Insights
RiskTAE Insights explains the UK prudential rules and senior risk appointments a bank board has to act on: the ICAAP and ILAAP, Pillar 2A, Basel 3.1 from 1 January 2027, the SDDT regime, and hiring or covering a chief risk officer under SMF4. Every article names its author and links to its primary sources.
Start here
All insights
35 articles and guides
A head of non-financial risk leads the second-line oversight of a bank's risks that do not arise from lending, trading or funding: operational risk, operational resilience, third-party and outsourcing risk, technology and cyber risk, and in some banks conduct and model risk. The role challenges the first line and reports on these risks to the CRO and the board.
By Benn Pople · 6 min read
An interim chief risk officer covers the role full time for a fixed period, usually while the permanent CRO is found; a fractional chief risk officer holds the role part time on a continuing basis. Either way the person performs the Chief Risk function, SMF4, and needs PRA approval unless the 12-week rule for short cover by an employee applies.
By Benn Pople · 9 min read
A chief risk officer job description for a UK bank has to do two jobs: describe the role to candidates and match the statement of responsibilities that goes to the PRA with the SMF4 application. This template sets out both, with the Risk Control Part requirements and the prescribed responsibilities to consider for a CRO.
By Benn Pople · 7 min read
A wind-down plan sets out how an FCA-regulated firm would close its business in an orderly way, with enough money and people to return client assets and settle what it owes without harming customers or markets. This template follows the FCA's Wind-down Planning Guide section by section, with the MIFIDPRU and payments rules that sit alongside it.
By Mark Dougherty, CPA (CAN) · 8 min read
SS4/25 is the PRA supervisory statement that sets its expectations of the ICAAP for small domestic deposit takers. It replaces SS31/15 for SDDTs from 1 January 2027, and its expectations on how often an SDDT updates its ICAAP have applied since 20 January 2026, when PS4/26 brought the two-yearly cycle into force.
By Mark Dougherty, CPA (CAN) · 8 min read
A solvent exit analysis is the PRA's requirement for a non-systemic UK bank or building society to show how it could stop its PRA-regulated activities in an orderly way while still solvent. Chapter 7 of the Recovery Plans Part has applied since 1 October 2025, with the PRA's expectations set out in SS2/24.
By Mark Dougherty, CPA (CAN) · 8 min read
Recovery indicators are the capital, liquidity, profitability and asset quality measures a bank sets in its recovery plan to warn that it is moving towards a stress in which recovery options may be needed. SS9/17, last updated in March 2026, expects them calibrated to the firm's own buffers and tested against severe scenarios.
By Mark Dougherty, CPA (CAN) · 8 min read
Which prudential assessment a firm needs depends on its regulator and its business. UK banks and building societies write an ICAAP, an ILAAP and a recovery plan, plus a solvent exit analysis if non-systemic; FCA investment firms run an ICARA; Solvency UK insurers write an ORSA; and the FCA expects payment and e-money firms to keep a wind-down plan.
By Mark Dougherty, CPA (CAN) · 7 min read
An ORSA, or Own Risk and Solvency Assessment, is an insurer's own assessment of the risks it faces and the capital it needs to stay solvent over its business plan, including under stress. Under Solvency UK the PRA expects the board to own it, use it in decisions and report the results to the PRA.
By Mark Dougherty, CPA (CAN) · 7 min read
An ILAAP, or Internal Liquidity Adequacy Assessment Process, is a bank's own assessment of whether its liquidity resources and funding are adequate in amount and quality, now and under stress. The PRA Rulebook requires one from every bank and building society, and the PRA reviews it in the liquidity SREP to set individual liquidity guidance.
By Mark Dougherty, CPA (CAN) · 9 min read
An ICARA, or Internal Capital Adequacy and Risk Assessment, is the process an FCA investment firm under MIFIDPRU uses to identify the harms its business could cause, decide the own funds and liquid assets it needs to cover them and to wind down in an orderly way, and record the result for its board and the FCA.
By Mark Dougherty, CPA (CAN) · 9 min read
The PRA buffer, also called Pillar 2B, is capital a bank or building society should hold on top of its Total Capital Requirement (Pillar 1 plus Pillar 2A) and its combined buffer, to absorb losses in a severe stress. The PRA sets it after the supervisory review, mainly from the firm’s stress test results net...
By Mark Dougherty, CPA (CAN) · 9 min read
A UK bank hiring a senior manager, a certification function holder or a notified non-executive director must request regulatory references covering the candidate’s previous six years from every relevant former employer, and must normally hold them before the PRA will approve a senior manager. PS12/26, in force since 24 April 2026, left the core rules...
By Benn Pople · 8 min read
A skilled person review is an independent report the PRA requires under section 166 of FSMA on a matter it wants analysed, monitored or put right, usually written by a professional services firm and paid for by the bank. The PRA’s policy is in SS7/14, and in 2025/26 it commissioned 14 reviews, all of banks...
By Mark Dougherty, CPA (CAN) · 8 min read
The Business Indicator is the measure of size that sets a UK bank’s Pillar 1 operational risk capital from 1 January 2027. It is the sum of three components taken mainly from the income statement, each averaged over three years: interest, leases and dividends; services; and the financial component. The bank multiplies it by marginal...
By Mark Dougherty, CPA (CAN) · 8 min read
The legal limit is three months from the day the regulator receives a complete application. In practice the PRA is much faster: its median time to decide senior manager applications was 28 days between December 2025 and February 2026, down from 62 days a year earlier, and 98% of SMF applications in that period were...
By Benn Pople · 7 min read
Pillar 2A is the firm-specific capital the PRA requires a bank or building society to hold on top of its Pillar 1 minimum, for risks Pillar 1 does not capture or does not capture fully, such as credit concentration and interest rate risk in the banking book. The PRA sets it after reviewing the firm’s...
By Mark Dougherty, CPA (CAN) · 7 min read
A chief risk officer runs a bank’s independent risk management function. In the UK the role is a regulated senior management function, SMF4, defined as “responsibility for overall management of the risk controls of a firm, including the setting and managing of its risk exposures”, with a direct reporting line to the board. The CRO...
By Benn Pople · 7 min read
In a UK bank the chair of the risk committee performs a senior management function of their own, SMF10, and needs PRA approval before taking up the role. The PRA requires a risk committee, and so an SMF10, in firms it classes as significant, and the chair must not perform any executive function in the...
By Benn Pople · 7 min read
The UK’s version of the Fundamental Review of the Trading Book (FRTB) arrives in two steps. From 1 January 2027 the new trading book boundary and the two new standardised approaches apply with the rest of Basel 3.1; the new internal model approach follows on 1 January 2028. In the year between, a firm with...
By Mark Dougherty, CPA (CAN) · 7 min read
The ICAAP is a bank’s own assessment of whether it holds enough capital for its risks; the ILAAP asks the same question of its liquidity and stable funding. The two sit in different Parts of the PRA Rulebook and feed different PRA reviews, but a supervisor expects both to rest on one balance sheet and...
By Mark Dougherty, CPA (CAN) · 7 min read
From 1 January 2027 an ICAAP has to be written on a Basel 3.1 basis. The PRA set this out in PS15/26: ICAAPs signed off by boards in 2026 should include an impact assessment of Basel 3.1, and those signed off from 1 January 2027 “should be prepared on a Basel 3.1 basis”, including the...
By Mark Dougherty, CPA (CAN) · 8 min read
An ICAAP, or Internal Capital Adequacy Assessment Process, is a bank's own assessment of how much capital it needs, of what type and where, to cover its risks now and over its business plan, including under stress. The PRA requires one from every bank and building society and uses it in the SREP to set Pillar 2 capital.
By Mark Dougherty, CPA (CAN) · 6 min read
The Basel 3.1 output floor stops a firm’s modelled risk-weighted assets falling below a set share of what the standardised approaches would produce. In the UK it starts at 60% on 1 January 2027 and rises every 1 January until it reaches 72.5% on 1 January 2030. It only binds where internal models produce lower...
By Mark Dougherty, CPA (CAN) · 7 min read
Most UK banks and building societies that meet the nine SDDT criteria, and expect to keep meeting them, should join the strong and simple regime. From 1 January 2027 an SDDT holds one Single Capital Buffer of at least 3.5% of RWAs instead of three buffers; since 20 January 2026 most SDDTs update their ICAAP...
By Mark Dougherty, CPA (CAN) · 6 min read
When a chief risk officer resigns, a UK bank can put someone into the Chief Risk function (SMF4) without regulatory approval for less than 12 weeks in any consecutive 12-month period, provided the absence was temporary or reasonably unforeseen. Since 24 April 2026, under the PRA’s PS12/26, that cover no longer stops at 12 weeks:...
By Benn Pople · 7 min read
Basel 3.1, the PRA's version of the final Basel III reforms, applies to UK banks and building societies from 1 January 2027. It reworks the standardised approaches and phases in an output floor that reaches 72.5% of standardised risk-weighted assets on 1 January 2030.
By Mark Dougherty, CPA (CAN) · 7 min readHow to write an ICAAP the PRA takes seriously: structure, stress testing, capital planning and board challenge, from people who write them.
By Mark Dougherty, CPA (CAN)A practitioner's guide to Basel 3.1 in the UK: what applies on 1 January 2027, what to have ready and what the PRA will look for. Free to read.
By Mark Dougherty, CPA (CAN)A practical guide to the PRA's simplified capital regime for small domestic deposit takers: eligibility, the choice to opt in and what changes.
By Mark Dougherty, CPA (CAN)A board's guide to hiring a chief risk officer in the UK: the brief, the search, the assessment, SMF4 approval and the first 100 days in post.
By Benn PopleCheck whether your bank or building society meets the PRA's nine criteria for the strong and simple (SDDT) regime, with each rule cited and explained.
RiskTAEPlan when a new chief risk officer can act as SMF4: notice, references, the PRA's decision times and the three-month limit.
RiskTAEDated PRA changes that affect a UK bank's risk function, with a link to the source for each, updated on the first working day of each month.
RiskTAEPlain-English definitions of the terms UK risk leaders use, including ICAAP, Pillar 2A, SMF4 and the output floor, written by practitioners.
RiskTAEReference
Practitioner guides for UK bank boards on Basel 3.1 readiness, the SDDT regime, the ICAAP and hiring a chief risk officer, with checklists and sources.
02Free tools for UK bank boards and risk teams: an SDDT eligibility checker for the strong and simple regime and an SMF4 approval timeline planner.
03Dated PRA changes that affect a UK bank's risk function, with a link to the source for each, updated on the first working day of each month.
04Plain-English definitions of the terms UK risk leaders use, including ICAAP, Pillar 2A, SMF4 and the output floor, written by practitioners.
Talk to us
Twenty minutes with a partner. Tell us what is on your desk and we will tell you straight whether we can help.
What happens on the call