What the FCA actually said on 27 March 2026
One year after the operational resilience transition ended, the FCA published findings drawn from reviews of firms’ annual self-assessments. The regulator acknowledged substantial progress, but identified areas where explanations, evidence and ongoing governance could improve. This is a supervisory observations document, not an announcement of a new blanket compliance deadline.
The most useful way to read the publication is as a set of challenges to a firm’s current evidence. Six workstreams are especially relevant.
1. Important business services and tolerances
The FCA observed stronger rationale and use of quantitative, non-time metrics alongside time measures. One weakness was failing to distinguish tolerance considerations around consumer harm and market integrity. Action: record the reasons for each service and tolerance, the data supporting harm thresholds, and the impact of peak periods and vulnerable customers. State separately where different harm mechanisms apply.
2. Mapping beyond technology
Good mapping shows the people, processes, facilities, information and supplier links required to deliver an important service. The FCA warned that some programmes were too technology-centred and that third-party vulnerabilities still needed attention. Action: choose a critical service and verify that its people, process and information dependencies are as well developed as the infrastructure diagram.
3. More credible scenario testing
The regulator welcomed expansion into cyber and alternative recovery scenarios. It warned against broad assertions that every disruption can be recovered from without sufficiently severe tests. Action: test a scenario that genuinely threatens the impact tolerance and record assumptions, timings, workarounds, observed decisions and confidence limitations.
4. Vulnerability management
Findings should be tied to important services, a prioritised remedy, owners, target dates and evidence of closure. Some self-assessments omitted the end-to-end process for discovering and resolving vulnerabilities. Action: maintain a register showing where each weakness came from, its impact and the decision made about it.
5. Communications alternatives
Plans can fail when ordinary channels are themselves unavailable. The FCA identified limited evidence of testing workarounds. Action: exercise a loss of primary communications, including how staff, customers and other stakeholders would receive accurate instructions.
6. Governance and board challenge
Good practice included clear accountabilities, reporting, visible remediation and board challenge. Weak practice involved incomplete approval records, uncertain ownership and limited second- or third-line input. Action: give the board an evidence index with explicit unresolved decisions, not an annual “all green” summary.
What this means for your next review
Build an evidence matrix with six columns corresponding to these topics and attach a dated record, owner, identified gap and next review date to each. Compare it with the FCA’s original publication before approval. A qualified specialist can challenge whether evidence quality matches the firm’s risk profile rather than only checking the presence of documents.
An actionable six-area review against the FCA’s March 2026 observations
Use the following as a management workshop agenda rather than pretending the FCA has published a universal scorecard. Each question is grounded in the themes of the FCA’s 27 March 2026 good-and-poor-practice publication.
| Supervisory theme | Question the programme should answer | Evidence owner |
|---|---|---|
| Important business services and tolerances | Are consumer harm and market-integrity limits individually explained, and updated after material change? | Service executive |
| Mapping | Are people, facilities, information, processes and material third parties mapped—not only applications? | Process / technology / vendor owners |
| Scenario testing | Have tests varied in nature, severity and duration and recorded limitations, outcomes and tolerance implications? | Resilience test lead |
| Vulnerability management | Do findings have a named owner, risk disposition, date and closure evidence? | Risk and operational owners |
| Communications | Can the firm contact staff, regulators and affected customers if its usual communications fail? | Incident / communications lead |
| Governance | Can the board see material gaps, challenge assumptions and verify decisions? | Company secretary / governance lead |
A practical red flag: a self-assessment might appear detailed but omit how a third-party outage affects people, data and processes. The FCA specifically notes that technology-heavy mapping can leave material dependencies and vulnerabilities unidentified. The improvement is not more diagrams; it is cross-functional verification and exercises selected from those dependencies.
Avoid describing this as a legal pass/fail checklist. Compliance and adequacy depend on the firm’s full obligations and underlying evidence. The right output is a documented remediation plan with accountable owners.
Practical template to use with your team
- Download the board evidence matrix — adapt, verify and approve before operational use.
Frequently asked questions
Did the FCA create six new rules in March 2026?
No. It published observations about implementation and ongoing compliance; the underlying FCA rules already applied.
What is the most practical first action?
Trace one important service from its harm-based tolerance through dependencies and testing to vulnerability decisions; fix breaks in that evidence chain.
Does a detailed self-assessment mean the programme is mature?
Not necessarily. Clarity, credible testing and visible board decisions matter more than document length.