Overview of the PRA’s Model Risk Management Principles for Banks
The Prudential Regulation Authority (PRA) issued Supervisory Statement SS1/23 on model risk management principles for banks, effective from May 17, 2024. This statement establishes binding expectations for UK-incorporated banks, building societies, and PRA-designated investment firms that rely on internal models to calculate regulatory capital requirements. These firms include those using Internal Ratings-Based approaches for credit risk, the Internal Model Approach for market risk, and the Internal Model Method for counterparty credit risk. The principles apply to all models—whether developed in-house or sourced externally—used to inform business decisions, including those leveraging artificial intelligence (AI) and machine learning (ML) techniques.
The statement’s core objective is to ensure banks adopt a strategic approach to model risk management (MRM) as a distinct risk discipline. It complements existing regulatory requirements and supervisory expectations, reinforcing the need for firms to strengthen their policies, procedures, and practices to identify, manage, and control risks associated with model usage. The principles are designed to be proportionate, scalable across firms, and adaptable to varying model complexities and technologies.
The Five Key Principles of Model Risk Management
SS1/23 outlines five overarching principles that form the foundation of an effective MRM framework. These principles are supported by sub-principles that address implementation, governance, and risk-specific considerations.
- Principle 1: Model Identification and Model Risk Classification
This principle emphasizes the need for firms to systematically identify all models used within their operations, regardless of their origin or the technology employed. It requires firms to classify models based on their risk profiles, ensuring that higher-risk models receive proportionate attention and oversight. The principle also mandates the allocation of responsibility for the overall MRM framework to the most appropriate Senior Management Function (SMF) holder(s), ensuring clear accountability at the executive level.
Firms are expected to implement MRM practices that are proportionate to the scale and complexity of their model inventory.
Scope and Applicability of the Principles
The PRA’s expectations under SS1/23 are not limited to specific types of models or technologies. They apply universally to all models used for decision-making, whether for regulatory capital calculations, financial reporting, or operational risk management. This includes vendor-provided models, which are increasingly common in banking due to their cost-effectiveness and specialized expertise. Firms must ensure that vendor models are subject to the same rigorous oversight as in-house models, including validation of their design, data inputs, and ongoing performance.
The principles are particularly relevant to firms utilizing AI and ML models, which are becoming integral to modern banking operations. The PRA acknowledges these challenges and expects firms to address them through enhanced governance, transparency, and independent validation processes.
The statement was initially published on May 17, 2023, with an effective date of May 17, 2024. Subsequent updates, such as LIAF01/26, reflect low-impact amendments to ensure the principles remain aligned with evolving regulatory and technological landscapes. These amendments do not alter the fundamental expectations but may introduce clarifications or adjustments to reflect changes in supervisory practices or industry standards.
Governance and Implementation Considerations
This involves integrating MRM into broader risk management frameworks, such as those addressing operational risk, credit risk, or market risk.
The principles also highlight the importance of independent validation as a cornerstone of MRM. The PRA does not prescribe specific validation methodologies but expects firms to demonstrate that their validation processes are comprehensive, objective, and aligned with the principles outlined in SS1/23.
Alignment with Regulatory and Industry Standards
By adopting a principles-based approach, the PRA allows firms flexibility in interpreting and applying the expectations to their specific contexts. However, this flexibility is balanced by the requirement for firms to demonstrate that their MRM practices are effective in achieving the intended outcomes.
The statement also reflects the PRA’s proactive engagement with the banking sector on emerging risks, including those posed by AI and ML. The PRA has held roundtable discussions with industry stakeholders to explore challenges and best practices in managing model risk, particularly in relation to advanced technologies. These discussions inform the development of supervisory expectations and ensure that the principles remain relevant to the evolving risk landscape.
While the principles are binding only for UK-incorporated firms, they serve as a benchmark for global institutions seeking to enhance their model risk governance.
Required actions
- Maintain a model inventory and tiering covering AI and machine-learning models; senior management function accountable for the framework - Independent validation before use and periodically, with model risk controls and reporting to the board