Guide to PRA SS 1/23 Model Risk Management for UK Banks

The Prudential Regulation Authority issued Supervisory Statement 1/23 on 17 May 2023 for UK banks and selected investment firms. The statement came into force on 17 May 2024, after a 12-month preparation period for in-scope firms. It gives model risk management a defined place within prudential regulation, rather than treating it as a subset of operational risk.

The PRA subsequently published an updated version effective 23 April 2026, following low-impact amendments. The five principles remain the foundation of PRA SS 1/23 model risk management.

The scope covers UK-incorporated banks, building societies and PRA-designated investment firms with internal model approval. This includes firms that use internal models for credit risk, market risk or counterparty credit risk calculations. Firms outside formal scope often use the framework to strengthen model governance proportionately.

This blog explains PRA SS 1/23, its five principles, coverage of AI and machine learning, and practical implementation steps. It also shows how banks can connect model inventory, independent validation, performance monitoring and model risk mitigants within a single MRM framework.

What Is PRA SS 1/23?

PRA SS 1/23 sets supervisory expectations for model risk management across in-scope UK banking firms. It defines five model risk management principles covering inventory, governance, development, validation and mitigants. Banks use it to manage model use through documented ownership and controls.

The supervisory statement provides firms with a strategic approach to model risk management throughout the model lifecycle. It expects firms to identify models and maintain appropriate risk classifications. Governance arrangements should support oversight across the full model portfolio.

The PRA's definition covers quantitative methods that apply relevant theories or assumptions to process input data into outputs. These inputs may be qualitative, and outputs can also be qualitative. Consequently, models do not need to produce numerical predictions to fall within the definition.

The statement also asks firms to consider applying relevant MRM controls to complex deterministic methods that materially influence business decisions.

For additional context, the Solytics Partners guide to model risk management explains how financial institutions establish governance throughout the model lifecycle.

Who Does PRA SS 1/23 Apply To?

PRA SS 1/23 applies to firms with internal model approval for regulatory capital purposes. The formal scope does not cover every UK financial institution. Firms outside scope may still adopt its supervisory expectations as good MRM practice.

The in-scope group includes UK-incorporated banks, building societies and PRA-designated investment firms. These firms use internal models under the Internal Ratings Based approach, the Internal Model Approach or the Internal Model Method.

Firms receiving internal model permission for the first time have 12 months from the grant of permission to meet the statement's expectations. The PRA also expects existing in-scope firms to maintain periodic self-assessments of their MRM framework.

This scope makes a reliable model inventory essential. Firms need to identify which models support business decisions and determine how much governance attention each requires. MRM Vault from Solytics Partners can support this work by maintaining model records and associated risk classifications.

Insurers, credit unions and third-country branches sit outside the formal scope of SS 1/23. Some firms may still align relevant MRM governance documents with PRA expectations. A shared inventory and evidence layer can also improve collaboration between model owners and control teams.

Why Does PRA SS 1/23 Matter?

PRA SS 1/23 establishes model risk as a discipline requiring consistent senior oversight. It connects model ownership with independent validation and operational controls. Banks need evidence that these arrangements work across model families, not only during periodic supervisory reviews.

• First detailed UK MRM baseline: SS 1/23 gives firms a formal model risk management structure across model types. Earlier guidance addressed specific areas, whereas PRA's model risk management statement sets out broader expectations.
• Model risk requires senior oversight: Boards and senior management must understand exposure relative to the model risk appetite. A clear model risk appetite helps firms decide where controls, challenge and escalation need more depth.
• AI and ML fit the principles: The PRA confirmed that artificial intelligence and machine learning fall within the principles where they apply to models. This technology-neutral approach allows firms to apply the framework while adjusting validation methods to the model's characteristics.
• Cross-border banks need alignment: Firms with UK, US and Canadian operations compare SS 1/23 with SR 26-2 and OSFI E-23. Each framework has a different institutional scope. Banks must therefore identify which expectations apply rather than assume that one regime satisfies another.

The practical implication is that model risk assessment should begin before validation. Identifying potential weaknesses during development helps teams address them before design changes become infeasible.

The Solytics Partners' approach to model risk assessment before validation explains why early assessment improves subsequent governance decisions.

What Are the Five Principles of SS 1/23?

SS 1/23 organises PRA's model risk management expectations through five principles. These principles cover identification, governance, lifecycle standards, validation and mitigants. Together, they help banks move from policy intent to repeatable MRM practices across the model portfolio. 

The five principles work together throughout the model lifecycle. Classification establishes the required control depth, while governance determines who is accountable for applying those controls. Independent validation then challenges whether the model remains suitable for its intended purpose.

Principle 5 completes this structure by addressing limitations that cannot be resolved through ordinary model development or validation alone.

What Does Principle 2 Governance Require?

Principle 2 defines accountability for the overall MRM framework. It places model governance within board and senior manager oversight. It also connects financial reporting models with audit committee review and documented escalation paths.

The PRA expects firms to allocate responsibility for the overall MRM framework to the most appropriate Senior Management Function holder or holders. Selection depends on the firm's organizational structure and risk profile. The relevant Statements of Responsibilities should reflect these arrangements.

The accountable SMF holders oversee the overall framework even when operational activities are distributed across teams. Their responsibilities include ensuring that necessary remediation plans have appropriate ownership.

The board sets the firm's approach to model risk and reviews material issues through governance channels.

For financial reporting, the PRA expects firms to make a report on the effectiveness of MRM available to the audit committee regularly and at least annually. This report should also be available in time to inform external auditors' assessment of financial reporting risks.

The audit committee's role therefore concerns the effectiveness of MRM for financial reporting. It does not replace the board's wider responsibility for establishing an effective model risk management framework.

The three lines of defence framework also supports Principle 2 governance. First-line model developers and model users build, use and monitor models. Second-line validation teams provide independent model validation, while internal audit reviews the control design.

This organizational model is a common way to assign responsibilities. SS 1/23 allows firms to structure their arrangements proportionately, provided the required independence and governance effectiveness are maintained.

How Does SS 1/23 Cover AI and Machine Learning Models?

SS 1/23 covers AI and ML models where they meet the model definition. The PRA kept the principles technology-neutral, rather than creating separate AI-only rules. Banks still need validation methods appropriate to explainability limitations and changing model behavior. Bias testing may also be relevant to particular applications.

The Bank of England and FCA addressed wider AI governance questions in FS2/23: Artificial Intelligence and Machine Learning, published on 26 October 2023.

FS2/23 summarised responses to an earlier discussion paper. Respondents generally considered existing governance frameworks capable of addressing AI risks, while identifying areas where further clarification could be useful.

These concerns included explainability and data-related risks. However, FS2/23 did not introduce new policy requirements, and its observations should not be presented as separate supervisory mandates.

AI and ML models introduce new governance pressure because their behavior may change after deployment. Banks need bias testing, model performance monitoring and controls for complex outputs where those risks are relevant to intended use.

Generative AI applications may introduce additional concerns, particularly where outputs are not deterministic. Agentic workflows can create further exposure when systems execute actions across connected services. Firms should evaluate how these technologies fit existing model definitions and whether additional governance processes are necessary.

This is where model risk teams need stronger alignment with enterprise AI governance. A connected governance layer helps banks manage AI ownership, approval evidence and monitoring signals without creating a separate oversight process.

Vendor models require additional review because firms may not receive complete methodological details. Off-the-shelf models, open-source components and third-party AI services still affect supervised activity. Banks remain accountable for validation outcomes when they use externally supplied systems.

Where vendor transparency is limited, teams should document the resulting validation constraints. Appropriate compensating controls can help manage residual exposure when complete technical information is unavailable.

How Does PRA SS 1/23 Compare to Other Regimes?

Cross-border banks apply SS 1/23 alongside related US and Canadian regimes. The frameworks differ by scope and vocabulary. Their requirements should be compared according to the regulated institutions and models covered by each framework.

On 17 April 2026, the Federal Reserve, OCC and FDIC issued SR 26-2, superseding SR 11-7 and SR 21-8. The revised guidance emphasizes an approach tailored to the institution's model risk exposure.

The Federal Reserve identifies the guidance as most relevant to banking organizations with more than $30 billion in assets under its supervision. This is an indication of expected relevance, not a universal applicability threshold across all three agencies.

OSFI E-23 takes effect on 1 May 2027. It establishes a principles-based approach for federally regulated financial institutions in Canada. The guideline also considers risks arising from AI/ML models within its broader scope.

The distinction matters for multinational banks. A common inventory can support model records across jurisdictions, but local policies must reflect each regulator's actual expectations.

What Are the Common Implementation Challenges with SS 1/23?

SS 1/23 implementation becomes difficult when governance policies are not reflected in daily model activities. Banks need accurate inventories and clear ownership. Problems appear when evidence cannot support committee decisions or supervisory inspections.

• Comprehensive inventory gaps: Firms often find shadow spreadsheets and end-user tools outside the formal model inventory. Inventory design should capture owners and model lineage. Records also need sufficient context to identify the models that influence business decisions.
• Proportionate control design: Banks must apply controls in a manner proportionate to materiality and complexity. Weak tiering creates over-control for low-risk models and under-control for high-risk models.
• Senior accountability handoffs: Firms may assign an SMF without giving the role useful reporting. Senior leaders need clear visibility into outstanding findings and remediation progress. Reports should also identify material breaches of the firm's model risk appetite.
• AI and ML validation gaps: Traditional validation may miss drift and black-box behavior in machine learning systems. Validators need techniques suited to the model's complexity and intended use. Independent review should also identify limitations that require additional controls.
• Documentation fragmentation: Teams often scatter evidence across emails and committee packs. This weakens the audit trail when supervisors request relevant MRM governance documents.

Some weaknesses cannot be eliminated immediately through redevelopment. In these cases, institutions may need temporary model restrictions or enhanced monitoring until the underlying issue is resolved.

The Solytics Partners guide to compensating controls for deployed models explains how institutions can manage unresolved weaknesses in deployed models through documented mitigants.

How Do UK Banks Build a Compliant SS 1/23 Program?

A compliant SS 1/23 program starts with inventory and classification. Banks then connect accountability and validation requirements to model materiality. Each step should create evidence that supervisors can review.

• Complete the model inventory: Catalog every model with its owner and intended purpose. Record the methodology and known limitations, while including vendor models that influence business decisions. The inventory should remain current throughout the model lifecycle.
• Define classification logic: Classify models by materiality, complexity, risk assessment results, and downstream impact. The tier should determine validation depth, approval level, and monitoring frequency.
• Update model risk policy: Align it with SS 1/23 principles and the risk appetite. Define ownership, approvals, escalation rules and model risk mitigants for each tier.
• Assign senior accountability: Identify the appropriate SMF holder or holders and update their Statements of Responsibilities. Establish reporting that gives the board a clear view of model risk exposure. The audit committee should receive the required financial reporting, including the MRM effectiveness report.
• Strengthen independent validation: Build validation capacity outside model development teams. Validation should cover conceptual soundness and implementation quality. Reviewers should document their conclusions and confirm how outstanding findings affect continued use of the model.
• Monitor production models: Track performance and relevant drift indicators after deployment. Define what constitutes a monitoring breach and who must respond. Material changes should trigger reassessment when the model's approved use may no longer remain appropriate.
• Govern model adjustments: Document overrides, overlays and compensating controls when outputs cannot be relied upon. Each adjustment needs a supporting rationale and appropriate approval. Independent review should address post-model adjustments in line with Principle 5. Banks can strengthen this work through stronger data lineage and evidence design. The Solytics Partners guide to data strategy for model risk management examines how structured data records support inventory governance and model review.

Once these steps are in place, the next challenge is evidence readiness. UK banks need a clear view of which records prove ownership and accountability. Validation findings and monitoring records must also be available for supervisors to review when assessing the effectiveness of the MRM framework.

The underlying evidence of model performance should also remain current. The Solytics Partners analysis of AI model monitoring explains how operational signals help teams identify changes that require validation or corrective action.

How Does Solytics Partners Enable PRA SS 1/23 Compliance?

PRA SS 1/23 model risk management requires banks to demonstrate that their governance arrangements work throughout the model lifecycle. A current inventory provides the starting point, but reviewers must also understand how identified weaknesses affect model use. Solytics Partners supports this through MRM Vault and its specialised model validation capabilities.

MRM Vault maintains model inventory records alongside ownership information and risk classifications. Its configurable workflows help teams manage findings and approval activities. This supports the governance arrangements associated with Principles 1 and 2, while keeping relevant model evidence accessible during subsequent reviews and supervisory examinations.

Independent validation adds technical challenge to those governance records. MoDeVa provides model testing capabilities, including explainability and fairness analysis where relevant. NIMBUS Uno complements these activities through model evaluation and production monitoring. This helps reviewers examine model behaviour and determine whether findings require additional investigation.

The resulting evidence can also inform decisions about model risk mitigants. Monitoring signals help teams identify deterioration, while MRM Vault maintains the corresponding governance information. Together, these capabilities support ongoing oversight of model limitations without implying that software alone establishes PRA compliance.

Book a demo with Solytics Partners to explore how connected model inventory and validation evidence support effective PRA oversight today.

Final Remarks

PRA SS 1/23 gives UK banks a clear baseline for model risk management. Its five principles connect model identification with governance responsibilities. Independent validation and model risk mitigants provide the corresponding technical challenge and response mechanisms.

Strong programs will align SS 1/23 with SR 26-2, OSFI E-23 and wider AI governance expectations. However, each framework has a distinct scope, so institutions should map applicable requirements rather than assume complete regulatory equivalence.

The practical test is whether banks can demonstrate that model risk remains appropriately managed between supervisory reviews. That requires current evidence of ownership and independent challenge, supported by clear remediation decisions.

Solytics Partners helps financial institutions maintain these records through MRM Vault and complementary model analytics capabilities. Connected evidence can support more consistent oversight as the model portfolio changes.

Frequently Asked Questions

When did PRA SS 1/23 come into force?

PRA SS 1/23 came into force on 17 May 2024, 12 months after the PRA published the supervisory statement. The PRA subsequently published an updated version effective 23 April 2026. Firms receiving internal model permission for the first time have 12 months from that permission to meet the statement's expectations.

Should insurers adopt PRA SS 1/23 voluntarily?

Insurers do not fall within the formal scope of PRA SS 1/23 because the statement targets specific PRA-regulated banking firms. Some insurers may still adopt its principles as a practical model governance benchmark. However, voluntary alignment should complement the supervisory requirements that apply directly to insurance undertakings.

How should UK banks prepare for PRA SS 1/23 compliance?

UK banks should begin with a complete model inventory and named ownership for material models. Risk classification should guide validation requirements and approval authority. Firms must also establish appropriate SMF accountability and maintain evidence of monitoring effectiveness. Periodic self-assessments help identify shortcomings that require remediation.

What evidence do firms need for PRA SS 1/23 reviews?

Firms need inventory records, tiering rationale, validation reports and monitoring evidence for PRA SS 1/23 reviews. Supervisors may also examine policy documents and committee materials. Relevant records should show how teams identify weaknesses and approve corrective action. Annual self-assessments and remediation plans provide further evidence of governance effectiveness.

How does PRA SS 1/23 affect third-party models?

PRA SS 1/23 keeps firms accountable for externally supplied models, including vendor models. Banks should assess these models according to their materiality and intended use. Limited disclosure of methodology may require additional testing or compensating controls. Institutions should document the resulting limitations and monitor performance throughout operation.

How often should models be validated under PRA SS 1/23?

PRA SS 1/23 does not prescribe one validation frequency for every model. Firms should determine review intensity according to the assigned model tier and associated risk. More material models generally require stronger challenge and closer monitoring. Significant changes or identified weaknesses may trigger reassessment before the next scheduled review.

What happens if firms fail to meet PRA SS 1/23 expectations?

Weak model risk management can result in supervisory findings and remediation requests. The PRA may examine governance records or validation evidence to determine whether firms are managing model risks appropriately. Banks should therefore maintain current records of outstanding issues and demonstrate how identified weaknesses are addressed.