On 30 September 2026, the Prudential Regulation Authority (PRA) published a Dear CFO letter on IFRS 9 expected credit losses (ECL), drawing on auditor reports from major UK-headquartered banks and building societies.
Aggregate ECL coverage is at its lowest level since before the Covid-19 pandemic, which the PRA notes is consistent with improvements in banks’ asset quality. Nonetheless, limited recent default experience for some portfolios and ongoing economic and geopolitical uncertainty reinforce the importance of identifying emerging credit risks and reflecting them promptly in ECL. Against this backdrop, the 2026 letter builds on the PRA’s 2024 and 2025 reviews and the supervisory expectations set out in SS1/23 and SS5/25.
The following sections examine five areas highlighted by the 2026 letter – climate-related ECL, ECL data governance, model risk management, securitisation, and private-market exposures – and consider their practical implications for banks.
1. Integrating Climate Risk into ECL
As part of the 2026 review, the PRA identified further areas for improvement in how firms assess climate-related credit risks and demonstrate that their findings inform ECL judgements.
1.1 Climate scenarios and refinancing risk
Connect scenarios to ECL judgements. The PRA encourages firms to use climate stress-test assumptions, scenarios, and outputs to identify material climate-related credit risks and assess whether these are adequately reflected in ECL. Better practice includes applying consistent climate scenarios across stress testing and assessments of climate-related ECL impacts.
Capture downside conditions. The PRA encourages firms to consider short- and medium-term disorderly climate scenarios to assess how climate risks may interact with wider macroeconomic stresses, rather than relying mainly on longer-term pathways or considering climate impacts only in baseline scenarios. Firms should also translate high-level scenarios into sector-relevant assumptions, such as carbon prices and changes in energy mix, and support comparisons with external climate scenarios through portfolio-level analysis.
Assess end-of-term refinancing risk. Building on earlier reviews, firms are encouraged to consider borrowers’ ability to repay or refinance under combined climate and macroeconomic downside conditions, including higher borrowing costs, adaptation expenditure, insurance costs, or reduced collateral values. The PRA found that evidence supporting conclusions of immaterial current refinancing impacts was generally more limited than other climate transmission channels. Better practice included modelling forecast interest costs and incorporating refinancing risks into credit grading and monitoring.
1.2 Credit assessments, modelling, and governance
Make climate scorecards actionable. The PRA continues to find that, although most firms use climate questionnaires and scorecards, there is limited evidence that results influence credit grades, watchlists, staging, or ECL. Better practice includes clear escalation criteria for when findings should affect credit judgements and ECL estimates.
Improve quantitative assessments. Building on its 2025 recommendation for more granular sector- and portfolio-specific analysis to refine probability of default (PD) and loss given default (LGD) estimates, the PRA highlights better practice including:
new data on insurance coverage, availability and affordability, and the longer-term effects of climate risk on insurance markets;
LGD models for the impact of energy performance certificate (EPC) and retrofit requirements on property values; and,
analysis of the relationship between EPC ratings, occupancy, and commercial real estate values. Other examples include transition-risk models for shipping, project finance, and power generation.
Strengthen model and data governance. Building on earlier expectations to identify data and model limitations and incorporate climate risks into loan-level ECL, the PRA highlights applying group-wide model risk standards to climate models, including:
independent validation and approval;
developing approaches to monitor models with limited data for back-testing;
using unique property identifiers to link internal data with EPC and flood-risk datasets; and,
stronger second-line oversight of proxies and externally sourced climate data.
2. ECL Data Governance
In its 2026 review, the PRA examined firms’ governance and controls over ECL data for the first time, identifying opportunities to strengthen the management and oversight of material ECL data.
Critical data elements (CDEs). The PRA encourages firms to identify CDEs by testing how changes in individual model inputs affect ECL and using quantitative materiality thresholds and supplementary qualitative criteria to determine which data are critical. Firms should also extend their CDE frameworks to cover material data used in post-model adjustments (PMAs) and model monitoring, rather than only core model inputs, and review their inventories following changes to models, systems, or reporting processes.
Accountability and lineage. The PRA’s areas of focus cover clear accountability for material ECL data, with defined responsibilities and controls at significant hand-offs between data providers and users. Firms should also maintain complete and usable end-to-end data lineage, tracing material ECL data from source systems to reporting outputs, with significant transformations, controls, accountable owners, and manual interventions clearly documented. Manual adjustments should be subject to appropriate governance, including documented rationale, independent review, approval, and post-implementation checks.
Preventative data controls. Downstream manual reconciliations remain important, but where they are the principal means of identifying data-quality issues, problems at source may be detected later. The PRA thus encourages more preventative and automated controls at source and at significant transfer and transformation points, alongside remediation of general IT control weaknesses, including privileged-access issues.
Third-party oversight. The PRA encourages firms to keep oversight of ECL data sourced, processed, or hosted by third parties under review, including the timeliness and scope of external assurance over third-party controls and the adequacy of complementary internal controls.
3. Model Risk Management
The PRA’s continued review of model risk adds more specific expectations and examples of practice for monitoring, validation, and PMAs.
Automated monitoring governance. The PRA’s new area of focus is the governance of automated model monitoring, such as the completeness of model inventories. It stresses that model risk controls should keep pace with increasingly automated monitoring, covering monitoring tools and associated code, the quality and lineage of monitoring data, and model change records.
Model validation and back-testing. Better practice includes independent checks that deployed models match their validated versions. The PRA also observed weaker practice where back-testing did not adequately distinguish model performance from economic forecasting error.
Event-driven PMAs. Better practice includes defined triggers for considering PMAs and separate review and approval routes for event-driven PMAs and those addressing model-performance issues.
4. Securitisation and Credit Protection
For firms with material securitisation activity, the PRA found no pervasive issues but identified scope to improve the ongoing monitoring and reporting of credit protection where underlying loans remain on balance sheet.
Recoverability after inception. Although governance at transaction inception generally appeared mature, evidence of routine monitoring was less consistent. The PRA encourages firms to assess whether credit protection remains recoverable under adverse conditions, considering counterparty and wrong-way risk, legal enforceability, collateral access, claims processes and timing, valuation uncertainty, and fraud.
Transparent financial effects. The PRA observed that credit protection benefits were reflected in different financial statement line items across firms, including reimbursement assets, issued liabilities, net interest income, and credit impairment charges, making it difficult to establish a clear and consistent picture of the gross and net effects of on-balance-sheet securitisations. For firms making material use of securitisations as a risk and capital management tool, the PRA encourages greater transparency in internal reporting of the aggregate gross and net effects of credit protection, including how the resulting risk and capital outcomes are monitored and managed within firms’ risk appetite and limits framework.
5. Private-market Exposures
As part of an upcoming review, the PRA has requested auditors’ views on how firms identify and monitor credit risks in private-market exposures and reflect changes in ECL promptly. The PRA points to challenges in identifying and aggregating exposures and obtaining timely, reliable data on complex, leveraged, interconnected, and correlated risks as primary areas of focus.
How We Can Help
Katalysys can support banks in assessing climate-related financial risks through climate scenario analysis (CSA) and stress testing, as well as strengthening their model risk management (MRM) frameworks. Regarding climate risk, through our work with the Climate Risk Consortium, we have developed comprehensive, proportionate guidance on estimating climate-related ECL impacts for non-systemic banks. These capabilities, along with our work on MRM, can help banks address the relevant supervisory expectations set out in SS1/23, SS3/18, SS5/25, and the PRA’s 30 September 2026 Dear CFO letter. More specifically, we can assist banks with:
Quantitative CSA. Assessing the impact of different climate scenario pathways (including those produced by the Network for Greening the Financial System, or NGFS) and time horizons on PDs, LGDs, and resulting ECL at both portfolio and individual exposure levels.
Climate capital and liquidity stress testing. Evaluating the impact of climate-related stresses on banks' capital and liquidity positions, including through climate reverse stress testing.
Model risk governance and monitoring. Assessing current MRM practices and developing MRM frameworks and model inventories.
Independent model validation. Providing objective validation of IFRS 9 and other risk models, assessing their technical soundness, controls, and alignment with regulatory expectations
For more information, please contact:
Josh Nowak
CEO & Managing Director - Advisory & Solutions
T: +44 (0)7587 720 988
E: josh.nowak@katalysys.com
