Significant risk transfer is what lets an originator take securitised exposures out of its risk-weighted assets. Two mechanistic tests do most of the work — a mezzanine test at 50% and a first loss test at 20% — but both are subject to the PRA's judgement on whether the risk transfer is commensurate. The PRA does not pre-approve, and notification is due one month after the transfer.
Where the rules actually live
This is worth getting right, because it is commonly misstated. The SRT rules are not in the Securitisation Regulations 2024 or in the PRA's Securitisation Part. They sit in the capital framework — Articles 244 and 245 of the retained CRR, for traditional and synthetic securitisations respectively.
The wider framework did change. The Securitisation Regulations 2024 came into force in stages, with the main commencement day on 1 November 2024, and the onshored EU Securitisation Regulation was revoked — Article 46 in December 2023 and the remainder on 1 November 2024.
And the SRT rules themselves move on 1 January 2027, into a new Securitisation (CRR) Part of the PRA Rulebook, under the PRA's restatement of the CRR requirements.
The two mechanistic tests
An originator may exclude the underlying exposures from its risk-weighted exposure amounts where significant credit risk has been transferred to third parties — or, alternatively, where it applies a 1,250% risk weight to all the securitisation positions it holds, or deducts them from CET1.
Significant credit risk is deemed transferred where either test is met:
- The mezzanine test. The risk-weighted exposure amounts of the mezzanine positions held by the originator do not exceed 50% of the risk-weighted exposure amounts of all mezzanine positions in the securitisation;
- The first loss test. The originator holds no more than 20% of the exposure value of the first loss tranche — but only where it can demonstrate that the first loss tranche exposure value exceeds a reasoned estimate of expected loss on the underlying exposures by a substantial margin, and there are no mezzanine positions in the structure.
There is a third route: permission from the competent authority for the originator to make its own assessment of SRT.
Crucially, the competent authority may reject the mechanistic conditions on a case-by-case basis where the risk transfer is not commensurate. Satisfying a test is not a safe harbour.
Commensurate risk transfer
This is the substantive requirement and the reason SRT work is analytical rather than mechanical. The PRA's position, in its supervisory statement: any reduction in capital requirements achieved through securitisation must be justified by a commensurate transfer of risk to third parties, and where the reduction in risk-weighted assets is not justified by a commensurate transfer, SRT shall not be considered to have been achieved.
Four points follow:
- It is an ongoing requirement. The PRA expects firms to ensure the reduction continues to be matched by commensurate risk transfer throughout the life of the transaction, taking a substance over form approach;
- The comparison test. One indication is whether post-securitisation risk-weighted assets are commensurate with what would apply if the firm had acquired the exposures from a third party;
- Premiums and tranche thickness. Firms must consider the size of premiums paid and the thickness of the tranches — a thin tranche bought cheaply transfers less than its nominal position suggests;
- Linked transactions. Where a structure is built as linked transactions, the aggregate effect must comply.
Notification: a rule, and after the fact
The notification obligation is a rule rather than guidance. Under the Credit Risk Part of the PRA Rulebook, a firm must notify the PRA that it is relying on the deemed transfer of significant credit risk no later than one month after the date of the transfer.
Notification goes simultaneously to the PRA's SRT mailbox and to the firm's usual supervisory contact, and the expected content is substantial:
- A transaction summary with an attestation by the relevant senior manager that the information is accurate and complete and that SRT has been achieved;
- Position-level detail — rating, exposure value, risk-weighted assets, sold versus retained;
- The SRT policy, including methodology and models;
- A statement of how all relevant risks and the full economic substance are captured;
- The SRT calculation, the ratings and pricing of bonds issued, and details of the governance and approval process.
Notification is not required where the firm achieves relief by deduction or by applying a 1,250% risk weight to all retained positions — though it should still consider whether the PRA would reasonably expect prior notice.
The PRA does not pre-approve
This is the point that most often surprises people structuring a first transaction. The PRA's stated position is that it does not intend to pre-approve transactions. Instead it will give a view on whether it considers commensurate risk transfer to have been achieved at a point in time, which may be after a transaction has closed — and it may reassess that judgement if the level of credit risk transfer changes materially.
Nor does the PRA specify a lead time. Permissions relating to individual transactions need not be granted before execution. So there is no supervisory sign-off to build into a pricing timetable, and the only hard deadline is the one-month notification after the transfer.
An own-assessment permission is granted only where the PRA is satisfied that in every relevant case the capital reduction would be justified by commensurate transfer, the firm has appropriately risk-sensitive policies and methodologies, and the transfer is also recognised for internal risk management and internal capital allocation. Multiple-transaction permissions can cover a defined scope and remove the need for individual notification within limits.
What changes on 1 January 2027
The thresholds do not move — 50% and 20% remain. What changes is the plumbing:
- The tests sit in Articles 244(2) and 245(2) of the Securitisation (CRR) Part;
- The own-assessment option is deleted from the deeming provision and becomes a section 138BA FSMA permission instead, with its own statement of policy on waivers and permissions;
- Notification moves to a new Article 245A, requiring notification of each transaction relied on;
- The PRA's power to preclude recognition is exercised through a section 55M requirement or a section 192C direction, with a separate statement of policy.
Two versions of the supervisory statement are therefore live: the July 2025 version, effective now, and the January 2026 version, effective 1 January 2027. Anyone drafting a transaction that closes either side of the year end should be reading the right one.
What to get right
Three things. Build the commensurate-transfer analysis as the primary document rather than as support for a mechanistic test — the tests are deemed conditions the PRA can disapply, and premiums and tranche thickness are where that happens.
Second, treat SRT as a life-of-transaction obligation with monitoring attached, not a closing condition.
Third, do not build a timetable around supervisory pre-approval that does not exist. Plan for a notification one month after transfer, with the senior manager attestation and the full evidence pack ready at that point.
Acumon supports banks and lenders on regulatory capital reporting, controls and the assurance around them through financial services audit, internal audit and risk management work — see also our guide to banking internal audit. If a transaction is being structured for the first half of 2027, the rulebook it will be notified under is the new one.