The prudential side
SS1/21: the PRA's operational resilience expectations
SS1/21 is the PRA supervisory statement 'Operational resilience: Impact tolerances for important business services', published in March 2021. It tells banks, building societies, designated investment firms and insurers how the PRA expects them to identify important business services, set impact tolerances and stay within them through severe but plausible disruption. It has applied in full since 31 March 2025.
Reviewed July 2026 against SS1/21 and the January 2026 supervision priorities.
The document
What SS1/21 asks of the firms the PRA regulates
A supervisory statement records how the PRA expects firms to meet their obligations, and supervisors assess against it directly. SS1/21 is the operational resilience one: identify the business services whose disruption would matter, set an impact tolerance for each, map the resources beneath them, then test against severe but plausible scenarios until the firm can show, not merely argue, that it stays within tolerance. The original statement is published on the Bank of England's website.
Since the transition closed on 31 March 2025, none of this is preparatory. The PRA now supervises against the finished expectation, and its 2026 priorities letters make clear where it intends to press hardest.
Two regulators, one programme
How the PRA's expectations differ from the FCA's
Dual-regulated firms comply once and evidence twice. The framework is shared; what differs is the harm each regulator is protecting against, and therefore where each expects your tolerances to sit. The conduct half is covered on our FCA operational resilience hub.
| Dimension | PRA (SS1/21) | FCA (PS21/3) |
|---|---|---|
| Where it is written | Supervisory statement SS1/21 sets the PRA's expectations for the firms it prudentially regulates. | Policy statement PS21/3 made binding rules, which sit in the FCA Handbook at SYSC 15A. |
| The harm it targets | Safety and soundness of the firm, and by extension the stability of the financial system it sits in. | Intolerable harm to consumers and damage to the integrity of UK markets. |
| Impact tolerances | A tolerance for the point at which disruption threatens the firm's viability or wider stability. | A tolerance for the point at which disruption causes intolerable harm to clients or markets. |
| Shared machinery | Important business services, impact tolerances, mapping, severe but plausible scenario testing and a self-assessment. | The same five building blocks, deliberately aligned so one programme serves both regulators. |
The tolerance question
One service, two lenses on the same tolerance
This is where dual-regulated firms most often stumble. For a given important business service, the PRA wants to know how long disruption can run before it threatens the firm's safety and soundness; the FCA wants to know when it starts causing intolerable harm to consumers or markets. Those are different questions, and they can produce different numbers for the same service. Where they do, the firm holds both and manages to the tighter one.
Getting the rationale for each figure onto paper, in language a supervisor can follow from harm to number, is most of the work. Our guide to impact tolerances and important business services works through how to set tolerances that hold up under questioning.
The 2026 agenda
What the PRA's 2026 supervision priorities demand
The PRA set out its insurance supervision priorities on 15 January 2026, and the Bank of England published a parallel letter for international banks. Four themes matter for resilience programmes this year.
Deeper scenario testing with critical third parties
The insurance supervision priorities of 15 January 2026 ask for scenario testing that reaches into the critical third parties a service depends on, rather than stopping at the firm's own perimeter. Joint exercises with key suppliers are the direction of travel.
How we run scenario exercisesReliance on AI
The same letter flags reliance on AI within firms' operations as a supervisory concern. Where AI sits behind an important business service, expect questions about how that dependency is mapped, governed and tested like any other.
Mapping what services depend onSolvent exit analysis
Insurers were reminded that solvent exit analysis is due by 30 June 2026, sitting alongside operational resilience in the same supervisory conversation about whether the firm could wind down in an orderly way.
The conduct side of the regimeCBEST and STAR-FS for banks
The Bank of England's priorities for international banks reiterate its threat-led testing programmes, CBEST and the lighter STAR-FS, as the expected route for proving resilience against realistic attack scenarios.
CBEST and STAR-FS explainedPhases and proof
The regime in phases, and the evidence that satisfies it
Every milestone below is behind us, which is the point: supervision now judges the standing capability, not progress towards it. What convinces a PRA supervisor is a chain that runs from each important business service, through its tolerance and its map, to test results and remediation records, without gaps a reader has to take on trust.
| Phase | Date | What changed |
|---|---|---|
| Policy | March 2021 | The PRA published SS1/21, alongside the FCA's PS21/3, establishing the shared framework of important business services and impact tolerances. |
| Expectations in force | 31 March 2022 | Firms had to have identified their important business services, set impact tolerances and started mapping and scenario testing. |
| Transition ends | 31 March 2025 | The build period closed. PRA-regulated firms must now be able to remain within their impact tolerances through severe but plausible disruption. |
| Ongoing supervision | 2026 onwards | Supervision priorities published on 15 January 2026 for insurers, and the Bank's parallel letter for international banks, set the current agenda: third-party testing depth, AI reliance and threat-led testing. |
The testing themes above land as engagements we run at fixed fees: scenario testing exercises for the third-party depth the 2026 letters ask for, and CBEST and STAR-FS preparation for firms facing threat-led testing.
Common questions
SS1/21 in three answers
What is SS1/21?
SS1/21 is the PRA supervisory statement on operational resilience, published in March 2021 under the title 'Operational resilience: Impact tolerances for important business services'. It sets out how PRA-regulated firms are expected to identify their important business services, set impact tolerances and prove they can stay within them. Those expectations have applied in full since the transition ended on 31 March 2025.
Does SS1/21 apply to insurers?
Yes. SS1/21 covers the firms the PRA prudentially regulates, which includes insurers alongside banks, building societies and PRA-designated investment firms. Insurers also carry the most specific 2026 supervisory agenda: the January 2026 priorities letter asks for deeper scenario testing involving critical third parties, scrutiny of AI reliance, and solvent exit analysis by 30 June 2026.
How do the PRA and FCA operational resilience regimes differ?
They share the same machinery but pursue different harms. The PRA cares about the safety and soundness of the firm and the stability of the system, so its impact tolerances mark the point where disruption threatens viability. The FCA cares about consumers and market integrity, so its tolerances mark the point of intolerable client harm. A dual-regulated firm builds one programme, sets tolerances against both lenses where they diverge, and evidences compliance to each supervisor.
Two supervisors, one story
Make your evidence work for the PRA and the FCA at once
Bring us your current tolerances and testing record. We will tell you where the prudential lens exposes gaps the conduct lens missed, and what closing them would cost.