UK SS1/23

What UK SS1/23 Means in Practice

UK SS1/23 is not a standalone climate rulebook. It is a supervisory statement that tells regulated firms to treat climate risk as part of normal governance, risk appetite and oversight, rather than as a separate compliance silo.

That matters because the statement is framed around how climate risk flows into existing decision-making. Firms are expected to connect board accountability, management information and escalation paths so that climate considerations influence ordinary business and risk decisions, not just annual reporting.

Governance, Risk Management and Scenario Analysis

The core operational challenge is translating an uncertain, long-horizon risk into a form that a firm can manage today. SS1/23 expects firms to build climate risk into governance structures, use scenario analysis to test resilience, and make sure assumptions are visible to decision-makers.

This makes the statement especially relevant for firms with credit, market, underwriting or operational exposures that may be shaped by physical and transition effects. The point is not to predict one climate outcome, but to understand how different futures could affect strategy, capital planning, product design and risk controls.

For a broader supervisory perspective on how financial regulators are approaching AI, climate and governance expectations together, see Financial Regulators and AI.

Disclosure, Evidence and Supervisory Credibility

Disclosure under SS1/23 is only credible when it is backed by evidence. Firms need information that is consistent with internal risk reporting, scenario outputs and governance records, otherwise climate disclosures risk becoming marketing statements rather than supervisory evidence.

A practical implication is that firms should be able to show how climate assumptions were derived, challenged and approved. If the documentation trail is weak, supervisors may question whether climate risk is genuinely embedded in the firm’s risk framework or simply described after the fact.

For a deeper treatment of model governance, validation and monitoring discipline, AI Model Risk Management Guide (SR 11-7) is a useful adjacent reference because the governance logic is similar, even though the underlying risk type is different.

How Firms Should Use the Statement

SS1/23 should be read as a supervisory benchmark for integration, not as a checklist that sits beside existing risk management. Firms that treat it seriously will align climate risk with strategy, governance, internal controls and disclosure processes already used across the organisation.

That usually means climate risk owners, control owners and report owners need clear accountability. It also means firms should avoid treating scenario analysis as a one-off exercise, because the supervisory expectation is that the framework evolves as data, exposure and regulatory understanding mature.

One useful way to interpret the statement is to treat it as a test of whether climate risk is decision-useful. If it does not change governance, risk appetite, stress testing or disclosure quality, then it is not yet embedded in the way SS1/23 expects.

Risk and Threat Considerations

UK SS1/23 creates risk when firms treat climate change as a reporting topic instead of a management issue. The main exposure is not just disclosure weakness, but poor strategic decisions driven by incomplete scenario testing, weak governance and inconsistent risk data.

Failure mechanism: Climate assumptions stay fragmented across business lines, so the firm cannot reliably assess how physical or transition risk affects portfolio quality, capital planning or operational resilience.

Impact: Supervisory challenge, weaker risk decisions and disclosures that do not reflect the firm’s real exposure can follow, especially when stress conditions expose gaps in governance or data quality.

Practitioner Guidance

Why practitioners should care: The statement is most useful when it is operationalised through existing governance rather than handled as a separate climate project. That is how firms avoid duplicate reporting and weak ownership.

Governance implication: Boards and senior management should be able to trace climate risk from scenario analysis into risk appetite, business planning and disclosure sign-off. If those links are missing, the supervisory framework is not fully embedded.

Practitioner takeaway: The strongest implementation signal is not a polished climate narrative, but a risk framework that can explain how climate assumptions change decisions.

Related resources from NHI Mgmt Group

• Guide: AI Agents in Financial Services Security Guide
• How should organisations govern agentic AI under EU and UK regulations?
• What breaks when MSP access is not tightly governed under the UK CS&R Bill?
• How should organisations prepare for faster cyber incident reporting under the UK bill?
• Who should own DSPM accountability under UK GDPR?