UK specialist construction lenders operate inside a framework with four moving parts that don't always talk to each other. A construction loan risk management policy that doesn't reference each of them is incomplete. So, frankly, is any internal audit pack, credit committee report, or board risk paper that can't show how each one is being managed.
This article walks through the four. What they are, what each requires of a lender, and where the practical compliance work actually lands.
What regulators oversee UK construction lending?
UK construction lending sits under four sets of rules: FCA and PRA prudential oversight for authorised firms, the RICS AI standard for monitoring surveyor panels, the Building Safety Act 2022 for higher-risk buildings, and the Housing Grants, Construction and Regeneration Act 1996 (the Construction Act) for payment mechanics on every facility. They overlap, and a credible compliance position has to address each one.
FCA and PRA prudential oversight
Banks and building societies doing construction lending are subject to PRA capital and liquidity requirements that treat in-progress real estate as its own exposure class. The PRA expects construction-exposed loan books to be run against documented credit policies, with consistent drawdown approval processes, ongoing portfolio monitoring, and clear concentration limits.
Non-bank specialist lenders sit outside PRA prudential supervision but still come under FCA conduct rules where regulated activities (lending to individuals, or on residential property) are in scope. Pure commercial development finance to corporate borrowers is largely unregulated at the activity level, which is why so many UK specialist lenders are non-bank shops. Unregulated doesn't mean unsupervised though. Institutional funders, warehouse providers, and rating agencies effectively impose a regulatory-equivalent standard through their own due diligence.
What this looks like in practice for a Head of Credit:
- A documented construction loan risk management policy with quantified risk appetite, concentration limits, and exception protocols, reviewed at least annually.
- Evidence the policy is actually being enforced, not just published. Examiners and institutional funders both look for evidence trails on individual facilities, not just policy documents.
- Ongoing portfolio reporting that supports oversight at credit committee and board level, with the ability to surface concentration risk by geography, contractor, borrower group, and product type.
The RICS AI standard, mandatory since 9 March 2026
The RICS AI standard became mandatory on 9 March 2026. Any RICS-regulated firm using AI to produce or assist with a cost report, valuation input, or condition assessment has to meet seven governance requirements covering transparency, reliability decisions, audit trail, and ongoing oversight.
For lenders, this matters because the monitoring surveyor panel is RICS-regulated. The audit trail covering AI-assisted reliability decisions on cost reports and condition assessments is now a regulatory artefact on the panel firm's side, and the lender relying on that surveyor inherits the quality of that trail. If the trail is good, you've inherited a strong audit position. If it's weak, you've inherited that too.
Two questions a credit team should be asking:
- Does your monitoring surveyor panel comply with the RICS AI standard? Most panel firms are still working out what compliance looks like in practice, and lenders that ask the question are pulling their panel forward. That's in the lender's interest.
- Can you reproduce the audit trail on demand? If a regulator, an institutional funder, or an internal auditor asks how an AI-assisted cost report was reviewed, can the lender actually produce the documentation? If the answer involves chasing the panel firm for emails, the answer is no.
Lenders working with monitoring surveyors on the BankBuild platform have the audit trail built in. Every AI-assisted decision and every reliability review carries a timestamped, attributed record consistent with the RICS standard, and the lender can pull it as a structured artefact rather than asking the surveyor to dig out a PDF.
The Building Safety Act 2022
The Building Safety Act 2022 introduced a gateway process for higher-risk buildings: residential buildings of 18 metres or seven storeys and above. The Building Safety Regulator, which sits inside the Health and Safety Executive, operates three gateways. At planning, before construction starts, and before occupation. Schemes that drift through a gateway without sign-off face delay, and in some cases remediation obligations that attach to the building itself rather than to the contractor that built it.
For construction lenders, the Act creates exposure that wasn't there on pre-2022 facilities:
- Gateway delay risk. A higher-risk building scheme that fails a gateway is a stalled scheme. The cost of carry sits with the borrower, and ultimately with the lender.
- Remediation orders. Where existing buildings need remediation under the Act, cost can attach to the freeholder rather than the original contractor, with knock-on effects for any lender secured against the asset.
- Underwriting changes. Facilities on higher-risk buildings should be underwritten with the gateway view built in. Who's the Principal Designer, who's the Principal Contractor, when is the Gateway 2 submission planned, and what does the drawdown schedule look like relative to that gateway.
Specialist lenders writing across all building heights are starting to find that Building Safety Act stock needs distinct underwriting, distinct monitoring, and distinct reporting from the rest of the book.
The Construction Act 1996
The Housing Grants, Construction and Regeneration Act 1996, known universally as the Construction Act, sets the payment mechanics for almost every construction contract in the UK. Payment notices, pay-less notices, adjudication rights, and statutory payment terms are all governed by it. A missed pay-less notice can cost a developer or main contractor the right to challenge a subcontractor's valuation, which in turn can cost the lender the ability to push back on inflated drawdown numbers.
The legal mechanics of payment matter to lenders in three concrete ways:
- Contract review at facility approval. The building contract, usually JCT or NEC, should be reviewed for payment provisions, with any non-standard clauses flagged. A facility funding a contract with weak pay-less mechanics has less downside protection than one funding a standard contract.
- Adjudication exposure. Adjudication is fast (28 days from notice to decision) and binding pending litigation. A live adjudication on a funded scheme is a material event the lender should know about, preferably before it concludes.
- Pay-when-paid prohibitions. The Construction Act prohibits most pay-when-paid clauses. Subcontractor disputes that flow from a main contractor delaying payment can cascade through the supply chain very quickly, and that cascade is the leading indicator of the supply-chain insolvency exposure the lender ends up wearing.
How the four sets of rules interact
The four don't sit in separate boxes. They overlap in ways that matter for portfolio risk.
- A higher-risk building scheme (Building Safety Act) funded by a regulated bank (PRA) with a RICS-regulated monitoring surveyor (RICS AI standard) operating under a standard JCT contract (Construction Act) is inside all four at once.
- An adjudication notice on a subcontractor package (Construction Act) is a leading indicator of contractor distress. The monitoring surveyor's RICS-compliant audit trail (RICS AI standard) should capture it, and the lender's portfolio reporting (PRA) should surface it.
- The same audit trail that satisfies the RICS standard on the panel firm's side largely satisfies the PRA's expectation of evidence on the lender's side. You capture once and use twice.
A construction loan risk management policy that addresses all four sets of rules is the document the FCA, PRA, internal audit, and an institutional funder will all want to see.
For more on the underlying risk categories these rules try to mitigate, see our pillar piece on construction lending risk and real-time portfolio management.
Frequently asked questions
-
Lending to consumers and on residential property is regulated by the FCA, and authorised banks and building societies are also subject to PRA prudential supervision. Pure commercial development finance to corporate borrowers is largely unregulated at the activity level, which is why most UK specialist construction lenders are non-bank. Institutional funders and rating agencies typically impose a regulatory-equivalent standard through their own due diligence.
-
The RICS AI standard, mandatory since 9 March 2026, requires RICS-regulated firms to meet seven governance requirements when using AI to produce or assist with cost reports, valuations, or condition assessments. For UK construction lenders, it matters because the monitoring surveyor panel is RICS-regulated. The audit trail on AI-assisted reliability decisions is now a regulatory artefact on the panel side, and lenders inherit it at portfolio level.
-
The Building Safety Act 2022 applies to higher-risk buildings, defined as residential buildings of 18 metres or seven storeys and above. The Building Safety Regulator operates three gateways: at planning, before construction starts, and before occupation. Schemes that fail a gateway face delay and, in some cases, remediation obligations.
-
The Housing Grants, Construction and Regeneration Act 1996 (the Construction Act) sets statutory payment terms, requires payment notices and pay-less notices, gives subcontractors a right to adjudication, and prohibits most pay-when-paid clauses. It applies to almost every construction contract in the UK. Lenders should review the payment provisions of contracts they fund and treat live adjudications as material events.
-
A documented construction loan risk management policy that references each set of rules, evidence of enforcement on individual facilities, an auditable portfolio reporting layer, and a monitoring surveyor panel operating to the RICS AI standard between them demonstrate compliance. Where the audit trail is generated by the work rather than assembled after the fact, you satisfy multiple sets of rules from a single data layer.