UK Regulator Finalizes Tougher Bank Exposure Rules, With Changes Set for 2028

The UK’s Prudential Regulation Authority has finalized tighter rules on the risks banks can take with individual counterparties, reducing the scope for large trading-book exposures and requiring more consistent treatment of collateral. The changes, published on November 10, will take effect on January 1, 2028, following an extended consultation with the industry.

The new framework is intended to limit the damage that could follow if one borrower, trading counterparty or connected group fails. It will affect PRA-regulated banks and building societies, along with certain investment firms and holding companies. The final policy is stricter in important respects than the existing arrangements, although the regulator has eased several proposals that banks warned could disrupt trading and secured funding.

Large-exposure rules already place a general ceiling on a firm’s exposure to a single counterparty or connected group, normally 25% of Tier 1 capital or £130 million, whichever is greater. The latest decision does not create that basic ceiling. Instead, it changes how certain exceptions work and how firms recognize risks that may be hidden by collateral or internal exposure models. The PRA set out those decisions in its final policy statement, PS20/26.

Trading-book flexibility will be sharply reduced

One of the largest changes concerns positions held in a bank’s trading book. Under the current framework, firms can exceed the ordinary large-exposure limit for trading-book counterparties by as much as 500% of Tier 1 capital, subject to additional restrictions and capital requirements. The PRA proposed abolishing the special allowance altogether for exposures to counterparties outside a bank’s own group.

It has now decided to retain a much narrower exception. Under the final rules, a firm may have trading-book exposure to a third party of up to 85% of its Tier 1 capital for no more than 10 business days, subject to safeguards. The revised limit is a ceiling for the qualifying trading-book exposure, not permission to add 85 percentage points on top of the ordinary limit. Non-trading-book exposures must stay within the usual limits, and an additional capital requirement applies to the excess.

Banks told the regulator that even a rarely used allowance could be valuable when market conditions become volatile. Without some temporary headroom, firms might need to carry larger operating buffers or scale back activity simply to avoid a short-lived breach. The PRA accepted that argument in part, but concluded that the previous allowance permitted concentrations that were too large relative to a firm’s capital.

The exception comes with oversight. A bank must promptly report each relevant breach of the normal large-exposure limit, including the amount involved and the counterparty or connected group. The rules also seek to prevent firms from repeatedly moving positions around to evade the 10-business-day restriction. For the extra capital calculation, the PRA clarified that a 100% risk weight applies to the exposure above the standard limit; banks are not being told to hold capital equal to the entire excess amount.

Exposures between entities in the same banking group are treated separately. The regulator has confirmed a reduced 85% trading-book excess allowance there too, while creating a higher-permission route for some cross-border group exposures. Qualifying firms that receive the relevant permission will be allowed trading-book exposures to designated non-core group entities of up to 350% of Tier 1 capital, rather than the 250% limit originally proposed. This is a specific permission, not a general allowance for every bank.

Collateral and securities-financing risks face new calculations

The second major change concerns how banks measure exposure from securities financing, including repurchase agreements and securities lending. The PRA will remove the option to use internal models for calculating large-exposure values on those arrangements. Instead, firms will have to use the prescribed regulatory methodology, producing a more consistent measure across institutions.

That distinction matters because a change in calculation method can make a bank’s reported exposure look larger without any change in the amount of business it conducts. Several consultation respondents warned that switching away from internal models could inflate measured exposures between entities in an international banking group, where trading and funding activity may be centralized. The regulator cited those effects when raising the special intragroup permission limit to 350%.

The PRA is also making the so-called substitution approach mandatory for relevant credit-risk protection. When a bank reduces an exposure because it holds securities as collateral or benefits from another party’s guarantee, it can still become concentrated in the collateral issuer or protection provider. The revised approach requires that indirect risk to be recognized rather than allowing the original exposure reduction to obscure it.

For example, a bank may hold bonds issued by the same company as collateral against loans or market positions involving several unrelated borrowers. Although the bank has reduced its immediate exposure to those borrowers, it is now relying on a single bond issuer across multiple arrangements. The updated framework is designed to capture that concentration. The policy does not treat cash collateral as creating this kind of substituted issuer exposure.

After assessing market effects, the PRA carved out two targeted exemptions from large-exposure limits. One covers exposures assigned to sovereign collateral issuers under funded credit-protection arrangements. The other covers exposures to collateral issuers arising from tri-party repurchase agreements handled by a tri-party agent. These exemptions reduce potential disruption to government-bond collateral and repo activity, but they do not remove relevant identification and reporting obligations.

The result is not an across-the-board restriction on secured lending. Corporate collateral exposures remain subject to mandatory substitution, while the exemptions distinguish particular funding arrangements whose treatment the regulator judged disproportionate under its original proposal. The PRA said its aim was to close gaps in concentration-risk measurement without unnecessarily constraining the functioning of financial markets.

Firms have until 2028 to update systems and permissions

The implementation timetable is itself a significant change from the consultation. The PRA had originally proposed bringing much of the package into force soon after final publication and ending internal-model calculations for these exposures earlier. Banks argued that the collateral changes would require substantial work to identify issuers, monitor pools of securities that change frequently, revise reporting and adjust some legal arrangements.

The regulator settled on January 1, 2028, for the changes in this policy statement. Firms can begin applying for new or higher non-core large-exposures group permissions on July 1, 2027. The PRA has encouraged early applications where firms want approvals in place by the effective date, while making clear that decisions will follow its normal assessment process. Existing permissions and modifications remain valid until their stated expiry, even when that falls after the new rules begin.

The announcement also completes a two-stage overhaul initiated through an October 2024 consultation. A first policy statement issued in July 2025 dealt with less contentious changes, including certain exemptions and connected-client requirements, with those earlier amendments taking effect in January 2026. The latest statement resolves the more difficult issues involving trading-book limits, securities financing and credit-risk mitigation.

Alongside the substantive changes, the PRA is consolidating its large-exposure rules and adjusting supervisory guidance and reporting instructions. Some issues tied to the broader Basel 3.1 capital framework remain under review, particularly the treatment of certain off-balance-sheet exposures. The regulator expects to assess those consequential matters separately in 2027 and consult further where needed. For affected firms, the immediate practical milestone is the July 2027 opening of the new permission process, ahead of the January 2028 effective date.