The FCA operational resilience review is the Financial Conduct Authority’s (FCA) assessment of UK firms’ annual self-assessments, published on 27 March 2026 FCA review. It concerns firms subject to the FCA’s operational resilience rules, whose mapping and testing transition period ended on 31 March 2025 FCA operational resilience guidance. The FCA oversees compliance. Its review gives supervisory feedback; it does not replace the binding rules.
- Scope: The FCA operational resilience review concerns UK firms subject to the FCA’s operational resilience rules, not every UK organisation or every technology supplier.
- Dates: The mapping and testing transition period ended on 31 March 2025 FCA review; further reporting rules apply from 18 March 2027 FCA policy statement.
- Regulator: The FCA reviews firms’ operational resilience records and can require their written self-assessments on request FCA Handbook.
- Practical change: Firms should make service selection, tolerances, dependency mapping and severe scenario tests defensible, rather than treating the review as a new rulebook.
- Penalties: The review sets no new fine. Firms still need to comply with the underlying FCA rules and address weaknesses the regulator identifies.
- Out of scope: A supplier does not become subject to a firm’s SYSC 15A duties merely because that firm relies on its services.
🧩 What did the FCA operational resilience review find?
The FCA operational resilience review found that firms need stronger explanations and evidence behind their resilience decisions. The FCA examined annual self-assessments after the transition period, rather than issuing replacement operational resilience rules FCA review. A polished document is not enough if the firm cannot show why a service matters, how disruption harms customers or markets and whether its recovery assumptions survive a demanding test.
Impact tolerances need particular care. The FCA’s earlier feedback found limited justification for the point where disruption becomes intolerable for consumers or threatens market integrity FCA operational resilience observations. Subsequent analysis of the review identified firms that did not distinguish consumer harm from market integrity when setting tolerances operational resilience review analysis. Firms should explain each measure and threshold in terms a reviewer can challenge.
The same analysis highlighted the risk of outdated mapping data, unsupported claims that firms could recover from every scenario and self-assessments that did not describe end-to-end vulnerability identification and remediation review analysis. Those are practical gaps, not a request for longer paperwork. Our starting point is to trace each important business service through its dependencies, tests, decisions and unresolved weaknesses. If one link is missing, the assurance claim needs qualification.
Key Takeaway
The review is supervisory feedback on existing duties. A firm needs evidence that connects its decisions to the service it must protect.
📌 Does FCA operational resilience apply to my firm?
FCA operational resilience duties apply to firms within the scope of Senior Management Arrangements, Systems and Controls (SYSC) chapter 15A. The FCA operational resilience review does not extend that scope to every UK business. A firm should check the FCA Handbook’s application provisions for its regulated entity rather than assume that FCA authorisation alone answers the question.
For an in-scope firm, the unit of analysis is the important business service: a service whose disruption could cause intolerable harm to consumers or risk to market integrity. The FCA says firms must not exclude a service merely because they believe they can recover it, or because one factor appears reassuring FCA service identification guidance. Record the reasoning for inclusion and exclusion in the self-assessment.
Third parties require a separate scope decision. A cloud provider supporting an important business service does not take over the firm’s mapping or testing obligations. The firm still needs enough understanding of that provider’s supporting resources to identify and address vulnerabilities FCA mapping guidance. Equally, a supplier should not assume that serving a regulated customer makes it an in-scope SYSC 15A firm.
Some suppliers face a distinct UK designation regime. The Critical Third Parties (Designation) Regulations 2026 designated named technology providers as critical third parties from 13 July 2026 UK designation regulations. Designation is not the same as a financial firm’s duty to demonstrate that its important business services remain within tolerance.
🗓️ When must services and impact tolerances be reviewed?
An in-scope firm must revisit its important business service assessment after a material change and no later than one year after its previous assessment. That timetable comes from SYSC 15A.2.2R FCA Handbook requirements. The FCA operational resilience review does not restart the clock or create a fresh transition period. Firms should be able to show when the assessment happened and what changed.
Do not confuse that specific review interval with a blanket annual deadline for every resilience artefact. Each important business service needs its own impact tolerance under SYSC 15A.2.5R, but the cited annual review provision addresses service identification FCA Handbook requirements. Tolerances still need a sound rationale. When a service, its users or its dependencies change, check whether the existing tolerance remains defensible.
The completed mapping and testing milestone was 31 March 2025 FCA review. Since then, the task has been to keep the supporting picture accurate and test whether services can remain within tolerance. A firm that changes a core platform, outsourced provider or delivery process should not wait for its next scheduled assessment before considering the effect on resilience.
Written self-assessments must also stay current. Each version must be kept for at least six years and supplied to the FCA if requested FCA self-assessment rules. That retention rule matters when decisions evolve: keep the earlier reasoning, the later revision and the evidence that explains why the firm changed course.
🔑 What does the FCA operational resilience review expect in records?
The FCA operational resilience review expects self-assessments to explain how the firm reaches and tests its resilience conclusions. The binding record-keeping duty sits in SYSC 15A.6.1R, not in the review itself FCA self-assessment rules. A useful record connects each important business service to its tolerance, supporting resources, test results, vulnerabilities, remediation and communication plans.
| Area | Rule or expectation | What to keep |
|---|---|---|
| Service selection | SYSC 15A.2.1R requires identification of important business services FCA Handbook. | The decision and its rationale, including exclusions. |
| Impact tolerance | SYSC 15A.2.5R requires a tolerance for each important service FCA Handbook. | The threshold, measure and explanation of intolerable harm. |
| Dependency mapping | SYSC 15A.4.1R covers people, processes, technology, facilities and information FCA mapping rules. | A current service map and ownership of its inputs. |
| Scenario testing | SYSC 15A.5.3R requires severe but plausible disruption tests FCA testing rules. | The scenario, assumptions, results and decisions. |
| Self-assessment | SYSC 15A.6.1R requires a current written assessment FCA documentation rules. | Vulnerabilities, remediation, communications and methodologies. |
The table is a working check, not a substitute for the full Handbook. For example, a dependency list can look detailed yet fail to show who keeps it accurate. Review analysis identified clear ownership of mapping data as good practice because stale information can undermine resilience planning review analysis. Give each important map an owner and a way to capture changes.
Self-assessments should also explain how weaknesses are found, prioritised and fixed, including the contribution of independent review functions. Our cyber risk assessment guide explains how to turn identified weaknesses into decisions. For resilience purposes, the record should go further: show which important service is affected and whether the weakness threatens its tolerance.
Key Takeaway
Keep the reasoning and the test result together. A self-assessment should let a reviewer follow a service from selection through disruption to remediation.
📊 How severe should scenario tests and cloud mapping be?
Scenario tests must use severe but plausible disruption and assess whether each important business service stays within its impact tolerance. SYSC 15A.5.3R sets that duty; SYSC 15A.5.4R calls for adverse circumstances that vary in nature, severity and duration and fit the firm’s risk profile FCA scenario testing rules. A convenient test that only confirms existing recovery assumptions will not answer the harder question.
For cloud-supported services, map the dependency beyond a provider name. Identify the people, processes, technology, facilities and information needed for delivery, including what the firm understands about relevant third party resources FCA mapping guidance. Then test plausible shared failures: what stops, what alternative remains available and how long customers or markets experience the disruption? Our IT disaster recovery planning service addresses the recovery planning that supports such tests.
Outsourcing the exercise does not outsource responsibility. The firm remains responsible for the quality and accuracy of third party testing FCA testing guidance. Review analysis found unsupported assertions that some firms could recover from every scenario review analysis. State the test limits plainly, particularly where a provider cannot expose all its internal dependencies.
Shared cloud disruption deserves attention. In October 2026, the Bank of England reported that the Cross-Market Operational Resilience Group (CMORG) had run SIMEX26 around a global cloud outage Bank of England exercise report. Firms can use that type of scenario to challenge concentration assumptions without claiming that participation in a sector exercise proves their own service will remain within tolerance.
🚨 What are the penalties and how does enforcement work?
The FCA operational resilience review does not introduce a new fine or replace the existing rules. An in-scope firm must meet its obligations under SYSC 15A, and the FCA can request its self-assessment records FCA documentation rules. Treat a supervisory observation as a reason to examine compliance, not as a separate penalty provision or a safe harbour.
There is no flat penalty amount in the review. A firm should avoid presenting a generic fine figure to its board as the cost of missing an impact tolerance. The more useful question is whether it can demonstrate the required service identification, mapping, testing and remediation, and explain a failure when it occurs. Unsupported assurance is especially risky when the underlying test did not reflect severe disruption.
A written record is part of that accountability. SYSC 15A.6.2R requires the firm to retain every version of its self-assessment for at least six years and provide it to the FCA on request FCA record retention rule. Keep evidence of challenge and decisions with the assessment, rather than reconstructing them after a disruption.
The review should not be mistaken for a promise that the FCA will accept any particular test result. Firms remain responsible for testing quality even when a specialist provider performs the exercise FCA scenario testing guidance. Our cyber resilience service can support the technical assessment, while the regulated firm retains its compliance decisions.
Case Study: Strengthening resilience at Deutsche Bank
Deutsche Bank needed stronger cyber resilience amid heightened threats and regulatory scrutiny. Its complex technology estate called for better visibility, a more mature internal Security Operations Centre (SOC) and tighter control over privileged and user access.
Our team provided senior cyber advice on the SOC operating model and roadmap, oversaw its development and directed a deployment spanning multiple security information and event management (SIEM) systems. We also strengthened privileged access management and identity and access management controls.
The work improved SOC governance, monitoring visibility and detection capability. Stronger access controls improved accountability and supported operational resilience and regulatory assurance.
⚙️ How do new reporting rules affect preparation?
New operational incident and material third party reporting requirements will apply from 18 March 2027 under PS26/2 FCA final policy. PS26/2 is adopted policy, not an open consultation. The joint arrangements involve the FCA, Prudential Regulation Authority (PRA) and Bank of England. Covered firms will also need a register of material third party arrangements for annual submission to the FCA.
Keep reporting and resilience assessments connected
An incident report and a resilience self-assessment serve different purposes. The former addresses reportable events under the newer regime; the latter records whether the firm meets its continuing service, tolerance, mapping and testing duties. Before the reporting rules apply, align service maps with third party records and agree who verifies incident facts. Our incident response planning guide covers the operational decisions needed when disruption begins.
Check UK duties separately from EU rules
The EU Digital Operational Resilience Act (DORA) is a separate regime. A group operating across the UK and EU should not assume that a DORA control document demonstrates compliance with UK SYSC 15A, or vice versa. Our DORA requirements overview discusses the EU regime. For UK preparation, begin with the applicable FCA rules, then reconcile shared controls and evidence across entities.
Preparation should be practical: confirm the firm’s scope, refresh important service decisions, reconcile cloud dependencies and rerun tests where assumptions have changed. Assign owners to unresolved weaknesses and make sure incident response can reach the people responsible for each service. Our cyber security strategy service helps organisations order that work without treating a future reporting duty as a reason to defer obligations already in force.
❓ Frequently asked questions
What is the deadline for the FCA operational resilience review?
There is no new compliance deadline created by the FCA operational resilience review. The mapping and testing transition period ended on 31 March 2025 FCA review. In-scope firms must continue to meet the underlying rules, including revisiting important business service assessments after material change and no later than one year after the previous assessment FCA Handbook.
Do firms submit their operational resilience self-assessment every year?
No general annual submission requirement appears in the operational resilience self-assessment rule. An in-scope firm must keep a current written assessment, retain each version for at least six years and provide the records to the FCA on request FCA self-assessment rules. Do not confuse that request-based duty with the separate annual submission of material third party registers under PS26/2 FCA final policy.
Does the board have to approve the operational resilience self-assessment?
Do not assume that an annual board sign-off is a substitute for the firm’s continuing duties. The relevant FCA rule requires an in-scope firm to make and keep current a written assessment of its compliance FCA self-assessment rules. Check the firm’s applicable governance requirements and record who challenged the service decisions, testing assumptions and unresolved vulnerabilities.
What counts as an important business service?
An important business service is identified by assessing the harm its disruption could cause to consumers or market integrity. The FCA says not to exclude a service because of one reassuring factor or because the firm believes its recovery capability is strong FCA service identification guidance. An in-scope firm must document its selection and reasoning.
What penalties apply for failing the FCA operational resilience review?
The FCA operational resilience review itself sets no new fine and is not a pass-or-fail certification. Binding obligations sit in the FCA’s operational resilience rules, and the FCA can request the firm’s written self-assessment FCA documentation rules. A firm should assess any breach against those duties rather than assume that a particular monetary penalty follows from an observation in the review.
How should a firm map cloud providers?
Map the resources needed to deliver each important business service, not just the supplier’s name. The FCA expects enough understanding of a supporting third party’s people, processes, technology, facilities and information to identify and address vulnerabilities FCA mapping guidance. Record what the firm knows, who owns updates and where gaps limit assurance.
Which cloud providers are designated critical third parties in the UK?
The Critical Third Parties (Designation) Regulations 2026 name Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited. The designations took effect on 13 July 2026 UK designation regulations. The named legal entities matter: designation does not remove a regulated firm’s responsibility for its own important business services.
What changes under the FCA incident and third party reporting rules?
PS26/2 introduces operational incident and material third party reporting requirements from 18 March 2027 FCA final policy. Covered firms will need to maintain a register of material third party arrangements and submit it to the FCA annually. Those requirements sit alongside, rather than replace, existing operational resilience mapping, testing and self-assessment duties.
Contact Us
