What is PRA SS1/23?
By Nick Jang, founder of MINERVA Studio ·
The short answer
SS1/23, Model risk management principles for banks, is the UK Prudential Regulation Authority’s supervisory statement on how banks should manage the risk of their models. It was published on 17 May 2023 and took effect on 17 May 2024, and a minor update on 23 April 2026 clarified it. It applies to UK banks, building societies and PRA-designated investment firms with approval to use internal models for regulatory capital, and rests on five principles: model identification and risk classification, governance, development and use, independent validation, and model risk mitigants.
Who it applies to
SS1/23 is aimed at UK-incorporated banks, building societies and PRA-designated investment firms that have internal model approval for credit risk (the IRB approaches), market risk (the internal model approach) or counterparty credit risk (the internal model method). It covers all their models, though, not only the capital ones, and models built in-house or bought from vendors alike.
Firms outside that scope aren’t bound by it, but the PRA notes that vendors and consultants may find it useful, and plenty of smaller firms use it as a benchmark.
The five principles
| Principle | What it asks |
|---|---|
| 1. Model identification and model risk classification | A firm-wide definition of a model, a complete model inventory, and risk-based tiering by materiality and complexity. |
| 2. Governance | A board that sets model risk appetite and approves the policy, and a named senior manager (SMF) accountable for the framework. |
| 3. Model development, implementation and use | Standards for design, data, testing, documentation and supporting systems, with limitations recorded and fixed. |
| 4. Independent model validation | Ongoing, independent and effective challenge, performance monitoring and periodic revalidation. |
| 5. Model risk mitigants | Policies for when a model under-performs, including independent review of post-model adjustments, limits on use and escalation. |
Each principle has sub-principles, twenty-three in all, and the PRA expects firms to meet them as well as the headline principles.
What counts as a model
SS1/23 asks firms to adopt this definition: a model is “a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into output.” Inputs can be quantitative, qualitative or expert judgement, and outputs quantitative or qualitative.
It then goes a step further than many rules. Where a deterministic method, such as a complex set of decision rules, isn’t a model but has a material bearing on business decisions, firms should consider applying the relevant parts of the framework to it anyway. The statement also asks firms to manage the risks of AI and machine learning techniques used in models. What counts as a model is the first argument most model risk teams have, so it helps that the definition is written down.
Accountability and vendors
Two features stand out. First, a Senior Management Function holder is personally accountable for the model risk framework under the UK’s senior managers regime, and must make sure the firm assesses itself against SS1/23 and fixes what it finds, with the self-assessment updated at least once a year. Second, for vendor models, firms must satisfy themselves that the model has been validated to the same standard as their own, check the vendor’s data and assumptions, and monitor its performance against their own outcomes. Buying a model doesn’t buy the validation.
The April 2026 update
On 23 April 2026, as part of a package of low-impact amendments, the PRA clarified that SS1/23’s expectations are not conditions for internal model approval, and that a firm newly granted internal model permission has 12 months from the grant to comply. It also amended SS3/18, so firms with internal model approval assess their stress-testing model risk against SS1/23 too. The PRA described these as clarifications, not changes in policy, and made them without consultation.
SS1/23, E-23 and SR 26-2
| PRA SS1/23 (UK) | OSFI E-23 (Canada) | SR 26-2 (US) | |
|---|---|---|---|
| Date | Effective 17 May 2024 | Effective 1 May 2027 | Issued 17 April 2026 |
| Who | Banks with internal model approval | All federally regulated financial institutions, banks and insurers | Banking organizations supervised by the Fed, FDIC and OCC |
| Shape | Five principles, 23 sub-principles | Outcomes and principles across the model lifecycle | Principles-based guidance |
| Personal accountability | A named SMF holder | Senior management, by role | Senior management and the board |
| AI | AI and ML risks to be managed within the framework | AI and ML methods expressly models | Applies as to any other model |
A Canadian bank with a UK subsidiary may face both. The work overlaps heavily: one inventory, one tiering, one validation record can serve both if each record names the rule it answers. That’s how MINERVA keeps it: one model inventory, with the rules each model answers to read from the same record. See OSFI E-23 and SR 11-7.
Related questions
When did PRA SS1/23 take effect?
On 17 May 2024, a year after its publication on 17 May 2023. A clarifying update was published and took effect on 23 April 2026.
Who does SS1/23 apply to?
UK-incorporated banks, building societies and PRA-designated investment firms that have approval to use internal models for regulatory capital in credit, market or counterparty credit risk. It covers all of their models, not only capital models.
What are the five principles of SS1/23?
Model identification and model risk classification; governance; model development, implementation and use; independent model validation; and model risk mitigants.
Does SS1/23 cover AI models?
Yes. Its model definition is broad, and it asks firms to identify and manage the risks of artificial intelligence and machine learning techniques used in modelling.
What is a post-model adjustment?
A change made to a model’s output outside the model itself, often to cover a known weakness. Principle 5 of SS1/23 expects a process for applying them and their independent review.
Sources
- Bank of England PRA — SS1/23, Model risk management principles for banks
- Bank of England PRA — SS1/23 as amended (April 2026)
- Bank of England PRA — LIAF01/26, low-impact amendments (April 2026)
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.