Standards
PRA SS1/21 & FCA PS21/3Bank of England / FCA

Operational resilience: impact tolerances for important business services

The UK regime, often cited as the most mature in the world. It requires identifying important business services, setting a quantified impact tolerance for each, mapping the resources needed, and testing the ability to stay within tolerance under severe but plausible scenarios.

Official text

Who it applies to

  • UK-regulated entities
  • EU groups with a UK subsidiary
  • Practitioners looking for a mature model

Structuring points

  • An important business service is defined from the client and market viewpoint, not the org chart
  • Impact tolerance is expressed as a maximum tolerable duration of disruption
  • The annual self-assessment must be board-approved
  • The regime clearly separates operational resilience from business continuity

UK banks, building societies, investment firms, insurers and financial market infrastructures.

Requirements 3