory questions. Boards should see the capital impact by portfolio well before the first reporting date, so that pricing and business mix can be adjusted in time.
The PRA plans an off-cycle review of firm-specific Pillar 2 capital requirements before 1 January 2027, so that Pillar 2 reflects the new Pillar 1 framework. The firm's analysis of the challenges for UK banks in 2026 and 2027 covers Basel 3.1 alongside operational resilience and supervisory intensity.
The internal capital adequacy assessment process (ICAAP) is the bank's own assessment of the capital it needs for all material risks, including those not fully captured by Pillar 1 such as concentration, interest rate risk in the banking book and pension risk. It should inform capital planning and business decisions, not only satisfy the PRA.
The internal liquidity adequacy assessment process (ILAAP) assesses whether a bank can meet its obligations through a period of liquidity stress. Liquidity can deteriorate faster than capital, which is why the PRA expects the same discipline here as for capital.
The Strong and Simple framework gives eligible small domestic deposit takers (SDDTs) a simpler prudential regime. PS4/26, published on 20 January 2026, finalised the simplified capital regime and further liquidity simplifications. The capital regime and its reporting requirements take effect on 1 January 2027. Changes to ICAAP update frequency, including reverse stress testing, and to ILAAP update frequency took effect on publication.
| Criterion | Threshold |
|---|---|
| Size | Average total assets of no more than £20 billion over the past three years |
| Domestic activity | UK credit exposures of at least 75% at all times and at least 85% on average |
| Trading activity | Limited trading book and foreign exchange positions; no commodity positions |
| Approach to credit risk | No internal ratings-based models |
| Ownership and services | UK bank or building society with no non-UK parent; no clearing, settlement, custody or correspondent banking for other banks |
Simplification does not reduce the PRA's expectations of governance or of the board's understanding of risk. Firms close to a threshold should monitor growth, international activity and trading so that a change in eligibility is planned rather than discovered.
Pillar 2 covers risks not adequately captured by Pillar 1 and the quality of the firm's risk management. Pillar 2A sets additional capital for specific risks; the PRA buffer covers the firm's vulnerability to stress. Simplified Pillar 2A methodologies for SDDTs take effect on 1 January 2027, and the PRA is reviewing firm-specific Pillar 2 requirements for other banks ahead of Basel 3.1.
Pillar 2 is not only a reporting exercise. Credit concentration, interest rate risk, pension obligations and operational risk all drive it. When models, risk systems and regulatory reports classify the same exposures differently, the firm loses the ability to explain its own capital, and that is what supervisors probe.
Banks maintain recovery plans proportionate to their size and systemic importance, and non-systemic banks plan for a solvent exit. The PRA looks for options that can actually be executed under stress.
Solvency UK is the prudential framework for UK insurers, covering capital, technical provisions, governance, risk management and reporting. It replaced the retained Solvency II regime, with the main reforms completed by the end of 2024. The solvency capital requirement (SCR) and the minimum capital requirement (MCR) are the core measures, alongside internal models, the matching adjustment and transitional measures where they apply.
The PRA continues to treat Solvency UK implementation as a supervisory priority in 2026/27 and launched the Matching Adjustment Investment Accelerator at the end of 2025. Supervision looks beyond reported ratios to the quality of risk management, the credibility of management actions and liquidity. The firm's guide to FCA compliance for UK insurers covers the conduct side of the same firms.
The own risk and solvency assessment (ORSA) is the insurer's assessment of its risk profile, capital needs and solvency under normal and stressed conditions. It should reflect the strategy and inform decisions on risk appetite, capital, reinsurance and business planning, rather than repeat the SCR calculation. Stress testing should cover adverse claims experience, market movements, liquidity and operational disruption, and the board should challenge it. For new insurers, the PRA reviews draft ORSA material as part of authorisation.
Funded reinsurance, used heavily alongside the growth in bulk purchase annuities, remains a PRA focus under SS5/24. The PRA plans to consult during 2026/27 on the next phase of policy for a consistent, risk-sensitive capital treatment. Insurers should assess counterparty, collateral, recapture and concentration risk, test combined adverse scenarios and bring actuarial, investment, risk and legal expertise into governance of each arrangement.
SM&CR applies to PRA-regulated banks and insurers. The PRA's PS12/26, issued on 22 April 2026, set out phase 1 of its review, with rule and supervisory statement changes effective from 24 April 2026 and changes to the application forms on 10 July 2026. Changes include removing the need for a new criminal record check when an existing senior manager moves to another senior management role in the same group, and requiring only the latest statements of responsibilities and responsibilities maps within a six-month window.
HM Treasury has confirmed a second phase of legislative change, including removing the certification regime from primary legislation and reducing the number of roles needing pre-approval, when parliamentary time allows. Firms should update approvals, statements of responsibilities, fitness and propriety processes and governance documents, and make sure responsibilities match where decisions are actually taken, including at group level. The firm's guide to SM&CR in 2026 sets out the changes across both regulators.
The transition period for the PRA's operational resilience policy ended on 31 March 2025. Firms must now show that they can remain within impact tolerances for each important business service in severe but plausible disruption scenarios. The 2026 focus is effectiveness and continuous improvement, and new operational incident and third-party reporting rules, developed with the FCA and the Bank, take effect in March 2027.
Cyber resilience is a separate line of PRA work. The PRA continues CBEST intelligence-led penetration testing with the National Cyber Security Centre, supports the Cyber Security and Resilience Bill and is reviewing systemic firms' cyber response and recovery capabilities. Firms should be able to show how long it takes to restore each important business service after a destructive cyber attack, not only after a technology outage.
The critical third parties regime lets the regulators oversee services whose disruption could threaten financial stability. Designation does not transfer responsibility from the firm, which still needs contingencies, data portability and exit plans. Groups with EU entities should align this work with the EU Digital Operational Resilience Act.
PS25/25, published on 3 December 2025, introduced SS5/25 on banks' and insurers' management of climate-related risks, replacing SS3/19 in full. Climate risk is expected to sit inside governance, risk management, scenario analysis and decision-making, not run as a separate disclosure project.
For banks, the effects run through credit, market, operational and liquidity risk via customers, collateral and sector exposures. For insurers, they run through underwriting, investments and liabilities. Analysis should be useful for decisions, and uncertainty in the data is a reason to use ranges and judgement, not a reason to defer action.
The PRA uses reporting data directly in supervision, so accuracy, data lineage and governance are prudential controls in their own right. Returns should be reproducible from controlled source data and reviewed by people who understand what they show.
Insurers report under Solvency UK; banks are implementing Basel 3.1 and, for SDDTs, Strong and Simple reporting from 1 January 2027. Change programmes should include reporting from the start. Errors should be assessed for significance and corrected, and repeated errors attract supervisory attention.
Banks and insurers use models for credit, pricing, capital, claims, fraud and operations. SS1/23 sets the PRA's model risk management principles for banks with internal model approval, and covers machine learning used in modelling. The depth of oversight should follow the model's materiality, not whether the technique is labelled AI.
The PRA's 2026/27 plan commits it to monitoring firms' use of AI and supporting responsible adoption. Reliance on a vendor does not remove the need to understand material model risk, and a model inventory with risk classification focuses assurance where it matters. The firm's guide to AI governance for financial services covers the inventory, ownership and testing supervisors expect.
Capital, operational resilience and financial crime decisions affect prudential and conduct outcomes at the same time. A single register of obligations, with each mapped to its owner and evidence, keeps the firm's explanations to both regulators consistent.
Major change, such as an acquisition, a restructuring, a new product or a significant outsourcing, can affect threshold conditions, capital, conduct and resilience together. The regulatory impact assessment should happen before the decision becomes hard to reverse.
A new bank or insurer applies to the PRA, which authorises with the FCA's consent. The statutory period under the Financial Services and Markets Act 2000 is six months for a complete application and twelve months for an incomplete one. New banks commonly use the mobilisation route: the PRA authorises the firm with restrictions, such as a cap on deposits, and the firm has up to twelve months to complete its build-out, raise the remaining capital and recruit before the restrictions are lifted.
The PRA's New Bank and New Insurer Start-up Units offer pre-application meetings. They look for a credible business plan with capital and liquidity projections under stress, a board and senior managers with the right experience, a risk management framework, ICAAP and ILAAP or ORSA material in draft, recovery and solvent exit planning, and operational resilience and outsourcing arrangements that work from day one. Payment institutions and EMIs follow a different route: they are authorised by the FCA alone, and many use that route before considering a banking licence.
| Date | Change |
|---|---|
| 31 March 2025 | Operational resilience transition ended |
| 3 December 2025 | SS5/25 on climate-related risks took effect, replacing SS3/19 |
| 20 January 2026 | PS1/26 (Basel 3.1) and PS4/26 (Strong and Simple) published; SDDT ICAAP and ILAAP frequency changes took effect |
| 24 April 2026 | PRA SM&CR phase 1 rule changes took effect |
| 1 January 2027 | Basel 3.1, SDDT simplified capital regime and simplified Pillar 2A for SDDTs |
| March 2027 | Operational incident and third-party reporting rules |
| 1 January 2028 | Market risk internal models approach under Basel 3.1 |
The firm's regulatory compliance service supports banks with Basel 3.1, Strong and Simple, ICAAP, ILAAP and reporting readiness, and insurers with Solvency UK, ORSA, operational resilience and outsourcing, coordinating with actuarial, model and legal specialists where a matter needs them.
Banks, building societies, credit unions, insurers and a small number of major investment firms, together with certain holding companies. Most are also regulated by the FCA for conduct.
From 1 January 2027 under PS1/26, published on 20 January 2026. The market risk internal models approach applies from 1 January 2028.
A simpler prudential framework for eligible small domestic deposit takers, broadly UK-focused banks and building societies with up to £20 billion in average total assets. Its capital regime applies from 1 January 2027.
The UK prudential framework for insurers, covering capital, technical provisions, governance, risk management, reporting and the ORSA. It replaced the retained Solvency II regime.
Yes. Firms must show they can stay within impact tolerances, keep mapping and testing current, and prepare for new incident and third-party reporting rules taking effect in March 2027.
PRA phase 1 changes in PS12/26 took effect on 24 April 2026, simplifying criminal record checks for internal moves and submissions of statements of responsibilities. A legislative phase 2 will follow.
Buckingham Capital Consulting has supported regulated financial firms on authorisation, governance and regulator engagement since 2013. It works with banks and insurers on prudential obligations mapping, SM&CR, operational resilience, outsourcing and reporting controls, alongside their FCA conduct obligations.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.