Managing climate-related risk

The PRA has published its promised consultation (CP10/25) on enhancements to banks’ and insurers’ approaches to managing climate-related risk. The CP comes with a draft supervisory statement which will replace SS3/19.

CP10/25 sets out the PRA’s updated draft expectations for banks and insurers on the identification, assessment and management of risks associated with climate change. The consultation and associated supervisory statement respond to requests from firms for further clarity and reflect updated understanding of climate-related risks across the industry, prior regulatory feedback and guidance, and international standards.

The PRA notes that, since the publication of SS3/19, banks’ and insurers’ progress in building their climate-related risk management capabilities has been “uneven”. CP10/25 sends a clear signal that more work is needed, and that the PRA intends to keep climate-related risk high on the supervisory agenda.

The CP is set out in 7 chapters, covering governance, risk management, climate scenario analysis (CSA), data, disclosures and banking- and insurance- specific issues.

The consultation will close on 30 July 2025. Once finalized, the updated Supervisory Statement is intended to take immediate effect.

Principles-based

Crucially, CP10/25 sets out supervisory expectations for effective risk management practices, not granular rules for banks and insurers to follow. It is principles-based and seeks to provide a context within which firms can develop “innovative solutions that are most suited to their business”.

This contrasts with, for example, the EBA’s ‘Final guidelines on the management of ESG risks’ which are highly prescriptive in terms of methodologies and exposure- , sector- , portfolio- and scenario- based methods. Instead, the PRA outlines overall expectations on identification of risk transmission channels, risk assessment and risk register, and it is for firms then to conduct their analysis within their own risk management frameworks.

Proportionate and risk-based

As in SS3/19, the PRA intends firms to apply the expectations in a proportionate and risk-based manner. This means that actions should be scaled to manage the climate-related risks to which a specific firm is exposed. This should be driven by factors including business model and geographical concentration of the balance sheet, not just size.

Focus on climate only but no climate targets

Unlike ECB, EBA and EIOPA expectations, there is no mention of broader nature or environment-related considerations. The PRA does not require firms to adopt climate goals, for example net zero emission targets or adaptation goals.

No climate-specific capital requirements

There is no explicit link to climate-specific capital requirements in the papers, nor any suggestion that this might follow, unlike EIOPA’s recommendation to the European Commission that EU insurers should hold capital for assets held in fossil fuel sectors.

Link to wider sustainability reporting

The broader proposals in CP10/25 should improve firms’ ability to produce high-quality decision-useful disclosures based on ISSB standards. Previous references to TCFD are updated to UK SRS (the imminent UK Sustainability Reporting Standards).

Uplift from SS3/19 to CP10/25

The updated expectations are more sophisticated and detailed than those in SS3/19, for example around stress test horizons and calibrations for scenario analysis. They also give supervisors the levers to engage very specifically with firms.

1. Much greater focus on governance and decision-making based on climate risk assessments. The PRA expects:

Boards to have appropriate information to facilitate decision-making;
Internal risk reporting to facilitate decision-making;
Risk assessments on clients, counterparties, investees and policyholders, and clear definitions on materiality criteria and how such assessments support decision-making;
Firms to document clearly how their Climate Scenario Analysis (CSA) results have informed decision-making, and Boards to understand this also; and
Climate-related risk to be incorporated into internal control frameworks across the three lines of defence.

2. Increased focus on risk appetite, to be set by Boards and cascaded across the firm’s business lines down to business.

3. Firms should regularly review, and where necessary update, their internal risk assessments and proposed climate actions. They should be able to demonstrate that steps taken, proposed or in train are appropriate and that any actions are up to date.

4. More sophisticated expectations on CSA:

Scenario selection to be relevant to the risk profile of the firm.
The positioning of chosen scenarios in the distribution of potential outcomes to match their respective use cases.
The CSA use case to determine the scenarios, time horizons, frequency and calibration used by firms.

5. The PRA expects firms to manage and remedy data gaps, either via further investment in data tools or, as an intermediate step by using appropriately conservative assumptions and proxies. Data gaps should not prohibit firms from developing their climate-related risk management capabilities.

6. Operational resilience — the PRA expects firms to assess the impact of climate change on both general operations and their ability to continue providing critical operations, including services provided under outsourced and third-party arrangements. Boards should set risk appetite and tolerance levels for outsourced and third party arrangements that may be exposed to climate-risks or introduce climate-related risks to the firm through their activities.

Financial reporting

Banks are expected to have appropriate processes in place to ensure timely capture of climate-related risks for financial reporting and effective governance — including consideration of the way responsibilities are allocated in the financial reporting function and ensuring that appropriate personnel and processes are in place.

Processes and controls should cover the sourcing, management, enhancement and quality of data needed to factor climate-related risk into balance sheet valuations.

Banks should consider the practices and policies needed to identify climate-related risk drivers of expected credit losses (ECL), to recognise ECL in line with accounting standards and to enable challenge of ECL calculations and inform the use of post-model adjustments.

Appropriate controls should be in place to monitor these drivers, and all processes should be reviewed periodically.

Capital

Banks should provide evidence of how they have determined the materiality of climate-related risks in their ICAAPs, as well as methodologies, assumptions, judgements, proxies and subsequent uncertainties used in assessing climate-related risk for the purposes of ICAAPs.

Liquidity and funding

Banks should incorporate the impact of material climate-related risks into their calibration of liquidity buffers and risk management frameworks.

They should be able to evidence the reasons for risks not being considered material.

Assessments of the impact of any material climate-related risks on net cash outflows or the value of assets comprising liquidity buffers should inform the level of liquidity held to meet the PRA’s Overall Liquidity Adequacy Requirement.

Credit risk

Banks should have clear processes and policies to identify, measure, monitor and mitigate climate-related credit risks, including integrating climate considerations into credit risk assessments, evaluating climate-related risks across the credit life cycle and evaluating how risks may impact their ability to recover loans.

They should also consider how to approach climate-related concentration risk — the PRA proposes a non-exhaustive list of mitigants.

Market risk

Banks should understand how climate-related risks translate into market risks, for example through price volatility related to physical events or changes in expectations around transition pathways.

The PRA proposes scenario analysis as an important tool for measuring and managing the market risk arising from climate change.

Reputational risk

Banks should understand the impact of climate-related risk drivers that could increase strategic, reputational and regulatory compliance risk, and liability costs associated with climate-sensitive investments and businesses.

Risk management

Insurers are expected to assess the potential for financial losses on the contracts they have underwritten or expect to underwrite over the next 12 months, including potential losses on technical provisions (TPs) or assets. Risk appetite statements should categorise risk by level of risk appetite e.g. accept, manage and avoid.

Risk appetite

Under the Prudent Person Principle (PPP), Solvency II insurers should consider whether there is an excessive accumulation of climate-related risks particularly if those risks are likely to crystallise via transition risk factors.

ORSA

Insurers’ SST in the ORSA should include sufficiently granular scenarios for the risks they face (e.g. tropical storms, flooding, longevity risk etc), and must also include reverse stress testing.

When outlining management actions to take in different circumstances, insurers should be prudent in the assumptions they make about market availability, liquidity or price levels, and that other market participants may wish to act in a similar way.

The ORSA should also include reputational and litigation risks from greenwashing.

SCR

Insurers using an internal model (IM) to calculate SCR should consider the impact of climate change on underwriting, reserving, market, credit and operational risk components of the IM. Insurers using the standard formula (SF) should consider whether the impact of climate-related risks leads to a change in their assessment of SF appropriateness and develop a partial or full internal model if climate-related risks are material.

Additionally, although the SCR is a one-year time horizon, insurers need to capture how climate-related risks could impact the variability of cashflows over the term of the TPs. This is particularly relevant for long tail liabilities such as annuities and Periodic Payment Orders (PPOs).

Underwriting and reserving risk

Non-life insurers should consider the impact of climate change on their natural catastrophe (Nat Cat) risk, and the potential accumulation of claims under liability lines (e.g. Directors and Officers, public liability etc). Life insurers should consider the impact of climate change on mortality and morbidity assumptions.

Credit risk

Insurers should understand to what extent the methodologies of external credit ratings reflect climate-related risk. Additionally, when reviewing counterparty exposures where the exposure is collateralised, they should consider to what extent the underlying assets could be impaired as a result of climate-related risks. Similarly, insurers should consider their reinsurance counterparties’ exposure.

Regulatory balance sheet

Where there is no active market for an insurer’s asset, the firm may need to adjust the valuation or transaction price to reflect assumptions that other market participants would make about the impact of climate-related risk on pricing. Additionally, insurers should consider how climate-related risks could be a source of credit risk as part of their Matching Adjustment internal credit assessments.

What should firms do now?

The PRA sets out some clear next steps and plans to engage actively with industry groups to help firms collectively develop and advance best practice:

Step 1: Risk identification, assessment and sign-off

Identify material climate risks to which the firm is exposed and how these will impact resilience of the business model over relevant time horizons and under different climate scenarios.
This process should be supported by relevant scenario analysis that reflects impact on current balance sheet, evolution of the balance sheet and future business model viability. The Board should review and agree the material risks identified.

Step 2: Appropriate risk management tools and response

Develop a risk management response that is proportionate to the vulnerability to climate-related risk of PRA-regulated activities.
Use of more sophisticated risk management tools will be expected as the magnitude and likelihood of material risks to which they are exposed increases.
Firms should be able to evidence or explain how they have reached any judgements that underpin the outcomes from steps 1 and 2.
To give firms time to transition from SS3/19, supervisors will not ask for evidence of internal assessments, gap analyses, action plans and other steps taken to meet the updated expectations until a period of 6 months has elapsed from the commencement of the SS.
During and after this 6-month period, firms should continue to ensure that they appropriately manage climate-related risks and engage with any ongoing PRA core assurance meetings or requests.

How KPMG in the UK can help

KPMG in the UK offers a range of services to assist financial institutions in managing climate — related risks. Our team of climate, risk and regulatory professionals can assist you in multiple areas including:

Gap assessments — expected to be available to the PRA six months after publication of the final supervisory statement. Supporting with climate risk management framework design, identifying gaps between practice and updated requirements, and creating a roadmap to compliance, including development of interim actions.
Board training — delivering training to maintain appropriate Board knowledge, to support robust governance and decision-making — as per CP10/25
Scenario analysis frameworks and model development — assistance in identifying, designing and developing scenarios, building models, setting up associated governance and data frameworks, and managing feedback between risk assessments and CSA, etc.
For insurers: reviewing reserving practices and assumptions

For banking queries please reach out to:

Richard Andrews, Begona Ramos, Ross Molyneux, Andrew Fulton, Heather Townson, James Philpott, Thomas Clarke or Jonathan Hooson.

For insurance queries please reach out to:

Richard Andrews, Alec Innes, Roger Jackson, James Isden, Chirag Shah, Susan Dreksler, Joshua Holbrook, or Shaheer Hafeez