By Alix Prentice

Partner | Financial Regulation

In Supervisory Statement SS31/15, the UK’s Prudential Regulation Authority (“PRA”) updates banks and the large investment firms it supervises on its expectations for their Internal Capital Adequacy Assessment Process (“ICAAP”) and Supervisory Review and Evaluation Process (“SREP”). SS31/15 provides further detail underpinning the high-level PRA expectations set out in its “approach to banking supervision” in the following areas, effective from 1 July 2026:

1. Expectations of firms undertaking an ICAAP

• Firms are reminded that ICAAP assessments are an ongoing obligation that involve more than just the PRA’s own methodologies because they must reflect the level and nature of the bank’s own risk exposure. ICAAPs are the responsibility of a firm’s management body and an integral part of the management process and decision making, necessitating robust and demonstrable systems, controls and information flow.
• Firms electing to recognise guarantees as qualifying as unfunded credit protection by substituting the risk weight of an obligor with that of a guarantor are expected to assess whether that substitution is appropriate and whether that credit protection could become ineffective for a reason other than guarantor default, such as the guarantor seeking to be released from liability under the guarantee or the operational risk that the guarantee is breached such that the guarantor may be entitled not to pay out.
• Banks are required to maintain appropriate and proportionate systems and processes in order to identify, evaluate and manage interest rate risk in the banking book (“IRRBB”). Again, oversight and ultimate approval of the bank’s risk appetite and IRRBB is the responsibility of its management body, who receive direct reports from those responsible for identifying, measuring, monitoring and controlling IRRBB.
• ICAAPs should include evidence as to how the bank has calculated its additional capital provisioning for market risk, and in particular for assigning liquidity horizons in stressed situations.
• ICAAPs must also address group risk, that is, the risk that the financial position of a bank might be affected by its connections with other entities in the same group, whether financial or non-financial.  The PRA’s expectations here include whether or not there is any under-allocation of capital to the UK member of a group, and if so, how that risk is dealt with, and where a firm is a member of a consolidation group including an entity established outside the UK, whether any ex-UK capital requirements or buffers lead to any group risk.
• For managing operational risk, the PRA refers to business continuity plans as a key ICAAP element.
• Pension obligation risk is subject to both the firm’s own assessment and a set of stresses on the accounting basis applied by the PRA to that assessment.
• When dealing with exposures to securitisations in an ICAAP, banks should consider the risk characteristics and structural features of both the securitisation and its underlying exposures to the extent they could materially impact the performance of any positions held by the bank.  Banks should also consider whether the application of another method, SEC-IRBA, SEC-ERBA or SEC-SA, insofar as it may be used, would result in a materially different risk weight, and whether any difference may be caused by identified risk characteristics and structural features as well as the approach taken by a third party rating agency.
• Banks are now also expected to understand risks from climate change, and, using scenario analysis, how they will affect their business model.
• When looking at ICAAP assessment of the risk of excessive leverage, the PRA focusses on the risk of contingent leverage, and circumstances such as those in which firms are contractually obligated to maintain a transaction with a particular counterparty even though it is detrimental to the firm’s leverage ratio position.

2. Stress testing, scenario analysis and capital planning

• As expected, the PRA’s expectations is that stress and scenario testing should include sensitivity and scenario analysis, and test at individual portfolio as well as firm-wide level.
• The exercise should be carried out at least annually, and more frequently if risks identified in the ICAAP process suggest that is appropriate.
• Capital planning should be done over a three to five year horizon.
• The bank’s management body should be actively involved and engaged at all relevant stages.

3. Reverse stress testing

• Reverse stress testing is an exercise in which stress tests and scenario analyses are carried out to test a firm’s business plan to the point of failure, thereby revealing its vulnerabilities.
• The PRA requires firms to identify any unacceptably high business model failure risks and develop measures to prevent or mitigate these. 
• Reverse stress testing scenarios should also include failures of major counterparties or market disruption as a result of such a failure.

4. SREP

• The SREP is the process in which the PRA reviews the ICAAP, the risks the firm is exposed to and those it poses, the risks shown up by the firm’s stress testing programme, its governance, culture, management body capabilities, and resources.
• The PRA looks at whether the firm’s resources and risk management measures adequately address its risk profile in order to achieve sound coverage.
• If not, the PRA will require the firm to take appropriate steps at an early stage.
• The PRA will also base certain elements of capital requirements that it sets, including the PRA buffer, on the SREP.