The UK operational resilience framework at a glance
Operational resilience is the ability of firms and the wider financial sector to prevent, adapt to, respond to, recover from and learn from operational disruption.
The FCA's operational resilience rules arising from PS21/3 and the PRA's expectations in SS1/21 took effect on 31 March 2022. A three-year transition period ended on 31 March 2025. By that date, firms in scope were required to have completed sufficient mapping and testing to demonstrate that they could remain within their impact tolerances for each important business service during severe but plausible disruption.
Operational resilience is now a business-as-usual regulatory obligation rather than a transformation deadline. Firms are expected to continue reviewing their important business services, impact tolerances, mapping, scenario testing and identified vulnerabilities as their businesses, technology, suppliers and risk environment change.
Boards and governing bodies have an important oversight role. Important business services and impact tolerances need appropriate approval and review, supported by scenario testing, mapping and a credible self-assessment showing how the firm remains within tolerance and how identified vulnerabilities are being managed. The PRA specifically requires boards to approve and regularly review important business services, impact tolerances and the written self-assessment.
Identifying important business services
For FCA purposes, an important business service is a service provided to one or more clients which, if disrupted, could cause intolerable levels of harm to clients or pose a risk to the soundness, stability or resilience of the UK financial system or the orderly operation of financial markets.
The service should be defined from the outside in, around the outcome delivered to the customer, counterparty or other identifiable external user, rather than around the internal application or technology used to provide it. The PRA similarly distinguishes important business services from internal systems and business lines.
Common examples may include making payments, executing trades, processing insurance claims and providing access to funds. The actual services identified will depend on the firm's business model, customers and role within the financial system.
A useful discipline is for the firm to be able to explain clearly what outcome each service provides, who relies upon it and what harm could arise if that outcome became unavailable.
Setting and evidencing impact tolerances
An impact tolerance represents the maximum tolerable level of disruption to an important business service.
Time is fundamental: the PRA requires impact tolerances to include a time-based metric. However, time should not necessarily be the only measure. Depending on the service, firms should consider additional metrics such as the number of affected customers, transaction volumes or values, financial loss, loss of access and the confidentiality, integrity or availability of data.
Impact tolerances should be set at the point beyond which further disruption would create intolerable harm or the relevant prudential or market impact, rather than simply the point at which disruption becomes inconvenient.
Firms must be able to remain within their tolerances during severe but plausible disruption. Scenario testing should therefore test meaningful operational failure, including technology outages, cyber incidents, third-party disruption and the loss of key people or facilities where relevant. Lessons learned should feed directly into vulnerability management and remediation.
Mapping people, processes, technology and third parties
Each important business service depends upon a chain of resources that may include people, processes, applications, data, infrastructure, facilities and third parties.
Mapping should be performed to the level of detail necessary to identify vulnerabilities and support meaningful scenario testing. The PRA explicitly expects firms to map resources needed to provide important business services whether those resources are provided internally, by another group company or by an external third party.
Mature organisations will often connect operational-resilience mapping with sources such as configuration-management information, application inventories, workforce dependencies and third-party registers. This is good practice rather than a specific requirement to use a particular technology such as a CMDB.
The objective is a sufficiently current view of dependencies to identify single points of failure, common dependencies, concentration risk and recovery constraints, and to support evidence-based investment decisions.
DORA applicability and readiness for UK-headquartered firms
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025. It applies to the categories of EU financial entities specified by DORA and establishes a framework covering ICT risk, incidents, testing and ICT third-party dependencies.
A UK-headquartered organisation is not automatically directly subject to DORA merely because it conducts cross-border business. UK groups should assess their position where they have EU-authorised subsidiaries or EU branches to which DORA applies. The European Commission has confirmed, for example, that DORA applies to relevant third-country branches of credit institutions and insurance and reinsurance undertakings within the EU.
UK-based ICT providers serving EU financial entities may also face DORA-derived contractual and assurance requirements because the EU financial entity remains responsible for ensuring that its third-party arrangements do not prevent DORA compliance. Critical ICT third-party providers can additionally fall within DORA's direct oversight framework.
DORA is commonly considered across five areas: ICT risk management; ICT-related incident management and reporting; digital operational resilience testing; ICT third-party risk management; and voluntary information and intelligence sharing.
UK firms with a DORA nexus should map their UK operational-resilience framework to DORA rather than assume equivalence. Particular attention should be given to the register of information, ICT contractual requirements, incident classification and reporting and, for firms identified as subject to the requirement, threat-led penetration testing. DORA TLPT is not a universal requirement for every financial entity.
Third-party and ICT concentration risk
Third-party dependency is a significant operational-resilience risk. FCA data shows that third-party issues have represented a substantial proportion of reported operational incidents and were the leading cause of incidents reported to the FCA between 2022 and 2023. More recent FCA reporting also shows that more than 40% of cyber incidents reported in 2025 involved a third party, and the FCA has pointed to high-profile disruptions such as the Cloudflare and AWS outages as examples of how a single provider failure can affect many firms at once.
Firms remain responsible for managing the risks created by their outsourcing and third-party arrangements. This includes appropriate due diligence, contractual controls, ongoing monitoring, resilience testing and, where relevant, credible business continuity and exit strategies.
For PRA-regulated firms, material outsourcing arrangements should include documented exit strategies covering both planned and stressed exits, with appropriate testing.
From 18 March 2027, in-scope firms will also need to notify the regulators of material third-party arrangements and maintain a material third-party register under PS26/2 and PS7/26. Importantly, the new rules cover both material outsourcing and material non-outsourcing arrangements. An arrangement is material where its disruption or failure could cause intolerable harm to clients, pose a risk to the soundness, stability, resilience, confidence or integrity of the UK financial system, or cast serious doubt on the firm's ability to meet its threshold conditions, the Principles or SYSC 15A. FG26/4 sets out how to assess materiality and complete the register templates.
The UK's Critical Third Parties regime now provides direct regulatory oversight of certain providers whose disruption could threaten UK financial stability or confidence in the financial system. The first four designated CTPs (Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited) entered joint Bank of England, PRA and FCA oversight on 13 July 2026.
Designation of a provider does not transfer responsibility away from the regulated firm. Firms remain responsible for managing their own third-party dependencies and operational resilience.
Emerging technology is adding a further dimension. In June 2026 the FCA added guidance and resources on frontier AI to its operational resilience materials. Firms adopting advanced AI models, often supplied by a small number of third-party providers, should consider how those dependencies affect important business services, concentration risk, cyber exposure and their ability to remain within impact tolerances.
Cyber incident response and regulatory reporting
A resilient firm is not one that assumes incidents can always be prevented, but one that can respond, recover and continue delivering important business services without exceeding its impact tolerances.
Incident playbooks should therefore address relevant severe but plausible events such as ransomware, destructive cyber attacks, data loss, third-party failure, major technology outages and insider events, with clear decision rights, escalation paths, communications arrangements and regulatory notification triggers.
Under DORA, a major ICT-related incident must be notified as early as possible and, in any event, within four hours of classification as major and no later than 24 hours after the financial entity became aware of the incident. The intermediate report is generally required within 72 hours of the initial notification and the final report no later than one month after the intermediate report, subject to the detailed rules.
For UK firms, FCA Principle 11 and SUP 15 currently establish important notification requirements. PRA-regulated firms also need to consider PRA Fundamental Rule 7 and the General Notification Requirements in the PRA Rulebook. Where a personal data breach meets the applicable threshold, notification to the ICO is generally required within 72 hours of awareness.
There is also an important forthcoming change. On 18 March 2026 the FCA published PS26/2 (Operational Incident and Third Party Reporting), with supporting guidance FG26/3 on operational incident reporting and FG26/4 on material third-party reporting, and the PRA published PS7/26 alongside SS1/26. The new rules come into force on 18 March 2027.
The new regime introduces a single reporting portal shared by the FCA, PRA and Bank of England, removes duplicative incident reporting for payment service providers and credit rating agencies, and sets clearer thresholds and definitions. Firms fall into two tiers: standard reporting firms (most firms with a Part 4A permission, many of which can use a short-form report) and enhanced reporting firms, including banks, building societies, designated investment firms, Solvency II firms, enhanced-scope SMCR firms, CASS large firms, payment service providers and UK RIEs. Firms should be preparing their classification criteria, data, templates and governance for the new regime now.
Board reporting and self-assessment
Boards need a concise and comparable view of operational resilience covering important business services, impact tolerances, scenario-test outcomes, current vulnerabilities, key third-party dependencies, incidents and remediation progress.
FCA rules require firms to make and keep up to date a written self-assessment of compliance, including their important business services, impact tolerances, mapping, testing, vulnerabilities, remediation actions and communications strategy. Records must be retained for at least six years and supplied to the FCA on request.
Important business services, impact tolerances and mapping must be reviewed when there is a material change and, in any event, no later than one year after the previous assessment. The PRA similarly expects important business services to be reviewed at least annually, with boards regularly reviewing the written self-assessment.
The strongest self-assessments are evidence-led and candid about residual vulnerabilities. They identify clear owners, investment requirements and completion dates, and demonstrate through subsequent testing that remediation has actually improved the firm's ability to remain within tolerance.