Climate risk under the clock: PRA gives firms six months to complete gap analysis

With the UK government’s messaging emphasising economic growth over green targets, banks and insurers might have been tempted to relegate climate risk down their priority list.  But a new PRA Supervisory Statement 4/25 (SS4/25) has landed, following a consultation that closed in July 2025.   

SS4/25 aims to support firms’ risk assessment and management, better enabling them to build resilience against climate-related risks and make informed decisions about their strategy.  It covers the same four general areas of governance, risk management, climate scenario analysis and disclosures as its predecessor SS3/19 but provides far greater detail on how to meet the PRA’s expectations.  There’s also a new chapter dedicated to climate-related data as well as banking and insurance-specific chapters. 

Proportionality is an overarching theme.  Firms are expected to identify the climate-related risks they face and tailor their efforts accordingly. This is a two-step process: first, firms should assess the potential impact of climate-related risks on their business model, through relevant scenario analysis (see further below); second, they should adopt a risk management response that is proportionate to that assessed risk profile.  In practice, firms are likely to leverage existing work (such as that undertaken under the Corporate Sustainability Reporting Directive) to determine the appropriate level of response. 

Some other notable aspects of SS4/25 include:

• Governance:  Climate-related responsibilities may be assigned within firms’ established governance arrangements and do not require a separate structure. For now, there’s no new dedicated climate Senior Management Function.
• Risk management: Firms should assess and identify climate risks periodically, based on the latest scientific evidence, so that no material risks go unrecognised. They should be incorporated across the Internal Capital Adequacy Assessment Process (ICAAP) and Internal Liquidity Adequacy Assessment Process (ILAAP) for banks, and own risk and solvency assessment (ORSA) for insurers. Firms may choose to treat litigation as a distinct transmission channel when that better reflects their business model and risk profile.
• Scenario analysis: This actually needs to inform business decision-making, with flexibility for narrative approaches over longer time horizons. Reverse stress testing (i.e. exercises that identify the point of failure of a firm solely due to climate-related risks) are likely to prove useful for firms exposed to material climate risks.
• Climate data: Data and model uncertainty is recognised by the PRA as an integral part of managing climate risks. Firms need to understand the limitations of the data they use, especially from third-party climate data providers, and apply proxies where necessary.  

If it wasn’t already clear, the PRA has indicated that climate risks - like other financial and operational risks - are rooted in its primary objectives to promote the safety and soundness of firms and protect insurance policyholders.  Having been the first prudential regulator to publish a comprehensive set of climate-related risk management expectations for firms in 2019, it has now set an even higher bar.  Banks and insurers have six months from publication to review their position and set a credible plan for closing any gaps to comply with the new policy.