The FCA regime
FCA operational resilience, from rules to evidence
The FCA's operational resilience rules have applied in full since 31 March 2025. Firms are expected to know their important business services, hold an impact tolerance for each, and demonstrate through severe but plausible scenario testing that they can stay within those tolerances. This page sets out the requirements, what the FCA's 2026 review found, and where fixed-fee support fits.
Reviewed July 2026 against the FCA's current rules and its March 2026 review.
Where the regime stands
The transition is over. Evidence is the whole game now.
UK operational resilience regulation reached its final form on 31 March 2025, when the transition period closed. Until that date, a credible roadmap was an acceptable answer to a supervisor. It no longer is. A firm in scope must today be able to show, with test results rather than intentions, that each of its important business services can keep operating within its impact tolerance through severe but plausible disruption.
The rules themselves were made in policy statement PS21/3 and live in the FCA Handbook at SYSC 15A. The regulator maintains its own overview on the FCA's operational resilience page. If the vocabulary is new to you, start with what operational resilience actually means and come back; this page assumes the basics.
The requirements
FCA operational resilience requirements, in six obligations
The framework reduces to six connected obligations. Each one feeds the next, which is why a weak service list or a vague tolerance quietly undermines everything downstream of it. The detailed rule text sits in SYSC 15A; our PS21/3 guide walks through it section by section.
Identify important business services
Work out which of your services would, if disrupted, cause intolerable harm to clients or put market integrity at risk. Everything else in the regime hangs off this list, and supervisors read it first.
Set impact tolerances
For each important business service, state the maximum disruption you could bear before the harm becomes intolerable, usually expressed as a duration and often paired with volume or value limits.
Map the resources behind each service
Document the people, processes, technology, facilities and third parties each important business service depends on, at a depth that shows where a disruption would actually bite.
Run scenario testing
Test your ability to remain within each impact tolerance under severe but plausible disruption, and record what the tests showed rather than what the plans promised.
Keep a written self-assessment
Maintain a document that records your services, tolerances, mapping, testing and vulnerabilities, keeps pace with change, and can be handed to the FCA on request.
Remediate vulnerabilities
Where mapping or testing exposes a weakness that could push you outside a tolerance, invest to fix it. Since the end of the transition, firms are expected to be able to stay within tolerances, not just plan to.
One year on
What the FCA's 2026 review found
On 27 March 2026 the FCA published its insights and observations on the first year of the fully applied regime. It is the closest thing firms have to a marking scheme, because it names the patterns supervisors kept finding and, by implication, what they will look for next.
| What the review found | What it means for your firm |
|---|---|
| Third-party mapping was incomplete | Mapping that stops at the contract boundary no longer passes. Firms are expected to map supplier dependencies deeply enough to show which third parties a tolerance breach would actually run through, and to test with those suppliers rather than around them. |
| Scenario testing was not severe enough | Comfortable scenarios that firms know they can pass tell supervisors nothing. Tests should be genuinely severe but plausible, and the most useful ones push a service to the point where the tolerance breaks, so you learn where the real limit sits. |
| Self-assessments had not been updated since the deadline | A self-assessment frozen at 31 March 2025 reads as a compliance artefact, not a living record. The document should move when the business moves: new services, new suppliers, new test results, new vulnerabilities. |
| Recovery claims were not evidenced | Asserting that a service can be restored within tolerance is not the same as demonstrating it. Every recovery claim in the self-assessment should trace back to a test, an exercise or a real incident that proves it. |
The regime in phases
How the regime got here, and where it is going
There is no future deadline to chase. The useful way to read the timeline is as a shift in what supervisors ask for: first policy, then structures, now evidence.
| Phase | Date | What changed |
|---|---|---|
| Policy | March 2021 | The FCA published policy statement PS21/3, Building operational resilience, setting out the regime alongside the PRA's parallel expectations. |
| Rules in force | 31 March 2022 | The rules took effect. Firms had to have identified their important business services, set impact tolerances and started mapping and scenario testing. |
| Transition ends | 31 March 2025 | The three-year transition closed. From this date firms must be able to remain within their impact tolerances for each important business service. |
| Ongoing supervision | 2026 onwards | The regime is now business as usual. The FCA published its insights and observations review on 27 March 2026, and supervision continues against those findings. |
Dual-regulated firms run this alongside the PRA's expectations in SS1/21, which pursue safety and soundness rather than consumer harm. Firms serving EU clients may also sit inside DORA, a second regime with its own evidence demands.
Where we help
Fixed-fee help with the gaps the FCA is finding
Each engagement below targets one of the weaknesses the 2026 review named, is scoped in writing before we start, and carries a published fee. Every figure sits on our pricing page before you speak to anyone.
Self-assessment review
We review your self-assessment against the FCA's expectations and the 2026 findings inside the Resilience Gap Analysis, and give you a written gap report with the fixes ranked. Fixed at £8,990 to £16,780 by scope.
About the self-assessmentImpact tolerance workshop
We facilitate the sessions that settle your important business services and set tolerances your board can defend to a supervisor, with worked rationale for each figure.
Impact tolerances explainedScenario testing exercises
We design and run severe but plausible scenarios against your tolerances and hand you the evidence pack, which is precisely what the 2026 review found missing.
How scenario testing worksCommon questions
FCA operational resilience, asked and answered
Who do the FCA's operational resilience rules apply to?
Banks, building societies, PRA-designated investment firms, insurers, recognised investment exchanges, enhanced scope SMCR firms, and payments and e-money firms. Dual-regulated firms answer to the PRA's parallel expectations in SS1/21 at the same time, so one programme has to satisfy two supervisors.
What are firms expected to have in place now?
Since 31 March 2025, the full set: identified important business services, an impact tolerance for each, resource mapping deep enough to expose vulnerabilities, scenario testing that proves the firm can stay within its tolerances, a current written self-assessment, and remediation of any weakness the testing surfaced. The transition is over, so plans to get there no longer count as compliance.
What did the FCA's 2026 review criticise?
The insights and observations review of 27 March 2026 called out four recurring weaknesses: third-party dependencies mapped incompletely, scenario testing that was not severe enough to be informative, self-assessments left untouched since the March 2025 deadline, and recovery capabilities asserted without evidence to back them.
Before the supervisor asks
Know where your evidence falls short
A scoping call costs nothing. Tell us where your programme stands and we will say plainly which of the 2026 findings would stick to it, and what fixing each one involves.