PRA SS1/23 and Third-Party AVMs
What the Bank of England’s model risk management framework expects of lenders — and what it means when the model in question comes from a vendor.
This page is written for risk managers, model governance professionals, and credit teams at firms evaluating automated valuation models. It describes the framework as published; it is not legal or regulatory advice, and the obligations described below sit with regulated firms, not with model vendors. Current as of June 2026.
What SS1/23 is
Supervisory Statement SS1/23, Model risk management principles for banks, was published by the Prudential Regulation Authority in May 2023 and updated in April 2026. It sets out the PRA’s expectations for how firms manage the risk that arises from using models — the possibility, as the statement puts it, of “adverse consequences from model errors or the inappropriate use of modelled outputs to inform business decisions” (paragraph 2.6).
The statement is built around five principles covering the whole life of a model: identification and risk classification (Principle 1), governance (Principle 2), development, implementation and use (Principle 3), independent validation (Principle 4), and risk mitigants (Principle 5). The expectations took effect on 17 May 2024 (paragraph 1.5), and firms are expected to self-assess against them at least annually (paragraph 1.7).
Source: SS1/23 — Model risk management principles for banks, Bank of England. Citations on this page refer to the April 2026 version.
Whose obligation it is
This is the point most often misstated: SS1/23 binds lenders, not model providers — and not even all lenders.
By its own scope provision (paragraph 1.2), the statement is relevant to UK-incorporated banks, building societies and PRA-designated investment firms with internal model approval to calculate regulatory capital requirements. Firms without internal model permissions are expressly outside the expectations, though the PRA notes they “may find the proposed principles useful”. Credit unions, insurers and third-country branches are out of scope entirely.
Vendors appear once, in a footnote: they “may find this supervisory statement useful as it sets out the PRA’s minimum expectations for firms’ own MRM frameworks” (footnote 3). A vendor cannot comply with SS1/23, and no product can be “SS1/23 compliant” or “SS1/23 aligned” — there is nothing in the statement for a vendor to comply with.
Why, then, does SS1/23 matter to anyone procuring an AVM? Two reasons. First, in-scope firms must apply their model risk framework to “all models, developed in-house or externally, including vendor models” (paragraph 1.3) — so a vendor AVM adopted by an in-scope bank becomes an entry in that bank’s inventory, subject to the full framework. Second, even outside the statement’s scope, its vocabulary has become the common language of UK vendor model due diligence. Lenders with no PRA internal-model permission routinely impose the same logic contractually on their suppliers — the questions below get asked either way.
What it means when a firm adopts a vendor model
The vendor-specific expectations are concentrated in Principle 2.6 (“Use of externally developed models, third-party vendor products”). It makes three demands of the firm:
Validation evidence
Firms should “satisfy themselves that the vendor models have been validated to the same standards as their own internal MRM expectations” (Principle 2.6(b)(i)). In practice the firm’s model risk team asks the vendor for its validation design and results: how the model is tested, on what data, how often, and with what outcome.
Data and assumption transparency
Firms should “verify the relevance of vendor supplied data and their assumptions” (Principle 2.6(b)(ii)) — which requires the vendor to disclose what data the model is built on and what it assumes.
Outcomes monitoring on the firm’s own book
Firms should “validate their own use of vendor products and conduct ongoing monitoring and outcomes analysis of vendor model performance using their own outcomes” (Principle 2.6(b)(iii)). No amount of vendor-published testing substitutes for this: the firm is expected to test the model against its own completions, initially and on an ongoing basis.
Principle 2.6(a) adds the governance frame, citing the PRA’s outsourcing statement SS2/21: boards “are ultimately responsible for the management of model risk, even when they enter into an outsourcing or third-party arrangement”. Model risk cannot be outsourced along with the model.
Around that core, other principles generate the rest of the due-diligence checklist:
- Documentation deep enough to validate with. Vendor-model documentation should be “sufficient to validate the firm’s use of the model” (Principle 3.5(a)), within a documentation standard that asks whether “an independent third party with the relevant expertise would be able to understand how the model operates” and “identify the key model assumptions and limitations” (Principle 3.5(a)). Principle 3.5(b) lists the contents: data sources and quality-test results, methodology and assumptions, the ongoing performance-testing plan, and model limitations.
- The inventory entry. The firm must record each model’s purpose and intended use, its “operating boundaries… under which model performance is expected to be acceptable”, its assumptions and limitations, current validation findings, and governance details (Principle 1.2(c)(i)–(iv)). Every item on that list is information only the vendor can supply.
- Risk classification. Models are tiered by materiality and complexity, and the complexity assessment may consider “measures of a model’s interpretability, explainability, transparency, and the potential for designer or data bias” (Principle 1.3(c)(ii)). The statement is explicit that risk is higher for models that are “difficult to understand or explain in non-technical terms” or “where the results and findings cannot be easily repeated or reproduced” (paragraph 2.8). A transparent, explainable, reproducible vendor model is — in the framework’s own terms — a lower-risk model to adopt.
- Ongoing monitoring and escalation. Performance monitoring should be continuous, with tests including benchmarking, sensitivity testing and outcomes analysis (Principle 4.4), and firms should have escalation procedures so stakeholders are “promptly made aware of a model exception” — which footnote 23 defines to include persistent breaches of performance metrics and back-testing inconsistent with actual outcomes. A vendor that publishes its monitoring on a fixed cadence, and commits to telling clients when performance moves, feeds this machinery directly.
- Mitigants and restrictions. Firms should be ready to restrict a model’s use where deficiencies emerge, including “prohibiting the model to be used for specific purposes” (Principle 5.2(a)), and to apply governed adjustments to model output (Principle 5.1). Per-property confidence measures, declared coverage limits, and a model that declines to value rather than guessing give a firm ready-made material for exactly these controls.
How transparency artefacts serve each expectation
The practical consequence of the framework is a document request list. The table below maps the expectation to the kind of artefact that answers it — the artefact types Gadsden Valuations publishes or provides.
| The firm’s obligation | SS1/23 reference | What answers it |
|---|---|---|
| Satisfy itself the vendor model is validated to its own standards | Principle 2.6(b)(i) | Published validation methodology and results: out-of-time backtesting against realised sale prices, on a stated cohort, on each model release, with segment-level detail |
| Verify relevance of vendor data and assumptions | Principle 2.6(b)(ii) | A data sources table with licences and update frequencies; stated model assumptions and known limitations |
| Monitor performance using its own outcomes | Principle 2.6(b)(iii) | A backtest run against the firm’s own completions — before commitment and periodically after |
| Complete the model inventory entry | Principle 1.2(c) | Statement of purpose, coverage and operating boundaries; limitations; dated validation findings; the vendor’s governance facts |
| Assess complexity, explainability and bias | Principle 1.3(c)(ii); para 2.8 | Per-property feature attribution (e.g. SHAP), published methodology, reproducible audit trail per valuation |
| Hold documentation sufficient to validate use | Principle 3.5 | A technical summary for assessment, with full model documentation available on request for firms progressing due diligence |
| Track material model changes | Principles 2.3(c)(viii), 3.3(c) | Version history and change logs; notice of material changes |
| Build restrictions and adjustments | Principles 5.1, 5.2 | Per-property confidence bands; declared coverage exclusions; a published no-value policy |
Two honest notes belong alongside any such mapping. First, vendor-published testing is the start of the firm’s validation, never the end of it — Principle 2.6(b)(iii) exists precisely because the firm must form its own view on its own book. Second, a vendor’s transparency does not transfer any obligation: the assessment, the tiering, the approval and the ongoing monitoring remain the firm’s work product. What good vendor documentation does is make that work faster and its conclusions firmer.
Where this fits in the wider regulatory picture
SS1/23 governs how in-scope banks manage model risk. It is distinct from the rules on whether a statistical valuation may be used for lending purposes — currently UK CRR Article 208(3) for monitoring, with the Basel 3.1 implementation expressly permitting “a suitably robust statistical method” as the origination valuation from 1 January 2027 (PRA Rulebook, Credit Risk: Standardised Approach, Article 124D(8)(a); see our Basel 3.1 article). It is also distinct from valuation-practice standards such as the RICS Red Book and IVS, covered in RICS & UK Regulation. Internationally, it sits alongside the Federal Reserve’s SR 11-7 and OSFI’s E-23 as one of the major supervisory frameworks for model risk — see International Standards.
Gadsden Valuations is not a PRA-regulated firm, and PRA SS1/23 places no obligations on model vendors. What we publish — accuracy testing on every model release against Land Registry completion prices, segmented results, per-property confidence scoring and feature attribution, a no-value policy, version history, and a full per-valuation audit trail — is the evidence set that Principle 2.6 expects in-scope lenders to obtain from any third-party model provider, and that risk teams at other lenders ask for in practice. Documentation for vendor review is available on request, and we offer a free backtest against your own completions: the test the framework itself says matters most.
Run the test the framework asks for
Backtest Meridian against your own completed transactions — free, no commitment — or get in touch to request documentation for vendor review.