Managing ESG and climate risks: rising supervisory expectations for financial institutions in the UK and EU

As ESG and climate risks climb the supervisory agenda, financial institutions face rising expectations from both UK and EU regulators. This article compares the evolving approaches of the PRA and EBA—and what firms must do now to stay ahead.

In the past six months, the Prudential Regulation Authority (PRA) and the European Banking Authority (EBA) have each consulted on or introduced new climate risk requirements and guidelines for credit institutions. Both sets of publications significantly raise expectations for how firms identify and manage climate and ESG-related risks.

These rising expectations reflect a continued evolution in the market’s understanding of climate-related risks, data, tools, and best practices. As a result, supervisory authorities now expect firms of all sizes to better integrate material ESG and climate-related risks across their organisations.

This article compares the PRA and EBA publications and explores what they mean for banks and building societies. While both publications address similar themes, the differences between them reflect long-standing distinctions in regulatory and supervisory approaches — namely, the EU’s more detailed and prescriptive style versus the PRA’s principles-based model. That said, the PRA’s new supervisory statement is more than three times longer than its predecessor, signalling that the UK’s climate risk regulatory standards are moving closer to those of its European counterparts in terms of detail.

When it comes to implementation, both authorities are clear: firms must now assess how their existing processes for identifying, monitoring, and managing climate and ESG-related risks compare to the new requirements—and produce clearly allocated and documented action plans to close any gaps.

The window for doing so is short, and both authorities expect to see tangible progress soon.

“The market’s understanding of ESG-related risks and what it means for firms’ business models is maturing. Recent publications from the EBA and PRA clearly demonstrate that supervisory authorities expect firms of all sizes to better integrate material ESG/climate-related risks across their organisation.“

Gregory Marchat, Group Head of Financial Services Advisory, Forvis Mazars in the UK

Background to the EU and UK supervisory expectations regarding climate risk

ECB supervisory expectations on climate-related and environmental risks (since 2020)

The EU has been at the forefront of climate risk regulations. In 2020, the European Central Bank (ECB) published its seminal Guide on climate-related and environmental risks: Supervisory expectations relating to risk management and disclosure.[1] This sets out comprehensive expectations for banks to build climate risk into their risk management frameworks and regulatory reporting. It focuses on four main elements: business models and strategy; governance and risk appetite; risk management; and disclosures. The ECB expected firms to be compliant with all requirements by December 2024.

The ECB used these supervisory expectations to conduct thematic reviews[2] of banks’ climate risk management practices. These reviews found that banks lacked sufficiently sophisticated methodologies and granular information to adequately measure their exposure to climate risks and had blind spots in identifying these risks, with half failing to effectively implement basic risk management practices. Based on these conclusions, the ECB emphasised that, during the 2023 Supervisory Review and Evaluation Process[3], it would assess climate risk primarily under the business model and internal governance elements, paying particular attention to models and data governance.

EBA guidelines on ESG risk management and scenario analysis (2025)

In January 2025, the EBA published its final Guidelines on the management of environmental, social and governance risks[4] and also consulted on draft guidelines on ESG scenario analysis.[5] A key difference between the EBA Guidelines and the ECB climate Guide is that the EBA Guidelines require institutions to consider ESG risk holistically and therefore cover the ‘S’ and ‘G’ of ESG as well as the ‘E’. The EBA’s guidelines represent another significant step in the formalisation of supervisory expectations for banks’ ESG risk management processes and methodologies, including developing plans to address risks arising from the transition to a low-carbon and nature-positive economy. The guidelines are detailed, so banks of all sizes should carefully review them and assess the implications for their existing processes.

PRA supervisory expectations (since 2019) and new CP10/25 consultation (2025)

In 2019, the PRA was one of the first regulatory authorities to issue supervisory expectations on how financial institutions approach the management of climate risks.[6] Similar to the ECB’s Guidelines, the policy covers: governance; risk management; scenario analysis; and disclosures.

In the intervening years, the PRA has issued Dear CEO letters[7] and undertaken a thematic review[8] of firms’ adherence with SS3/19. The review underscored the necessity for financial institutions to develop more structured and detailed approaches to manage climate-related risks. Another publication from the Bank of England — Measuring climate-related financial risks using scenario analysis [9] — found that the current range of climate scenarios may understate the true level of climate risk and that firms must tailor their climate risk stress testing to their unique exposures and business models.

Approaches to climate risk management have progressed significantly in the six years since SS3/19 was published. In May 2025, it was timely that the PRA published CP10/25, updating their supervisory expectations for banks’ management of climate risk. In CP10/25, the PRA recognises that firms have requested greater clarity on what the PRA expects firms to do to manage the effects of climate change; this may explain why CP10/25 is over three times longer than its predecessor publication. The PRA expects to publish the final supervisory statement by the end of 2025. All PRA-regulated firms will then have six months to submit their roadmaps, including internal assessments, gap analyses and action plans, to the PRA. CP10/25 places significantly higher expectations on banks and building societies to manage climate risks; in so doing, the PRA’s climate risk regulatory standards are moving closer to those of its European counterparts in terms of detail.[10]

“Supervisors are now asking how deeply ESG and climate risks are embedded within financial institutions—how these risks shape governance, strategy and risk management at every level. This is no longer just about regulatory compliance—it’s about securing long-term viability and reputation in a rapidly shifting landscape.”

Eric Cloutier, Group Head of Banking Regulations / Head of Global FS RegCentre, Forvis Mazars in the UK

Comparing the EBA’s guidelines to the PRA’s new supervisory expectations

With this regulatory context in mind, the following section compares the EBA’s and PRA’s evolving expectations—highlighting key areas of alignment and divergence that financial institutions should be aware of.

Key similarities

Underlying themes of Governance, Strategy, risk Management and Disclosures and reflecting the outcomes of the Climate/ESG process in ICAAPs and ILAAPs

The EBA’s Guidelines and the PRA’s CP10/25 set out regulatory/supervisory expectations for risk management, governance, business models and strategy, scenario analysis, data and disclosures. Equally both publications lay out requirements for firms to develop processes so that they can identify, quantify and evaluate the solvency and liquidity impacts of the firms material climate/ESG risks in their prudential assessments – Internal Capital Adequacy Assessment Process (ICAAP) and Internal Liquidity Adequacy Assessment Process (ILAAP). This is so firms can maintain on an ongoing basis, the amounts, types and distribution of internal capital/liquidity and funding positions that they consider adequate to cover the nature and level of climate/ESG risks, in the short, medium and long term. The importance of using appropriate scenario analysis to inform those prudential assessments is also highlighted by both authorities.

Proportionality

The EBA’s Guidelines and the PRA’s CP10/25 emphasise that proportionate application of their requirements should be risk-based on the potential impact of climate/ESG risks on the firm’s business model. So firm size is not a sufficient criterion to apply proportionality, because smaller institutions are not necessarily immune to ESG risks. For example, smaller institutions may have concentrations of exposures to transition-vulnerable economic sectors or in geographical areas prone to physical risks. Consequently, all firms should be using their ESG materiality assessment process as the driver for identifying those material risks where their business models are most vulnerable to ESG/climate risks. This approach to proportionality means that firms should be taking the outcomes of the materiality assessment and ensuring that all stages in the governance, strategy, risk management and disclosure framework adequately cover the material risks that make the firm’s business model vulnerable to climate/ESG-related risks.

Where the two sets of requirements vary regarding proportionality is that the EBA Guidelines have some explicit and differentiated provisions for small and non-complex institutions (SNCIs) allowing them to implement less complex or sophisticated arrangements. For example, SNCIs can perform materiality assessments less frequently than large institutions. In contrast, and consistent with the PRA’s more principles-based approach, no such size criteria distinctions are explicitly specified.

ESG data quality

A key ongoing challenge for firms when trying to achieve supervisory authorities’ climate/ESG requirements is data quality. Both authorities recognise this challenge, but don’t want it to hamper firms in progressing improvements in their identification and management of ESG/Climate-related risks. The EBA and PRA expects firms to identify and formulate a plan to overcome data challenges and should be prepared to discuss those in supervisory reviews. This can include developing internal data capabilities and having robust data governance arrangements.

Key differences

Types of risks covered

The most obvious distinction between the PRA’s supervisory expectations and the EBA Guidelines are the types of risks covered. CP10/25 focuses on banks and building societies management of climate-related risks, while the EBA Guidelines encompass all types of ESG risks.

Prudential aspects of transition planning (“CRD-based transition plans”)

Another clear area where the two sets of publications materially differ is regarding Transition Plans. The EBA Guidelines requires banks to develop specific “CRD-based transition plans” to address the risks arising from the transition and process of adjustment of the economy towards the regulatory objectives related to ESG factors of the jurisdictions they operate in. The output should demonstrate how a firm ensures its robustness and preparedness for the transition towards a climate and environmentally resilient and more sustainable economy. The plans are not subject to disclosure, but will be assessed by prudential supervisors as part of the supervisory review and evaluation process (SREP). In contrast to the EBA, the PRA’s supervisory expectations publication makes no mention about firms needing to prepare Transition Plans.

Regulatory approach

Consistent with the different regulatory/supervisory approaches that are typically evident in the EU and the UK, the ECB guidelines contain a higher level of granularity and prescriptiveness than the PRA’s. The EBA guidelines contain minimum standards and detailed reference methodologies for the identification, measurement, management and monitoring of ESG risks. For example, the Guidelines specify a minimum set of ESG indicators that Large institutions should monitor. In contrast, the PRA’s latest publication continues it’s principles-based approach, offering firms the flexibility to develop their own approach within the guardrails of the PRA’s expectations based on the firm’s identification of material climate-related risks.

What do these heightened supervisory expectations mean for firms?

Apart from the EBA and PRA having greater expectations for firms to better integrate material ESG and climate-related risks across their organisations, both authorities are also clear that firms need to act now. They must assess how their existing processes for identifying, monitoring and managing these risks compare to the new requirements—and produce clearly allocated and documented action plans to close any gaps, including through interim actions.

Neither authority is leaving firms much time to complete this work before internal assessments, gap analyses and action plans are subject to supervisory scrutiny. The PRA gives firms six months from the publication of the final supervisory statement (expected by the end of 2025) before those plans will be reviewed. The EBA guidelines will apply from 11 January 2026 for large institutions, and from 11 January 2027 for small and non-complex institutions.

Key steps that firms should be taking now to help produce those internal assessments, gap analyses and action plans include:

• Securing senior organisational buy-in to create a cross-divisional team that will form the steering group for driving the work. Climate/ESG is a cross-organisational issue and supervisory authorities will expect to see the whole organisation represented.
• Recognising that integrating the more detailed requirements into risk management/governance frameworks and across the three lines of defence will take time. This is all the more challenging given the cross-organisational nature of climate/ESG related-risks to a firm.
• Refreshing climate/ESG-related materiality assessments against the new requirements. This includes ensuring that all assessment material is documented and prepared so that supervisory authorities have a clear trail and explanations for what are the material (and immaterial climate/ESG-related risks). The materiality assessment is the starting point for all climate/ESG-risk related work and it drives where firms concentrate their subsequent attention.
• Not being afraid to recognise limitations in current processes, but making sure you put in place suitable remedial plans to present to the supervisors. How you overcome weaknesses in climate/ESG data is a good example.

Finally, although the two publications are intended for different audiences in different jurisdictions, firms should not overlook the opportunity to use insights from both to strengthen their operational approach to managing climate and ESG risks. For example, the detailed list of ESG indicators that large institutions in the EU must monitor could be useful for UK banks and building societies still working to identify suitable metrics. The same applies to firms operating in jurisdictions outside the EU and UK.

[1] Guide on climate-related and environmental risks; [2] Good practices for climate-related and environmental risk management; [3] Aggregated results of SREP 2023; [4] Final Guidelines on the management of ESG risks.pdf; [5] Consultation paper on draft Guidelines on ESG scenario analysis.pdf; [6] Note, the PRA’s requirements cover banks, building societies, (re)insurers and other regulated firms), while the ECB and EBA only cover certain banks. This paper focuses on the PRA’s requirements as they apply to banks.; [7] UK regulator sets clear climate risk management expectations for UK financial institutions in 2024 – Forvis Mazars – United Kingdom; Letter from David Bailey ‘Thematic feedback on accounting for IFRS 9 ECL and climate risk’ | Bank of England; Letter from Victoria Saporta ‘Thematic feedback from the 2022/2023 round of written auditor reporting’ | Bank of England; Thematic feedback from the 2021/2022 round of written auditor reporting; [8] Managing climate-related financial risk – thematic feedback from the PRA’s review of firms’ Supervisory Statement 3/19 (SS3/19) plans and clarification of expectations; [9] The Bank of England shares useful insights to measure climate-related financial risks using scenario analysis – Forvis Mazars – United Kingdom; Measuring climate-related financial risks using scenario analysis | Bank of England; [10] https://www.forvismazars.com/uk/en/industries/financial-services/banking-capital-markets/climate-risk-management/predicted-updates-on-pra-ss3-19/everything-you-need-to-know-on-cp10-25