FCA operational resilience: What PS21/3 requires

• FCA operational resilience means the rules in PS21/3 and SYSC 15A of the FCA Handbook, in force since 31 March 2022.
• Firms identify their important business services, set an impact tolerance for each, map what each service depends on, test against severe but plausible scenarios, and record it all in a self-assessment.
• The transitional period ended on 31 March 2025. Firms must now stay within their impact tolerances and review their services and tolerances at least once a year.
• Dual-regulated firms also follow the PRA's SS1/21, published alongside PS21/3.
• Next to plan for: the PS26/2 incident and third-party reporting rules apply from 18 March 2027.

FCA operational resilience is what the Financial Conduct Authority expects of firms under its policy statement PS21/3, Building Operational Resilience, and the SYSC 15A rules in the FCA Handbook. It asks firms to identify their important business services, set an impact tolerance for each, map what those services depend on, test that they can stay within tolerance under severe but plausible disruption, and record it all in a self-assessment.

The rules came into force on 31 March 2022. The transitional period ended on 31 March 2025, so firms must now operate their important business services within impact tolerances and keep reviewing, testing and self-assessing on an ongoing basis.

Read the rules themselves: the FCA's operational resilience page, PS21/3 and SYSC 15A in the FCA Handbook. This page explains what they mean and how to meet them.

Start by identifying the important business services that, if disrupted, could harm consumers or market integrity, threaten the firm's viability, or cause instability in the financial system. For each one, break it into the critical processes behind it and map the people, processes, technology, facilities and information those processes depend on.

Review the list at least once a year, and sooner after a material change to the business or the market (SYSC 15A.2.2R).

For each important business service, set an impact tolerance: the maximum level of disruption you can accept before the harm becomes intolerable. This is the line between an inconvenience and intolerable harm.

Review each tolerance on the same cycle: at least once a year, or sooner after a material change (SYSC 15A.2.6R).

Test your ability to stay within impact tolerances using severe but plausible scenarios. Include failures within your control, such as an IT system outage, and outside it, such as a cyber attack or a loss of power. The question each test answers: how would this event hit your most important services, and what happens next?

After every test, and after any real disruption, run a lessons learned exercise to find the weaknesses and act on them (SYSC 15A.5.8R).

Develop and maintain the monitoring, analysis and reporting that shows how you manage operational risk, and the escalation process for incidents. SYSC 15A.6.1R asks for a written self-assessment that records:

• your important business services, and why you chose them
• each impact tolerance, and why you set it there
• how you mapped each service
• your testing plan and the scenario tests you ran
• the lessons learned, the vulnerabilities found and the action you are taking
• your communication strategy, and the methods behind all of the above

Your governing body approves the self-assessment and reviews it regularly (SYSC 15A.7.1R). Keep an internal and external communication strategy ready to reduce harm when disruption happens (SYSC 15A.8.1R).

On 27 March 2026, a year after the transitional period ended, the FCA published what it found in firms' self-assessments (Operational resilience: insights and observations, one year on). It saw good practice, including clear methods and rationale for choosing important business services and setting impact tolerances. It also named five areas to improve:

• Impact tolerances. Some firms did not set separate tolerances for harm to consumers and for risk to market integrity.
• Mapping. Mapping had largely focused on technology, rather than the people, processes, facilities, information and third parties behind each service.
• Scenario testing. Some firms said there was no scenario they could not recover from, without evidence of testing against sufficiently severe ones.
• Communications. There was limited evidence that communication strategies were tested in scenario exercises, or that firms had planned for losing their usual channels.
• Governance. Several self-assessments showed unclear board engagement, approval processes and review trails.

If you are reviewing your own self-assessment this year, these five areas are the place to start.