At a glance:

- The PRA’s long awaited update to SS3/19 paints a stark picture of banks’ and insurers’ progress to date on developing the capabilities they need to manage climate-related financial risks effectively.

- Aligning with the PRA’s new expectations will require significant work by all firms, and, with a relatively tight timeline for implementation, firms should get started as soon as possible on a gap analysis.

- The PRA emphasises the importance of a stronger link between firms’ strategies, governance and their climate risk management capabilities, and seeks to strengthen Board visibility and oversight of climate risk management.

- Climate scenario analysis is a key pillar of the PRA’s framework, and firms need to make significant progress. The PRA’s assessment is that no firm is capable of fully operationalising scenario analysis as a tool.

- As requested by industry, the PRA has provided more clarity on how the principle of proportionality applies. Proportionality remains closely linked to the materiality of firms’ exposure (rather than their size), and all firms are expected to produce a robust materiality assessment.

The PRA has published its long-awaited update to its supervisory statement on managing climate-related financial risks (SS3/19).

When the PRA finalised the original version of SS3/19 in 2019, firms’ climate risk management capabilities generally ranged from non-existent to nascent; the PRA was the first mover among supervisory authorities on climate-related financial risks; and political and industry momentum behind climate- and ESG-related initiatives was seemingly unstoppable.

In the six years since, a lot has changed. Firms, by and large, have made a start on developing their capabilities. EU supervisory authorities have been more vocal than the PRA on the development of climate-related (or ESG-related) risk management and the EU has already moved on to a “2.0” framework through EBA and EIOPA guidelines on ESG risk management. On the other hand, policy action related to sustainability has faced headwinds as the growth outlook has deteriorated in 2025, with governments prioritising regulatory simplification in pursuit of economic growth and international competitiveness.

In that broader context, there was some uncertainty across the industry over how ambitious the PRA’s update would be, and whether it would be willing to impose short-term costs on firms through heightened expectations in an environment in which the government is actively seeking ways to reduce the regulatory burden for firms. The PRA itself sought to temper expectations, promising “evolution rather than revolution”.

With all of that said, the PRA’s update to SS3/19 (henceforth referred to as CP10/25) strikes a robust tone. The PRA has not been shy in pointing out the (several) areas in which it considers that firms are falling short, nor does it shrink from iterating its previous expectations in a way that will create significant additional work for some firms.

The supervisory statement will likely be finalised some time towards Q3 2025, with supervisors then assessing firms’ capabilities six months after that. This is a tight timetable, given the gap between firms’ current practices and the PRA’s evolving expectations. Firms would be well advised to start a gap analysis against the draft expectations, and to start putting in place a well-resourced plan to develop their capabilities ahead of the 2026 ICAAP or ORSA cycle.

Below are seven interesting points that we picked out:

Note: we use the term “firms” where the banks’ expectations are directed at both banks and insurers, and refer directly to banks and insurers where points are addressed specifically at those sectors.

1. ”Could do better”: Supervisory report card on firms’ progress to date is blunt

In recent years, it is fair to say that, while climate has remained important to the PRA, other supervisory priorities have emerged and been more prominently highlighted in the PRA’s communications. For international banks, investment decisions have often been driven by the ECB rather than the PRA. While the PRA has made it clear at points over the past few years that firms have further to go, the political landscape has seen focus on climate diminish.

Yet some of the PRA’s assessments of firms’ progress to date in CP10/25 strike a far more robust tone than many of their recent statements – not just for a few laggards, but for all firms. For example, according to the PRA, none of the banks it supervises has fully operationalised scenario analysis as a tool or demonstrated an ability to tailor their scenario design effectively for specific use cases. Insurers’ risk management processes are still, after five years, at “early development stages”. For many firms, therefore, the baseline is shifting before they have managed to reach it. From our conversations with clients, this may be a surprise for some – many firms considered themselves to be towards the more advanced end of the spectrum already.

Once the new supervisory statement is made final, a key question will be how supervisors go about making it stick. While we see little prospect of the PRA going down the ECB’s periodic penalty payment route, it does seem likely that it will take a more robust approach to enforcement and deadlines than it did after SS3/19 was published.

2. Connectivity between governance, strategy and risk management is key

A theme that comes through clearly in CP10/25 is the need for firms to demonstrate that the climate risk management capabilities they put in place to have a tangible impact on how they steer the business. This is identified by the PRA as an area where firms have not made sufficient progress, with firms’ analysis of the impact of climate-related risks on their overall business strategies being described as “limited”.

Notably, the PRA’s proposals seek to strengthen the visibility of the Board over the climate-related risks that its firm faces, and the capabilities that are in place to manage those risks. The PRA proposes that firms’ management bodies (led by the accountable SMF) should periodically report to the Board on the appropriateness of the firm’s climate risk management practices, risk appetite and strategy. Supervisors will expect that those reviews, and any associated follow-up actions are appropriately documented, and it is reasonable to assume that they could request formal attestation in the future.

An open question ahead of the consultation being published was whether the PRA might include specific requirements for firms to produce transition plans. It has not. UK policy on transition plans is being developed separately by the UK Government. However, the PRA does set out its expectation that, where firms have adopted “goals or targets”, they should be able to demonstrate, on request, how they plan to meet those targets, and the consequent effect on their risk profile. In practice, this seems similar to the “prudential transition plan” requirements in the EBA and EIOPA’s respective ESG risk management frameworks, and firms which have goals or targets may be able to look to that framework for inspiration on how to meet the PRA’s expectation.

Integrating climate risk into risk appetite is another key task. It is no surprise, therefore, that this is an area where the PRA has gone into more detail than it had done previously. The PRA sets out a clear expectation that the risk appetite framework should be informed by scenario analysis, include quantitative metrics and limits, and be effectively cascaded to all business lines. In our experience, this is an area where firms have made relatively slow progress. However, unlike the EBA, the PRA has chosen not to propose specific risk metrics for firms to measure and monitor. Once again, firms could look to the EBA framework for inspiration, even if they are not in scope.

3. Climate Scenario Analysis (CSA): Progress made, but must try harder.

A notable aspect of CP10/25 is the increased emphasis on the role of CSA in climate risk management, both in credit or underwriting risk and market risk. While firms have made progress, there is still some way to go. For example, the PRA highlights that current industry models and toolkits fall short of capturing the full spectrum of climate-related risks. Firms often lack a full understanding of their climate risks and the shortcomings of their models, leading to underestimation of potential impacts. Many also rely on external toolkits without fully grasping the underlying assumptions. As noted above, the PRA’s view is that no firm is currently capable of designing scenarios tailored to specific use cases.

To address these limitations, the PRA aims to strengthen CSA guidance through increased detail and clarity, intending to foster, not restrict, firms' future capabilities. Firms are expected to utilise conceptually sound, research-backed CSA models and toolkits, tailoring scenarios to their specific objectives and use cases. The scenarios are expected to cover a range of horizons and plausible future outcomes (including physical, transition, and tail risks), and incorporate relevant jurisdictional climate targets. Regular review and challenge of CSA toolkits, incorporating the latest scientific advancements, will be key to ensuring scenarios stay relevant and plausible.

The PRA proposes that firms should describe how they determine the materiality of climate-related risks in their ICAAPs or ORSA, including the methodologies, assumptions, and uncertainties involved. To promote awareness of vulnerabilities, the PRA also proposes incorporating reverse stress tests into CSA, to identify scenarios that could render a firm’s business model unviable and support with risk appetite setting and development of loss limits.

CSA is another example of the PRA emphasising the need for a better link between the outputs of firms’ climate risk analysis and decision-making. Boards often struggle to use CSA effectively in decision-making processes due to limited understanding of CSA model limitations and uncertainties. To bridge this gap, the PRA recommends comprehensive training for boards and management on climate-related risks and CSA methodologies, emphasising the need for a realistic assessment of management actions and ensuring adequate resources are dedicated to address CSA capability gaps.

4. A new focus on liquidity for banks

Unlike its predecessor, the draft supervisory statement includes specific expectations for banks to capture climate-related risks in their Internal Liquidity Adequacy Assessment Process (ILAAP). This would include, at a minimum, assessment of the materiality of a bank’s climate-related liquidity risks (and justification for where the risk is considered immaterial), and assessment of the impact of material climate-related risks on net cash outflows and the value of assets in its liquidity buffers. Those assessments would then need to feed in to the level of liquidity that banks hold to meet the PRA’s Overall Liquidity Adequacy Requirement.

This brings the PRA into line with regulators elsewhere – aligning with the BCBS principles on management and supervision of climate risks and the EBA Guidelines on ESG risk management. While the PRA has observed that some banks are doing this already, in our experience the practice is not widespread. Much like for market risk, doing so effectively will rely on banks strengthening their understanding of how climate risks could materialise over short time horizons.

5. Insurers’ solvency capital requirements and asset valuation under scrutiny

Insurers are expected to improve the way they include climate-related risks in their risk management frameworks and in particular the depth and granularity of analysis in the Own Risk and Solvency Assessment (ORSA), which will be expected to include climate scenarios when climate-related risks are material. This is to ensure current risk appetites to manage catastrophe and asset risks do not underestimate the impact of climate change.

The PRA is clarifying that the Solvency Capital Requirement (SCR) calculation should reflect the impact of climate-related risk in each of its risk components – although this is not a change, the clarification should act as a wake-up call for insurers to review their SCR calculations and consider what the implicit impact of climate-related risks is and how it is being embedded. In particular, insurers relying on historical experience for modelling weather perils should consider how climate change might lead them to incur larger claims than historical data might anticipate. Insurers are also expected to consider the impact of climate change on an increase in liability claims through for example increased litigation.

The impact of climate-related risks on insurers’ balance sheets is another area of attention, in particular for those with a material Matching Adjustment (MA) portfolio. The PRA expects insurers to factor all potential credit risks, including those stemming from climate change, into their internal credit assessments. Finally, as part of their MA attestation process, insurers must consider whether the Fundamental Spread also reflects retained climate-related risks. This is likely to be a challenging prospect for the increasing pool of more complex illiquid investments that may be eligible for inclusion in the MA under the Solvency UK reforms and the recent proposals for an MA Investment Accelerator tool.

6. Proportionality spelled out more clearly, but no firms off the hook

Many in industry were hoping for greater clarity on how the principle of proportionality applies to the PRA’s expectations. SS3/19 and the PRA’s communications since have made clear that proportionality is not based on size, but rather on the materiality of the firm’s exposure. This principle remains in place – there is no differentiation of expectations based on size thresholds, for example.

The PRA is proposing a two-step process to ensuring that firms’ capabilities are proportionate to their exposure. As a first step, all firms are expected to come to a robust view (that is signed off by the Board, documented through the ICAAP or ORSA and periodically reviewed) on the materiality of climate-related risks to their business. This process would need to be supported by scenario analysis reflecting both the current state and future evolution of the firm’s balance sheet and, interestingly, reverse stress testing – albeit there is some room for firms to use less sophisticated versions of these techniques at this stage in the process (e.g. using scenario narratives quantified with expert judgement).

As a second step, where a firm has assessed that the risk is less material to its business (and the PRA agrees with that assessment), there is some leeway on the sophistication of the risk management tools and techniques that the PRA expects the firm to use – for example, in the granularity of counterparty level risk assessments, the range of monitoring metrics used, and the frequency of reporting to and engagement by the Board.

But, given that all firms need to complete the first step, no firm is off the hook – even if the materiality assessment will naturally be less complex for smaller firms.

7. Not much content on disclosure, but more to come from elsewhere

Overall, the PRA does not propose substantial changes to its previous expectations on climate-related disclosures, beyond pre-emptively changing references to TCFD to UK SRS in anticipation of UK endorsement of the ISSB standards. Previous references to Pillar 3 disclosure have been removed.

While, in practice, many in-scope firms will be captured by the upcoming ISSB-aligned FCA disclosure requirements for listed issuers (expected to be consulted on in Q3 2025), there is no explicit expectation that firms adopt ISSB. However, the PRA does note that the broader proposals in the consultation “should strengthen firms’ ability to produce high-quality decision-useful disclosures based on ISSB”.

Conclusion

Given the number and extent of gaps identified, firms should not wait until the final supervisory statement is issued. Aside from responding to the consultation, we would suggest the following actions:

1. Start a gap analysis against the draft expectations. We would recommend that gap analysis covers the areas we have highlighted above, in particular: governance, strategy and risk management – how much visibility does the Board have of the firm’s climate risk? And CSA – is the range and severity of the firm’s scenarios appropriate given the range of use cases?
2. Ensure robust materiality assessment is in place
3. Start putting in place a well-resourced plan to develop capabilities ahead of the 2026 ICAAP or ORSA cycle. Again, a central area of focus should be on CSA.

As noted by the PRA, the size and distribution of future risks will be determined by actions taken now. It clearly has little appetite for firms failing to take the required actions to safeguard their future resilience to climate related risks. Given the slow progress among UK FS firms so far, for many it will be time for another step change.