What the FCA and PRA Operational Resilience Policy Requires
The FCA and PRA jointly published their operational resilience policy in March 2021, with full implementation required by March 2025. For FCA and PRA-regulated firms — banks, insurers, investment managers, payment firms, and in-scope market infrastructure — the policy requires: identification of important business services, setting of impact tolerances for each service, mapping of the resources and third-party dependencies that support each service, scenario testing to demonstrate the firm can remain within impact tolerances, and an annual self-assessment of operational resilience capability.
This is a different regulatory framework from ISO 22301 business continuity management — although the two complement each other. ISO 22301 focuses on the management system for business continuity. FCA/PRA operational resilience policy focuses specifically on customer and market outcomes: can the firm deliver its important business services within tolerances that protect consumers and market stability, even during severe but plausible disruption?
Financial services resilience specialists. Programme assessment within 48 hours.