Operational resilience is the ability of a firm to prevent, adapt to, respond to, recover from and learn from operational disruption. In UK financial services it is also a set of binding rules. The FCA's rules in SYSC 15A came into force on 31 March 2022, and in-scope firms had until 31 March 2025 to show they can keep each important business service within its impact tolerance during a severe but plausible disruption. Two further changes now matter: the first critical third parties were designated on 13 July 2026, and new incident and third-party reporting rules apply from 18 March 2027.
What operational resilience means in practice
Traditional business continuity planning asks how quickly systems can be restored. Operational resilience starts from the opposite end. It assumes disruption will happen, whether from a cyber attack, a cloud outage, a failed software update or the loss of a key site. It then asks how much harm the firm's customers and markets can tolerate before the firm must have recovered.
The difference is one of perspective. A recovery time objective is set around a system. An impact tolerance is set around a service that a customer uses, such as making a payment, accessing an account or settling a trade. That service may depend on dozens of systems, people and suppliers.
Who the FCA rules apply to
SYSC 15A applies to:
- Banks, building societies and PRA-designated investment firms;
- Solvency II insurers;
- Enhanced scope SMCR firms;
- UK recognised investment exchanges;
- Payment and e-money firms. This covers electronic money institutions, payment institutions and registered account information service providers;
- Consolidated tape providers.
The chapter does not apply to firms whose registered office is outside the UK. Dual-regulated firms must also meet the PRA's parallel rules and supervisory statement SS1/21. Other FCA firms are not in scope of SYSC 15A, but they still have general systems-and-controls and outsourcing obligations. The FCA's published expectations are a useful benchmark for them too.
The five core requirements
- Identify important business services. These are services that, if disrupted, could cause intolerable harm to clients or risk to market integrity. Each distinct service must be identified separately, not grouped together;
- Set an impact tolerance for each one. This is the maximum tolerable level of disruption, measured by a length of time plus any other relevant metrics. It should reflect peak demand, the vulnerability of clients and the financial harm a disruption could cause;
- Map the service. Identify and document the people, processes, technology, facilities and information needed to deliver it, including those provided by third parties;
- Test it. Keep a testing plan and run scenario tests against severe but plausible disruptions. The guidance lists data corruption, loss of key people or facilities, third-party failure and loss of technology. Each test, and each real incident, must be followed by a lessons learned exercise and improvements;
- Communicate. Keep internal and external communication strategies so the firm can warn and support clients quickly when a service is disrupted.
The identification, tolerance and mapping work must be reviewed whenever the business changes materially, and in any event no later than one year after the last assessment.
The self-assessment and the board
Everything above must be written up in a self-assessment. This record covers the important business services and why they were chosen, the impact tolerances and how they were set, the mapping approach, the testing plan and results, the lessons learned, the vulnerabilities found and the remediation timetable. The firm's governing body must approve and regularly review it. Each version must be kept for at least six years and given to the FCA on request.
The FCA has said it expects to be told about any failure to meet an impact tolerance, under Principle 11. In practice the self-assessment is the first document a supervisor asks for, so it should be a live management document rather than a compliance file.
Worked example: a payments firm
A payment institution identifies "customers sending a payment from the app" as an important business service. Many of its customers are small businesses paying wages. Using that profile it sets an impact tolerance of four hours, with a shorter limit on payroll days.
Mapping shows the service relies on a single cloud region, one third-party fraud-screening provider and a team of three people who know how to fail over the payment gateway. A scenario test simulating the loss of the fraud-screening supplier shows recovery would take about nine hours, well outside tolerance. The lessons learned exercise produces three actions: a documented manual fallback for low-value payments, cross-training of two further staff, and a contract change requiring the supplier to take part in joint testing. The self-assessment records the breach of tolerance in testing, the actions and their deadlines. The board approves it.
What changes in 2026 and 2027
- Critical third parties. The CTP regime began on 1 January 2025, and HM Treasury designated the first four on 13 July 2026: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited. The regulators now oversee their systemic services directly. The FCA is clear that this does not change firms' own accountability for their resilience and third-party risk;
- Incident and third-party reporting. Policy statement PS26/2, published on 18 March 2026, introduces a single FCA, PRA and Bank of England regime from 18 March 2027. Firms must report operational incidents that cross set thresholds through a single standardised submission, whichever regulators the report is for. They must notify the FCA of new or significantly changed material third-party arrangements, and keep a register of those arrangements that is submitted annually.
Common weaknesses
- Services defined as systems. "The core banking platform" is not a business service; "customers withdrawing cash" is;
- Tolerances set to match current recovery capability rather than the point at which customers suffer intolerable harm;
- Thin third-party mapping. The rules expect firms to understand the people, processes and technology their suppliers use to deliver the service;
- Tabletop-only testing that never stresses data corruption or a prolonged supplier outage;
- A self-assessment the board signs but does not challenge.
The primary sources are the FCA's operational resilience page, the rules in SYSC 15A, the FCA's critical third parties page, PS26/2 and the PRA's SS1/21. For related reading, see our guides to business continuity planning and DORA.
Acumon's IT risk and internal audit teams can review a firm's important business services, impact tolerances, mapping and testing, and give the board independent challenge on the self-assessment before the FCA asks for it.