FCA and PRA Operational Resilience Regime

Under the UK regime, a firm subject to FCA or PRA operational resilience rules starts from the services its customers and the wider market rely on, not from its systems or its control catalogue. The firm names those important business services, sets an impact tolerance for each one, maps the people, processes, technology, facilities and third parties that support each service, tests the service against severe but plausible disruption scenarios, and records a self-assessment of whether it could remain within tolerance. That sequence is the core of the UK regime, and it is distinct from other regimes that use different concepts, documents and tests.

The regime is labelled UK throughout this guide because its source is the FCA and PRA policy statements published in March 2021, and its timetable is a UK timetable. Firms identified important business services and set impact tolerances by 31 March 2022, and were to remain within tolerance for severe but plausible scenarios by 31 March 2025. A reader who treats those expectations as interchangeable with another regime will miss the point of the UK approach, which judges resilience by the outcome for a named service during disruption, rather than by the completeness of a general control framework alone.

The UK approach turns the usual order of resilience work around. Instead of asking whether controls exist in general, it asks what happens to a particular service when something goes wrong, how much disruption users of that service could bear before harm becomes intolerable, and what would have to keep working, or be restored, for the service to stay within that limit. A payments service, a mortgage servicing operation and a customer access channel therefore each receive their own analysis, even when they share underlying technology. Shared technology matters, but it is assessed through the lens of each service that depends on it.

Identification comes first, because tolerance, mapping and testing all need a defined service to work on. Once a service is identified, its tolerance states the point beyond which disruption to that service would cause intolerable harm, expressed in terms that reflect how users experience the service, such as how long it is unavailable, how many users are affected, or whether data integrity is compromised. Mapping then traces every resource the service depends on, including dependencies that sit outside the firm, so that a single point of failure is visible before it fails in practice.

Consider a retail current account service that lets customers view balances, make payments and receive funds. Its users experience disruption as payments that do not arrive, balances that cannot be seen, or money that appears to be missing. The firm therefore describes the service from the customer perspective first, then maps the channel, the payment processing system, the data store, the fraud checking step and the settlement link, together with the teams that operate each element and the suppliers that support them. A tolerance for that service has to capture the customer harm of a stoppage, not merely the technical fact that a system is down.

A recurring weakness is the substitution of another regime for the UK regime. A firm, or an adviser writing for a firm, may import concepts, templates or answers developed for a different framework and present them as a UK self-assessment. The result reads smoothly but answers the wrong question, because the UK regime asks about a named service and its tolerance, while the imported material may be organised around systems, entities or control families. The pitfall named in this cluster, copying a DORA answer into a UK self-assessment or the reverse, is a version of that error, and it leaves neither regime properly addressed.

A credible UK account names its services in terms a customer would recognise, states a tolerance for each service that describes intolerable harm, and shows a map that reaches beyond internal systems to the people and third parties on which the service depends. It describes testing that was severe enough to expose failure, records where the service would breach tolerance, and sets out dated actions owned by named roles to address those breaches. Absence of any of those elements is informative in itself, because the regime is designed as a chain and a missing link breaks the chain.

This guide is educational only and describes the regime in general terms. It does not assess any particular firm, and it does not replace the FCA and PRA policy statements or supervisory guidance for a firm working out how the regime applies to its own services. The supporting guides in this cluster examine each element in turn: identifying services, setting tolerances, mapping, scenario testing and self-assessment, followed by guides on timetable, comparison with DORA, dual-regulated firms, supervision, implementation lessons, small firms, third parties, incident reporting, testing and governance.