Bank of England Proposes Automatic Regulatory Adjustments Linked to Economic Growth

The PRA plans to index 128 thresholds across banks, insurance firms, and credit unions according to nominal UK gross domestic product (GDP). These thresholds will determine applicable regulatory requirements and the information institutions must report. The first automatic adjustment is set to occur on July 1, 2031, with further updates every five years. The public consultation on this proposal will close on February 7, 2027.

While the proposal does not introduce any new software testing mandates, it emphasizes the need for quality assurance (QA) teams to assess how regulatory logic is maintained, validated, and implemented within financial institutions.

Katharine Braddick, Deputy Governor for Prudential Regulation and chief executive of the PRA, noted that this reform aims to provide “crucial stability and predictability” and help prevent outdated thresholds from hindering growth. Of the 128 proposed thresholds, 52 pertain to reporting while others focus on regulatory scope, methodologies, internal governance, and lending or investment flexibility.

Though firms may incur costs updating their systems and policies, the PRA believes that scheduled adjustments will facilitate coordinated planning for these changes.

Institutions nearing a threshold should be particularly attentive to boundary testing, ensuring values are treated correctly around the relevant limit. The proposed methodology will also include scenarios for recalculating GDP data, rounding updated values to two significant figures, and ensuring thresholds do not decline when nominal GDP decreases.

The implementation of these thresholds could present challenges in maintaining consistency across different parts of an institution, which may use varying systems. Accurate testing will be necessary to confirm that revised values are consistently applied and that earlier reporting decisions can be reproduced.

Furthermore, the Bank has flagged that AI could expedite the discovery of vulnerabilities faster than institutions can safely validate and implement fixes. As outlined in a July Financial Stability Report, financial firms must now manage an increased frequency of changes that require validation, which could complicate the change-management process. Legacy systems and complex dependencies may also hinder rapid response and implementation times.

In a related context, Governor Andrew Bailey emphasized the importance of demonstrating resilience against cyber threats in a July letter, stating that firms need to validate their defenses through stress tests and penetration testing.

While the PRA's threshold consultation addresses specific regulatory adjustments, both the regulatory changes and heightened cybersecurity demands require that technology teams prove their systems function correctly as conditions evolve. The five-year window for regulatory adjustments offers time to prepare, but an imminent security patch may not. Both scenarios necessitate effective ownership, reliable testing, and demonstrable system compliance with intended regulatory changes.

The Bank's proposed regulatory framework may facilitate policy maintenance; however, firms will still need to ensure their systems correctly implement the updated rules.