Regulation: operational resilience
Impact tolerances your firm can actually stand behind.
The UK operational-resilience rules, FCA PS21/3 and the PRA's equivalent, took effect on 31 March 2022, with a transitional period running to 31 March 2025.
Five things every in-scope firm has to do, and evidence.
The regime asks a firm to work out which of its services really matter, decide how much disruption to each it can live with, and then prove it can stay inside that limit when something severe hits. The board is accountable and signs the self-assessment.
- Identify your important business servicesThe services whose failure would cause real harm to clients or the market.
- Set an impact tolerance for eachThe maximum tolerable level of disruption you can accept for that service.
- Map what each service depends onThe people, processes, technology, facilities and third parties behind it.
- Test against severe-but-plausible scenariosScenario testing hard enough to find where the service actually breaks.
- Stay within tolerance by the end of the transitionBe able to remain inside every impact tolerance by 31 March 2025.
A tolerance you can’t breach in testing isn’t a tolerance.
Where firms trip
- Impact tolerances set to look comfortable, rather than set to bite.
- Mapping that stops at the obvious dependencies and never reaches the ones that would actually take the service down.
- Scenario testing that is too gentle to reveal where a service really fails.
- Being unable to evidence, on demand, that the firm remained within tolerance.
How we help
A regulator-facing security lead who owns the resilience work end to end and can answer for it when the supervisor asks.
TransformationMapping, impact tolerances and scenario testing built into how the firm runs, not a document that ages on a shelf.
Board and NED advisoryThe fluency a board needs to challenge the numbers and sign the self-assessment with something behind the signature.