Stress-testing models face greater scrutiny under SS1/23

In April 2026, the PRA finalised an amendment under LIAF01/26, requiring banks using the internal models (IM) approach to assess any models that are used in stress testing against SS1/23 instead of SS3/18. On the surface, this read like housekeeping and was introduced with little fanfare. But in practice, it has closed a gap that existed since 2023, to ensure stress testing and ICAAP models are held to the same standard as credit and market risk. As such, it reflects a genuine tightening of UK model risk standards and IM banks need to take action to ensure they continue to comply with PRA expectations.

IFRS 9 and ECL models will need updating

For any bank running IFRS 9 or ECL models that feed into stress testing or the ICAAP, which is most of them, this puts those models explicitly in scope of SS1/23 level governance. Independent challenge, documented validation and clear ownership are no longer good practice, they’re now essential requirements.

However, it’s important to be realistic about how much of this is genuinely new. SS1/23 has applied to capital models since 2024, so a bank with a mature model risk function should already have a model inventory, PMA governance and documentation standards that meet the standard bar. So, the focus isn’t on creating new capabilities, it’s about extending existing capabilities to include stress-testing and ICAAP models that have historically sat outside that structure.

To ensure the model risk framework reaches the newly in-scope models, firms can look at three key areas, as outlined below.

Governance and oversight

SS1/23 doesn't just apply the same five principles to stress-testing models. It folds them into the same accountability structure as capital models. In practice, firms need to make the following changes:

• Bring IFRS 9/ECL models used in stress testing or the ICAAP into the main model inventory, risk-tiered by materiality and complexity alongside capital models, rather than logged separately as ‘stress-test models’.
• Name a specific Senior Management Function (SMF) holder who is accountable for these models (a key requirement of SS1/23) – moving away from broader owners such as the wider stress-testing team.
• Build or extend a formal governance and control framework for post-model adjustments (PMAs) – so every overlay applied to ECL outputs has documented rationale, appropriate sign-off, and a defined trigger for reduction or removal (essential to SS1/23 but rarely in place for stress-test-specific overlays).
• Track recurring PMAs on the same model over time as the PRA expects firms to analyse whether repeated adjustments point to an underlying flaw in model design, rather than treating each one as a one-off fix.
• Route model performance issues (such as a failed backtest or a breached tolerance) through the same escalation channel as capital models, rather than a separate stress-testing route.

In addition to the above, SS1/23 covers interpretability, explainability and the use of newly advanced modelling approaches. As such, where any part of the ECL model uses machine learning (ML), then SS1/23 principles apply to it directly. This would typically include ML-based segmentation in probability of default (PD) or loss given default (LGD) models, among others.

Reporting

Most firms currently run two reporting cycles. One is a self-assessment against SS3/18 for stress-testing models, and the other is a separate one against SS1/23 for capital models, often going to different committees on different timetables. Bringing both models under SS1/23 aims to remove that duplication and firms can begin to consolidate their reporting processes, including:

• Establishing one model inventory, not two, covering stress-test and capital models on the same risk-tiering basis.
• Maintaining one self-assessment cycle, since SS1/23 expects this at least annually, rather than two parallel exercises with different scope and timing.
• Directing all stress-test model management information to the governance committee that already oversees capital models (typically a model risk or model oversight committee), instead of a bespoke stress-testing forum.
• Creating a single board risk committee paper covering both sets of models (rather than two overlapping submissions), ensuring model risk management effectiveness is also reported to the audit committee.

Documentation

SS3/18 already expected stress-test model documentation detailed enough for an independent third party to understand and, in principle, replicate the results. So, that core standard isn’t new but SS1/23 is more prescriptive in two key areas. Its PMA sub-principles ask firms to document their criteria for calculating, reducing and removing each adjustment, not just record that the judgement was applied. Similarly, its model inventory sub-principles ask for specific fields to be kept current, including the date a model was last validated and when it is next due, rather than a general expectation for those records to exist.

For IFRS 9/ECL models used in stress testing or ICAAP, documentation should cover the following.

• The design, theory and logic behind the model, not just a description of its outputs.
• Data sources and lineage, including where proxy or externally sourced data has been used.
• Methodology and validation results – which should be kept current, rather than reflecting the model's original build.
• Assumptions and known limitations, which should be explicitly stated.
• Named ownership and accountability for the model.
• A documented rationale for every PMA or expert-judgement adjustment, including who approved it, the criteria for removing it, and when it's next due for review.
• A version history showing how the model, and its documentation, has changed as it's been revalidated – this is a key element of SS1/23, which expects all documentation to reflect the current model, not the initial build.

Firms whose stress-test model documentation has solely focused on the core replicability standard, will likely find gaps against SS1/23's expectations for PMAs and inventory upkeep.

A welcome clarification on SS1/23

Alongside the SS3/18 amendment, the PRA has added a clarifying footnote to SS1/23 confirming that compliance is not a condition of gaining internal model approval in the first place. This isn’t entirely new, as SS1/23 gives firms with newly granted IM approval 12 months to comply. But the PRA has explicitly stated that SS1/23 readiness itself cannot be used as a reason to withhold IM approval.

Some firms had found the PRA’s stance ambiguous on this point, so the clarification removes an element of uncertainty from the approval process. This gives firms more room to plan effective governance processes and appropriate resources, rather than attempting to be fully compliant on day one.

Key actions for firms

While the changes within LIAF01/26 won't require a full transformation programme, but it confirms SS1/23 as the gold standard for model risk governance at IM-approved banks. However, it’s important to note that firms without IM approval continue to follow SS3/18 for stress-testing models, so the change doesn't retire the older standard altogether.

For firms with mature capital model governance already in place, the changes are largely an extension exercise rather than a fresh implementation. To bring stress-testing and capital models under one model risk management approach, firms can get started by:

• Mapping the overlap — identify every model that touches stress testing or the ICAAP and check whether it already sits under SS3/18 or SS1/23 governance.
• Checking independent validation coverage — review light-touch validation processes, since SS1/23 expects the same independent challenge for stress-testing models as for capital models.
• Consolidating board reporting — bring stress-testing and capital model reporting together in one board pack instead of running two separate ones.
• Revisiting documentation — check that existing model documentation clears SS1/23's governance and documentation bar, which is higher than SS3/18's.
• Watching the transition window — track the 12-month deadline from IM approval grant to meet SS1/23 expectations.

For further information on model risk management in banking, contact Vivian Lagan.