CP10/25: How expectations on climate risk are developing

CP10/25 doesn’t introduce new climate risk rules — but it does raise the bar. The paper builds on existing guidance and reflects a clear push for firms to go beyond policy statements and start demonstrating how climate risk is integrated into real-world decision-making.

The emphasis now is on depth. Firms are expected to show how climate factors are being considered across risk, capital and governance — not just acknowledged in ESG strategies or high-level plans. For many, that means testing whether current frameworks are doing enough to influence outcomes.

What CP10/25 covers

CP10/25 proposes updates to SS3/19, consolidating previous PRA guidance and aligning it more closely with international approaches. While it doesn’t introduce statutory changes, it sets out clearer supervisory expectations across a number of key areas:

• Governance and accountability: Boards should receive clearer, more decision-useful analysis of climate risk. That includes director training, a defined link between climate and risk appetite, and clear SMF-level accountability.

• Integrated risk management: Climate risks should be built into credit, market, liquidity and operational risk frameworks — using structured methods to identify, assess, measure and report on them. Managing climate in isolation is no longer seen as sufficient.

• Scenario analysis and data: CSA should inform strategy, risk management and capital planning. Firms are expected to understand model limitations, use proxies where data is lacking, and have governance in place to support those judgements.

• Financial reporting: Climate risk should feed into financial disclosures, ECL calculations and internal capital and liquidity assessments — with material exposures reflected clearly.

Taken together, these proposals point to a step-up in expectations. Firms need to be able to evidence how climate risk is being embedded in practice.

What firms should prioritise now

Although CP10/25 remains open for consultation until 30 July 2025, firms don’t need to wait for the final Supervisory Statement to start making progress in five key areas:

1. Run a detailed gap analysis
Compare current practices against the expectations set out in the draft update to SS3/19. Identify areas that fall short and develop a clear, resourced plan to address them.

2. Strengthen board oversight of climate risk
Review the information provided to the board. Is it clear, specific and useful for decision-making? Consider whether directors have the training needed to challenge and engage with climate issues effectively.

3. Improve climate data and CSA capability
Work on sourcing and managing climate-related data more effectively. Update CSA methodologies to ensure outputs are reflected in ICAAP, ILAAP and strategic decisions. Where possible, tailor scenarios to your business model and include reverse stress testing.

4. Build climate into existing risk frameworks
Make sure policies and procedures for key risk types reflect climate risk appropriately. Define useful metrics and limits. Review how climate factors are treated in ECL modelling and wider financial reporting.

5. Respond to the consultation
Feedback based on operational experience can help shape the final expectations and lead to more workable outcomes. Engagement with the PRA at this stage is encouraged.

Firms that move early will be better placed to demonstrate control and credibility as scrutiny builds.

Final thoughts

The consultation reinforces the need to move beyond climate policy statements and ensure risk frameworks are genuinely equipped to handle climate-related exposures. That means embedding climate across risk, capital, and reporting processes — with the data, governance and metrics to back it up.

Firms that begin preparing now will be better placed to meet expectations when the final statement is published and to show regulators that climate risk is being taken seriously, in practice as well as in principle.