For financial firms with a regulator to answer to.

The rules moved. The expectations moved with them.

DORA has applied across the EU since January 2025. In the UK, the FCA and PRA have expected firms to identify their important business services, set impact tolerances and evidence resilience since 2022. Different regimes, one underlying question: can the firm keep operating, and recover, when something breaks?

The old answer, a thick policy set and an annual pen test, no longer passes. Supervisors want proof that resilience is designed into how the firm runs, owned by a named executive, and tested against scenarios you didn’t get to choose.

Supervisors don’t grade the binder. They grade the recovery.

Where the pressure shows

• Impact tolerances set on paper, but never tested to the point where they’d actually bite.
• ICT and third-party concentration that nobody has mapped end to end.
• A named senior manager, accountable under SM&CR, who can’t yet answer for cyber.
• Cloud and product moving faster than the control environment around them.
• A board that receives cyber as reassurance, when it needs a decision.