UK Operational Resilience for Dual-Regulated Firms

A dual-regulated firm in the UK is subject to both FCA and PRA operational resilience expectations, and it needs to satisfy both through work that is coherent across the firm. In practice, that means a single, well governed account of important business services, impact tolerances, maps, scenario tests and self-assessment, prepared in a way that addresses the expectations of both regulators, rather than two disconnected programmes that describe the same services differently. The firm identifies its important business services once, sets tolerances that both regulators can examine, maps the resources supporting each service, tests those services severely, and records a self-assessment that reflects challenge from both regulatory perspectives.

Coherence does not mean that differences between the regulators disappear. The FCA and PRA have their own policy statements, supervisory approaches and areas of emphasis, even though they share the service based approach. A dual-regulated firm therefore needs to understand where the regulators align and where their expectations differ in emphasis, and to ensure that its documentation addresses both. A self-assessment written only for one regulator, and presented to the other without considering the second regulator perspective, risks missing an expectation that the second regulator regards as central.

Dual regulation changes the work because the firm faces two supervisory relationships, each with its own engagement, questions and follow up. A service that is important from a conduct perspective, because its disruption harms retail customers, may also be important from a prudential perspective, because its disruption threatens the safety and soundness of the firm or the wider system. The same service may therefore be examined through two lenses, and the firm's account needs to speak to both forms of harm. A service list that captures only customer harm, or only prudential harm, may be incomplete for a dual-regulated firm.

One account can serve both regulators when it is organised by service, with tolerances, maps and test results stated clearly for each service, and with governance and challenge recorded in a way that both regulators can follow. The account should not be organised by regulator, with separate chapters that describe the same service differently, because that structure invites inconsistency. Instead, the service analysis should be shared, and any regulator specific emphasis should be addressed within that shared analysis, for example by ensuring that harm reasoning covers both customer harm and prudential harm where both are relevant.

In practice, coordination means aligning timetables for identification, mapping, testing and self-assessment so that both regulators receive a coherent account, rather than fragments produced at different times for different purposes. It means coordinating scenario testing so that a service is not tested twice in incompatible ways, while still ensuring that scenarios address both conduct and prudential vulnerabilities. It also means coordinating remediation, so that an action arising from testing is owned once, tracked once, and reported consistently, rather than being tracked separately by different teams with different closure criteria.

One recurring mistake is to run two programmes in parallel, each producing its own service list and tolerances, so that the firm has two versions of the truth for the same service. Supervisory engagement then becomes an exercise in reconciling documents, rather than a discussion of resilience. Another mistake is to assume that satisfying one regulator automatically satisfies the other, on the reasoning that the regimes are similar. Similarity of approach does not mean the expectations are identical, and an assumption of automatic satisfaction may leave a gap that only the second regulator notices.

Dual-regulated work can be checked by asking whether the service list, tolerances, maps and test results are consistent wherever they appear, whether harm reasoning covers both customer and prudential perspectives where relevant, and whether challenge from both perspectives is visible in the record. A reader can also ask whether remediation actions are owned once and tracked consistently, and whether the self-assessment can be read as a single account rather than as two accounts bound together. Inconsistency, duplication or regulator specific silos each suggest that coordination has not yet been achieved.

This guide describes dual regulation in general educational terms. It does not assess any particular firm, and it does not replace FCA and PRA policy statements or supervisory guidance for firms working out how dual regulation applies to their own structure. Firms also subject to DORA should keep that regime separate, as described in the comparison guide in this cluster, rather than merging DORA work into the UK dual-regulated account.