Insights · Reference
UK regulatory tracker for risk functions
The RiskTAE regulatory tracker is a dated list of the PRA changes, with a few from the FCA and the Bank of England, that affect the risk function of a UK bank or building society. Each row gives the date, the change, who it applies to and a link to the regulator’s own document.
Use it to check which dates your ICAAP and board calendar need to allow for. We update it on the first working day of each month. Last updated .
Coming up
What regulatory changes are still to come?
Dated changes from 29 September 2026 onwards, soonest first. Eight of them fall on 1 January 2027, when Basel 3.1 and the SDDT capital regime take effect together with the first Pillar 2A changes.
| Date | Change | Who it affects | Source |
|---|---|---|---|
| Basel 3.1 takes effect, apart from the internal model approach for market risk. The PRA’s rules replace the CRR articles that HM Treasury revoked from the same date. Basel 3.1 reporting starts, and SS11/13 (IRB) and SS14/13 (operational risk) are withdrawn. What Basel 3.1 means for you | Banks, building societies, PRA-designated investment firms and their holding companies. SDDTs apply their own capital regime instead. | PRA PS1/26, paras 1.23, 1.26, 2.9 and 2.14 SI 2026/45, made 13 January 2026 | |
| The output floor starts at 60%: total risk-weighted assets cannot fall below 60% of the amount calculated on standardised approaches, with an adjustment for provisions. The factor rises each January until 2030. What Basel 3.1 means for you | Firms using IRB or other internal models | PS1/26 Appendix 1, Article 92(5)(a) | |
| Deadline to have assessed every existing residential and commercial real estate exposure for material dependence on cash flows from the property. Lending that depends on those cash flows attracts higher risk weights. What Basel 3.1 means for you | Firms with real estate lending on the standardised approach | PRA PS1/26, para 2.6 | |
| Limits on the scope of IRB take effect through amended IRB permissions. Income-producing real estate on foundation or advanced IRB moves to the standardised approach unless the firm applies to use slotting. What Basel 3.1 means for you | Firms with IRB permissions | PRA PS1/26, para 2.10 | |
| The SME and infrastructure support factors leave Pillar 1. Firm-specific Pillar 2A adjustments replace them, set so that removing the factors does not increase a firm’s capital requirements in total. What it means for your ICAAP | Firms lending to SMEs or financing infrastructure | PRA PS7/25, para 1.7 (22 May 2025) PRA PS1/26, para 1.7 | |
| The SDDT capital regime and its reporting take effect, including a Single Capital Buffer in place of the capital conservation, countercyclical and PRA buffers. SS4/25 replaces SS31/15 as the ICAAP statement for SDDTs. What the SDDT regime means for you | SDDTs, which join the regime by modification by consent | PRA PS4/26, paras 1.15, 1.16 and 1.19 | |
| The refined methodology to Pillar 2A is retired for all firms. What it means for your ICAAP | Banks and building societies, SDDTs included | PRA PS2/26, para 1.11 | |
| Pillar 2A review, phase 1. The benchmarking methodology goes, IRB benchmarks included, and new systematic methodologies cover exposures to central governments, central banks, regional governments and local authorities, and retail unconditionally cancellable commitments. A second consultation is due in 2027. What it means for your ICAAP | Banks, building societies and PRA-designated investment firms; the credit risk changes do not apply to SDDTs | PRA PS15/26, paras 1.6, 1.12 and 2.1 (28 May 2026) | |
| Operational incident and third-party reporting starts. Incidents are reported on one form completed in three phases, and new or changed material third-party arrangements are notified in advance, both through FCA Connect. A register of those arrangements goes to FCA RegData once a year. A new SS1/26 and an updated SS2/21 apply. | Banks, building societies and PRA-designated investment firms | PRA PS7/26, para 3.6 (18 March 2026) | |
| The internal model approach for market risk (FRTB IMA) takes effect. Existing IMA permissions, kept for the 2027 interim year, lapse automatically at its end, and the FRTB IMA reporting templates start. What Basel 3.1 means for you | Firms with, or applying for, IMA permission | PRA PS1/26, paras 1.24, 3.11 and 3.27 | |
| The output floor rises to 65%. What Basel 3.1 means for you | Firms using IRB or other internal models | PS1/26 Appendix 1, Article 92(5)(b) | |
| Latest date for the PRA’s review of all the SDDT criteria, the £20 billion size threshold included, which gives it the chance to rebase them, for example for inflation. What the SDDT regime means for you | SDDTs and firms close to the criteria | PRA PS15/23, para 2.27 | |
| The output floor rises to 70%. What Basel 3.1 means for you | Firms using IRB or other internal models | PS1/26 Appendix 1, Article 92(5)(c) | |
| The output floor reaches its full 72.5%, the transitional period having ended on 31 December 2029. What Basel 3.1 means for you | Firms using IRB or other internal models | PS1/26 Appendix 1, Articles 92(2A) and 92(5) PRA news release, 17 January 2025 |
Recently in force
What has changed since January 2025?
Rules that took effect, and final rules and consultations that were published, from January 2025 to September 2026, most recent first.
| Date | Change | Who it affects | Source |
|---|---|---|---|
| CP9/26 proposes adjustments to the FRTB internal model approach, including how the profit and loss attribution test is monitored and how non-modellable risk factors are treated. The IMA start date stays at 1 January 2028. Responses closed on 18 September 2026 and the proposals are not final. What Basel 3.1 means for you | Firms with IMA approval or considering an application | PRA CP9/26 | |
| Senior Managers and Certification Regime, phase 1. A firm covering a senior manager vacancy under the 12-week rule now has 12 weeks to submit a complete application, where before the application had to be decided in that time, and the interim holder is subject to the Senior Manager Conduct Rules. Criminal record checks may be up to six months old at submission, and updated statements of responsibilities are due within six months of a significant change. Some form and process changes followed on 10 July 2026. | All PRA-authorised firms and their senior managers, including whoever holds the Chief Risk function (SMF4) | PRA PS12/26, para 1.23 (22 April 2026) FCA PS26/6 | |
| Deadline for the Basel 3.1 Pillar 2 data collection (reference date 31 December 2025), relaunched on 25 September 2025. The data feeds the PRA’s off-cycle review to remove double counting between Pillar 1 and Pillar 2A. Some firms also sent FSA080 market risk data by the same date. What it means for your ICAAP | Firms in scope of Basel 3.1; eligible firms that opted in to the SDDT regime were exempt | Bank of England, Basel 3.1 data collection exercise | |
| The PRA publishes the final Basel 3.1 rules in PS1/26, with no substantive change to the near-final rules outside market risk, and PS2/26 retiring the refined methodology to Pillar 2A. What Basel 3.1 means for you | Banks, building societies, PRA-designated investment firms and their holding companies | PRA PS1/26, para 1.7 PRA PS2/26 | |
| The PRA publishes the final SDDT capital regime in PS4/26. Some parts apply from publication: SDDTs other than new and growing banks update their ICAAP and ILAAP every two years, and the new rules on how often reverse stress testing is run take effect. What the SDDT regime means for you | SDDTs | PRA PS4/26, paras 1.15 and 1.16 | |
| The Interim Capital Regime is revoked and SoP3/23 deleted. With Basel 3.1 and the SDDT regime aligned on 1 January 2027 it was no longer needed, and it never operated as a live capital regime. What the SDDT regime means for you | SDDT-eligible firms that had joined it or planned to | PRA PS4/26, para 1.17 PRA PS1/26, para 2.16 | |
| Step-in risk rules take effect: the Step-in Risk Part of the PRA Rulebook and SS1/25, finalised in PS5/25 on 22 April 2025. Firms must identify, monitor and manage step-in risk, and prepare and regularly update a step-in risk assessment. The SI700.00 return, with SI01.00 where there is any step-in entity and SI02.00 where any is material, goes in at the same time as the ICAAP. What step-in risk means for you | CRR firms and CRR consolidation entities that are not SDDTs | PRA PS5/25, para 1.15 PRA Rulebook, Regulatory Reporting Part, chapter 24 | |
| Large exposures changes: immovable property can no longer be used as credit risk mitigation to reduce exposure values, the exemption for exposures to the UK deposit guarantee scheme is removed, and a new SS3/25 sets out how to identify groups of connected clients. | Banks, building societies, PRA-designated investment firms and holding companies | PRA PS14/25, para 1.20 (17 July 2025) | |
| The Bank of England’s revised MREL statement of policy applies. The indicative total assets range for a bail-in or transfer resolution strategy rises to £25 billion to £40 billion (previously £15 billion to £25 billion), and the Bank expects to set MREL for transfer firms equal to their minimum capital requirements. | Banks and building societies with total assets near or above £25 billion | Bank of England policy statement on MREL, 15 July 2025 | |
| SS5/25 on managing climate-related risks replaces SS3/19 with immediate effect. Banks should reflect material climate risks in the ICAAP and ILAAP, and be able to show a supervisor how they judged a climate risk immaterial. Firms had six months to review their position and plan how to close the gaps. What it means for your ICAAP | Banks, building societies, PRA-designated investment firms and insurers; not UK branches of overseas firms | PRA PS25/25, paras 1.20 and 2.10 | |
| Solvent exit planning: Chapter 7 of the Recovery Plans Part comes into force and firms must meet SS2/24, which includes preparing a solvent exit analysis as part of business as usual. | UK banks and building societies that are not G-SIIs, O-SIIs or subject to the Operational Continuity Part | PRA PS5/24, para 1.9 | |
| End of the operational resilience transition. Firms must be able to remain within the impact tolerance for each important business service in a severe but plausible disruption. | Banks, building societies, PRA-designated investment firms and insurers | PRA SS1/21, paras 4.14 and 4.16 | |
| The PRA delays Basel 3.1 by a year to 1 January 2027 and shortens the transitional periods so that full implementation stays at 1 January 2030. It pauses the Pillar 2 data collection at the same time. What Basel 3.1 means for you | Firms preparing for Basel 3.1 | PRA news release, 17 January 2025 |
Method
How is the tracker compiled?
We list a change only when the regulator has stated its date, and we give the date it takes effect as well as the date it was published, because the two can be close to a year apart. The final Basel 3.1 rules were published on 20 January 2026 and take effect on 1 January 2027.
When a new policy statement lands, read its implementation paragraph first. It usually sits at the end of chapter 1, and it often splits the policy: PS4/26 brought the SDDT changes to ICAAP and ILAAP frequency into force on 20 January 2026, almost a year before the rest of the regime.
We check every source again on the first working day of each month, move rows to the second table once their date has passed, and mark a consultation as not final until its policy statement arrives. If one of these dates falls inside your next ICAAP cycle, our ICAAP and Basel 3.1 pages set out what the work involves.
Sources: every row links to the regulator’s own document (Bank of England and PRA publications, the PRA Rulebook, the FCA or legislation.gov.uk), opened and checked on 29 September 2026, with the paragraph that states the date where there is one.
One expert firm
The rest of the risk function, from the same team
Next step
Find out which dates are yours
Tell us which rows apply to your firm and how far the work has got. A partner will tell you what it would take to be ready, and whether you need advice, consulting or both.
Scope an advisory need
Tell us what needs doing and by when. A partner will come back to you. Treated in confidence.
Prefer email? advisory@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.