Michael PittasLast updated: 22 October 2026
Quick answer: UK operational resilience rules from the FCA (PS21/3) and PRA (PS6/21 and SS1/21) have applied since 31 March 2022, and in-scope firms had to be able to remain within their impact tolerances by 31 March 2025. The transition is over, so the work is now ongoing: keeping important business services, impact tolerances, mapping and scenario testing up to date, fixing vulnerabilities, and keeping a board-approved self-assessment that can stand up to supervisory review.
For most UK banks, insurers, investment firms and payment firms, operational resilience is no longer a project with an end date. The regulators expect firms to keep proving, year after year, that they can keep their most important services running through severe disruption, or bring them back before customers, markets or the firm itself suffer harm that cannot be tolerated.
The main difficulty after 2025 is staleness. Maps of people, processes, technology and suppliers drawn up for the March 2025 deadline go out of date quickly as firms move to the cloud, change suppliers and launch new products. A self-assessment that was accurate last year can now be misleading.
This guide explains what the FCA and PRA rules require, what business as usual looks like now, how the rules connect to outsourcing, the critical third parties regime and incident reporting, how they compare with the EU’s DORA, and where software helps. It ends with a practical checklist.
What are the FCA and PRA operational resilience rules?
They are a joint framework, published in March 2021 by the FCA, the PRA and the Bank of England, that requires firms to identify their important business services, set a maximum tolerable level of disruption for each, and show they can stay within it.
The main documents are:
- FCA PS21/3, Building operational resilience: introduced the rules in chapter 15A of the FCA’s Senior Management Arrangements, Systems and Controls sourcebook (SYSC 15A).
- PRA PS6/21 and SS1/21, Operational resilience: impact tolerances for important business services: the policy statement adds an Operational Resilience Part to the PRA Rulebook, and the supervisory statement sets out how the PRA expects firms to meet it.
- Bank of England: parallel requirements for the financial market infrastructures it supervises, such as central counterparties and recognised payment systems.
The FCA rules cover banks, building societies, PRA-designated investment firms, insurers, recognised investment exchanges, enhanced scope SM&CR firms, and payment and e-money institutions. The PRA rules cover banks, building societies, PRA-designated investment firms and UK Solvency II insurers. Dual-regulated firms must meet both sets of rules.
What were the key dates?
| Date | What it meant |
|---|---|
| 29 March 2021 | Final policy published by the FCA, PRA and Bank of England |
| 31 March 2022 | Rules applied. Firms had to identify important business services, set impact tolerances and start mapping and testing |
| By 31 March 2025 | End of the transition. Firms had to have carried out mapping and testing so that they could remain within impact tolerances, and to have invested to fix the vulnerabilities they found |
| From April 2025 | Business as usual: annual review, ongoing testing, remediation and an up-to-date self-assessment |
What are the key operational resilience concepts?
The framework rests on seven building blocks. Supervisors will look at each, and at how well they connect.
Important business services
An important business service is a service the firm provides to an external end user or market participant where disruption could cause intolerable harm to consumers or a risk to market integrity (the FCA test), or threaten the firm’s safety and soundness, policyholder protection or financial stability (the PRA tests). Examples include making payments, accessing deposits or paying insurance claims. Internal functions such as HR or IT are not business services in themselves, but they usually support them.
Impact tolerances
An impact tolerance is the maximum tolerable level of disruption to an important business service. It must include a time-based measure, such as a maximum duration of outage, and can add other metrics such as the number of customers affected or the volume of transactions. Tolerances assume disruption will happen. They are not the same as recovery time objectives for individual systems. Dual-regulated firms may need different tolerances for the same service, one against FCA objectives and one against PRA objectives.
Mapping
Firms must identify and document the people, processes, technology, facilities and information needed to deliver each important business service. Mapping should show third-party and intragroup dependencies, single points of failure and concentration risk. It is what lets you find vulnerabilities and design realistic tests.
Scenario testing
Firms must test whether they can remain within impact tolerances in a range of severe but plausible scenarios. Typical scenarios include loss of a key data centre or cloud region, a ransomware attack, failure of a major supplier, corruption of critical data and loss of key staff. Tests can range from desk-based exercises to live simulations. Where a test shows a firm would exceed a tolerance, the firm must record why and what it will do about it.
Vulnerabilities and remediation
Mapping and testing exist to find weaknesses. The regulators expect firms to prioritise and fund remediation, track it to completion and re-test. Lessons learned from real incidents count as much as lessons from planned tests.
Communications
The FCA requires internal and external communication plans for when an important business service is disrupted, so that customers and other stakeholders get timely, useful information and harm is reduced.
Self-assessment and board approval
Firms must keep written self-assessment documentation covering their important business services, impact tolerances, mapping, testing, lessons learned and remediation, and make it available to supervisors on request. The board, or equivalent governing body, must approve and regularly review it, along with the important business services and impact tolerances. Under the Senior Managers Regime, responsibility for operational resilience sits with a named senior manager.
What does operational resilience look like after March 2025?
It looks like a regular operating cycle rather than a programme, with clear owners, fixed review points and triggers for unplanned review.
The FCA requires firms to review their important business services and impact tolerances at least once a year, and whenever there is a material change to the business or the market in which it operates. In practice, firms should treat the following as triggers for review:
- onboarding, replacing or exiting a supplier that supports an important business service;
- migrating systems to the cloud or between providers;
- launching a new product, channel or customer group;
- mergers, restructuring or changes to intragroup services;
- a significant incident or near miss, inside the firm or at a key supplier;
- a test result showing a tolerance would be breached.
Supervisors are now less interested in whether firms identified their services and more interested in whether they can show, with current evidence, that they stay within tolerance. That means maps that match reality, tests that use realistic and increasingly demanding scenarios (including the failure of a shared third party, not just an isolated internal outage), and remediation that actually closes. A self-assessment written once a year from scattered spreadsheets and emails is hard to defend if the mapping behind it is already out of date.
In practice: link your change management process to your resilience map. If a change request touches a system or supplier that supports an important business service, it should prompt a check of the mapping and, where needed, the impact tolerance and test plan.
Which related UK regimes should you consider?
Operational resilience overlaps with several other UK requirements, mostly about third parties and incidents.
PRA outsourcing and third-party risk management (SS2/21)
PRA SS2/21, Outsourcing and third party risk management, took effect alongside the operational resilience rules on 31 March 2022. It sets expectations for PRA-regulated firms on governance, due diligence, contracts, data security, access and audit rights, sub-outsourcing, business continuity and exit planning, including stressed exit. It also expects firms to notify the PRA about material outsourcing arrangements. For FCA-only firms, the outsourcing rules in SYSC 8 and related FCA guidance apply. Third parties that support important business services should be mapped and tested as part of operational resilience, so outsourcing records and resilience records should agree.
Critical third parties regime
The Financial Services and Markets Act 2023 gave HM Treasury the power to designate third parties, such as large cloud providers, as critical third parties (CTPs) where their failure could threaten financial stability or confidence in the UK financial system. The Bank of England, PRA and FCA published final rules for CTPs in November 2024, and they took effect on 1 January 2025. Designated CTPs must meet fundamental rules and operational risk and resilience requirements, report incidents and take part in testing. The regime does not move responsibility away from firms: you must still manage your own dependence on those providers. Check HM Treasury’s announcements for which providers, if any, have been designated.
Incident and third-party reporting
In December 2024 the FCA (CP24/28) and PRA (CP17/24) consulted on new requirements for reporting operational incidents and material third-party arrangements, including a staged approach to incident reports. Check the FCA and PRA websites for final policy and implementation dates before building processes around the proposals. Whatever the final form, firms will need consistent incident classification, a clear owner for regulatory notifications and an accurate register of material third-party arrangements.
Wider UK cyber and data rules
Operational resilience sits alongside UK GDPR breach reporting to the ICO and wider cybersecurity reforms, such as the Cyber Security and Resilience Bill, which mainly updates the NIS Regulations for essential and digital services rather than financial firms. Our guide to GRC software for UK organisations covers the wider UK compliance picture.
How does UK operational resilience compare with EU DORA?
The two regimes share goals but differ in focus. The UK rules start from business services and tolerable harm. The EU’s Digital Operational Resilience Act (Regulation (EU) 2022/2554) starts from ICT risk and sets detailed, prescriptive requirements. DORA has applied since 17 January 2025 to EU financial entities. It does not apply to UK entities as such, but UK groups with EU-regulated subsidiaries, and UK firms providing ICT services to EU financial entities, will feel its effects.
| Topic | UK (FCA/PRA) | EU DORA |
|---|---|---|
| Starting point | Important business services and impact tolerances | ICT risk management framework covering ICT systems, assets and functions |
| Form | Outcome-based rules plus supervisory statements | Directly applicable regulation plus detailed technical standards |
| Testing | Severe but plausible scenario testing against impact tolerances | Digital operational resilience testing programme, with threat-led penetration testing for selected entities |
| Incidents | Existing notification duties; new incident reporting proposals consulted on in December 2024 | Classification and reporting of major ICT-related incidents with fixed deadlines |
| Third parties | PRA SS2/21 and FCA outsourcing rules; CTP oversight by UK regulators | Contractual requirements, register of information and EU oversight of critical ICT third-party providers |
| Governance | Board approval of self-assessment; senior manager accountability | Management body defines, approves and is accountable for the ICT risk framework |
For groups with entities on both sides, the practical answer is one set of underlying records (services, assets, suppliers, risks, tests and incidents) that can be reported in two ways. A UK important business service map and a DORA register of information draw on much of the same supplier and system data. See our guides to DORA for UK financial services, the DORA ICT risk management framework and DORA major incident reporting for the EU detail.
How does operational resilience differ from business continuity?
Business continuity plans focus on recovering systems, sites and processes after an event. Operational resilience takes the view of the customer and the market: it asks how long an important service can be disrupted before harm becomes intolerable, and works backwards across every dependency, including suppliers. Business continuity remains an important input, and a management system such as ISO 22301 business continuity can provide useful structure, but it does not on its own meet the FCA and PRA requirements.
How can software help with operational resilience?
Software does not set your tolerances or make your services resilient, but it makes the evidence easier to maintain and harder to let slip. The value is in linking records together so that a change in one place shows up everywhere it matters.
- Mapping: an asset inventory that links systems and applications to business processes and to the suppliers that provide them shows which important business services depend on what, and how risk flows from a vendor to an asset to a service.
- Third parties: a vendor and third-party management module holds contracts, certifications, due diligence and risk assessments, so outsourcing records and resilience maps stay consistent.
- Testing records: scenario tests, their results, the vulnerabilities found and the remediation tasks can be logged against the services they relate to, with owners and due dates.
- Risks and vulnerabilities: a central risk register keeps resilience weaknesses alongside cyber, privacy and vendor risks, with controls and mitigation tracking.
- Evidence: a document repository keeps board papers, test reports, approvals and policies with version history, ready for the self-assessment and supervisory requests.
- Incidents: an incident register helps compare real disruptions against impact tolerances and feed lessons learned into testing.
Enactia is one option here. Its asset, vendor, risk, policy, incident and evidence modules are connected, and it supports frameworks including DORA, ISO 27001 and NIST CSF; our GRC software by framework guide explains how cross-framework mapping works. Firms can record their important business services, impact tolerances and testing records within these modules and link them to the underlying assets, suppliers and risks. Large enterprise suites can also do this but often need dedicated administrators, while spreadsheets work for very small scopes but struggle once several services, suppliers and entities are involved.
UK operational resilience checklist
- Confirm scope. Check which legal entities fall under FCA SYSC 15A, the PRA Operational Resilience Part or both, and which EU entities fall under DORA.
- Review important business services. Re-test the list against current products, customers and markets at least annually and after material change.
- Revalidate impact tolerances. Make sure each has a time-based metric, reflects intolerable harm rather than system recovery targets and is set separately for FCA and PRA objectives where needed.
- Refresh mapping. Update people, processes, technology, facilities, information and third parties for each service, including intragroup and fourth-party dependencies where known.
- Link change to resilience. Add a resilience check to change management, supplier onboarding and cloud migration.
- Run scenario tests. Use severe but plausible scenarios, including third-party and shared-provider failure, and record results against each tolerance.
- Track vulnerabilities. Log every weakness found, assign an owner and deadline, fund remediation and re-test.
- Align third-party records. Reconcile outsourcing registers, SS2/21 documentation, exit plans and resilience maps.
- Test communications. Check internal and external communication plans for each important business service.
- Prepare for incident reporting. Agree incident classification, notification owners and a material third-party register, and monitor final FCA and PRA rules.
- Update the self-assessment. Keep it current through the year, not only before board approval.
- Get board approval. Present services, tolerances, test results, vulnerabilities and remediation clearly, and minute the challenge and decisions.
Frequently asked questions
Did the operational resilience rules end on 31 March 2025?
No. 31 March 2025 was the end of the transition period, by which firms had to be able to remain within their impact tolerances. The rules continue to apply, and firms must keep reviewing, mapping, testing and improving their resilience as part of normal business.
How often should important business services and impact tolerances be reviewed?
The FCA requires a review at least once a year and whenever there is a material change to the firm’s business or the market it operates in. The PRA expects regular board approval. Many firms also review mapping whenever a supplier or system supporting an important business service changes.
What is a severe but plausible scenario?
It is a disruption that is extreme but could realistically happen, such as a ransomware attack, the loss of a data centre or cloud region, the failure of a key supplier or the corruption of critical data. Firms choose scenarios based on their own services and dependencies and test whether they would stay within impact tolerance.
Does DORA apply to UK firms?
DORA does not apply to UK entities as such, because it is EU law. It does apply to EU-regulated subsidiaries of UK groups, and UK providers of ICT services to EU financial entities will face DORA-driven contract terms and oversight. Groups operating in both regimes benefit from shared underlying records.
Who approves the self-assessment?
The board or equivalent governing body must approve and regularly review the self-assessment, along with the firm’s important business services and impact tolerances. A named senior manager is usually accountable for operational resilience under the Senior Managers Regime.
Do critical third parties reduce a firm’s own obligations?
No. The critical third parties regime lets UK regulators oversee designated providers directly, but firms remain responsible for managing their own outsourcing and third-party risk and for staying within their impact tolerances.
Keeping operational resilience current
The March 2025 deadline moved UK operational resilience from building the framework to proving it works. Firms that keep important business services, impact tolerances, mapping, testing and remediation linked and up to date will find each annual self-assessment simpler, and will be better placed for incident reporting changes and, where relevant, DORA. The FCA’s operational resilience pages are a useful place to check for updates.
For help organising your operational resilience records, contact us or book a demo or start your 14-day free trial.
This article is for general information and is not legal advice.
