UK PRA's new supervisory statement: detail provided to banks and insurers on climate risk management approach

For the first time in 2019, the PRA set out its expectations for banks’ and insurers’ management of climate-related risks with Supervisory Statement 3/19. 

Earlier this year it consulted on an update to that SS in its consultation paper 10/25. Following feedback, the PRA has now published Supervisory Statement 5/25, which is its update to and replacement of SS 3/19, along with its policy statement 25/25 which describes its approach.

Links here to the policy statement and the new supervisory statement.

The purpose of this SS is described as being to provide greater clarity and detail as requested by firms in scope, and to bring the expectations up to date with international standards and developments in the understanding of climate-related risks since 2019. Indeed, there is a lot more specificity in this SS than has been provided previously, particularly in relation to expectations around governance practices. There is also a strong focus on the need for evidence to back-up decisions made.

Key expectations include:

• Governance:
  • Boards must set climate risk appetite and oversee integration into strategy.
  • Executive management should ensure climate risk is embedded in decision-making and be able to demonstrate to the board how the firm’s business strategy and risk management approach is responding to climate-related risks to its business model.
  • Boards should review and agree the material climate-related risks identified periodically, and put in place governance to manage the monitoring and assessment of the firm’s risk appetite going forward.
  • No new SMF is required but responsibilities for climate risk must be held at an appropriately senior level, e.g. by an SMF. Allocation of responsibility should be clearly articulated with the appropriate information going up to the board.
• Risk Management:
  • Firms should identify material climate risks and incorporate them into existing frameworks, including credit, market, and operational risk processes.
  • Firm’s should include all material climate-related risks in the firm risk register (or a subset of that) and agree this at the board.
  • To inform their risk identification and assessment, firms should assess the risks arising from relationships with clients, counterparties, investees and policyholders and to identify only those relationships that have a material impact on their climate-related risk profile.
• Scenario Analysis: Firms should use climate scenario analysis to inform strategy and risk decisions, applying robust assumptions and methodologies.
• Data & Disclosure:
  • Firms must assess data quality, address gaps, and align disclosures with international standards.
  • Data gaps must be identified and understood (and not quantified, as previously drafted in the consultation paper) on an ongoing basis.
  • Where further investment in data tools is needed, firms should demonstrate plans to manage and remedy these gaps with processes in place to ensure that developments in data and tools will be identified and incorporated accordingly into their approach.
  • Firms should evolve their disclosures to make these as insightful as possible, and in particular, should ensure they reflect the firms’ evolving understanding of climate-related risks.
• Proportionality: Approaches should reflect the firm’s size, complexity, and exposure to climate risk. Firms should follow a two-step process to ensure their approach to climate-related risk management appropriately reflects the materiality of the climate-related risks they face. In step 1, all firms should carefully assess the potential impact of climate-related risks on their business model. In step 2, a firm that is materially exposed to climate-related risks would need to make a greater investment in monitoring and managing those risks compared to a firm that is less exposed. Firms should be able to evidence or explain how they have made any judgements that underpin the outcomes from steps 1 and 2.

Timelines

• Effective now: the new Supervisory Statement SS4/25 has replaced SS3/19 since 3 December 2025.
• Begin internal review: Firms should review compliance and develop remediation plans immediately, as there is only a fairly short six month grace period before PRA may start to interact with firms on this.
• Mid-2026: PRA supervisors may request evidence of internal reviews after a six-month bedding-in period.
• Ongoing: Climate risk management will form part of routine supervision from 2026 onwards.

Next steps for firms

• Conduct a gap analysis against PRA expectations. PRA expects firms to carry out an internal review of their current position against the updated expectations set out in this SS. As noted above, this should be completed within six months of commencement of the SS (ie by 3 June 2026). As part of this internal review, firms should identify the expectations that require further work for them to meet, and develop a plan for how they will address any gaps. The PRA will not ask for evidence rom this internal review until at least after the six-month internal review period has passed. As and when evidence is requested, it should be “both credible and ambitious”.
• Update governance and risk frameworks to integrate climate risk. These should be reviewed “regularly” and where necessary lead to updates of internal risk assessments and proposed climate actions.
• Expect and prepare for supervisory engagement in 2026.