The New UK Securitisation Rules

Introduction

On 30 April 2024 the Financial Conduct Authority (“FCA”) and the Prudential Regulation Authority (“PRA”) published Policy Statements¹ (the “Policy Statements”) setting out their final rules relating to securitisation and feedback on responses to their earlier consultation papers² (the “Consultation Papers”).

The draft FCA and PRA rules in the Consultation Papers largely preserved the current requirements of the of the UK Securitisation Regulation (the “UK SR”)³, but made some substantive policy changes, in light of market feedback on the Treasury’s 2021 Review⁴ of the UK SR. The final rules set out in the Policy Statements incorporate some limited changes (summarized below) in response to market feedback on the Consultation Papers, but do not diverge significantly from the rules proposed in the Consultation Papers.

More far-reaching changes may, however, be on the way. The FCA and the PRA expect to consult on further changes to their securitisation rules in Q4 2024/Q1 2025 (although timings may be subject to change). This second consultation will have a broader remit for policy change, including a review of the definition of public and private securitisations and the associated reporting regime, amongst other areas, such as possible enhanced ESG reporting requirements.

In this alert, we look at (i) the main differences between the final rules and the draft rules set out in the Consultation Papers, (ii) the new rules in more detail and (iii) the principal areas of divergence between the final UK rules and the EU securitisation rules set out in the EU Securitisation Regulation⁵ (the “EU SR”) and related technical standards.

Implementation and transitional provisions

The new FCA and PRA rules, together with the Securitisation Regulations 2024⁶, will come into force on 1 November 2024, subject to the Treasury revoking the UK SR and related technical standards. Market participants have a 6-month period between publication of the Policy Statements and the implementation date to familiarise themselves with the new rules and update their internal procedures.

The Treasury anticipates making a commencement order to revoke the UK SR and related technical standards later this year. The FCA and the PRA will delay or revoke their new rules if the commencement order is not made.

The new FCA and PRA rules include grandfathering provisions under which securitisations entered into before the implementation date of the new rules will generally⁷ preserve their treatment under the existing UK SR and related technical standards.

The architecture of the new UK securitisation framework

The new UK securitisation framework will comprise three separate, but interrelated, sets of rules: (i) the Securitisation Regulations 2024, (ii) the FCA rules and (iii) the PRA rules.

The Securitisation Regulations

The Securitisation Regulations 2024 (the “SI”) create a new framework empowering the FCA and PRA to enact rules for the firms they regulate. The SI also grants jurisdiction to the FCA under the designated activities regime (“DAR”)⁸ over unauthorised entities engaging in activities relating to the “manufacturing” of securitisations (i.e. acting as the originator, original lender or securitisation special purpose entity (“SSPE”) in a securitisation).

The SI requires the FCA and the PRA to “have regard” to the coherence of the overall framework for the regulation of securitisation.

The SI also:

1. imposes statutory due diligence requirements on trustees or managers of occupational pension schemes (“OPS”) investing in securitisations⁹. These requirements are set out in the SI because The Pensions Regulator, which supervises OPS, does not have rule-making powers.
2. narrows the scope of the definition of ‘institutional investor’ as it relates to alternative investment fund managers (“AIFMs”), so that UK due diligence requirements for investing in securitisations only apply to UK authorised AIFMs¹⁰.
3. restates a prohibition on establishing SSPEs in jurisdictions which are considered high-risk or non-cooperative by the Financial Action Task Force, or those which have not signed an agreement with the UK to ensure an effective exchange of tax information. The current prohibition in the UK SR is not explicit as to which entities it applies to¹¹. The SI now specifies that originators and sponsors are prohibited from setting up an SSPE in these jurisdictions, and institutional investors are prohibited from investing in securitisations which involve an SSPE in one of these jurisdictions.

The FCA Rules

The FCA rules apply to: (i) authorised firms involved in securitisation markets as institutional investors or ‘manufacturers’ (i.e., original lender, originator, sponsor and/or SSPE), (ii) unauthorised entities acting as an original lender, originator or SSPE of a securitisation subject to the UK SR, (iii) sellers of securitisation positions to retail clients; (iv) individuals holding offices or positions involving responsibility for taking management decisions at firms involved in securitisation markets, (v) persons applying to be third party verifiers (“TPVs”) and (vi) securitisation repositories (“SRs”) as well as those applying to be SRs.

The PRA Rules

The PRA rules apply to: (i) PRA-authorised persons established in the UK, including firms regulated under the UK Capital Requirements Regulation¹² (“CRR”), insurance and reinsurance undertakings regulated under the UK Solvency II framework (“Solvency II firms”), non-CRR firms such as building societies and credit unions, and non-Solvency II firms such as insurance companies and friendly societies not regulated under Solvency II that are authorised to write insurance contracts and (ii) qualifying parent undertakings, which comprise financial holding companies and mixed financial holding companies, as well as credit institutions, investment firms, and financial institutions which are subsidiaries of these firms.

The PRA rules do not apply to non-UK firms with branches in the UK.

Where to find the current rules in the new framework

The PRA rules (set out in the PRA Rulebook) and the FCA rules (set out in the FCA Handbook) each have rules which cover due diligence, risk retention, asset selection, and credit granting requirements. While the PRA rules apply only to PRA-authorised persons, the FCA rules in areas shared with the PRA apply both to FCA-authorised firms and to unauthorised entities acting as ‘manufacturers’ of securitisations.

Requirements relating to simple, transparent and standardised (“STS”) securitisations, which apply to FCA and PRA firms alike, are set out in the FCA rules (see SECN 2.2). The requirements relating to TPVs and SRs are also set out in the FCA rules (see SECN 10 in relation to the former and SECN 9.3 and 9.5 in relation to the latter).

Annex 2 to the FCA’s Policy Statement contains a Derivation and Changes Table which sets out where the current provisions of the UK SR and assimilated EU law (such as the STS criteria on homogeneity of underlying exposures¹³) can be found in the FCA rules or, as applicable, in the SI. Certain provisions of EU regulatory technical standards which came into force after the end of the Brexit transition period (and therefore did not automatically become part of UK domestic law), such as parts of the EU regulatory technical standards on risk retention¹⁴ (the “EU Retention RTS”), are also included in the FCA rules.

The PRA and FCA rules contain separate (but identical) sets of reporting templates, which are consistent with the existing UK SR reporting templates.

Summary of material changes from the Consultation Papers

In the Policy Statements the FCA and the PRA have made the following changes to the draft rules set out in the Consultation Papers (in addition to some corrections and technical adjustments):

• allowed for a 6-month period between publication of the Policy Statements and the implementation date of the new rules;
• added transitional provisions for pre-implementation date securitisations which broadly preserve their treatment under the existing UK rules;
• clarified the meaning of “before pricing” in the due diligence, transparency, and STS requirements, now requiring information to be provided “before pricing or commitment to invest”;
• amended the due diligence requirements for secondary market investors in relation to disclosures made by securitisation manufacturers;
• clarified that a UK institutional investor may delegate its due diligence to an investor which is not itself an institutional investor, provided that the institutional investor retains responsibility for compliance with the due diligence requirements;
• clarified the prohibition on hedging of the material net interest required to be retained under the risk retention requirements; and
• clarified that there is no need for risk retention in relation to securitisations of own liabilities (e.g. own-issued covered bonds).

General considerations applicable to the new UK rules

Jurisdictional scope

The new UK rules apply only to entities, including manufacturers, established in the UK. An entity is ‘established’ in the UK if it is constituted under UK law with a head office in the UK or if it has a registered office in the UK.

The market understanding is that the UK securitisation rules only apply to ‘originators’ and ‘original lenders’ that are involved in the securitisation, although the broadness of those definitions potentially capture entities with no involvement in, or awareness of, the transaction. However the regulators chose not to clarify this point¹⁵.

Alignment of drafting

In the Consultation Papers, the FCA rules and the PRA rules were largely aligned as to policy and substance, but market participants expressed concerns about the lack of a uniform drafting approach between the FCA and the PRA rules. Following this feedback, and in line with their obligation to have regard to the coherence of the overall securitisation framework, the FCA and PRA have largely aligned the drafting of their rules in areas where the rules are shared – both in the language and the order of the rules. The FCA, the PRA and the Treasury have also largely aligned the drafting of the FCA and PRA due diligence rules with the statutory due diligence requirements for trustees and managers of OPS set out in the SI.

EU non-legislative materials

The Policy Statements make clear that EU non-legislative materials (such as guidelines, recommendations and Q&A documents) should continue to apply to the extent that they remain relevant in light of the UK’s changes to the regulatory framework¹⁶.

Recitals

The FCA and PRA have sought to incorporate UK SR recitals in the new rules where market participants rely on them as if they were operating provisions, or where they were regarded as essential to the interpretation of operating provisions. For example, Recital 14 of the UK SR, which provides that credit granting criteria need not be met with respect to trade receivables not originated in the form of a loan, has been expressly added to the FCA/ PRA rules governing credit granting requirements.

Waivers

The FCA and the PRA have a general power under section 138A of the Financial Services and Markets Act 2000 (“FSMA”) to modify or waive their rules where they are satisfied that: (a) compliance with the rules would be unduly burdensome or would not achieve their intended purpose and (b) modifying or waiving the rule would not adversely affect any of their objectives.

Although the FCA and the PRA will consider applications for waivers of requirements applying to manufacturers in areas shared with the PRA under the DAR waiver process, they encourage firms wishing to apply for the modification or dispensation of a rule to apply under their general modification and waiver power in section 138A of FSMA.

Due diligence

The FCA and the PRA have adopted a more principles-based and proportionate approach to due diligence disclosure obligations for institutional investors than applies under the UK SR. This new approach applies both to investments in UK securitisations as well as to overseas securitisations.

In a welcome change, the requirement in Article 5(1)(e) of the UK SR for institutional investors to verify that information provided in relation to non-UK securitisation is “substantially” the same as under Article 7 of the UK Securitisation Regulation is replaced with a requirement for institutional investors to verify: (i) the sufficiency of the information a manufacturer has made available to enable them to independently assess the risk of holding the securitisation position; (ii) that they have received at least specified minimum information listed in the rules¹⁷; and (iii) that there is a commitment from the sell-side parties to make further information continually available, as appropriate. There is no requirement to verify the use of reporting templates.

The new principles-based approach applies both to investments in UK securitisations as well as to non-UK securitisations. Although securitisation ‘manufacturers’ will still be obliged to report on the UK prescribed templates, UK institutional investors will not be obliged to verify the availability of template reporting.

In relation to the initial due diligence requirements for institutional investors, the final FCA and PRA rules make two changes to the draft rules in the Consultation Papers:

1. The rules now require information to be provided ‘before pricing or commitment to invest’ in appropriate places, to address the fact that ‘pricing’ does not generally occur in private securitisations. The revised wording is intended to apply to both public and private securitisations.
2. Secondary market investors are only required to conduct due diligence on the most up-to-date information available at the time of investment, as opposed to documents from the time of ‘pricing’ (or ‘commitment’).

Information required by institutional investors to conduct their due diligence must be made available before pricing (or commitment) at least in draft form, with final versions made available within 15 days of closing of the transaction.

The trigger for the application of the investor due diligence requirements remains “holding a securitisation position”. The UK regulators have so far declined to specify whether this should be interpreted as limited to the credit risk of a securitisation position or securitised exposures. This interpretation would exempt the counterparty to an interest rate or currency swap or a liquidity facility who did not assume the credit risk of the securitisation position or securitisation exposures from having to comply with the due diligence rules.

Delegation of due diligence

The rules replacing Article 5(5) of the UK SR provide that if a delegating party instructs a managing party, the delegating party will not be responsible for failure to comply with the relevant obligations, provided that the managing party is an institutional investor. The final rules do not prohibit an institutional investor delegating its due diligence requirements to an entity that is not an institutional investor, but regulatory responsibility will remain with the delegating party. AIFMs who are not authorised in the UK will no longer fall within the definition of an ‘institutional investor’ (a change made by the SR 2024). This change will affect some existing delegation arrangements – some delegating parties will either have to find a new managing party in the period before implementation of the new rules or accept that they retain responsibility for compliance.

An exception to the application of the delegation rules is where an institutional investor delegates the investment decision to an OPS. In that case, the rules on delegation of due diligence obligations do not apply and the responsibility for complying with the due diligence requirements will remain with the institutional investor and will not transfer to the OPS.

Risk retention

The final rules largely preserve the risk retention requirements from the existing UK SR and related technical standards. However, the FCA and the PRA have implemented the following material policy changes.

Non-performing exposures (NPEs)

Where a securitisation of NPEs includes a non-refundable purchase price discount, the risk retention requirement will be calculated on the market value of the NPE rather than its face value. This aligns the UK rules with changes made to the EU SR in 2021. However the final rules do not allow eligible servicers to fulfil the risk retention requirements, as is permitted under the EU's regulatory technical standards.

Transfer of the retainer

The question of transfer of the retainer also often arises in the context of restructuring, takeovers and acquisitions, or the reorganisation of a risk retainer entity or its group. Under the final UK rules, risk retention may be transferred to another entity upon the insolvency of the risk retainer or in the case of retention on a consolidated basis. However the FCA and the PRA decided not to include the provision from the EU RTS¹² which allows a transfer of the retained interest "where the retainer, for legal reasons beyond its control and beyond the control of its shareholders, is unable to continue acting as the retainer". In addition, they do not implement the Treasury Review's¹⁸ conclusion that there was merit in allowing a transfers by CLO managers retaining risk where investors in a CLO choose to replace the manager.¹³

The final UK rules are therefore more restrictive than the EU rules in relation to transfers of the retained interest (although there is the possibility of a waiver under the regulators’ general modification and waiver powers). As a result there could be cross-border compliance issues (i) for sell-side parties where a securitisation has a mixture of UK and non-UK originators or (ii) for institutional investors.

Sole Purpose test

The risk retention holder must not be established, or operate, for the "sole purpose" of securitising exposures. The rules give further guidance on the "sole purpose" test, by providing that, when considering whether an entity has been established for the sole purpose of securitising exposures, the following must be considered: (i) the entity has a business strategy and payment capacity consistent with a broader business enterprise; and (ii) the members of the management body have the necessary experience to enable the entity to pursue the established business strategy, as well as adequate corporate governance arrangements.

The final rules do not adopt the provision in the EU Retention RTS which sets out a safe harbour, under which an entity shall not be considered to have been established or to operate for the sole purpose of securitising exposures if it meets specified criteria, including that its 'sole or predominant' source of revenue does not rely on the securitised exposures. The final version of the 'sole purpose' test under the UK rules, with its requirement to 'take into account' the specified criteria, should avoid uncertainty which can arise regarding the scope and effect of the 'sole or predominant' wording in the EU Retention RTS.

Resecuritisation

Securitisations containing securitisation positions as underlying exposures (i.e. resecuritisations) are prohibited except in narrowly specified circumstances. The final rules specify two instances that do not amount to resecuritisations for risk retention purposes: (i) the retranching of an issued tranche into contiguous tranches by the securitisation’s originator and (ii) fully supported asset-backed commercial paper programmes.

However, manufacturers can apply to the FCA or, as applicable, the PRA for a waiver of the ban in order to manufacture a securitisation containing securitisation positions as underlying exposures. Similarly, an institutional investor can apply to the relevant regulator for a waiver to allow it to invest in a securitisation containing securitisation positions as underlying exposures (see “Waivers” above).

In resecuritisations which are permitted, the risk retention rules must generally be complied with at the levels of both the underlying securitisation and of the resecuritisation. However, the retention for the underlying securitisation will suffice for retention purposes if (i) the originator is the retainer in the underlying securitisation, (ii) it securitises only exposures or positions retained in excess of the minimum net economic interest in the underlying securitisation and (iii)there is no maturity mismatch between the underlying securitisation positions or exposures and the resecuritisation.

Exemption from cash collateralisation requirement for synthetic/contingent retention

Under the current UK SR, if risk retention is held through a synthetic or contingent form of retention, it needs to be fully cash collateralised and held on a segregated basis as clients’ money unless a credit institution is the risk retention holder. The new rules allow all CRR and Solvency II firms to retain risk in synthetic/contingent form without fully collateralising it in cash (i.e. exposure under a guarantee or credit derivative acting as the material economic interest should be secured by cash).

'Cherry picking'

The final FCA and PRA rules retain, with an exception, the UK SR requirement that originators cannot select assets to transfer to the SSPE in order to render the losses on those assets (measured over the life of the transaction or over four years if the transaction is longer than four years) higher than the losses over the same period on comparable assets held on the balance sheet of the originator. As an exception, originators or sponsors may select assets with a higher risk profile for the securitisation provided that this is clearly communicated to investors or potential investors. The rules also provide that, in assessing compliance, the originator’s compliance with its internal policies procedures and controls to prevent ‘cherry picking’, should be considered.

Homogeneity

The final rules contain amendments similar to those the European Banking Authority proposed in its draft regulatory technical standards on the homogeneity of the underlying exposures in STS securitisation under Articles 20(14), 24(21) and 26b(13) of the EU SR.¹⁹

Additionally, the rules clarify that where no homogeneity criteria are relevant for a particular securitisation, no homogeneity conditions apply. The final rules also make clear that underlying exposures may include corporate bonds for homogeneity purposes, provided that they are not listed on a trading venue.

Transparency Requirements

Interaction between transparency requirements and requirements relating to confidentiality and processing of personal data

The draft rules in the Consultation Papers did not expressly allow firms to comply, as under Article 7(1) of the UK SR, with the transparency requirements by disclosing data only in aggregated or anonymised form (or in relation to underlying documentation, as a summary) in circumstances where UK law relating to confidentiality and/or processing of personal data or any confidentiality obligation relating to customer, original lender or debtor information do not allow more ‘granular’ disclosures. The final rules add express provisions that track the wording in Article 7(1) of the UK SR.

Timelines for manufacturers making available certain information

In the transparency and disclosure requirements, the final rules replace references to ‘before pricing’ with the wording ‘before pricing or original commitment to invest’.

Gap analysis: the new UK rules and the existing EU rules

The main points of divergence between the new UK rules set out in the Policy Statements and the SI and the EU rules as set out in the EU SR and related technical standards are as follows:

Topic	EU Rules	UK Rules
General
Jurisdictional scope	Silent as to scope (but interpreted to apply only to entities established in the EU).	Apply only to entities established in the UK.
SSPEs	May not be “established” in a relevant jurisdiction.	Originators and sponsors may not set up an SSPE in a relevant jurisdiction; institutional investors may not invest in securitisations which involve an SSPE in a relevant jurisdiction.
Due diligence
Definition of “institutional investor”	Differs from the definition in the UK rules in a number of respects.	Differs from the definition in the EU rules – for example, it only includes UK authorised AIFMs. (Regulation 3(1) of the SI)
Timing of initial Article 7 disclosures	Before ‘pricing’	Before ‘pricing or commitment’ (SECN 6.2.2 R (2); Article 5(1) of PRA rules)
Requirements for secondary market investors	Rules appear to require investors to conduct due diligence on information provided prior to pricing.	Only required to conduct due diligence on the most up-to-date information available at the time of investment. (SECN 4.2.1 R; Article 5.1(e) of PRA rules)
Due diligence requirements before holding a securitisation position	Institutional investors must verify availability of Article 7 disclosure, including ESMA template reporting.	Institutional investors must only verify: (i) the sufficiency of the information a manufacturer has made available to enable them to independently assess the risk of holding the securitisation position; (ii) that they have received at least specified minimum information listed in the rules; and (iii) that there is a commitment from the sell-side parties to make further information continually available. (SECN 4.2.2 R (1); Article 5(1) of PRA rules)
Delegation of due diligence to an investor which is not itself an institutional investor	Where an institutional investor has delegated to another institutional investor the authority to make investment management decisions and has instructed such managing party to fulfil that institutional investor’s due diligence obligations, any sanction under Articles 32 and 33 of the EU SR may be imposed on the managing party and not on the institutional investor who is exposed to the securitisation.	The final rules do not prohibit an institutional investor delegating its due diligence requirements to an entity that is not an institutional investor, but regulatory responsibility will remain with the delegating party. AIFMs who are not authorised in the UK will not fall within the definition of an ‘institutional investor’ (SECN 4.5.1 R; Article 5(5) of PRA rules)
Risk retention
‘Sole purpose’ test	Includes a safe harbour if certain conditions are satisfied, including that the retainer does not rely on securitised exposures or retained interests or corresponding income as its “sole or predominant” source of revenue.	Lists factor which must be ‘taken into account’ when assessing whether an entity has been established or operates for the sole purpose of securitising exposures; omits the “sole or predominant ”wording. (SECN 5.3.6 R; Article 2(6) of PRA rules)
Guaranteed or upfront fees	Certainguaranteed or upfront fees payable to the retainer on a priority basis and which relate to post-closing services have to be deducted from the recognised retention amount.	UK rules are not explicit on whether such fees should be deducted from the retention.
Transfer of retainer	Permitted (i) in cases of insolvency, (ii) retention on a consolidated basis and (iii) for legal reasons beyond the retainer’s control and beyond the control of its shareholders, where it is unable to continue acting as a retainer.	Permitted only in cases of insolvency and retention on a consolidated basis. (SECN 5.12.1 R (4)(a); Article 12(3)(a) of PRA rules)
NPE securitisations	Servicer may be risk retainer for an NPE securitisation.	Servicer may not be risk retainer for NPE securitisations.
Synthetic STS transactions	On-balance sheet synthetic securitisations may achieve STS status.	Cannot achieve STS status. (SECN 2.2.2 R)
ESG disclosure	Provides for voluntary disclosure by originators of STS transactions of principal adverse impacts (PAIs) on the financed assets on sustainability factors.	Voluntary disclosure of PAIs not included in UK rules.

 

Conclusion and looking forward

The final UK securitisation rules set out in the Policy Statements contain welcome amendments to the current rules, particularly those changes which introduce a more principles-based approach to due diligence for UK investors and therefore improve their ability to invest in third country securitisations.

The market will keenly await the UK regulators’ second consultation on changes to the securitisation rules, which will have a broader remit for policy change, in particular potential changes to the definition of public and private securitisations and the associated reporting regime.