The Prudential Regulation Authority said in its letters sent on Tuesday that it has seen AI, as well as interest rates and geopolitical events, test levels of risk management at firms in the sector. Poor data is a root cause of some risks.
Compnies should aggregate their data better to ensure they have the information required to improve risk management and board decision-making at a time of developing technology, the watchdog said.
"Moreover, continued technological developments including increased use of artificial intelligence places heightened importance on the quality and accuracy of the data underpinning these tools," the regulator wrote. One of the letters is to U.K. banks and the other is to international lenders, with some overlapping content but also differing material.
The PRA said it expected firms to have robust governance and risk management frameworks in place across businesses. They should consider where risk culture may be the root cause of weakness in controls.
The regulator stressed the importance of robust credit risk management. It told U.K. banks that current credit risks could differ from those on which models to assess such risk were built. Banks should consider longer-term credit risk like climate change impact.
Many international banks are falling short of standards required in management of credit risk in counterparties, meaning buyers or sellers in financial contracts, according to the PRA.
The PRA said that by March 2025, U.K. and international banks must show they can stay within the level of disruption they can tolerate. This will keep the business running even in the face of severe shocks.
The watchdog said firms should already have made significant progress in strengthening their ability to respond to, and recover from, cyber defense weaknesses exposed by outdated technology still in use.
Businesses should have action plans to address disruption in services like payroll or storage from external suppliers.
The watchdog said that branches of international banks should be able to deliver similar outcomes in resisting shocks.
Firms should ensure they work thorough the potential impact of Basel 3.1, the latest package of international capital rules, with their board. Basel 3.1 will start in the U.K. on Jan. 1, 2027, after the PRA recently announced a 12-month delay.
The regulator said it is considering the impact of the Basel 3.1 delay on the timeframe for implementing the so-called strong and simple capital framework for smaller banks. This will introduce a capital regime proportionate to the needs of such companies.
Relevant firms should still, however, be considering the implications of these proposed simpler capital rules, according to the PRA.
--Editing by Alyssa Miller.
For a reprint of this article, please contact reprints@law360.com.
