Towards a Dynamic and Proportionate Regulatory Framework
The UK banking sector is supervised through a structured risk-based approach led by the Prudential Regulation Authority (PRA), part of the Bank of England. The PRA’s mandate is to ensure “the safety and soundness of the firms we regulate, focusing on the adverse effects that they can have on the stability of the UK financial system” (PRA, 2023, p. 6). This risk-based framework does not aim to eliminate failures but ensures that when they occur, they do so in an orderly manner without jeopardizing the broader economy.
Key Principles: Judgment-Based, Forward-Looking, and Focused on Risks
Risk-based supervision in the UK follows three key principles: it is judgment-based, forward-looking, and focused on key risks. According to the PRA, supervisors “reach judgements on the risks that a firm is running, the risks that it poses to our objectives, whether the firm is likely to continue to meet the Threshold Conditions, and how to address any problems or shortcomings” (PRA, 2023, p. 12).
A forward-looking approach means assessing potential future risks, rather than reacting to past crises. This involves continuous horizon-scanning to anticipate vulnerabilities that could emerge over time. “Through our horizon-scanning work, we assess firms not just against current risks, but also against those that could plausibly arise further ahead” (PRA, 2023, p. 12).
Risk Assessment and Categorization of Banks
The PRA classifies banks based on their potential impact on financial stability, the risks inherent in their business models, and their external risk factors. Banks are assigned to one of four impact categories, ranging from Category 1 (most significant institutions) to Category 4 (least systemically important). The PRA states:
“The most significant firms whose size, interconnectedness, complexity, and business type give them the capacity to cause very significant disruption to the UK financial system” are placed in Category 1, while firms in Category 4 have “almost no capacity individually to cause disruption” (PRA, 2023, p. 18).
For smaller institutions like credit unions and building societies, a more proportionate and simplified approach is applied, ensuring that compliance costs do not unduly burden them while maintaining financial resilience. The Strong and Simple prudential framework supports this balance by tailoring regulation to non-systemic firms.
Supervising Ring-Fenced Banks and Systemic Institutions
A crucial pillar of UK banking regulation is the ring-fencing framework, introduced in 2019 to separate core retail banking from riskier investment activities. “Ensuring that the business of ring-fenced bodies (RFBs) is carried on in a way that avoids any adverse effect on the continuity of the provision in the UK of core services” is a key supervisory objective (PRA, 2023, p. 7).
For globally and domestically systemically important banks (G-SIBs and D-SIBs), the PRA conducts intensive supervision, including:
• Regular capital and liquidity stress testing
• In-depth risk management reviews
• Enhanced scrutiny of governance structures
These institutions are expected to maintain higher capital buffers and demonstrate resolvability in crisis scenarios to protect the financial system from cascading failures.
Supervising International Banks Operating in the UK
The UK is home to numerous international banks operating through branches or subsidiaries. The PRA’s approach to supervising these entities depends on their home country’s regulatory framework. Subsidiaries must adhere to UK prudential rules, while branches are assessed based on the strength of their home regulator. The PRA states:
“We expect all UK branches, like UK subsidiaries, to act responsibly in a manner that is consistent with safety and soundness and the appropriate protection of policyholders” (PRA, 2023, p. 23).
For branches engaging in wholesale banking activities, the PRA evaluates their systemic risk and may impose stricter regulatory requirements. International cooperation through supervisory colleges ensures alignment with global regulatory standards.
Key Enforcement and Supervisory Tools in Risk-Based Banking Supervision
The Prudential Regulation Authority (PRA) employs a range of enforcement and supervisory tools to ensure that banks maintain financial resilience and adhere to regulatory standards. Four of the most critical tools include engagement with senior management and boards, regular stress testing, thematic reviews, and the use of Skilled Persons Reports (s166). Each of these mechanisms plays a vital role in safeguarding financial stability and preempting risks that could threaten the UK’s banking system.
1. Engagement with Senior Management and Boards to Assess Governance Effectiveness
One of the most critical aspects of risk-based supervision is continuous engagement with a bank’s senior management and board of directors. The PRA places a strong emphasis on effective corporate governance, ensuring that decision-making structures support the safety and soundness of financial institutions. The supervisory authority assesses whether boards are actively challenging management decisions, fostering a culture of risk awareness, and embedding prudent financial controls within the institution.
To evaluate governance effectiveness, the PRA examines several key factors:
• Board Composition & Diversity: The regulator ensures that boards have diverse skill sets, industry experience, and independent perspectives to avoid groupthink and enhance decision-making.
• Accountability under the Senior Managers & Certification Regime (SM&CR): The PRA expects banks to clearly assign responsibilities to senior leaders and hold them accountable for risk management and compliance failures.
• Risk Culture & Internal Controls: The effectiveness of risk management frameworks, control functions, and internal audit processes is assessed. A strong risk culture must be reflected in clear reporting lines, robust risk oversight, and mechanisms to prevent excessive risk-taking.
• Remuneration and Incentives: The PRA scrutinizes executive compensation structures to ensure they do not encourage short-termism or excessive risk-taking. Bonus deferrals and clawback provisions are examined to align incentives with long-term stability.
The PRA engages with boards through structured meetings, thematic discussions, and direct supervisory interventions when necessary. If deficiencies are identified, institutions are required to implement remediation plans to strengthen governance standards.
2. Regular Stress Testing to Evaluate Capital and Liquidity Resilience
Stress testing is a cornerstone of the PRA’s supervisory approach, designed to assess banks’ ability to withstand adverse economic conditions. These forward-looking exercises help regulators understand how financial institutions would react to severe shocks, such as an economic downturn, liquidity crisis, or market collapse.
The PRA conducts both firm-specific and system-wide stress tests, examining various financial risks, including:
• Credit Risk: The impact of rising default rates on loan portfolios.
• Market Risk: The effect of volatile asset prices, exchange rate fluctuations, and interest rate shocks.
• Liquidity Risk: A bank’s ability to withstand short-term funding pressures and sudden deposit withdrawals.
• Operational & Cyber Risk: How banks would cope with technological failures, cyberattacks, and other operational disruptions.
Stress tests are scenario-based, simulating conditions that go beyond historical financial crises to assess banks’ resilience. The results determine whether a firm needs to increase capital buffers, adjust liquidity management strategies, or strengthen risk mitigation practices.
When a bank fails a stress test, it may be required to raise additional capital, reduce risky exposures, or modify its business strategy to ensure compliance with prudential regulations. The PRA works closely with the Financial Policy Committee (FPC) of the Bank of England to refine stress testing methodologies and integrate new risks into the framework.
3. Thematic Reviews on Emerging Risks Across Multiple Firms
In addition to institution-specific supervision, the PRA conducts thematic reviews to assess risks that affect multiple firms or the entire financial sector. These reviews provide regulators with a broader perspective on systemic vulnerabilities and help shape industry-wide regulatory policies.
Key areas that may be subject to thematic reviews include:
• Cybersecurity & Operational Resilience: Evaluating how banks protect themselves against cyber threats and technological disruptions.
• Climate Risk & Environmental Sustainability: Assessing banks’ preparedness for risks arising from climate change and regulatory shifts towards green finance.
• Conduct & Culture: Reviewing whether institutions have implemented ethical business practices, especially in areas such as anti-money laundering (AML), fraud prevention, and customer protection.
• New Business Models & Fintech Innovation: Monitoring risks associated with digital banking, cryptocurrency adoption, and artificial intelligence (AI)-driven financial services.
The PRA shares thematic review findings with banks to help them benchmark their risk management practices against industry best practices. When weaknesses are identified across multiple firms, regulators may issue policy guidance, revise supervisory expectations, or impose new industry-wide standards.
4. Use of Skilled Persons Reports (s166) for Independent Assessments
Under Section 166 of the Financial Services and Markets Act 2000 (FSMA), the PRA has the authority to commission Skilled Persons Reports (s166) to obtain an independent and detailed assessment of a bank’s risk management, governance, or compliance frameworks.
These reports are typically ordered when the PRA has serious concerns about a firm’s ability to meet regulatory requirements but requires further evidence before deciding on enforcement actions. A third-party expert (the Skilled Person) is appointed to conduct an in-depth review, focusing on areas such as:
• Governance Failures: Examining whether senior management is effectively overseeing the institution’s risk framework.
• Financial Crime & AML Compliance: Investigating lapses in anti-money laundering policies, fraud controls, and Know Your Customer (KYC) practices.
• Capital & Liquidity Management: Assessing whether a bank is adequately capitalized and has a robust liquidity buffer.
• IT Resilience & Cybersecurity: Evaluating a bank’s ability to withstand cyber threats, data breaches, and IT disruptions.
Once the review is completed, the Skilled Person submits a detailed report to the PRA, outlining key findings and recommendations. The regulator may use these findings to:
• Mandate corrective actions within the bank.
• Impose capital add-ons or other prudential measures.
• Initiate enforcement actions if regulatory breaches are identified.
If a bank is deemed non-compliant or at risk of failure, the PRA takes early intervention measures. The Proactive Intervention Framework (PIF) is used to assess distress levels and recommend corrective actions. If resolution is necessary, the Financial Services Compensation Scheme (FSCS) ensures that eligible depositors are protected.
The PRA emphasizes that “firms should be allowed to fail, and we will work to ensure that any failure is orderly”, ensuring continuity of critical functions without public bailouts (PRA, 2023, p. 10).
Conclusion: A Resilient and Adaptive Supervision Model
The UK’s risk-based banking supervision ensures financial resilience while fostering a dynamic banking sector. By adopting a judgment-based, forward-looking, and proportionate approach, the PRA protects financial stability without stifling competition. The emphasis on early intervention, systemic risk assessment, and international coordination makes this framework robust against future financial crises. As the banking landscape evolves, the PRA remains committed to enhancing risk-based supervision through improved data analytics and adaptive regulatory strategies.
References
Prudential Regulation Authority. The Prudential Regulation Authority’s Approach to Banking Supervision. Bank of England, July 2023.
Leave a Reply