Supervisory Statement SS1/23United Kingdom

SS1/23 – Model risk management principles for banks

SS1/23 sets the PRA’s expectation that banks treat model risk as a risk in its own right. Five principles cover model identification and tiering, board-led governance with an accountable SMF, model development, independent validation and model risk mitigants. In effect since 17 May 2024.

Key points

01
Published on 17 May 2023, in effect since 17 May 2024; the April 2026 version (effective 23 April 2026) adds clarifications only.
02
In scope: UK-incorporated firms with internal model approval for regulatory capital; UK branches of third-country banks are out of scope.
03
Broad model definition: inputs may be quantitative, qualitative or expert-judgement based; material and complex deterministic methods should be considered for MRM treatment (Principle 1.1).
04
The board sets the model risk appetite and approves the MRM policy; an accountable SMF holds overall responsibility, reflected in the Statement of Responsibilities (Principles 2.1 and 2.2).
05
Covers all models, developed in-house or externally, including vendor models and models used for financial reporting (para 1.3).
06
Firms update their self-assessment at least annually and share findings and remediation plans with the board; the PRA can request them (paras 1.7 and 1.8).

Status

Published on 17 May 2023 together with PS6/23; the policy came into effect on 17 May 2024. An updated version dated 16 April 2026, published with LIAF01/26 and effective from 23 April 2026, clarifies that the expectations are not conditions for internal model approval and gives firms 12 months from first receiving internal model permission to comply. With the same update, firms with internal model approval assess their stress-test model risk management against SS1/23 instead of SS3/18. The five principles are unchanged.

What it requires

01
Principle 1 – Model identification and model risk classification
An established model definition, a comprehensive model inventory and risk-based tiering. Materiality considers size-based measures and qualitative factors; complexity may consider alternative and unstructured data and measures of interpretability, explainability, transparency and potential bias (Principle 1.3).
02
Principle 2 – Governance
Strong governance oversight with a board that promotes an MRM culture from the top by setting a clear model risk appetite, approves the MRM policy and appoints an accountable individual to implement a sound MRM framework.
03
Principle 3 – Model development, implementation and use
A robust development process with standards for model design and implementation, model selection and performance measurement, and regular testing of data, model construct, assumptions and outcomes. Documentation should let an independent expert understand the model and replicate parameter estimation and results (Principle 3.5).
04
Principle 4 – Independent model validation
A validation process that provides ongoing, independent and effective challenge to model development and use. The individual or body approving a model ensures that validation recommendations for remediation or redevelopment are acted on.
05
Principle 5 – Model risk mitigants
Established policies for using model risk mitigants when models under-perform, a consistent firm-wide process for post-model adjustments with independent review, restrictions on model use and formal exception and escalation procedures (Principles 5.1 to 5.3).

What it means for the board and executive management

01
The board sets a model risk appetite with measures for framework effectiveness, model approval, limits and exceptions, performance thresholds and the use of mitigants and expert judgement (Principle 2.1(c)).
02
The board receives regular reports on the model risk profile against the appetite and is expected to challenge the outputs of the most material models and understand their limitations (Principle 2.1(d) and (e)).
03
A Senior Management Function holder is accountable for the MRM framework, and the Statement of Responsibilities must reflect this (Principle 2.2).
04
Self-assessment findings and remediation plans go to the board in a timely manner, with regular progress updates (para 1.7).

In MRM-Solution

How MRM-Solution supports it

01Keep every model in one inventory with owner, tier, EU AI Act risk class and re-validation dates, linked to the committees that approve its use.
02Generate policies from the modelled processes, so roles and responsibilities in the text match how the work is actually done.
03Model committees, mandates and escalation lines once; the structure is checked for gaps, cycles and independence of the second line.
04Keep an append-only audit trail of who changed what, when and in which role, plus a change log per policy.

Book a demo

Questions executives ask

Does SS1/23 apply to our UK operations?

Only to UK-incorporated banks, building societies and PRA-designated investment firms with internal model approval for credit, market or counterparty credit risk capital. A UK branch of a third-country bank, for example a Swiss bank, is not in scope; a UK-incorporated subsidiary with internal model approval is. Firms out of scope are welcome to use the principles (para 1.2).

Does SS1/23 cover AI and machine learning models?

SS1/23 does not single out AI by name; it applies to every method that meets its model definition, including vendor models. For newly advanced approaches or technologies, the complexity assessment may consider alternative and unstructured data and measures of interpretability, explainability, transparency and potential bias (Principle 1.3(c)).

What changed in the April 2026 update?

LIAF01/26, effective 23 April 2026, clarified that the expectations are not conditions for internal model approval and that firms first receiving internal model permission have 12 months from that permission to comply. Firms with internal model approval now assess stress-test model risk management against SS1/23 rather than SS3/18. The principles themselves did not change.

Sources

Executive summary for orientation, not legal advice. The official text prevails.

Reference: Supervisory Statement SS1/23
Issued by: Prudential Regulation Authority (PRA), Bank of England
Type: Supervisory statement
In force since: 17 May 2024
Applies to: UK-incorporated banks, building societies and PRA-designated investment firms with permission to use internal models (IRB, IMA or IMM) to calculate regulatory capital. Firms without such permission and third-country firms operating in the UK through a branch are not in scope, but may use the principles (para 1.2).
Last reviewed: 13 October 2026