REGULATION — OPERATIONAL RESILIENCE

Impact tolerances your firm can actually stand behind.

The UK operational-resilience rules — FCA PS21/3 and the PRA's equivalent — took effect on 31 March 2022, with a transitional period running to 31 March 2025.

WHAT THE RULES DEMAND

Five things every in-scope firm has to do — and evidence.

The regime asks a firm to work out which of its services really matter, decide how much disruption to each it can live with, and then prove it can stay inside that limit when something severe hits. The board is accountable and signs the self-assessment.

Identify your important business servicesThe services whose failure would cause real harm to clients or the market.
Set an impact tolerance for eachThe maximum tolerable level of disruption you can accept for that service.
Map what each service depends onThe people, processes, technology, facilities and third parties behind it.
Test against severe-but-plausible scenariosScenario testing hard enough to find where the service actually breaks.
Stay within tolerance by the end of the transitionBe able to remain inside every impact tolerance by 31 March 2025.

A tolerance you can't breach in testing isn't a tolerance.

WHERE FIRMS TRIP

Impact tolerances set to look comfortable, rather than set to bite.
Mapping that stops at the obvious dependencies and never reaches the ones that would actually take the service down.
Scenario testing that is too gentle to reveal where a service really fails.
Being unable to evidence, on demand, that the firm remained within tolerance.

HOW WE HELP

Fractional CISO

A regulator-facing security lead who owns the resilience work end to end and can answer for it when the supervisor asks.

Transformation

Mapping, impact tolerances and scenario testing built into how the firm runs — not a document that ages on a shelf.

Board & NED advisory

The fluency a board needs to challenge the numbers and sign the self-assessment with something behind the signature.

DORA

The EU's resilience regime for financial entities and their critical ICT providers — the counterpart to the UK rules. →

SECTOR

Financial services

How we work with banks, insurers, asset managers, payments and fintech under the FCA and PRA. →

Set tolerances that mean something, and be ready to prove you held them.

Start a conversation