The PRA raises the bar on climate risk: what banks need to do now

Update, August 2026. This piece was written while CP10/25 was still open. The Prudential Regulation Authority (PRA) published the final standard as Supervisory Statement 5/25 in December 2025: paragraph 3.1 brings it into force on 3 December 2025, and from that date it "replaces SS3/19 in its entirety".¹ The direction below is the one the PRA took, and the section headings still map onto the statement’s own chapters. What has changed is that none of it is a proposal any more. The six-month internal review the statement asks for fell due on 3 June 2026, and supervisors undertook not to ask for evidence of it until then, so the window in which a firm could reasonably still be preparing has closed.

The PRA’s supervisory statement SS5/25, published in December 2025 after consultation in CP10/25, marks a decisive shift in how UK banks are expected to manage climate-related risks.² SS3/19, published in April 2019, made the PRA the first prudential regulator anywhere to publish climate expectations.³ Building on it, SS5/25 moves beyond setting foundations and focuses on implementation, accountability, and integration across risk frameworks.

What follows are the key takeaways from the statement, and concrete examples of what the PRA expects to see from banks.

Governance and accountability

One of the strongest messages in SS5/25 is that climate risk needs to be embedded into the core of how firms are governed and managed.

Boards are expected to set clear climate-related risk appetites and to ensure climate risk is properly integrated into decision-making at all levels. Integrating climate risk into decision-making includes regular reporting to the board, documented reviews, and senior manager accountability. SS5/25 is specific about what should survive as evidence. Under paragraph 3.18 the board reviews and agrees the material climate-related risks the firm has identified and records them in the risk register, with an agreed timeline for the next review. Paragraph 4.20 adds that the register should carry a risk categorisation, and paragraph 4.12 gives accept, manage or avoid as an example of one.¹ The individual assigned climate responsibility should have climate-related objectives, and performance against them should be reflected in the firm’s appraisal and reward system. The statement gives variable remuneration as the example.

What to do: firms need governance processes that do more than tick boxes. They need board-level discussions informed by climate risk analysis, and a clear link between stated climate goals and the way the business is run.

Risk management

The PRA wants firms to treat climate risk like any other core financial risk, which means it needs to be present in risk registers, appetite frameworks, limits, and management information.

SS5/25’s expectations are clearer now: quantitative metrics where appropriate, scenario-informed limits, and risk identification that drills down to sector, geography, and counterparty level.

What to do: start with a thorough review of how climate risk is identified and monitored. Are credit limits informed by climate exposures? Is there a consistent view of climate risk across business lines? Can the risk appetite metrics stand up to scrutiny?

Climate scenario analysis

Climate scenario analysis (CSA) is a central pillar of the new framework, and an area where the PRA has been blunt: firms aren’t doing enough.

The most concrete measurement of that gap comes from the European Central Bank (ECB) rather than the PRA. In its 2022 climate risk stress test of euro-area significant institutions, at a reference date of 31 December 2021, around 60% of banks did not yet have a well-integrated climate risk stress-testing framework, and, on a separate question, only around 40% reported a framework of any kind in place.⁴ Of those that did, roughly 40% did not use its outcomes when implementing business strategy, and only 19% used it to inform loan granting. UK firms were not in that sample, but the diagnosis is the one both supervisors keep returning to.

The PRA wants to see scenario analysis that is tailored, objective-driven, and used meaningfully. That includes using scenarios to test strategic plans and capital resilience, and reverse stress testing. Our guide to climate scenario analysis covers how such an exercise is built.

What to do: build CSA processes that are credible, challengeable, and well documented. Off-the-shelf tools may help, but the PRA expects firms to understand their limitations and assumptions. Outputs need to link back to business planning, the ICAAP, and risk limits.

Data: gaps are not an excuse

The PRA acknowledges the industry’s data challenges, but it also makes clear that data gaps don’t justify inaction. Where perfect data isn’t available, firms should use proxies or conservative assumptions, with proper documentation and governance. SS5/25 attaches a condition to that permission rather than granting it outright: less granular proxies are acceptable where the firm is aware of the limitations of those tools and makes a prudent interpretation of the information they produce when informing decision-making. A proxy used without stating what it cannot see is not the concession the statement offers.

Banks should also be able to show how external data is validated, and how its limitations are factored into model use.

What to do: review the climate risk data strategy. Are controls in place for data lineage and quality? Are climate assumptions in models transparent and challengeable? What is the plan to close the gaps?

ICAAP and ILAAP: integration is no longer optional

Climate risk now needs to be factored explicitly into both the ICAAP and the ILAAP. For capital, that means demonstrating how scenario outcomes affect loss projections, capital buffers, and business model viability. For liquidity, the PRA wants banks to assess how climate-related risks could hit funding outflows, asset liquidity, and the value of liquid buffers. SS5/25 puts it through the firm’s own materiality judgement rather than a supervisory formula: paragraph 4.22 asks firms to consider whether their assessment of risk materiality "is appropriate for the calculation of regulatory capital and liquidity requirements" and to expand their list of material risks for regulatory purposes as required.¹ There is no climate capital add-on to await. The route into capital runs through the material-risk list a firm maintains itself.

What to do: if climate isn’t already embedded in capital and liquidity stress testing, now is the time to build that capability, with governance oversight and board sign-off.

Proportionality: based on exposure, not size

Proportionality isn’t about how big you are. It’s about how exposed you are.

Every firm needs to carry out a materiality assessment. SS5/25 sets this out as a two-step process: in step 1 all firms assess the potential impact of climate-related risks on their business model, and in step 2 a firm that turns out to be materially exposed has to make a greater effort.¹ Size enters at the second step rather than the first. A smaller firm with material exposure may deploy less sophisticated tools and less granular data proxies, but only where it is aware of their limitations and interprets what they produce prudently. The assessment itself exempts nobody.

What to do: even smaller firms should have a clear view of their exposure to climate risk, supported by scenario analysis, even if simpler, and formal board-level review.

Disclosures and reporting: the next wave is coming

SS5/25 does not itself rewrite disclosure requirements, but paragraph 4.83 expects firms to engage with wider initiatives on climate-related risk disclosures, including the UK Sustainability Reporting Standards (UK SRS). It was CP10/25 that explained the direction, noting that the Task Force on Climate-related Financial Disclosures had been disbanded and its recommendations folded into the standards UK SRS is built on. Disclosures will need to reflect how climate risk is integrated into strategy, governance, and risk frameworks, rather than sitting in standalone climate reports.

What to do: use the time before the next wave of disclosure requirements arrives to get the reporting suite in order. Map where climate risk sits in the reporting suite, and identify opportunities to improve clarity, consistency, and credibility.

What banks should be planning now

The PRA has outlined its expectations. Firms need to move from theory to action, and these are the examples banks should be considering today.

Credit risk and lending

• Buy-to-let portfolios: assess Energy Performance Certificate (EPC) ratings across the mortgage book. Properties rated D or below may face transition risk through future regulation or reduced tenant demand.
• Underwriting policies: incorporate climate risk indicators, such as flood zone or wildfire exposure, into affordability models and approval criteria.
• Portfolio monitoring: track exposures to high-emitting sectors or geographies vulnerable to physical risks, and use that to update appetite statements and trigger early warning indicators.

Physical risk mapping

Use geospatial data and postcode-level overlays to identify loans secured against properties exposed to:

• Flood risk, via Environment Agency flood zone mapping
• Wildfire and heatwave risk, especially for international property portfolios in southern Europe or the US West Coast
• Coastal erosion or sea-level rise, for mortgages in low-lying areas

Business and transactional risk

• For corporate lending, integrate transition risk into credit approval: the borrower’s decarbonisation strategy, sector climate exposure, and reliance on fossil-linked revenues.
• Include climate red flags in due diligence. Are suppliers or clients in flood-prone areas? Is the borrower over-concentrated in a declining, carbon-intensive market?
• Align risk appetite by setting exposure caps on vulnerable industries or locations.

Management information

Develop dashboards showing climate-adjusted loan performance by region and sector, the EPC distribution of property portfolios, trends in exposure to climate-stressed industries, and scenario analysis outputs mapped to strategic plans and limits.

Capital planning

Model downside climate scenarios across residential and commercial real estate portfolios, high-LTV loans in flood-prone areas, and SME lending to sectors with no viable transition path, such as coal and peat extraction. Adjust capital buffers or provisioning strategies to reflect the findings.

The start of a new phase

SS5/25 sets a higher bar. The PRA is no longer asking firms whether they’re thinking about climate risk. It’s asking how they’re managing it, how it affects their business, and how their decisions reflect that understanding.

The final rules landed in December 2025 as SS5/25, and the six-month internal review they asked for fell due on 3 June 2026. Paragraph 3.4 sets the standard a firm should be able to meet when a supervisor asks for that review: a timetable to address any gaps that is "both credible and ambitious". Firms that used the consultation window to build the capability are now demonstrating it. Firms that waited are having the conversation with a supervisor rather than ahead of one.

Frequently asked questions