Those regulated by the FCA are expected to have identified vulnerabilities in their operational resilience. But where do you start?
Since March 2022, firms need to have identified their important business services and mapped out the processes that enable those services to function. Firms then need to determine how much disruption those important business services could tolerate and test their ability to endure that disruption to set their impact tolerances.
The FCA also want a 'lessons learned' exercise completed and a communications plan in place. Finally, the regulator wants the self-assessment document finalised and approved by the board.
To help, we explain what is needed to create a compliant operational resilience programme in the UK and the requirements in context.
The UK Financial Conduct Authority (FCA) defines operational resilience as "the ability of firms, financial market intermediaries (FMIs), and the financial sector as a whole to prevent, adapt, respond to, recover and learn from operational disruptions."
Operational disruptions include:
Operational risk management is a process that results in the acceptance, mitigation or avoidance of risk. However, operational risk management does not eliminate risk – risks can still turn into loss events.
Operational resilience is different because the regulator sees it as an outcome. It focuses on what happens if a loss event occurs. The UK FCA expects firms to be forward-looking and make decisions today that help prevent harm tomorrow.
The Bank of England notes that operational resilience extends beyond business continuity and disaster recovery because "financial firms and FMIs must have robust plans in place to deliver essential services, no matter what the cause of the disruption." In contrast, business continuity and disaster recovery usually focus on delivering "business as usual at the earliest opportunity."
Also, operational resilience expands business continuity management programs to focus on an event's impact on stakeholders beyond the firm itself. It also connects business continuity more directly with a business' risk appetite.
The FCA says that financial services firms in scope for operational resilience compliance:
"Must have in place sound, effective and comprehensive strategies, processes and systems to enable it to comply with its [operational resilience] obligations."
and that these
"Must be comprehensive and proportionate to the nature, scale and complexity of the firm's activities."
Let's unpack this statement. The FCA outlines several components that make up an operational resilience programme. The final policy document on the topic lists these elements.
At first, firms may need to work through these requirements sequentially. However, once their programmes have matured, they may need to work on or revise individual steps as needed.
As with operational risk management, organisations may have a team dedicated to implementing the framework and running the programme. However, responsibility for operational resilience stretches far beyond just that team.
As with risk management, this team nurtures and supports operational resilience. Across the organisation, individual employees are responsible for operational resilience related to their roles. For example, individuals whose roles touch an important business service may have particular, named responsibilities.
Firms need to identify the important business services that they provide. From here, firms should set an impact tolerance for each important business service.
"Important business service" is a term the FCA defines as:
"a service provided by a firm, or by another person on behalf of the firm, to one or more clients of the firm which, if disrupted, could: (1) cause intolerable levels of harm to any, one or more of the firm's clients; or (2) pose a risk to the soundness, stability or resilience of the UK financial system or the orderly operation of the financial markets."
Firms should particularly note the outward orientation in assessing the impacts – this is in contrast to most risk management and business continuity management processes, which tend to focus on internal impacts within the firm.
The FCA lists 13 factors firms should consider when identifying important business services.
Key factors when identifying important business services:
When documenting important business services using the full 13 elements, the FCA wants to see firms naming each important business service and providing a "sufficient, distinct rationale" for each, including metrics.
The regulator has also said that internal functions, such as HR, should not be identified as important business services.
As part of operational resilience, firms need to ensure they can remain within the impact tolerances they set for each important business service in the event of "a severe but plausible disruption to its operations".
'Impact tolerances' are defined as:
"The maximum tolerable level of disruption to an important business service – as measured by a length of time, in addition to any other relevant metrics – reflecting the point at which any further disruption to the important business service could cause intolerable harm to any one or more of the firm's clients or pose a risk to the soundness, stability, or resilience of the UK financial system or the orderly operation of the financial markets."
- UK Financial Conduct Authority
Firms must review their impact tolerances at least annually or if there is a relevant change to the firm's business or markets. Also, firms need to notify the FCA of any failure to stay within an impact tolerance.
The FCA lists some factors that firms should consider when setting their impact tolerance for an important business service.
These factors include:
As with the important business services, the FCA wants firms to document their thinking as to how they set these and avoid simplistic shortcuts such as relying on recovery time objectives as impact tolerances.
In setting them, the regulator also wants firms to focus on developing plans to avoid breaching their impact tolerances, and in this, prioritise the effect on consumers and markets rather than on the firm itself.
Firms need to identify and document the necessary people, processes, technology, and information to deliver their important business services. By undertaking this mapping, firms should be able to identify any vulnerabilities in delivering those important business services within their impact tolerances. Firms should be able to test their ability to remain within their impact tolerances. The regulator has not set a specific methodology for mapping.
Full mapping of all important business services is a significant undertaking for many firms. The FCA has recognised this, and so it has broken down compliance with this requirement into two stages.
Firms need to have undertaken mapping to the point at which it supports their identification of important business services and impact tolerances. It should also have enabled them to identify any vulnerabilities in their operational resilience. The regulator expects full mapping to be complete by its second deadline of the 31st of March 2025.
In conducting mapping, the FCA has flagged three areas that firms should pay particular attention to:
Financial firms need to carry out scenario testing of their ability to remain within their impact tolerances for each of their important business services in the event of a severe but plausible disruption of their operations. Firms also need to create and maintain a regular testing plan – scenario testing is not a "one-time" event but rather an ongoing programme, much like it is in operational risk.
Testing plans should include
To perform the scenario testing, firms need to identify a range of adverse circumstances of varying nature, severity and duration relevant to their business and risk profile and consider the risks to the delivery of the firm's important business services in those circumstances.
The FCA says that firms should consider the following scenarios:
Firms need to think creatively about the scenarios that they may face. It might be helpful to explore external operational risk loss databases and news databases for event descriptions that may provide insight into the kinds of possible operational resilience scenarios the firm might face.
The FCA is keen for firms to develop and retain institutional memory regarding operational resilience, so they have baked in a "lessons learned" section into the operational resilience regulation. This seems to be something that other regulators are noting.
For example, The Board of the International Organisation of Securities Commissions (IOSCO) has requested feedback on the lessons learned about the operational resilience of trading venues and market intermediaries during the COVID-19 pandemic.
So, following scenario testing or after an operational disruption, firms need to conduct a lessons-learned exercise that enables them to identify issues and improve their ability to respond and recover in the future. Firms also need to address weaknesses identified to remain within their impact tolerances in the future. Lastly, firms need to document the process, including the methodology used and the outcomes.
The FCA require firms to have self-assessment documentation and provide clear, timely and relevant communications to stakeholders in the event of operational disruption.
Self-assessments need to be approved by senior management and the board, and the FCA suggests a pattern of regular communication with these stakeholders about operational resilience.
For operational resilience, the FCA says a self-assessment for firms will include:
Firms need to keep this self-assessment up-to-date – it's not a one-off exercise. Plus, firms need to ensure they retain supporting documentation for all of the actions taken to support these various elements of their operational resilience programme, including the self-assessment.
Items that should be included are:
The FCA also wants documentation of the firms' methodologies for all the different parts of the operational resilience programme.
The FCA puts a great deal of emphasis on communicating quickly and effectively to prevent the potential harm that operational disruptions could cause.
The regulator also makes it clear that developing a communications strategy in the teeth of a crisis is a bad idea. As part of its operational resilience rules, the FCA expects firms to:
There are considerable benefits from putting resources into developing such a plan in advance. A robust communications plan can help prevent a situation from escalating further and provide crucial information about how the situation is impacting consumers and other stakeholders.
It can help firms fine-tune their response, improve risk management outcomes, and protect their reputations. So, although this is a requirement, having a good communications plan will deliver significant value in the event of operational disruption.
Back to top of page
The FCA makes it clear that the board (or the organisation's governing body) should review and approve the self-assessment, including lessons learned. The regulator warns that "if you present it to them at the very end and fail to take them on this journey, you're unlikely to get the buy-in you need."
In reality, this means the board should be involved in the operational resilience programme from the beginning, and in particular:
Board members who have experience in business continuity
The team building the operational resilience programme should consider, from the start, the materials they need to present to the board, alongside operational resilience metrics the board may wish to see regularly. As operational resilience programmes are ongoing, the team should ensure that the reporting cycle is sustainable from a resource perspective.
We have created an SMCR roadmap to help you navigate the compliance landscape, supported by a comprehensive library of FCA Courses.
We also have over 100 free compliance training aids, including assessments, best practice guides, checklists, desk aids, eBooks, games, posters, training presentations and even e-learning modules!
Finally, the SkillcastConnect community provides a unique opportunity to network with other compliance professionals in a vendor-free environment, priority access to our free online learning portal and other exclusive benefits.