Prudential regulation asks a different question from conduct regulation. Conduct supervision asks whether a firm treats its customers and markets properly. Prudential supervision asks whether the firm is safe and sound, and whether it could fail in a way that causes wider harm.
For dual-regulated firms the two operate in parallel, and the interaction is not always straightforward: decisions that improve a conduct outcome may have prudential consequences, and firms must be able to explain both.
This article sets out the principal PRA obligations, how supervision operates, and where firms most often have difficulty.
[IMAGE]
Which firms are PRA-regulated?
The PRA is responsible for the prudential regulation of deposit-takers, banks, building societies and credit unions, insurers, and designated investment firms.
These firms are dual-regulated: the PRA sets prudential requirements and the FCA supervises conduct. Investment firms that are not designated are solo-regulated by the FCA under the Investment Firms Prudential Regime.
The PRA has two statutory objectives: promoting the safety and soundness of the firms it regulates, and, for insurers, contributing to securing an appropriate degree of protection for policyholders. It also has a secondary objective relating to competitiveness and growth.
The principal obligations
| Area | What it covers |
|---|---|
| Capital | Minimum requirements, buffers, and the firm's own assessment of capital adequacy through the ICAAP or, for insurers, the ORSA and Solvency Capital Requirement |
| Liquidity | Liquidity coverage, net stable funding, and the firm's own liquidity adequacy assessment |
| Governance | Board composition and effectiveness, risk committee arrangements, and the allocation of responsibility under SM&CR |
| Risk management | Risk appetite, the three lines model, risk identification and measurement, and stress testing |
| Recovery and resolution | Recovery plans, resolution packs, and resolvability assessment for firms in scope |
| Operational resilience | Important business services, impact tolerances and testing, jointly with the FCA |
| Reporting | Regulatory returns, with data quality a persistent supervisory theme |
| Outsourcing and third parties | Material outsourcing arrangements, oversight and exit planning |
How PRA supervision operates
PRA supervision is judgement-based, forward-looking and proportionate to a firm's potential impact.
Business model analysis is central. The PRA seeks to understand how the firm makes money, what that depends on, and what would happen if those dependencies weakened. Firms that can describe their capital position but not their business model's vulnerabilities are at a disadvantage.
Supervisory intensity varies with the firm's potential impact on the PRA's objectives. Larger and more complex firms face more continuous engagement.
The periodic summary meeting and supervisory letter set out the PRA's assessment and any actions required. Firms should treat these as the definitive statement of supervisory concern and address each point explicitly.
Stress testing is used both as a supervisory tool and as a discipline the firm must be able to run itself, with results informing capital and liquidity planning.
Capital and liquidity
For banks, capital requirements derive from the capital requirements framework, with the firm's own Internal Capital Adequacy Assessment Process informing the PRA's Total Capital Requirement and any buffer.
For insurers, the Solvency UK framework sets the Solvency Capital Requirement and Minimum Capital Requirement, with the Own Risk and Solvency Assessment providing the firm's own view.
Two points recur in supervisory feedback.
The firm's own assessment should be the firm's own. An ICAAP or ORSA that reproduces the regulatory calculation without independent analysis of the firm's specific risks does not serve its purpose and is visible as such.
Forward-looking capital planning. Capital adequacy assessed under stress, over the planning horizon, with identified management actions that are credible and within the firm's control.
Governance and risk management
The PRA assesses whether governance is effective, not whether it exists.
Board effectiveness is examined through the quality of challenge, the information the board receives, the time given to prudential matters, and the independence and expertise of non-executive directors.
Risk management is assessed on whether the risk function has genuine independence and authority, whether risk appetite is defined in terms that can be measured and breached, and whether breaches trigger action.
SM&CR applies, with Prescribed Responsibilities allocated between individuals and the Management Responsibilities Map required to reflect actual arrangements.
Recovery and resolution
Firms in scope must maintain a recovery plan setting out the actions available to restore viability under stress, with triggers, timelines and assessment of feasibility.
Resolution planning is led by the Bank of England as resolution authority, with firms required to provide information and, for larger firms, to demonstrate resolvability against defined outcomes.
Recovery options should be genuinely available. Plans relying on asset disposals that would not be executable under stress, or on capital raising in conditions where it would not be available, do not withstand assessment.
Dual regulation in practice
Firms must maintain a coherent framework across both regulators.
Governance arrangements, risk management, systems and controls, outsourcing and operational resilience all sit within both regulators' interests. Where a firm describes its arrangements differently to each, that inconsistency is itself a finding.
Conduct and prudential considerations can also interact directly. Redress provisioning, product pricing decisions, and business model changes made for conduct reasons all have prudential consequences that must be identified and explained.
Our guides to FCA compliance for wholesale banking and FCA compliance for insurers address the conduct side of the framework for the two largest dual-regulated populations.
Where firms most often have difficulty
The ICAAP or ORSA is a compliance document. Prepared to satisfy the requirement rather than to inform the firm's own view of its capital needs.
Risk appetite is not measurable. Stated in terms that cannot be breached, so breaches never occur and the framework never triggers action.
Recovery options are not credible. Actions listed that would not be executable in the circumstances in which they would be needed.
Regulatory reporting data quality. Returns produced from systems that do not reconcile, with errors identified after submission.
Board information is volume without insight. Extensive packs that do not surface the issues requiring board attention.
Inconsistency between regulators. Different descriptions of the same arrangements given to the PRA and the FCA.
About Regulatory Counsel
Regulatory Counsel advises UK and international financial services firms on authorisation, prudential and conduct requirements, governance, financial crime and regulator engagement.
Our prudential work covers ICAAP and ORSA preparation and review, capital and liquidity adequacy assessment, risk appetite framework design, recovery plan development and testing, governance and board effectiveness review, SM&CR implementation for dual-regulated firms, regulatory reporting review, outsourcing and third-party risk frameworks, and support through PRA supervisory engagement including responses to supervisory letters.
Contact our regulatory team at info@regulatorycounsel.co.uk.
This article is provided for general information and does not constitute legal or regulatory advice. Firms should confirm the current position against PRA and FCA publications and take advice on their specific circumstances.
Frequently Asked Questions
Deposit-takers including banks, building societies and credit unions; insurers; and designated investment firms. These firms are dual-regulated, with the FCA supervising conduct.
The PRA supervises for safety and soundness and, for insurers, policyholder protection. The FCA supervises conduct, market integrity and, for solo-regulated firms, prudential matters. Both examine governance, systems and controls from their respective perspectives.
The Internal Capital Adequacy Assessment Process, through which a bank assesses the capital it requires against its own risks, informing the PRA's setting of the Total Capital Requirement. It should reflect the firm's own analysis rather than reproducing the regulatory calculation.
The Own Risk and Solvency Assessment, through which an insurer assesses its own risk profile, capital needs and the adequacy of its solvency position over the business planning horizon.
Actions available to restore viability under stress, with defined triggers, realistic timelines and assessment of feasibility. Options should be genuinely executable in the circumstances in which they would be required.
Supervision is proportionate to a firm's potential impact on the PRA's objectives. Smaller firms face less continuous engagement, but the substantive obligations on capital, liquidity, governance and risk management apply.