Operational resilience is the ability of firms, financial market infrastructures and the financial sector as a whole to prevent, adapt and respond to, recover and learn from operational disruption. By 31 March 2022, relevant firms must identify their important business services, set impact tolerances and carry out necessary mapping and testing to enable them to do so.
On this page:
Ensuring the UK financial sector is operationally resilient is important for consumers, firms and financial markets. We believe an operationally resilient financial system is one that can absorb shocks rather than compound them.
Operational disruptions and the unavailability of important business services have the potential to cause wide-reaching harm to consumers and/or risk to market integrity, threaten the viability of firms and cause instability in the financial system.
The disruption caused by Covid-19 has shown why it is critically important for firms to understand the important business services they provide, and to invest in their resilience to protect themselves, consumers and markets.
In March 2021, we published our final rules and policy and a shared policy summary alongside the Bank and the Prudential Regulation Authority (PRA)
The rules apply to banks, building societies, PRA-designated investment firms, insurers, Recognised Investment Exchanges, Enhanced scope Senior Managers and Certification Regime firms, and entities authorised and registered under the Payment Services Regulations 2017 and Electronic Money Regulations 2011.
If you’re one of these firms, by 31 March 2022 you will need to have:
- identified your important business services that, if disrupted, could cause intolerable harm to consumers of your firm or risk to market integrity, threaten the viability of firms or cause instability in the financial system
- set impact tolerances for the maximum tolerable disruption to these services
- carried out mapping and testing to a level of sophistication necessary to identify important business services, set impact tolerances and identify any vulnerabilities in its operational resilience
- conducted lessons learnt exercises to identify, prioritise, and invest in your ability to respond and recover from disruptions as effectively as possible
- developed internal and external communications plans for when important business services are disrupted
- prepared self-assessment documentation
As soon as reasonably practicable after 31 March 2022 and no later than 31 March 2025, you will need to have:
- performed mapping and testing so that you are able to remain within impact tolerances for each important business service
- made the necessary investments to enable you to operate consistently within your impact tolerance.
Currently, we assess firms’ operational resilience capabilities against our Operational Resilience Framework, which defines industry practices aligned to our existing rules and expectations. The new requirements above expand on the practices we expect firms to meet.
Under Principle 11 of the FCA’s Principles for Businesses, firms are required to deal with the FCA in an open and cooperative way and to disclose to the FCA appropriately anything relating to the firm of which the FCA would reasonably expect notice. SUP 15.3 sets out additional rules and guidance on when the FCA would expect notice of matters relating to a firm. This means that the FCA is likely to expect a firm to report material operational incidents to the FCA. An incident may be material if it:
- results in a significant loss of data
- results in the unavailability or control of your IT systems
- affects a large number of customers
- results in unauthorised access to your information systems
Note that this list is not exhaustive. Payment service providers should also be aware of their obligations to report major operational or security incidents under the Payment Services Regulations 2017 (the PSRs). SUP 15.14 sets out additional directions and guidance on this obligation.
If you consider the incident to be material, please report it us by:
- contacting your named FCA supervisor, if you have one
- using the channels on our contact page if you don’t have a named supervisor
- informing the PRA if your firm is dual-regulated (by both the FCA and PRA)
- by following any specific rules or directions that apply
You should also consider whether you may need to report the incident to anybody else:
- If you believe the incident is criminal, you should contact Action Fraud via their website or by calling 0300 123 2040.
- If the incident involves a data breach, you may need to report it to the Information Commissioner’s Office. Note they require you do this within 72 hours of becoming aware of the breach, where feasible.
- For cyber incidents, you may need to report it to the National Cyber Security Centre.
- It also helps other firms if you can share details of the incident on the CiSP platform. Fighting cybercrime must be a collaborative effort.
To help firms, as well as us, to understand their cyber resilience capability at a high level, with the PRA we’ve created a self-assessment questionnaire. CQUEST consists of multiple-choice questions covering aspects of cyber resilience, such as:
- does your firm have a board-approved cyber security strategy?
- how does it identify and protect its critical assets?
- how does it detect and respond to an incident, recover the business and learn from the experience?
The answers provide a valuable snapshot of a firm’s cyber resilience capability and highlight areas for development.
If you would like to complete CQUEST, please email your supervisor or portfolio lead, copying in [email protected].
The FCA has also created a broader operational resilience self-assessment questionnaire called ORQUEST to help firms, as well as us, understand their operational resilience capabilities, including their cyber capabilities.
If you would like to complete ORQUEST, please email your supervisor or portfolio lead, copying in [email protected].