Risk Advisory · Step-in risk
Step-in risk is the risk that a bank decides to provide financial support to an unconsolidated entity facing stress, without or beyond any contractual obligation to do so. The definition comes from the Basel Committee’s guidelines of October 2017, which name avoiding reputational risk as the main reason a bank steps in.
We build and review step-in risk frameworks for banks, building societies and groups under the PRA’s rules: the policy, the register, the entity assessments and the SI0, SI1 and SI2 returns filed with the ICAAP. Your board gets an assessment it can approve, and your team a process it can repeat.
By Mark Dougherty, CPA (CAN)Updated
The UK rules
Step-in Risk Part and SS1/25 in force
The PRA set out its final policy in PS5/25 on 22 April 2025, after consulting in CP23/23. It created a Step-in Risk Part of the PRA Rulebook and supervisory statement SS1/25, both in force since 1 January 2026. SS31/15, the PRA’s statement on the ICAAP, does not mention step-in risk.
The core rule is one line, “A firm must identify, monitor and manage step-in risk” (Rule 3.1), and the Part adds four obligations:
Sources: Bank of England, PS5/25, 22 April 2025; SS1/25 Step-in Risk; PRA Rulebook, Step-in Risk Part.
Scope
The rules apply to CRR firms and CRR consolidation entities unless they are SDDTs or SDDT consolidation entities (Step-in Risk 1.1). PS5/25 says the policies “are not relevant to small domestic deposit takers (SDDTs)” (para 1.2), so step-in risk is one more obligation a firm sheds by opting into the SDDT regime.
Application is consolidated for a CRR consolidation entity, sub-consolidated where Parts Two and Three of the CRR apply on that basis (ring-fenced sub-groups included), and individual for a firm outside a consolidation group (Step-in Risk 2.1 to 2.6). A firm need not identify a securitisation special purpose entity (SSPE) where it only holds a senior position and is not the original lender, originator or sponsor (Rule 6.2).
Reporting
| Data item | In SS1/25 | Required when |
|---|---|---|
| SI700.00 | SI0 | The firm is in scope of the rules |
| SI01.00 | SI1 | The firm has at least one step-in entity |
| SI02.00 | SI2 | The firm has at least one material step-in entity; capital and liquidity estimates only where step-in risk is significant (PS5/25 para 2.22) |
The three data items sit in chapter 24 of the Regulatory Reporting Part and go in “at the same time as the firm submits its ICAAP assessment to the PRA” (Rule 24.5), so the step-in work runs to the ICAAP timetable.
That is where it usually slips. The register has to be settled well before the ICAAP is finalised, because an entity found late means a new assessment and a changed SI2 while the board is reading the ICAAP. SI2 also carries the indicators the assessment must consider (Rule 7.2), so we write the two together.
Sources: PRA Rulebook, Regulatory Reporting Part, chapter 24; SS1/25; PS5/25.
Entities
Outsourced providers are the easiest to miss: they sit outside the accounting group, so a register built from the consolidation schedule will not find them.
| Entity | Basel Committee, October 2017 | PRA |
|---|---|---|
| Securitisation vehicles and conduits | Annex 2: RMBS, CMBS and other ABS, covered bond issuers, CDOs, CLOs, ABCP conduits, SIVs and repackaging vehicles | SS1/25 Annex 1; SSPEs in the Glossary |
| Funds | Annex 2, including money market funds and ETFs | SS1/25 Annex 1: mutual, hedge and private equity funds; REITs |
| Asset management companies | Para 26 | Glossary |
| Finance companies and securities firms | Annex 2 | SS1/25 Annex 1; financial institutions in the Glossary |
| Ancillary services undertakings | Not named | Glossary |
| Outsourced service providers | Para 28: critical operational services that cannot be substituted in time | Glossary: “suppliers under material outsourcing arrangements” |
| Joint ventures and equity-method entities | Para 21 | Glossary |
Assessment
Materiality comes first. An entity is immaterial if support would not materially affect the firm’s capital or liquidity, and SS1/25 expects a quantitative threshold, for example against CET1 or total assets, set for PRA-authorised firms within a group as well (paras 4.1 to 4.2).
Each material entity is assessed on its purpose and design, the risk indicators and the potential impact of support (Rules 7.2 and 7.3). The Basel indicators, such as sponsorship and implicit support, “are not ordered by importance” (para 36); a policy that ranks them as primary and secondary is working from the December 2015 consultation.
An entity can be material to the firm without the firm being likely to step in, and the assessment has to say which. Step-in risk is significant “where there is a strong indication overall that a firm will step in” (SS1/25 para 2.2), and the mitigation duty covers significant risk from material entities.
The UK also drops the Basel collective rebuttal, under which a clearly enforceable law of general application that explicitly prohibits support lets a bank exclude an entity (para 31). The PRA “does not consider that this is a ground for excluding an entity” (PS5/25 para 2.19); the prohibition counts as a mitigant instead (SS1/25 para 4.8).
Sources: BCBS, Guidelines: Identification and management of step-in risk, October 2017; PRA SS1/25; PRA PS5/25.
After the assessment
Where step-in risk is significant, the firm estimates the effect of support on ratios including CET1, the LCR and the NSFR (SS1/25 para 3.1). SS1/25 lists the responses:
The risk is addressed, where appropriate, in the ICAAP and the liquidity contingency plans (SS1/25 para 3.2), in line with the Basel reference to Pillar 2 (para 8). SS1/25 leaves out the Basel punitive ex post capital charge.
Firms in scope also move to Basel 3.1 on 1 January 2027, often with one ICAAP team doing both.
Sources: BCBS guidelines, October 2017; PRA SS1/25; Bank of England, PS1/26, 20 January 2026.
Beyond the UK
In the EU, step-in risk sits in the consolidation rules. CRR Article 18(8), added by the 2019 Risk Reduction Measures package, lets competent authorities require full or proportional consolidation of certain non-financial undertakings where there is a substantial risk of step-in, and Commission Delegated Regulation (EU) 2022/676 covers it.
For a group with UK and EU entities, the two regimes ask different questions: the PRA asks the firm to assess and report the risk, while the EU rule lets the supervisor pull the entity into consolidation. We map both where a group needs to.
Sources: EBA, 15 April 2021; Regulation (EU) 2022/676.
How we help
As with all our Risk Advisory work, you choose advice or consulting: an independent review before the board sees it, or a team that holds the pen and hands over.
The policy, the standard operating procedure and the methodology behind them, including who owns the register and where the materiality threshold sits.
Sponsored vehicles, funds, outsourced and connected service providers and other related entities, each classed as material or immaterial with the reason recorded.
A written assessment of each material entity against the indicators and its mitigants, with capital and liquidity estimates where the risk is significant.
Built from the register and the assessments and filed alongside the ICAAP, so the returns and the ICAAP agree.
Papers for the management body, which approves the assessment and the policy (Rules 9.1 and 9.2), and for the board risk committee, which the Basel guidelines expect to take the policy as a separate agenda item.
Each ICAAP cycle we rerun the register, add the year’s new vehicles, funds and suppliers, and rebuild the returns. Board training can come from Risk Education.
Track record
Yes. We have a complete step-in risk framework built on the Basel Committee’s guidelines and the SI0, SI1 and SI2 returns, with every document ready to tailor to your firm: the policy, the standard operating procedure and methodology, the register of in-scope entities, the returns themselves, and the written assessments of individual entities, including outsourced service providers and connected entities, that go to the risk committee and the board.
You start from finished documents rather than a blank page. The work is led by Mark Dougherty, CPA (CAN), our technical lead, with former CROs, heads of risk and regulators, and model and quant specialists.
FAQ
No. PS5/25 says the step-in risk policies are not relevant to SDDTs. A firm that is eligible for the SDDT regime but has not opted in is not an SDDT, so the rules still apply to it.
Not an automatic one. The Basel guidelines entail no automatic Pillar 1 capital or liquidity charge, and SS1/25 omits the punitive ex post charge from its responses. Where step-in risk is significant, the firm addresses it, where appropriate, in its ICAAP.
The policy must be reviewed at least every three years and the assessment updated regularly, with the management body approving both. Because the returns go in with each ICAAP, both need to be current each time.
Yes. We review what you have against the Step-in Risk Part and SS1/25 and give the risk committee a written view of the gaps.
Insights
From 1 January 2027 an ICAAP has to be written on a Basel 3.1 basis. The PRA set this out in PS15/26: ICAAPs signed off by boards in 2026 should include an impact assessment of Basel...
By Mark Dougherty, CPA (CAN) · 8 min read
The ICAAP is a bank’s own assessment of whether it holds enough capital for its risks; the ILAAP asks the same question of its liquidity and stable funding. The two sit in different Parts of the...
By Mark Dougherty, CPA (CAN) · 7 min readDated PRA changes that affect a UK bank's risk function, with a link to the source for each, updated on the first working day of each month.
RiskTAENext step
Tell us when your next ICAAP goes to the board and how far the register has got. We will tell you what it would take to be ready, and whether you need advice, consulting or both.
Tell us what needs doing and by when. A partner will come back to you. Treated in confidence.
Prefer email? advisory@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.