SS1/23: model risk management for UK banks

The Prudential Regulation Authority (PRA) opens its Supervisory Statement 1/23 (SS1/23) by reframing the next several years for any firm using internal models: “The PRA considers model risk as a risk in its own right.”

Think of it like an airline. An airline has always needed airworthy aircraft. But an airline doesn’t get to decide for itself whether its fleet is airworthy. Every aircraft needs a formal certificate, issued by an inspector who is independent of the maintenance team, and renewed on a defined cycle. A named commander takes personal legal responsibility for every flight. If the aircraft is modified, it must be re-certified before it returns to service.

SS1/23 applies the same logic to a bank’s models, the quantitative machinery behind its capital calculations, pricing, and lending decisions, and the PRA, like any regulator, expects to see the maintenance records.

A risk in its own right

SS1/23 organises the PRA’s expectations around five principles that cover the full model lifecycle, from initial classification through to the use of adjustments when models fall short. By naming model risk as a standalone risk category, the PRA signals that it will assess model risk governance in its own right during supervision.

Before SS1/23, model risk sat alongside operational risk like a co-pilot with no formal rating. The PRA has now given it its own cockpit.

SS1/23’s five principles demand a shift from informal practice to documented accountability. A firm must be able to state what models it runs, how material each one is, who owns it, and how much risk remains in relying on it. The PRA expects that picture to be reviewed and updated on a defined cycle, not revisited only when something breaks. Firms that have treated model oversight as the model development team’s responsibility alone can now expect that approach to attract questions.

SS1/23 puts model risk management into supervisory territory through a self-assessment. Firms were expected to assess their frameworks against the principles before the policy took effect, and to update that assessment at least annually since.¹

Who must comply

SS1/23 binds UK banks, building societies and PRA-designated investment firms that hold internal model permission, and nobody else. Not every operator needs the certificate, and the line between who is in and who is out matters.

• In scope: UK banks, building societies, and PRA-designated investment firms with any internal model approval: the internal ratings based (IRB) approach for credit risk, the internal models approach (IMA) for market risk, or the internal model method (IMM) for counterparty credit risk
• Out of scope: firms without internal model approval; third-country branches; credit unions; insurers and reinsurers

Firms that receive a new internal model permission have twelve months to comply from the approval date, so a bank entering the IRB approach for the first time doesn’t receive a grace period from the PRA. Firms actively pursuing an internal model application should treat SS1/23 as part of the approval itself, not something that begins after approval is secured. SS1/23 states those exclusions without giving a reason for them.¹

Scope is drawn by technology as well as by firm type: SS1/23’s definition is broad enough to catch machine learning models, but the statement never mentions generative or agentic AI at all. That silence is a gap we unpack in our companion pieces on generative AI in banking² and agentic AI³.

What do Principles 1 and 2 require?

An airline cannot certify a fleet it cannot name. SS1/23 starts in the same place.

Compliance with SS1/23 begins with the inventory: knowing what models the firm actually runs. Principle 1.1 gives firms the definition to adopt: “A model is a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into output.”¹ The test is the application of theory, which leaves deterministic methods such as decision-based rules outside the definition. Deterministic methods do not escape, though: where such methods are complex and bear materially on business decisions, firms should consider applying the relevant parts of the framework, and the PRA expects documented management controls over them regardless.

Principle 1 then requires a firm-wide model inventory and a risk-based tiering approach. A capital-models-only inventory is a fleet list that names the jets and forgets the rest of the hangar.

Principle 1 also requires firms to tier their models by materiality and complexity. Tiering is consequential: a tier-one model used in IRB capital calculations will face more demanding validation and documentation than a lower-tier internal tool. The tiering methodology itself should be documented and subject to challenge. The self-assessment should reflect any changes to the inventory or to model-level tiers made during the year. SS1/23 sets no update frequency for the inventory itself. The annual clock it does set is on the self-assessment: “Self-assessments should be updated at least annually thereafter.”¹

Ownership must be clearly assigned across three roles: model owner, model developer, and model user, each carrying defined responsibilities. Principle 2 ties this ownership structure into the firm’s governance framework.

SS1/23 does not use the phrase three lines of defence, but it allocates the roles that frame describes: model owners and users on one side, an independent validation function under Principle 4, and Internal Audit assessing the whole framework periodically under Principle 2.5.¹ On Gini’s reading that is the three-lines split in all but name, and SS1/23 ties it to senior manager accountability.

A named Senior Management Function (SMF) holder must formally accept responsibility for model risk management via their Statement of Responsibilities. SS1/23 is explicit that accountability sits with an individual rather than a committee: the board should “appoint an accountable individual to assume the responsibility to implement a sound MRM framework”, and a named Senior Management Function carries it.¹

Where a model comes from outside, Principle 2.6 refers firms to SS2/21 on outsourcing and third-party risk management, and holds boards and senior management ultimately responsible even then.⁴

A report on the effectiveness of model risk management for financial reporting must reach the audit committee “on a regular basis, and at least annually”, in time to inform the external auditor’s assessment of the risk of material misstatement.¹ The annual report to the audit committee brings model risk formally into the board’s oversight cycle, and into the statutory audit.

When models must move

Two technically demanding areas of SS1/23 concern how firms govern models that update dynamically and how they monitor performance on an ongoing basis. Governing dynamic models and monitoring their ongoing performance are both places where documented accountability is hardest to keep current.

• Principle 3.3(c) reaches dynamic models, which SS1/23 defines as those “able to adapt, recalibrate, or otherwise change autonomously in response to new inputs”. Development testing must cover material changes in them over time, comparing output before and after the change against what actually happened.¹
• The thresholds sit in Principle 2, where the board’s model risk appetite must set “thresholds for acceptable model performance and tolerance for errors” and receive regular reports against them. Principle 4 then makes ongoing performance monitoring a shared responsibility of model users, owners and validators, alongside independent review and periodic re-validation.¹

Across the firms Gini has worked with, and in the July 2025 validation roundtable held under the Chatham House Rule, model monitoring typically runs on a monthly or quarterly cycle, and pushing a warranted model change through committee takes months rather than weeks. In fast-moving data environments, that feedback lag is itself a form of model risk.

For validation functions building out the monitoring programmes that SS1/23 requires, the model-shift approach offers a path from periodic, committee-driven review toward analytically grounded surveillance, and it automates the part of monitoring that has to scale across a large inventory without bespoke checks for every model.

The governance challenge is real: most monitoring cycles were designed for a fleet that stays still. SS1/23 requires firms to think about aircraft that are already in the air.

Where should firms start with SS1/23?

Firms that haven’t completed their self-assessment should start with the model inventory: establish what exists, tier it by materiality, assign ownership. The governance work follows: validation independence, in practice the hardest thing to demonstrate, a named SMF holder, and the first annual report to the audit committee. Monitoring can build on parameter-level model-shift triggers rather than output-distribution alarms. For firms newly granted an internal model permission, the twelve-month window is already running.

Completing the inventory, governance and monitoring work is a starting point, not a finish line. SS1/23 was itself updated on 16 April 2026, so firms should work from that version rather than the 2023 original; the 17 May 2024 compliance date is unchanged.

The models SS1/23 governs decide who gets credit, at what price, and how much capital stands behind those decisions; getting their governance right protects borrowers and balance sheets alike, which is why the PRA now names model risk a risk in its own right. A firm that treats SS1/23 as a daily discipline keeps its certificate current: a fleet it can name, a commander for every flight, and models cleared to fly.

Frequently asked questions