Clifford Chance

The Prudential Regulation Authority (PRA) published its 2025/26 Business Plan on 10 April 2025, outlining its strategic priorities and key activities for the coming year. The Business Plan highlights the PRA’s planned work to deliver against its secondary objective on competitiveness and growth, as well as its continuing work in support of its primary objectives of safety and soundness and protecting policyholders.

The PRA's four key strategic areas remain consistent with 2024-25: (i) ensuring safety and soundness (ii) responding to new risks; (iii) promoting market competitiveness; and (iv) delivering modern regulation. This consistency suggests the PRA considers its current approach aligns well with the broader powers it gained under the Financial Services and Markets Act 2023. As a result, insurers can expect a further embedding of Solvency UK, a continued focus on streamlined interactions with PRA supervisors, and continued expectations for strong risk management frameworks and operational resilience.

Key highlights from the Plan include:

Further Matching Adjustment (MA) related changes

As part of the broader reform of the MA under Solvency UK, the PRA changed its approach to MA applications. This included establishing a new, streamlined application process and having a dedicated MA permissions team. The primary objective of these changes is to enhance the speed and efficiency with which new MA applications are processed, especially those involving asset types that have recently become eligible under the reforms.

A further drive for efficiency is planned through the Matching Adjustment Investment Accelerator (MAIA) framework proposal, which was consulted on in Consultation Paper CP7/25. Under the proposed MAIA framework and subject to certain exposure limits[1], an insurer with an existing MA permission may, following successful application for MAIA permission, add eligible assets to its MA portfolio with features beyond those which its existing MA permission allows, and claim regulatory capital benefits immediately. A firm would then have a two-year period in which to apply to the PRA for a variation to its MA permission to include and "regularise" these MAIA assets within its matching adjustment portfolio. Only firms that already hold an MA permission are eligible. The MAIA is expected to be implemented as soon as Q4 2025, but firms will need to commit time and effort to prepare their new MAIA Policy, take this through governance, and set up appropriate controls for managing MAIA exposures.

Continued Focus on Bulk Purchase Annuities & Funded Reinsurance

The rapid expansion of the BPA market (where insurers take on the liabilities of defined benefit pension schemes) is expected to continue in the coming year. Where UK insurers are engaged in BPA business, the PRA will continue to assess the arrangements insurers have in place to manage the risks involved.

Funded reinsurance (Funded Re), a method where insurers transfer the investment and longevity risk on the annuity portfolio by providing the assets backing the portfolio as upfront premium to the reinsurer, has emerged as a significant area of concern for the PRA. Despite Supervisory Statement SS5/24, which clarified the PRA's expectations for these arrangements, a 2024 review by the PRA found widespread non-compliance, particularly regarding the quality of the collateral provided by reinsurers in return and the concentration of risk with individual reinsurance partners. The inclusion of a scenario where Funded Re arrangements fail and need to be "recaptured" (brought back onto the insurer's balance sheet) in the 2025 Life Insurance Stress Test (LIST) signals the PRA's growing apprehension. Failure to fix these issues could lead to formal interventions by the PRA under powers set out in the Financial Services and Markets Act 2000.

Stress Testing as a Regulatory Tool

2025 marks a fundamental shift in how the PRA assesses the resilience of UK insurers. This year began with the launch of the LIST 2025 in January, targeting the largest UK life insurers. This exercise is notable, not just for its insights into financial resilience, but because for the first time ever, the PRA intends to publish individual firm results alongside aggregate data and contextual analysis. This move towards unprecedented transparency, expected in Q4 2025, will expose firms' specific financial vulnerabilities to public market scrutiny, moving beyond aggregated snapshots.

Simultaneously, a major exercise is signalled for general insurers. The next stress test, scheduled to commence in May 2026, will be a dynamic exercise, simulating complex, multi-week crises. Unlike static tests, this will require firms to manage cash flow in real-time over its three-week duration, presenting a significant operational challenge.

Changes to Insurance Special Purpose Vehicles (ISPVs) framework

Despite initial high hopes, the UK's framework for Insurance Special Purpose Vehicles (ISPVs)—entities used to transfer a variety of insurance risks to the capital markets has not seen the levels of activity originally envisaged. The PRA is accordingly planning reforms in 2025 aimed at:

1. making it easier for a range of global market practices to be undertaken in the UK;
2. speeding up the approval process for ISPVs;
3. clarifying the PRA's expectations for genuine risk transfer from a UK cedant to ISPVs, wherever established.

These changes are intended to support the establishment of the UK as a leading centre for insurance-linked securities (ILS). However, given the strong competition from established global hubs, the UK has been struggling to gain significant traction in the already mature insurance-linked securities market. Still, the deep expertise of the London Market offers a unique advantage, and the PRA's commitment to speeding up the approvals process provides encouraging signs for the future.

General Insurance: Market Cycles and Cyber Risks

In anticipation of for a shift to softening conditions for some lines of general insurance (GI) business in 2025 and 2026, the PRA has signalled it will increase its monitoring of GI firms' underwriting strategies and pricing decisions, assessing their efficacy in navigating these cyclical fluctuations. This scrutiny will be particularly directed towards firms with a history of presenting overly optimistic underwriting profit projections within their business plans and internal models, with the PRA prepared to challenge such assumptions. The PRA's coordination with the Society of Lloyd's is also to be enhanced to ensure consistent oversight of Lloyd's managing agents.

The PRA also intends to maintain its focus on the escalating challenge of cyber underwriting risk. This market continues to grow in both the magnitude of the risks involved and overall size. To inform its supervisory approach, the PRA will leverage the comprehensive data derived from the new mandatory cyber underwriting risk reporting template, which came into effect on 31 December 2024 (as introduced by PS3/24). Acknowledging the rapid evolution of this risk landscape, the PRA also intends to review its existing supervisory expectations for cyber underwriting risk, as articulated in Supervisory Statement SS4/17. This review will assess whether further regulatory work is necessary to ensure existing regulatory expectations remain aligned with current market developments and the complexities of contemporary cyber threats.

Other Key Takeaways:

• Preparing for Orderly Exits: Insurers need to be ready for new rules coming into force on 30 June 2026, regarding the wind down of operations in an orderly way, without having to rely on the backstop of an insolvency or resolution process (PS20/24). The PRA plans to work closely with firms beforehand to refine these plans. The goal is to make the market more dynamic, but it means insurers must have robust contingency frameworks in place.

• Implementing the Critical Third Parties (CTPs) Regime: The PRA, Bank of England, and Financial Conduct Authority (FCA) are reviewing third-party service providers with a view to recommending to HM Treasury those which could be designated as critical. These are service providers, such as cloud computing platforms, whose failure could disrupt the UK financial system. These CTPs will face intense regulatory checks, and insurers will also need to carefully vet their reliance on these third-party dependencies

• Boosting Operational Resilience: Since March 2025, rules on Operational Resilience have been in full force. This means firms must be able to keep their critical services running even when disruptions hit. The PRA is keeping a very close eye on IT changes within firms. New rules for reporting incidents (CP17/24) are expected to be finalised in 2025 to standardise disclosures.

• Strengthening Cyber Resilience: Consultations on new standards for Cyber Resilience are expected in the second half of 2025. This will mean more rigorous "CBEST" penetration testing (simulated cyber-attacks) and ongoing checks on "critical cyber-hygiene." A consultation later in 2025 will propose stricter rules for managing Information and Communication Technology (ICT) risk, particularly for complex IT projects. The PRA is also taking a leading role in global efforts on cyber security through groups like the G7 and EU cyber initiatives.

• Amendments to SM&CR: A consultation is expected in 2025 on changes to the Senior Managers & Certification Regime (SM&CR). The aim is to improve the clarity, efficacy and proportionality of the regime to reduce compliance costs and attract more global talent. In addition, the PRA is working with HM Treasury to replace the certification regime with a more proportionate approach.

• Managing Climate Risk: Updates to existing guidance (SS3/19) on Climate Risk Management are on the horizon. The PRA will consult during 2025 on stronger climate risk standards, consolidating existing rules into one framework.

Next Steps

The PRA's 2025/26 Business Plan signals another busy period for the UK insurance sector, with a clear regulatory focus on enhancing resilience, transparency, and market competitiveness. Firms face important milestones in the coming months, particularly with the anticipated Q4 2025 publication of individual firm results for the LIST 2025. This marks a new era of public accountability for life insurers, demanding not only financial robustness but also strategic foresight in managing market perception.

For firms with an existing MA permission, the expected Q4 2025 implementation of the MAIA offers an opportunity to unlock and deploy capital more efficiently. More broadly, all insurers should remain vigilant on operational resilience and should prepare for the consultation on cyber resilience due in the second half of 2025. Successfully navigating these regulatory changes remains a challenge and will demand a proactive, integrated approach by insurers across risk, capital, operations, and governance lines.

¹There will be a limit placed on the amount of assets firms can count as part of a MAIA permission sought, with this being the lower of £2bn or 5% of BEL (net of reinsurance) at the time of the permission.