The policy statement
PS21/3, explained and evidenced
PS21/3 is the FCA policy statement 'Building operational resilience', published in March 2021. It made the rules, now in the FCA Handbook at SYSC 15A, requiring in-scope firms to identify important business services, set impact tolerances and prove they can stay within them. Its transition period ended on 31 March 2025, so it applies in full today.
Reviewed July 2026 against the FCA Handbook and the March 2026 review findings.
Scope
Who PS21/3 applies to
The policy statement targets firms whose disruption could hurt consumers or markets at scale, rather than the whole regulated population. If your firm appears in the list opposite, the regime applies, and the size of your resilience programme is expected to be proportionate to the harm your services could cause, not to your headcount.
Dual-regulated firms, meaning most banks and insurers, meet PS21/3 and the PRA's SS1/21 together. The wider context, including the 2026 review and the rest of the regime, lives on our FCA operational resilience hub.
In scope
- Banks and building societies
- PRA-designated investment firms
- Insurers
- Recognised investment exchanges (RIEs)
- Enhanced scope SMCR firms
- Payments and e-money firms
Outside these categories the rules do not bite, though clients and counterparties increasingly expect the same discipline anyway.
The substance
What PS21/3 requires, section by section
Six building blocks make up the policy, and they are sequential by design: you cannot set a sensible tolerance for a service you have not identified, or test a dependency you have not mapped.
| Requirement | What the policy asks of firms |
|---|---|
| Important business services | Identify the services that, if disrupted, could cause intolerable harm to clients or damage market integrity. The policy statement is deliberate about the word services: supervisors want the client-facing outcome, not the internal system behind it. |
| Impact tolerances | Set, for each important business service, the maximum tolerable level of disruption, typically a duration, sometimes combined with volume or value measures. The tolerance is a hard line, not an aspiration. |
| Mapping | Trace each service to the people, processes, technology, facilities and third parties it depends on, in enough detail to see where a failure would breach the tolerance. |
| Scenario testing | Test the firm's ability to remain within each tolerance under severe but plausible scenarios, and treat what the tests reveal as the finding, not the pass mark. |
| Self-assessment | Keep a written self-assessment recording the services, tolerances, mapping, testing and identified vulnerabilities, ready to hand to the FCA on request. |
| Vulnerability remediation | Act on what mapping and testing expose. Since the end of the transition on 31 March 2025, firms must be able to remain within their tolerances, which makes unremediated known weaknesses hard to defend. |
Document, rulebook, twin
PS21/3, SYSC 15A and SS1/21: which does what
A point that trips up plenty of compliance searches: PS21/3 is the policy statement, the document in which the FCA confirmed its final position and reasoning. The enforceable rules it created live in the Handbook, in chapter SYSC 15A. When a policy or an auditor cites the binding requirement, SYSC 15A is the correct reference; PS21/3 is where you go to understand why the rule says what it says.
The PRA published its parallel expectations at the same time as supervisory statement SS1/21. The two regulators deliberately aligned the core concepts, important business services, impact tolerances, mapping and testing, so a dual-regulated firm builds one programme and presents it to two supervisors with different priorities.
The timeline
From policy to business as usual
Every date in PS21/3 has now passed. What remains is the standing obligation, and a supervisory cycle that has started publishing what it finds.
| Phase | Date | What changed |
|---|---|---|
| Policy | March 2021 | PS21/3 published, confirming the final rules after consultation and setting the two dates below. |
| Rules in force | 31 March 2022 | SYSC 15A took effect. Firms had to have identified important business services, set impact tolerances and begun mapping and testing. |
| Transition ends | 31 March 2025 | The period PS21/3 allowed for firms to build the capability closed. Remaining within impact tolerances became the operating requirement. |
| Ongoing supervision | 2026 onwards | The FCA's insights and observations review, published 27 March 2026, set out how firms performed in year one and where supervision is now focused. |
Proving it
How firms evidence PS21/3 compliance today
The self-assessment is the document that carries the whole case. Done well, it links each important business service to its tolerance, its map, the tests run against it, what those tests found and what was fixed as a result. The FCA's March 2026 review showed where that chain most often breaks, and the four gaps below are now the predictable lines of supervisory questioning.
Our guide to the operational resilience self-assessment covers structure and evidence in detail, and the review of your existing document runs inside the Resilience Gap Analysis, £8,990 to £16,780 fixed by scope.
Third-party mapping stops too early
Dependencies on suppliers were mapped to the contract and no further. Evidence should show which third parties each tolerance actually rests on.
Testing that could not fail
Scenarios were chosen that firms already knew they would pass. The review expects severity that generates findings, not reassurance.
Self-assessments left to age
Documents untouched since March 2025 signal a programme that stopped at the deadline. The self-assessment should reflect the firm as it is now.
Recovery asserted, not demonstrated
Claims that a service can be restored within tolerance appeared without supporting test results. Each claim needs an exercise or incident behind it.
Common questions
PS21/3 in three answers
Who does PS21/3 apply to?
Banks, building societies, PRA-designated investment firms, insurers, recognised investment exchanges, enhanced scope SMCR firms, and payments and e-money firms. If your firm is dual-regulated, the PRA's supervisory statement SS1/21 applies in parallel, and the two are designed to be met by one coherent programme.
Is PS21/3 still in force?
Yes, fully. The rules it made took effect on 31 March 2022, and the transition period it allowed ended on 31 March 2025. Nothing about it is pending or approaching: firms in scope are expected to comply in full today, and the FCA reviewed how well they were doing in March 2026.
What is the difference between PS21/3 and SS1/21?
PS21/3 is the FCA's policy statement and made the rules that sit in SYSC 15A of the FCA Handbook. SS1/21 is the PRA's supervisory statement, setting parallel expectations for the firms it prudentially regulates, with a focus on safety and soundness rather than harm to consumers and markets. Dual-regulated firms answer to both.
From policy to proof
Would your self-assessment survive a supervisor?
Send us nothing yet. A short call is enough to tell you whether a review of your self-assessment would earn its fee, and which of the 2026 findings we would check for first.