Operational resilience

Operational resilience is a firm's ability to keep delivering its most important services through a severe but plausible disruption, and to restore them before the harm becomes intolerable. It moves the supervisory question from whether each system can fail to whether the service a customer or market depends on survives when one does. The Basel Committee's Principles for operational resilience (31 March 2021) set the international baseline, aiming to strengthen banks' ability to withstand events such as pandemics, cyber incidents, technology failures and natural disasters.

The UK turned the idea into dated rules. Under the FCA's PS21/3 and the PRA's supervisory statement SS1/21, in-scope firms had to identify their important business services and set an impact tolerance for each, "the maximum tolerable disruption," by 31 March 2022. They then had to map the people, processes, technology and suppliers behind each service and test it against severe scenarios, and the deadline to show they can stay within those tolerances passed on 31 March 2025. In the EU, DORA has applied since 17 January 2025 and covers the ICT layer of the same problem: ICT risk management, incident reporting, resilience testing and third-party risk.

Resilience also depends on seeing change coming. The FCA's operational resilience observations (May 2024) tie horizon scanning, to understand new and emerging risks and the proximity of their impact, to keeping testing appropriate and controls in place. In practice that makes the scenario library and the service mapping living documents: a new outsourcing arrangement, a regulatory change or a supplier incident should trigger a review, and the review itself becomes evidence. The article on FCA horizon scanning expectations shows how supervisors connect the two.

This entry is general information, not legal advice.