PRA to streamline supervision as part of 2026 priorities

Prudential Regulation Authority | 20 Moorgate, London, EC2R 6DA +44 (0)20 3461 4444 | www.bankofengland.co.uk Charlotte Gerken Executive Director, UK Deposit Takers Supervision Laura Wallis Director, UK Deposit Takers Supervision 15 January 2026 Dear [Chief Executive Officer] UK Deposit Takers Supervision: 2026 Priorities We are writing to outline the Prudential Regulation Authority’s (PRA) 2026 priorities for UK banks and building societies (‘firms’). These priorities complement our core assurance work across a large and diverse population of firms and should be considered alongside the firm-specific feedback we provided following your most recent Periodic Summary Meeting (PSM). Our priorities are set to promote the safety and soundness of the firms we supervise, ensuring the sector is both resilient and able to support growth. Firms are facing an uncertain environment, in which geopolitical tensions, global fragmentation of trade and financial markets, and pressures on sovereign debt markets remain elevated.1 The UK banking sector’s resilience requires maintained focus on risk management, governance and controls, operational and financial resilience, and data risk. This letter includes those ongoing priorities, to which we expect firms to maintain attention, and sets out the work we are doing to advance our secondary objectives, by 1 Financial Policy Committee Record – October 2025. This version of the letter is intended for publication on the website. Square brackets indicate any differences in content or formatting compared to the versions sent directly to firms.

Bank of England | Prudential Regulation Authority Page 2 supporting innovation and adapting our supervisory approach, including through changes to PSM cycles. Strategic risk management We have observed that firms vary in their ability to proactively identify, monitor and manage changing risks and their complex interaction. Firms’ senior managers and boards need to ensure that their organisations maintain robust risk management frameworks that are proportionate, keep pace with changes to their business model and adapt to the changing external environment. We expect firms to have these frameworks in place across business lines, risk management, and audit. The shift in global trade flows presents opportunities but could also introduce frictions in supply chains and increase credit risk. Firms need to ensure adequate risk management of trade financing activities while supporting their clients amid the changing environment. Private markets’ resilience and their interconnections with banks (and other parts of the financial sector) have not been tested to a severe downturn. The Bank of England's (the Bank) second system-wide exploratory scenario exercise will explore risks and dynamics associated with the private markets ecosystem, and the potential implications of a stress for UK financial stability and the real economy. Major UK banks’ exposures to non-bank financial institutions (NBFIs) are growing and the relationships are multifaceted. 2 Counterparty credit risk (CCR) management continues to be a supervisory focus. Some firms still find it challenging to aggregate the full risk picture across their businesses. Boards should have an accurate view of exposures particularly across private equity and private capital counterparties. Since our 2024 letter, firms have taken steps to address our critical findings concerning data and risk aggregation, but further progress is needed to keep pace with increased risk appetite by ensuring decisions are better informed by the level, timeliness, and nature of disclosures by their clients. The use of significant risk transfers (SRTs) is a credit risk and capital management tool for some firms. The PRA has issued an update to supervisory statement (SS) 9/13 – Securitisation: Significant Risk Transfer which took effect on 1 January 2026. We expect firms’ senior management to be appropriately engaged in approving and maintaining transactions that lead to a reduction in capital requirements. 3 2 Bank analysis indicates that at January 2024, major UK banks’ total trading book exposures to all NBFIs stood at around £120 billion. 3 The PRA also issued a Dear CFO letter in relation to SRT financing on 9 April 2025: Significant risk transfer financing: Prudential expectations.

Bank of England | Prudential Regulation Authority Page 3 Our supervisory statement on model risk management came into effect in May 2024. Where shortcomings have been identified, firms should prioritise remediation as part of their broader risk management improvements. We will continue to engage with accountable Senior Manager Functions at firms to assess and monitor implementation. Advances in technology, including the increasing use of Artificial Intelligence (AI), present opportunities for firms to innovate products, their business models and operational efficiency and effectiveness. We see this innovation as key to a flourishing financial services industry that supports growth and competitiveness. However, these advanced technologies present novel risks, amplify existing issues such as inaccurate data, reliance on a small number of third party providers and cyber risks, and firms need to adopt them without compromising their safety and soundness. Digital asset initiatives, tokenisation and use of distributed ledger technology (DLT) present both competitive opportunities and threats to the banking sector. 4 DLT is growing and could provide banks with more efficient transactions and better operational resilience. Tokenisation of assets and money, combined with smart contracts, allows for greater programmability and fractionalisation of assets, deepening existing markets, potentially unlocking new ones, and changing how capital assets are mobilised within the financial system. The Bank and PRA are considering how regulatory and legal frameworks can support the responsible adoption of DLT and tokenisation, to facilitate innovation and advance digitally enabled financial markets. We encourage active participation in the digital securities sandbox. Operational resilience Following our review of firms’ work to meet the 31 March 2025 deadline in SS1/21, we expect firms to improve their operational resilience testing, and for operational resilience to be an integral part of their decision making. Firms’ senior managers and boards should routinely consider how strategic changes such as new products, IT upgrades, and outsourcing affect resilience. Actions should be proportionate to the size and business model of the firm and targeted at important business services. Cyberattack and geopolitical risk remain the two most frequently cited sources of risks among financial institutions, and are considered the most challenging risks to manage. 5 Firms need robust capabilities not just to prevent breaches, but also to detect attacks quickly, respond effectively, and recover critical services within their impact tolerances. 4 The Bank of England’s approach to innovation in artificial intelligence, distributed ledger technology, and quantum computing. 5 Systemic Risk Survey Results – 2025 H2.

Bank of England | Prudential Regulation Authority Page 4 We encourage all firms to apply lessons from the 2024 sector-wide cyber stress test and to make full use of the relevant outcomes from our cyber tools including the CBEST intelligence-led penetration testing programme to identify and fix vulnerabilities. Non-systemic firms should also consider the use of the Simulated Targeted Attack & Response assessments for Financial Services (STAR-FS) to assess their cyber resilience. Firms are becoming more reliant on a small number of third parties (and the latter’s third parties) to deliver important business services. In preparation for service failure, firms should maintain and test contingency plans, exit plans, and stressed exit plans. Firms should also be aware of concentration risks and ensure they understand the full chain of dependencies, including sub-outsourcing. Importantly, firms should not rely solely on assurances from third parties regarding their resilience; where possible firms should conduct their own testing and validation to ensure that services can be maintained during disruption. Financial resilience We continue to expect firms to consider and manage risks across a comprehensive set of forward-looking liquidity and capital metrics, using rigorous stress testing to evaluate their financial resilience. This is particularly important in light of major changes to the capital regime in the UK. The vast majority of Basel 3.1 is due to be implemented on 1 January 2027. 6 For those firms that are Small Domestic Deposit Takers (SDDTs), the Strong and Simple Framework is also due to be implemented on the same date. Firms should have worked through the implications of the Basel 3.1 standards or the Strong and Simple capital regime for their capital position and should be considering any actions they may need to take ahead of implementation. In 2026, we will rebase firms’ variable Pillar 2 requirements. We republished our data requests for this exercise in 2025 with a submission deadline of 31 March 2026, though earlier submission is encouraged. Firms need to provide us with timely and high-quality data to enable us to accurately update their requirements ahead of the implementation date. We expect boards to seek assurance over the accurate calculation and reporting of their risk weighted assets for the rebasing exercise and the implementation of the Basel 3.1 standards or the Strong and Simple framework. We expect Internal Capital Adequacy Assessment Processes (ICAAPs) signed off by boards in 2026 to include an 6 The Basel 3.1 proposals relating to the Fundamental Review of the Trading Book are proposed for 01 January 2028 as set out in CP17/25 – Basel 3.1: Adjustments to the market risk framework.

Bank of England | Prudential Regulation Authority Page 5 impact assessment of the Basel 3.1 standards or Strong and Simple and ICAAPs from 1 January 2027 to be prepared on a Basel 3.1 or SDDT basis. Firms should engage with us with regards to regulatory permissions they may have applied for or wish to apply for as soon as possible. Going forward, we expect firms to make new applications under the Basel 3.1 standards and SDDT capital rules and convert any in-flight applications impacted by the relevant capital regime as appropriate. Data risk Data is a cornerstone of effective risk management, yet weaknesses in data quality continue to drive operational and prudential issues. We expect firms to embed strong data governance and controls, recognising that poor data undermines regulatory calculations, effective decision-making and resilience – particularly as advanced technologies such as AI heighten reliance on accurate, complete and well managed data. Firms should benchmark practices against recognised standards, including the Basel Committee’s BCBS 239 principles for risk data aggregation and reporting where relevant.7 While progress has been made, challenges persist due to complex IT landscapes, legacy systems and governance gaps. We expect firms to demonstrate proactive investment in data architecture and validation processes, ensuring timely and accurate regulatory submissions. Most major firms are progressing multi-year programmes to modernise data infrastructure and address previous findings. We will continue to deploy specialist reviews and skilled person reviews where weaknesses persist, ensuring that data quality remains a cornerstone of prudential resilience. Facilitating competition, international competitiveness and growth Streamlining and reducing regulatory reporting burden In addition to working with firms to improve data quality, we are also looking to streamline and modernise reporting requirements through the Future Banking Data (FBD) Programme and will look for additional opportunities to support the competitiveness and growth of the UK economy. We encourage firms to share feedback on and actively engage with the FBD programme. Experience indicates that regulators and industry working together has the maximum potential to ensure regulators have the data they need to ensure a resilient financial system at the lowest cost to industry, with the greatest alignment to the data the firms use for their own business and risk management purposes. 7 Principles for effective risk data aggregation and risk reporting.

Bank of England | Prudential Regulation Authority Page 6 Supervisory approach Over recent years, the PRA has transitioned some firms from an annual cycle for PSMs to a two-year cycle. This adjustment has proven effective as it reflects the longer-term nature of supervisory workplans and allows firms and supervisors to focus resources more efficiently on identifying and remediating key risks. We are therefore planning in 2026 to commence the transition to a two-year PSM cycle for all firms which remain on an annual cycle. Reducing the number of PSMs, and associated communications and processes, will also reduce the regulatory burden on firms, in line with our secondary objective to facilitate UK competitiveness and growth. Your supervisor will provide details in due course on what this means for the timing of your firm’s next PSM. We will also continue to pursue a range of other initiatives in order to support delivery of our secondary objective on competitiveness and growth. This includes accelerating timelines for reviewing Senior Manager applications, new firm authorisations and internal ratings based (IRB) model change pre-approval applications. Mutuals and Scale-up Unit The PRA is also providing support that enables firms to scale up and compete more effectively, pursuing reforms to the Senior Managers regime and implementing a more proportionate Strong and Simple capital regime for our smallest firms to reduce the regulatory burden. Finally, we will continue working with the Financial Conduct Authority to consider how best to support the mutuals landscape to drive inclusive growth in the UK. Please consider this letter alongside your PSM letter and, where relevant, discuss our supervisory priorities with your board. Yours sincerely, Charlotte Gerken Executive Director, UK Deposit Takers Supervision Laura Wallis Director, UK Deposit Takers Supervision