What risk and finance teams actually need ready by 2026–27

As the January 2027 deadline for Basel 3.1 implementation looms in the UK under PRA rules, risk and finance teams at banks face a stark reality check. Forget the high-level policy statements; the real work boils down to recalibrating risk-weighted assets (RWAs), embedding a 72.5% output floor on internal models, and overhauling data pipelines for granular credit, market, and operational risk reporting. Larger institutions, especially G-SIBs and D-SIBs, must prioritise building RWA calculators for revised standardised approaches across portfolios, while smaller firms can lean on simplified liquidity metrics, but no one escapes the need for robust assurance frameworks.

Core Readiness Imperatives

Teams need parallel runs of internal ratings-based (IRB) and standardised models by mid-2026 to quantify output floor impacts, which could swell RWAs by 20-30% for model-reliant banks. Finance functions should integrate these into capital planning, rebasing Pillar 2A requirements to avoid artificial spikes from RWA shifts. Risk managers must map third-country exposures and credit concentration risks under the new rules, ensuring policy interpretations align with CRR3's European tweaks for proportionality.​

Data and Tech Overhaul

Granular data models are non-negotiable: expect regulators to demand traceability from source systems to COREP/FINREP returns. By Q4 2026, firms should have target operating models (TOMs) live, incorporating "1.5 LOD" controls - hybrid first- and second-line oversight for MI storytelling that links returns to business performance. RegTech platforms from the likes of Regnology or Vermeg will accelerate this, but custom builds for IRRBB and CVA desks remain essential.

Talent and Cultural Shifts

Hiring regulatory reporting specialists peaks in 2026, with PwC noting a scramble for experts in gap analysis and assurance. Finance teams must foster business partnering, turning compliance from a tick-box into a strategic edge. Delay here, and the 12-month window post-PRA's near-final rules evaporates.​

In short, readiness means data infrastructure that withstands scrutiny, not just submission. Banks ignoring this risk, regulatory rebukes and capital shortfalls in 2027.