Structuring a PRA NBSU Mobilisation Exit Application That Demonstrates Readiness

Exiting mobilisation is not a paperwork exercise. It is the moment the PRA and FCA decide whether your bank can operate as a fully authorised deposit-taker without the safety rails of restricted deposit limits. Applicants who treat the exit as a status update rather than a fresh evidential case tend to receive extended timelines, further information requests, or conditions carried into full authorisation. The bar is genuine operational readiness, evidenced at a level a supervisor can test.

Key Executive Takeaways

• The exit application is judged on evidenced operational reality, not board-approved intent, so every claim should be traceable to tested processes, live systems, and appointed people.
• Supervisory concerns almost always cluster in the same areas: capital and liquidity under stress, third-party dependencies, financial crime controls, and the credibility of the business plan against actual pipeline, so address these with primary evidence rather than narrative.
• Early, honest engagement with your NBSU case officer on residual gaps produces better outcomes than a polished submission that surprises supervisors, because unresolved issues surface either way.

Start with the supervisory question, not your internal narrative

The PRA is answering one question: can this bank be released from restrictions without material risk to depositors, financial stability, or its own viability? Structure the application around that question. Every section should let a reader confirm, with primary evidence, that a specific readiness criterion is met. Internal milestones, board journeys, and mobilisation history are context, not the substance.

The strongest applications open with a concise readiness statement from the CEO and Chair that maps directly to the conditions imposed at authorisation and the commitments in the Regulatory Business Plan. Each commitment gets a status, evidence reference, and a named accountable SMF.

Build the evidence pack before you draft the narrative

Most weak submissions are written first and evidenced second. Reverse that. Assemble the artefacts, then write to them.

The pack should include: signed policies with version control, operating procedures with live process owners, ICAAP and ILAAP with board approval dates and reverse stress tests that actually bite, recovery plan with tested playbooks, outsourcing register with executed contracts and exit plans, financial crime framework with completed customer risk assessments and tested transaction monitoring rules, SMCR documentation including Statements of Responsibilities and a current responsibilities map, and audited or reviewed opening financials.

Where something is not yet live because it depends on lifting restrictions, say so plainly and describe the parallel-run or dress-rehearsal evidence that substitutes for it.

Address the four areas supervisors probe hardest

Capital and liquidity credibility

The ICAAP and ILAAP must reflect the post-mobilisation business, not the mobilisation shell. Show the capital plan under base, stress, and reverse stress with clear management actions and trigger points. If you are relying on further capital injections post-exit, evidence committed funding, not indicative support.

Third-party and technology resilience

Core banking, payments, and cloud arrangements should be contracted, tested, and covered by exit plans that are more than templates. Include penetration test results, incident response rehearsal outcomes, and evidence of your ability to meet operational resilience impact tolerances for important business services.

Financial crime controls

Demonstrate the framework works in practice: sample customer files across risk tiers, tuning evidence for monitoring thresholds, SAR process walk-throughs, and MLRO reporting to the board. Model-based claims without transaction evidence are a common weakness.

Business plan realism

Pipeline, unit economics, and funding assumptions should reconcile to the plan submitted at authorisation. Material divergence is not fatal, but it must be explained with revised projections and, if needed, a refreshed capital view.

Sequence engagement with the case officer

Book a pre-submission meeting before you finalise. Walk through your readiness self-assessment, flag known gaps, and agree what evidence format works. This is where credibility is built or lost. Submitting cold, with unresolved issues buried in appendices, is the fastest route to extended restrictions or conditions.

After submission, expect follow-up questions within weeks. Prepare a small, senior response team with authority to sign off answers quickly. Slow, inconsistent responses signal governance weakness.

What good looks like

A good exit application reads as though the bank is already operating at full scale. Policies are used, not filed. Committees meet with real papers and real decisions. The three lines of defence show independent challenge with documented outcomes. Residual risks are named, owned, and mitigated with dates.

The decision point for the executive team is straightforward: if you cannot evidence readiness to the standard above today, delay submission and close the gaps. A short delay is materially cheaper than conditions carried into full permissions.

Frequently Asked Questions

How long does the exit process typically take once submitted?

Plan for three to six months from submission to decision, longer if material gaps emerge. Front-loading engagement with the case officer usually compresses this.

Can we exit mobilisation with some conditions still in place?

Yes, but conditions carried into full authorisation constrain commercial activity and signal residual supervisory concern. Where possible, close issues before exit rather than accept conditions as the price of speed.

What role should Internal Audit play in the exit submission?

An independent readiness review by Internal Audit or a qualified third party, covering the same criteria the PRA will test, materially strengthens the application and surfaces gaps before supervisors do.

How much should the business plan be updated from authorisation?

Update it to reflect current reality. Supervisors expect divergence over the mobilisation period. What they do not accept is a plan that quietly ignores changed assumptions on funding, pricing, or customer acquisition.

Who should sign the submission?

The CEO and Chair, with the SMF2 (CFO) and SMF4 (Chief Risk Officer) explicitly attesting to the financial and risk evidence respectively. Named accountability throughout the pack matters more than a single cover signature.