Operational resilience beyond the compliance deadline
The transitional period ended. Supervision is live.
Most operational resilience content still tells firms to prepare for a deadline. That deadline passed on 31 March 2025. The transitional period under PS21/3 and SS1/21 has ended, and firms are now supervised against a live standard rather than a project plan.
Building a framework once is a project. Keeping mapping current, testing against changing scenarios, and producing a self-assessment your board has genuinely reviewed is an operating discipline. Oakbridge Agility helps smaller regulated firms run that discipline without a programme team.
Where firms stand after March 2025
A wider population than many smaller firms realise
The rules sit in SYSC 15A and apply to banks and building societies, designated investment firms, enhanced scope SM&CR firms, Solvency II firms, and importantly for the fintech sector: electronic money institutions, payment institutions and registered account information service providers.
In March 2026 the FCA published its observations from reviewing firms' annual self-assessments. It reported strong engagement and good progress overall, alongside specific areas needing improvement, and confirmed it is engaging directly with firms on those findings. It is the clearest available statement of what supervision now expects, written against real self-assessments rather than a consultation.
Two things follow. First, the annual cycle is now the obligation: firms must assess their ability to remain within impact tolerance at least annually, and revisit mapping and tolerances after material change. Second, the bar for evidence has risen. The FCA noted that where firms report few or no outstanding vulnerabilities while providing little evidence of mapping and testing, it becomes difficult to verify that vulnerabilities were properly identified at all.
Mapping important business services
Getting the list right matters because everything downstream inherits its errors
An important business service is one provided to clients which, if disrupted, could cause intolerable harm to clients or pose a risk to the soundness of the UK financial system. Internal functions such as payroll do not qualify on their own. A service defined too broadly produces a tolerance nobody can defend; one defined too narrowly hides the dependency that will actually fail.
Mapping then documents the people, processes, technology, facilities and information needed to deliver each service, including third-party relationships that could threaten your ability to stay within tolerance. The most common weakness the FCA identified is mapping that concentrates on technology while treating people, facilities, processes and third-party resilience as afterthoughts. We map to the standard supervision expects, assign ownership of the mapping data so it does not decay between reviews, and use the output to drive testing.
Setting impact tolerances the board can defend
A round number with no reasoning behind it is not a tolerance
An impact tolerance is the maximum tolerable level of disruption to an important business service, measured as a length of time alongside any other relevant metric, marking the point at which further disruption would cause intolerable harm.
Boards get into difficulty when the tolerance is a round number with no reasoning behind it. Four hours sounds defensible until a supervisor asks what happens at hour five, and nobody can answer. The FCA has highlighted as good practice the use of quantitative metrics that are not time-based, such as transaction volumes or financial thresholds, set alongside the time measure and informed by real incidents. It has also flagged that firms often fail to distinguish between the point at which consumers suffer harm and the point at which market integrity is threatened, which are rarely the same moment.
We work with boards to set tolerances with a documented rationale, stated assumptions and explicit harm thresholds, then recalibrate them against what testing and live incidents actually show.
Scenario testing and self-assessment
Testing does not require a simulation suite
Testing plans must cover scenarios that vary in nature, severity and duration, aligned to your own risks rather than a generic list. The events of 2025 made the point for the regulator: repeated major cloud infrastructure outages and significant cyber attacks across the financial sector demonstrated that severe but plausible is not a theoretical standard. A testing plan that omits third-party failure of that kind is hard to justify.
For smaller firms, scenario testing requires a structured exercise with the right people in the room, honest recovery assumptions, documented workarounds, and a clear record of what was tested and what it showed. The FCA has been direct about one failure mode: firms asserting in their self-assessment that no scenario exists from which they could not recover, without evidence of having tested anything sufficiently severe.
One area consistently underdone is communications. Firms test recovery but not how they would tell customers, staff and the regulator what is happening, particularly when the usual channels are the thing that failed. Our crisis exercises cover that ground.
What the FCA looks for in a self-assessment
The self-assessment is the document supervision reads, and the board must review and approve it. From its March 2026 findings, a strong self-assessment:
The weaknesses named were mostly evidential rather than technical: unclear board engagement and approval trails, remediation without owners or dates, and little sign of second or third line input. Those are the gaps we close first, because they are the ones a supervisor can see immediately.
Frequently asked questions
Common questions about operational resilience
Due a self-assessment, or unsure whether yours would withstand scrutiny? Start with a scoping conversation and we will tell you where the evidential gaps are.