FCA operational resilience: what PS21/3 requires

FCA operational resilience is what the Financial Conduct Authority expects of firms under its policy statement PS21/3, Building Operational Resilience, and the SYSC 15A rules in the FCA Handbook. It asks firms to identify their important business services, set an impact tolerance for each, map what those services depend on, test that they can stay within tolerance under severe but plausible disruption, and record it all in a self-assessment.

The rules came into force on 31 March 2022. The transitional period ended on 31 March 2025, so firms must now operate their important business services within impact tolerances and keep reviewing, testing and self-assessing on an ongoing basis.

Start by identifying the important business services that, if disrupted, could harm consumers or market integrity, threaten the firm's viability, or cause instability in the financial system. For each one, break it into the critical processes behind it and map the people, processes, technology, facilities and information those processes depend on.

With RunReady:

• Build a central register of critical services, with owners, priority and criticality
• Map each process to its resource dependencies, including third parties
• Link services to the risks, events and scenarios that could disrupt them
• Plan alternate processes or resources for when a disruption occurs

For each important business service, set an impact tolerance: the maximum level of disruption you can accept before the harm becomes intolerable, including around data loss. This is the line between an inconvenience and intolerable harm.

With RunReady:

• Define intolerable harm and set tolerance levels across processes and resources
• Use an impact-over-time view to measure impact against how long a service is down
• Put controls and mitigants in place to keep critical operations within tolerance
• Measure impact against customers, the firm and the market, ready to show the FCA

Test your ability to stay within impact tolerances using severe but plausible scenarios. Include failures within your control, such as an IT system outage, and outside it, such as a cyber attack or a loss of power. The question each test answers: how would this event hit your most important services, and what happens next?

With RunReady:

• Work from a library of suggested scenarios, including mandatory FCA testing
• Run guided tests and see the results against your impact tolerances
• Measure how long recovery takes, so you know when you would cross into intolerable harm
• Keep an audit trail of every test: results, completed and approved

Develop and maintain the monitoring, analysis and reporting that shows how you manage operational risk, and the escalation process for incidents. Document your approach, the scenario tests you have run, the lessons learned and the remediation you are undertaking, in a written self-assessment you keep current.

With RunReady: keep the self-assessment evidence, test results and remediation together in one place, so the picture you show the Board and the FCA is always up to date rather than rebuilt at reporting time.