Make sure your firm is continuing to comply with our operational resilience rules. Use our observations from firms’ self-assessments to help review and evolve your firm’s approach to being resilient.
Introduction
We’re now almost a year on from the end of the operational resilience transition period on 31 March 2025. By that date, firms were required to have completed mapping and testing so they can remain within impact tolerances for each important business service.
We reviewed firms’ annual operational resilience self-assessments and have set out our observations and insights on how firms are continuing to strengthen their operational resilience under our rules and guidance since the transition period ended.
We’ve seen examples of good practice as well as areas where further improvement is needed, and we’re engaging directly with firms in scope of our rules on these findings. However, there is information here that all firms could benefit from considering, even those not in scope of these rules.
Who this applies to
The rules currently apply to:
- banks
- building societies
- designated investment firms
- enhanced scope SMCR firms
- Solvency II firms
- UK recognised investment exchanges
- electronic money institutions
- payment institutions
- registered account information service providers
- consolidated tape providers
(collectively referred to as ‘firms’).
Why we’re sharing this
Firms’ operational resilience is their ability to avoid intolerable harm to consumers and threats to market integrity when their services are disrupted. Firms need to reflect on how these harms could come about, based on their business model – including the services they provide, the types of customers they have, and their place within the markets they operate in. They then need to ensure that those services can continue or recover from a disruption before these harms are caused.
Overall status
By 31 March 2025, firms had done a significant amount of work to strengthen their operational resilience and gain assurance that in the event of a severe but plausible disruption, they could recover important business services within impact tolerances.
We have seen strong engagement and good progress across all areas of the operational resilience requirements.
Operational disruptions in 2025 emphasise the importance of resilience
Recent high-profile incidents and outages have reinforced the need for strong resilience and its role in maintaining trust and stability in the sector.
This has included outages among cloud service providers such as Amazon Web Services, Microsoft Azure and Cloudflare – as well as high-profile cyber-attacks in other sectors, such as on Jaguar, M&S, and the Co-op.
While these examples are severe, they are plausible scenarios firms should be considering in their testing.
We understand that preparing to comply with our operational resilience rules compelled many firms to rethink their own resilience and risks, driving them to innovate and adopt new practices.
Operational resilience has become a central part of many firms’ risk frameworks and planning, leading firms to test more rigorously the resilience and vulnerabilities of their third-party providers and supply chain. In some cases, firms have done so jointly with their third parties.
Firms have invested in data vaulting, immutable back-ups, standby data centres, and new processing centres to help ensure that they can recover important business services within impact tolerances and maintain critical operations following disruptions caused by cyber attacks.
Operational resilience and boards’ decision-making
Boards play an important role in strengthening firms’ operational resilience.
The self-assessment gives them the information they need to understand their firm’s approach, who’s responsible for it, and the organisation’s ability to recover important business services within impact tolerance.
Firms do not usually include every piece of evidence in the self-assessment document, provided the information they include is clear enough for the board to understand and decide what to prioritise and invest in to build and maintain operational resilience.
We recognise that many firms would find it a complex challenge to remain within impact tolerance for some scenarios, particularly in the event of a severe cyber attack or significant outage at a third-party provider.
We encourage firms to continue to address this by remediating individual firm-specific vulnerabilities and working collaboratively with industry groups. We published examples of effective practice we have observed in these areas with the PRA and Bank of England in 2025.
We are also focusing on addressing gaps within individual firms, specifically where firms need to strengthen and embed operational resilience to avoid causing intolerable harm to consumers and threats to market integrity.
Our findings
Below we’ve set out examples of good practice and areas for firms to improve, based on some firms’ most recent operational resilience self‑assessments.
Conclusion
Operational resilience is not static. The external environment continues to evolve and scenarios that seemed implausible in the past may now be more likely. This underscores the importance of firms taking a dynamic approach including regularly reviewing operational resilience measures.
Investing in operational resilience helps drive long-term growth. Firms that prioritise resilience are better positioned to innovate, attract customers, and support market confidence.
Many firms demonstrate maturity in governance, but all firms should continue to focus on board engagement, robust frameworks, and evidence-based self-assessment for sector-wide improvement.
Firms must assess their ability to remain within impact tolerance annually but should also consider how well they’re prepared for – and the impact of – disruptions in the markets they operate in and those further afield. This is key to maintaining resilience in a changing landscape.
Firms need to continue to move beyond compliance and embed operational resilience into how they design products and services and, more broadly, how they conduct business.
They should treat resilience as a core business capability, integrated into strategic planning, product development, and customer engagement, rather than as a standalone exercise.
This will help them not only meet regulatory expectations but also strengthen trust, protect consumers, and safeguard market integrity in the face of future disruptions.
Glossary
| Operational resilience rules and guidance | These are contained in SYSC 15A of the FCA Handbook. |
| Board / Governing body | The rules refer to ‘the governing body’ which is defined as ‘the board of directors, committee of management or other governing body of a firm or recognised body, including, in relation to a sole trader, the sole trader.’ We refer to this as ‘the board’ and ‘board members’ in this publication; if your firm does not have a board of directors, please take this to mean the relevant governing body. |
| Impact tolerance | The maximum tolerable level of disruption to an important business service, as measured by a length of time in addition to any other relevant metrics, reflecting the point at which any further disruption to the important business service could cause intolerable harm to any one or more of the firm’s clients or pose a risk to the soundness, stability or resilience of the UK financial system or the orderly operation of the financial markets. |
| Important business service | A service provided by a firm, or by another person on behalf of the firm, to one or more clients of the firm which, if disrupted, could:
|