Operational Resilience: Where Supervisory Expectations Stand Now

The Framework in Brief

The FCA’s rules are in SYSC 15A. They apply to banks, building societies, insurers, Enhanced SMCR firms, payment and e-money institutions and some market infrastructure. In outline, firms must:

• identify their important business services, meaning services whose disruption could cause intolerable harm to customers or risk to market integrity;
• set an impact tolerance for each, the maximum disruption the firm can tolerate;
• map the people, processes, technology, facilities and information that support each service;
• test their ability to stay within tolerance in severe but plausible scenarios;
• identify vulnerabilities and fix them; and
• keep a self-assessment, approved by the board, documenting all of this.

The transition period ended on 31 March 2025. Firms are now expected to be able to remain within tolerance, not to be working towards it.

From “Do You Have a Framework?” to “Prove It Works”

In the early years, supervisors focused on the foundations: had firms identified their services, set tolerances and mapped resources? Across most of the regulated population that work is done. Supervisory attention has moved to a harder question. When a severe scenario is tested, does the firm stay within tolerance, or does the test show that the tolerance was unrealistic, or that capability doesn’t match the paperwork?

That changes what good looks like. A firm with a polished framework and untested, optimistic assumptions is now more exposed than one with a plainer framework that has tested itself hard, found real gaps and is fixing them. Supervisors are looking for evidence of learning: what the last test found, what changed as a result, and whether the board knew.

What Has Changed Since the Deadline

The reporting rules give firms a year to prepare. In practice that means agreeing what counts as an incident, setting up the process to report within the deadlines, and building the third-party register. The work typically falls to the SMF24, with the compliance officer and the head of procurement or vendor management.

Third-Party Concentration Risk

Firms across the sector rely on a small number of providers for cloud hosting, core banking, payment processing and data. Supervisors are now focused on what happens if one of those providers fails across many firms at once. The critical third parties regime puts the largest providers under direct oversight, but it doesn’t remove individual firms’ responsibility. Each firm must understand its own dependencies, including fourth parties, and have credible plans that don’t assume another provider will be available during a sector-wide outage.

The new third-party register will make those dependencies visible to the FCA in a standard form. Firms that have never mapped their material arrangements in one place will find this harder than they expect.

Testing Maturity Varies Widely

In our work with SMF24 candidates and the firms hiring them, testing maturity varies far more than firms assume when they compare themselves informally with peers. Some run adversarial testing, bringing in outside specialists to find gaps the internal team hasn’t considered. Others still run tabletop exercises that tend to confirm the existing framework rather than challenge it. Where a firm sits on that spectrum should be stated in the SMF24 brief, because moving a firm from tabletop exercises to real testing takes different skills from maintaining a mature programme.

What This Means for SMF24 Recruitment

At Enhanced and dual-regulated firms, operational resilience usually sits with the Chief Operations function, SMF24. When recruiting one today, test for:

• Real testing experience: running severe scenario tests through to a board self-assessment, not only building a framework years ago
• Incident handling: leading the response to a live incident, including communications with regulators and customers
• Third-party oversight: managing material outsourcing, exit plans and concentration risk, including readiness for the PS26/2 register
• Board reporting: explaining test results and vulnerabilities to non-executives in plain terms
• Change delivery: fixing what the tests find, on budget and on time

A candidate whose experience predates the 2025 deadline may need support to bring it up to date. That’s a fair thing to plan for, but plan for it explicitly rather than discovering it after appointment. Our SMF24 recruitment service tests for these skills directly.

For Core firms outside the resilience rules, the same issues still matter. They usually fall to the CEO or an executive director, and the incident reporting rules apply to all firms with a Part 4A permission.

Questions to Put to SMF24 Candidates

• Tell us about the most severe scenario you have tested. Did the firm stay within tolerance, and if not, what did you change?
• How did you decide which services were important, and have you ever changed that list? Why?
• Walk us through a live incident you led. When did you tell the regulator, and what would you do differently?
• Which of your material third parties would be hardest to replace, and what is the exit plan?
• How did you explain a failed test to the board, and what did the board ask?

Good answers are specific and admit what went wrong. Vague answers about frameworks and policies usually mean the candidate has built documents rather than tested them. Our guide to interviewing SMF candidates covers wider interview technique.

The Board’s Role

The board approves the self-assessment and remains accountable for whether the framework is fit for purpose. Under the chair‘s leadership, the board should be asking the SMF24 pointed questions about the last real test: what it found, what changed and what is still open. Non-executives who chair the risk or audit committee, covered in our guide to SMF10 and SMF11, should see testing results, not only completion reports. Our governance review can help a board check that accountability for resilience is clearly allocated.

Frequently Asked Questions

When did the operational resilience rules take full effect?

31 March 2025. From then firms had to be able to remain within impact tolerances for their important business services.

What is PS26/2?

The FCA policy statement on operational incident and third-party reporting, published on 18 March 2026. Its rules come into force on 18 March 2027.

Which firms must report material third-party arrangements?

Enhanced SMCR firms, banks, building societies, Solvency II insurers, large CASS firms, payment and e-money institutions and some market infrastructure.

Who is accountable for operational resilience?

At Enhanced and dual-regulated firms, usually the SMF24. The board approves the self-assessment and remains accountable overall.

Do Core firms need to worry about this?

The SYSC 15A rules don’t apply to most Core firms, but the incident reporting rules apply to all firms with a Part 4A permission.