UK Regime for Small Firms

Small firms subject to the UK regime face the same outcome expectation as larger firms: for each important business service, the firm should be able to show its tolerance, its map, its scenario testing and its self-assessment. Proportionality does not mean exemption, and it does not mean a lower standard of harm protection for users of a small firm service. It means that the work is scaled to the firm's services, its complexity and its dependencies, so that a firm with a small number of services produces a focused account for those services, rather than a large programme designed for a firm with many services. A small firm with a single critical service may therefore have a short self-assessment, but that assessment still needs to address tolerance, mapping, testing and gaps for that service.

That distinction is important, because small firms sometimes misread proportionality as permission to produce a generic resilience statement. A generic statement that does not name services, state tolerances or record test findings does not meet the regime, however small the firm. Conversely, a focused, service specific account, written in plain language and owned by senior management, can meet the regime without the layers of programme governance that a larger firm might require. Scale changes the form of the work, not its service based logic.

Scale changes the work mainly through the number and complexity of services. A small firm may offer a narrow range of services, through a small number of channels, with a small number of systems and suppliers. Its service list may therefore be short, its maps may be simpler, and its scenario testing may involve fewer participants. That simplicity is an advantage, provided it reflects reality rather than omission. A small firm should still be able to trace each service end to end, including supplier steps, and to test a scenario that threatens its tolerance, even if the test is run as a focused exercise with a small team.

Supplier dependence often matters more for small firms, because a small firm may rely on a single supplier for a step that is critical to a service, such as payment processing, hosting, or a specialist system. That dependence concentrates risk: failure of the supplier may stop the service entirely, and the small firm may have limited leverage to demand resilience information, testing participation or alternative arrangements from the supplier. Mapping therefore needs to be particularly clear about supplier dependencies, and scenario testing needs to consider supplier failure explicitly, even where the supplier cannot participate directly in the exercise.

Small firms face particular people risks, because knowledge of a service, a workaround or a recovery procedure may sit with a very small number of individuals. If a key individual is unavailable during disruption, recovery may stall, even where technology and suppliers remain available. Mapping should therefore capture people dependencies explicitly, including specialist knowledge, decision authority and manual workaround capability. Scenario testing should consider unavailability of key individuals, not only technology failure, and should test whether a second person can find the map, the tolerance and the recovery sequence and act on them.

A recurring mistake is to copy a large firm template and present it as a small firm self-assessment, with service lists, tolerances and tests that do not reflect the firm's actual services. A copied template may look comprehensive, but it will fail under questioning about a named service, because its content was not derived from that service. Another mistake is to treat proportionality as a reason to omit testing, on the grounds that the firm is small or its services are simple. Simplicity does not remove the need to test whether a service would remain within tolerance under a severe but plausible scenario.

Small firm work can be checked with the same service questions as larger firm work, applied proportionately: can the firm name its important business services, state a tolerance for each, show a map that includes suppliers and people, describe testing that threatened the tolerance, and record gaps with owned actions? A short, focused account that answers those questions for each service is stronger than a long, generic account that answers none of them. A reader should not expect the same volume of documentation as from a large firm, but should expect the same clarity about services and harm.

This guide describes the UK regime for small firms in general educational terms. It does not assess any particular firm, and it does not replace FCA and PRA policy statements or supervisory guidance. Small firms also subject to DORA should keep that regime separate, as described in the comparison guide, rather than assuming that UK proportionality or DORA arrangements automatically satisfy the other regime.