Operational Resilience: The Regulatory Bar Keeps Rising

Regulatory expectations continue to rise, even when the underlying rules do not change. The FCA's latest operational resilience observations put the emphasis firmly on credible evidence, more meaningful measures of harm and firms' ability to sustain essential services through severe disruption.

1. FCA feedback: firms must demonstrate resilience in practice

On 11 November 2026, the FCA published Operational resilience: demonstrating resilience in practice, continuing its supervisory feedback on firms' self-assessments and implementation of the operational resilience framework. The March 2025 transition deadline was not the end of the journey: supervisors continue to scrutinise the quality of firms' implementation and the evidence behind their conclusions.

Its good and poor practice observations highlight six connected areas:

1. Important business services and impact tolerances. Firms need credible, harm-based tolerance setting and prioritisation; time alone may not capture the scale or consequences of disruption.
2. Mapping and dependencies. End-to-end mapping should reveal vulnerabilities, shared resources and material third-party, intra-group and downstream dependencies rather than merely document inventories.
3. Scenario testing. Severe but plausible tests must challenge assumptions, workarounds, recoverability and the ability to remain within tolerances.
4. Vulnerabilities and remediation. Identification and action plans are insufficient without prioritisation, implementation and evidence that weaknesses have actually been addressed.
5. Communications. Firms need effective, tested escalation and alternative communication arrangements, including for customers in vulnerable circumstances.
6. Governance and assurance. Boards need a realistic view of current resilience, limitations, residual vulnerabilities and the evidence supporting management's assessments.

These are supervisory observations, not a new set of rules. The recurring theme is the difference between having a framework and demonstrating that it would work when needed.

2. The regulatory bar continues to rise

As former regulators, this is an approach we know well. In supervising operational risk management, we explicitly used the phrase “raising the bar” to explain how supervisory expectations would evolve. The underlying rules and guidance might remain unchanged, but expectations concerning the sophistication, robustness and effectiveness of firms' risk management frameworks, controls and governance would continue to increase.

Establishing a framework and demonstrating initial compliance were never the end of the journey. Firms were expected to mature their capabilities, respond to emerging risks, learn from incidents and supervisory findings, and demonstrate increasingly effective risk management in practice.

We are now seeing the same approach applied to operational resilience. The initial challenge was to identify important business services, map dependencies, define impact tolerances and conduct scenario testing. The challenge now is to demonstrate that these arrangements genuinely protect customers and markets during severe disruption.

The rules may not have changed, but the bar for demonstrating compliance continues to rise.

Non-duration tolerances: from leading practice to wider supervisory expectation?

One particularly significant example is the increasing emphasis on non-duration impact tolerances. Historically, sophisticated measures of disruption—customer numbers, transaction volumes and values, and other measures of harm—were particularly associated with large and complex firms, including global systemically important financial institutions (G-SIFIs).

The FCA's feedback suggests a wider supervisory direction: non-duration impact tolerances increasingly appear to be moving from an example of more sophisticated practice towards an expectation that firms more generally should consider and, where appropriate, adopt them.

This matters for smaller and less complex firms. Proportionality should not automatically be interpreted as justification for relying exclusively on duration-based tolerances. Where intolerable harm depends on the number of customers affected, the value of transactions disrupted or other non-time-based factors, firms should explain how these considerations are reflected in their methodology.

Importantly, the FCA has not introduced a universal requirement for every firm to establish multiple independent non-duration tolerances. Nevertheless, the supervisory question may increasingly shift from whether firms have considered such measures to why they have decided not to adopt them.

That represents a potentially material increase in expectations—and in the difficulty of demonstrating resilience.

3. Non-duration impact tolerances: a more demanding test

Consider a payment service with a four-hour disruption tolerance. A 20-minute outage affecting 150,000 customers might be within its duration tolerance but beyond a separately established customer-impact tolerance of 100,000. The service could therefore breach an impact tolerance almost immediately, despite rapid technical recovery.

Other potentially relevant dimensions include transaction volumes and values, customer vulnerability, non-financial harm, market integrity and the accumulation of backlogs after systems have been restored.

Where several measures are defined as independent impact tolerances, breaching any one of them is a breach of that tolerance. Meeting the duration threshold alone is insufficient. But firms must distinguish independent tolerances from deliberately combined or conditional tolerances and from supporting indicators or escalation triggers. Not every operational metric should become a formal impact tolerance.

Calibration is critical. Set a threshold too high and it may miss intolerable harm; set it too low and routine disruptions could be classified as breaches without a credible harm rationale. A high number of affected customers does not, by itself, establish intolerable harm: the nature, timing and consequences of the disruption matter.

Adding carefully calibrated non-duration tolerances can make breaches more likely to be identified. That does not necessarily mean the firm has become less resilient; it may mean the earlier duration-only approach was insufficiently sensitive to the true consequences of disruption.

4. Scenario testing: beyond recovery times

Testing should challenge rather than confirm existing assumptions. Severe but plausible scenarios might involve simultaneous technology and third-party failures, unavailable workarounds, major cyber incidents, disrupted data, peak customer demand or backlogs that persist after the underlying systems return.

Restoring technology is not necessarily the same as restoring an important business service. A system may recover within four hours while accumulated transactions or customer harm continue to grow. Firms should therefore test both duration and non-duration dimensions of disruption, the scalability of manual workarounds and whether minimum essential service arrangements could prevent intolerable harm even where full recovery is delayed.

Testing must lead to action: identify weaknesses, prioritise remediation and retest to establish whether resilience has actually improved.

5. Mapping and third-party dependencies

Meaningful mapping identifies the people, processes, technology, facilities, information and third parties needed to deliver important business services. It should expose single points of failure, shared resources, concentration risks and dependencies that may not be obvious from contractual service levels or availability statistics.

Third-party oversight must be integrated with operational resilience. Firms need credible evidence of provider recovery capabilities, incident escalation, subcontracting exposure and the effectiveness of contingency arrangements. The same applies to intra-group arrangements: greater control or influence does not remove the need for testing and assurance.

The UK's Critical Third Parties regime may strengthen sector-wide oversight, but it does not transfer an individual firm's accountability for its own resilience to regulators or designated providers.

6. Governance, evidence and the self-assessment

Boards and senior management need to understand which services remain vulnerable, where recovery depends on assumptions, what severe testing has demonstrated and which remediation actions are still outstanding. Completion statistics, green dashboards and planned improvements are not substitutes for evidence of current resilience.

Effective challenge should ask whether tolerances capture intolerable harm, whether scenarios genuinely test the firm's limits, whether third-party assurances are credible, and whether management could maintain essential services when full recovery is impossible.

7. What should firms do now?

1. Revisit tolerance design: consider whether duration-only measures sufficiently capture intolerable harm for each IBS.
2. Distinguish measures: document which non-duration thresholds are independent tolerances, combined conditions or supporting indicators.
3. Calibrate against harm: use customer, transaction and service evidence rather than arbitrary thresholds.
4. Challenge scenario testing: include rapid high-impact disruption, third-party failures, backlogs and minimum service arrangements.
5. Strengthen dependency assurance: validate provider, intra-group and shared-resource recovery assumptions.
6. Improve governance evidence: present unresolved vulnerabilities, uncertainty and remediation effectiveness transparently to the board.

8. Impact-tolerance breaches and the March 2027 reporting rules

Firms should distinguish an impact-tolerance breach from an operational incident and from an incident that meets the separate regulatory reporting criteria under the new UK rules effective 18 March 2027. These concepts overlap but are not interchangeable: a breach does not automatically establish that an incident is reportable, nor should reporting assessments depend solely on whether an IBS tolerance has been breached.

For further analysis see our Insight on the March 2027 operational incident and material third-party reporting requirements.

Conclusion: resilience is about outcomes, not just the clock

The FCA's observations reinforce a supervisory philosophy familiar from operational risk management: expectations for the sophistication, robustness and effectiveness of firms' frameworks continue to rise even when the rules themselves remain unchanged.

Non-duration impact tolerances make the challenge particularly tangible. A firm may restore an important business service quickly yet still cause intolerable harm in minutes. More meaningful tolerances can expose weaknesses that duration-only measures overlook—and require better mapping, stronger contingency arrangements, more demanding scenario testing and credible evidence of resilience.

The regulatory bar is rising. Firms need to ensure that their resilience capabilities—and the evidence supporting them—rise with it.