Seven structural changes from SS3/19 to SS5/25, cited to paragraph. What every UK insurer needs in the ORSA now the review window has closed and supervisors are asking for evidence — including the gap-review table and the artefacts to have on file.
PRASS5/25ORSASolvency IISCRSS5/25 commenced on 3 December 2025 and replaced SS3/19 in its entirety on that date (SS5/25 §3.1). Firms had six months — to 3 June 2026 — to review their status, identify what needed work, and build a plan to close the gaps (SS5/25 §3.2). Supervisors undertook not to ask for evidence of those reviews until the six months had elapsed (SS5/25 §3.3).
They have. The window shut six weeks ago, and the standard the PRA set for what it will find is explicit: where firms are asked to produce their internal reviews and action plans, the timetable must be demonstrably credible and ambitious (SS5/25 §3.4). Not complete. Credible and ambitious.
SS5/25 applies to UK banks and to UK Solvency II (re)insurers — including the UK entities of international groups — but not to UK branches of overseas (third-country) firms (SS5/25 §1.7). Insurance-specific expectations sit in Chapter 7; five chapters apply to all firms (SS5/25 §1.6). Lloyd’s managing agents should read it alongside Lloyd’s own oversight framework; the expectations flow through to syndicate ORSAs in substance if not in addressee.
SS3/19 set out its expectations in one chapter — paragraphs 3.1 to 3.22, across four areas. Twenty-two paragraphs. SS5/25 sets out its expectations in Section 4 — paragraphs 4.1 to 4.140, across seven chapters, five applying to all firms and Chapter 7 to insurers alone (SS5/25 §1.6).
One hundred and forty paragraphs against twenty-two. A six-fold expansion — and that is the most conservative comparison the documents support. Count SS5/25’s Section 3, which also carries expectations, and it is 168 against 22. Whole-document, 182 against 34. Published commentary widely reports SS3/19 as having 32 paragraphs; that figure matches neither count on the Bank’s own text.
The direction is not in doubt: the PRA has stopped describing a posture and started specifying a programme.
A citation trap. The statement was published first as SS4/25 and renumbered to SS5/25 with no change to its content. The Bank’s PDF still sits at an ss425 path. A board paper citing SS4/25 is not wrong — it just dates the author.
SS3/19 asked for a response proportionate to the nature, scale and complexity of the firm’s business (SS3/19 §3.1). SS5/25 says firms of any size may be significantly exposed, and that what matters most is the materiality of climate risk to the given firm (SS5/25 §3.9).
But the widely-repeated summary — “exposure, not size” — is not what either instrument says. Materiality is size-blind. The response is not: SS5/25 §3.11 asks for assessment proportionate to risk exposure and the size of the firm. Smaller firms may use less sophisticated tools even where risks are material (SS5/25 §3.12, §3.20). The policy statement is more explicit still: proportionate application reflects exposure to material climate risk as well as the size and complexity of the business (PS25/25 §1.17, §1.4).
Size does not excuse you from finding the risk. It may shape your tooling. The price is prudent interpretation, and the price is stated.
SS3/19 never mentions one. Under SS5/25 the board reviews and agrees the material climate risks and they are recorded in the register with an agreed review timeline (SS5/25 §3.18, §4.7). Every entry links to an existing financial or operational risk type with the transmission channel articulated (SS5/25 §4.20).
SS3/19 asked that responsibility be allocated to an existing SMF (SS3/19 §3.4). SS5/25 keeps that and adds something SS3/19 has no equivalent for: the board should ensure the assigned individual has climate risk objectives, and that performance against them is reflected in the firm’s appraisal and reward system — variable remuneration is the PRA’s own example (SS5/25 §4.6). No new SMF is required (PS25/25 §2.31).
SS3/19 named liability risk as a third factor but subsumed it under physical and transition (SS3/19 §2.2). SS5/25 does not: litigation may be a distinct transmission channel or a subset, and firms apply judgement — provided the choice reflects the business and is applied consistently (SS5/25 §2.1, §2.5). Twelve respondents raised it; half, mostly insurers, wanted it recognised as distinct (PS25/25 §2.43). The PRA accepted that for some firms, general insurers in particular, it may materialise independently (PS25/25 §2.44).
SS3/19 gave appetite one paragraph (§3.3). SS5/25 gives it seven (§4.7–4.13): a defined hierarchy — firm-wide at board level, business-line reflecting each line’s material risks, and appetite and tolerance levels for outsourcing and third-party arrangements (§4.11) — with a two-way feedback process between the first two (§4.10). ACCEPT / MANAGE / AVOID is a suggestion, not a required format (§4.12).
Four paragraphs became twenty-eight (SS5/25 §4.46–4.73). Firms must document and demonstrate how results inform decision-making (§4.48, §4.71), with distinct exercises per use case (§4.53). Reverse stress testing is new, and precisely defined: the point of failure of a firm solely due to climate-related risks (§4.59).
The sharpest delta in the document, and it turns on one word. SS3/19: impact potentially non-linear, correlated and irreversible (§2.5). SS5/25: risks are systemic, impact likely to be correlated, non-linear, irreversible and subject to tipping points (§2.6).
Read it as an actuary. Correlated defeats independence. Non-linear defeats linear projection. Irreversible defeats mean reversion. Tipping points defeat smooth distributions. Four load-bearing assumptions, named in one line by the regulator — and the modal verb attached to them upgraded.
SS3/19 mentioned outsourcing once, inside an example (§3.8). SS5/25 gives it a subsection (§4.43–4.45): important business services under severe but plausible scenarios, and a definition of operational resilience that includes learning from near misses. The draft said “critical operations”; a respondent noted it is not a defined PRA term and the PRA amended §4.44 (PS25/25 §2.42).
SS3/19 has no data section. SS5/25 gives it Chapter 4 (§4.74–4.79), and relocates the subject in its first sentence: data uncertainty is part of the risk, not a caveat about it. Two softenings were won in consultation and most firms are still working to the draft: “quantify” uncertainty became “understand” it, and conservative proxies became appropriate ones (PS25/25 §2.65).
Internal model firms consider climate across the underwriting, reserving, market, credit and operational components (SS5/25 §4.129) — reserving included, and it is the one most often dropped. There is no requirement for a separate climate capital requirement (PS25/25 §2.88); climate is a risk driver in components you already have (PS25/25 §2.89).
Standard formula firms face the sharper question. Where a firm judges the SF no longer appropriate — the PRA’s own example being an assessment of material climate risk — it may need to apply for a partial or full internal model, and the PRA would consider a capital add-on where it judges SF use inadequate (PS25/25 §2.92).
One paragraph became four (SS5/25 §4.39–4.42). Regular reporting and ad-hoc reporting where an appetite limit for a material risk is breached (§4.39); frequency appropriate to materiality (§4.40); and climate incorporated across all three lines of defence (§4.42) — a phrase SS3/19 never uses.
The seven changes, reduced to one page. Each row: what SS3/19 asked, what SS5/25 asks, and what changes in the ORSA as a result.
| # | Area | SS3/19 said | SS5/25 says | What changes in the ORSA |
|---|---|---|---|---|
| 1 | Risk appetite | One paragraph (§3.3) | Three-tier hierarchy incl. third-party tolerances, with feedback loop (§4.7–4.13) | Appetite section restated as a hierarchy; outsourcing tolerances stated, not implied |
| 2 | Scenario analysis | Four paragraphs; use expected | Twenty-eight paragraphs; decisions demonstrably informed, distinct exercises per use case, climate-only reverse stress test (§4.46–4.73) | Every CSA exercise paired with the decision it moved; RST defining the climate-only failure point |
| 3 | Risk nature | Potentially non-linear, correlated, irreversible (§2.5) | Likely correlated, non-linear, irreversible, subject to tipping points; systemic (§2.6) | Assumptions register names where each property enters — or records the challenge where it doesn’t |
| 4 | Operational resilience | Outsourcing mentioned once, in an example (§3.8) | Own subsection: important business services under severe-but-plausible climate scenarios; near-miss learning (§4.43–4.45) | IBS mapping carries climate scenarios; near misses logged and fed back |
| 5 | Data | No section | A chapter: uncertainty is part of the risk; appropriate proxies, understood not merely quantified (§4.74–4.79; PS25/25 §2.65) | Data-uncertainty inventory with proxy justifications and a remediation timeline |
| 6 | Capital | General expectation | Component-level: underwriting, reserving, market, credit, operational (§4.129); no separate climate SCR (PS25/25 §2.88); SF adequacy question with IM/add-on consequence (PS25/25 §2.92) | Component-by-component climate statement; standard formula appropriateness assessed and evidenced |
| 7 | Reporting | One paragraph | Four: breach-triggered ad-hoc reporting, materiality-scaled frequency, all three lines of defence (§4.39–4.42) | MI pack shows the ad-hoc route; three-lines responsibilities mapped |
The gap review itself comes first: the internal review and action plan the PRA said it would not request before 3 June 2026, with a timetable that reads as credible and ambitious (SS5/25 §3.2–3.4), board-approved and minuted. Then, change by change, the artefacts that show the words became practice:
None of this is a documentation exercise for its own sake. Each artefact is the residue of a control operating — which is precisely why a supervisor asks for it.
What is PRA SS5/25?
SS5/25 is the Prudential Regulation Authority’s supervisory statement on managing climate-related risks, published on 3 December 2025 alongside Policy Statement PS25/25. It replaced SS3/19 in its entirety on publication and sets expectations for UK banks and insurers across governance, risk management, scenario analysis, data and disclosure.
When did SS5/25 come into force, and what was the deadline?
It took effect on publication, 3 December 2025 (SS5/25 §3.1). Firms had until 3 June 2026 to complete an internal gap review and action plan (§3.2); supervisors may request that evidence at any time since.
Does SS5/25 require a separate climate capital requirement?
No. The PRA confirmed no standalone climate SCR is expected (PS25/25 §2.88) — climate is a driver within existing risk components. But a standard formula firm that judges the SF inappropriate for its material climate risk may need a partial or full internal model, and the PRA may consider a capital add-on (PS25/25 §2.92).
How does SS5/25 change the ORSA?
Seven structural ways: a three-tier risk appetite hierarchy, a demonstrable scenario-to-decision trail with a climate-only reverse stress test, hardened treatment of correlation and tipping points, an operational resilience subsection, a data chapter, component-level capital expectations, and breach-triggered reporting across all three lines of defence.
What happened to SS4/25?
Nothing substantive: the statement was first published as SS4/25 and renumbered SS5/25 without content change. The Bank’s PDF still sits at an ss425 path. Citations to SS4/25 refer to the same instrument.
Where should the gap review stand now?
Complete, board-approved, and producible on request — with a delivery timetable the PRA would read as credible and ambitious (§3.4). Firms still drafting are not out of options, but they are out of runway.
SS5/25 names transmission channels; it does not map them. A climate assumption hardened in §2.6 does not stay in the climate column — it moves through reserving, reinsurance recoverables, liquidity under margin stress, and the operational resilience of the suppliers in §4.11’s tolerance levels. Tracing that movement across domains is the subject of Paper 04, Cross-Domain Transmission Channels, and the working core of the Abgalis Engine™.
If your gap review surfaced questions your current tooling cannot evidence — Request a Counsel.
Beyond the seven changes above, SS5/25 carries insurance-specific expectations this brief only names: the matching adjustment and Fundamental Spread attestation (SS5/25 §4.139), model validation of climate perils driving SCR (§4.131), liability accumulation across underwriting years (§4.132), technical provisions and the risk margin (§4.140), and the reinsurance-availability assumption under systemic scenarios (§4.127). We walk your team through each against your own undertaking.
Abgalis Research · Abgalis Limited · London · [email protected]
Paragraph references are to PRA SS5/25, SS3/19 (superseded) and PS25/25 as published. Where this brief refers to a regulatory instrument, the regulator’s primary text is authoritative; this paper does not paraphrase regulatory rules. The actuarial reading of SS5/25 §2.6 and the assessment of relative structural significance are Abgalis Research’s analysis, not the regulator’s.
Abgalis, Abgalis Engine and the seven-domain framework are trademarks of Abgalis Limited, with associated UK and PCT patent filings. This briefing is general thought leadership and does not constitute legal, regulatory, actuarial, investment or compliance advice.