What the FCA operational resilience rules require
Operational resilience is the ability of a financial firm to prevent, adapt, respond to, recover from and learn from operational disruption so that important services do not cause intolerable harm to consumers or threaten market integrity. For UK firms within FCA SYSC 15A, the obligation goes beyond continuity plans. They must identify important business services, set appropriate impact tolerances, map necessary resources, conduct severe-but-plausible scenario testing and maintain governance and self-assessment evidence.
The transition period finished on 31 March 2025. That was not the end of the work. The FCA’s 27 March 2026 supervisory observations explicitly emphasised continuing review, testing, vulnerability remediation, communications and board decisions.
Who is within SYSC 15A?
The FCA Handbook names enhanced-scope SMCR firms, banks, designated investment firms, building societies, Solvency II firms, UK recognised investment exchanges, electronic money institutions, payment institutions, registered account information service providers and consolidated tape providers. Whether a particular undertaking is in scope depends on its status and activities; not every FCA-authorised firm falls into that list. For payments and e-money businesses there are also specific provisions regarding the activities to which the chapter applies.
Do not confuse the population under SYSC 15A with the broader population under the new operational incident reporting rules beginning in March 2027. The regimes have different application tests.
The five core operational questions
- Which services matter? Identify client-facing important business services, with a rationale for inclusion and exclusion.
- How much disruption can be tolerated? Set harm-based metrics, considering time and other factors such as transaction volumes or vulnerable customer exposure.
- What supports each service? Document the people, processes, technology, facilities, information and relevant third parties.
- What would actually happen? Test appropriately severe and plausible disruptions, recording assumptions, limitations, results and remedial actions.
- Who decides? Provide the governing body with meaningful review and approval evidence; maintain written self-assessment and a credible action trail.
A firm should be able to connect every high-level assertion to an underlying record and identify material changes since the last review.
What the FCA highlighted in March 2026
The regulator observed improvements but warned about tolerances without distinct consumer-harm and market-integrity thinking, dependency maps biased toward technology, testing that did not challenge hard cases, remediation with unclear owners, untested communications alternatives and incomplete board challenge records. These observations are a practical checklist for reviewing a programme, not a new legal regime in themselves.
What to do now
Start with the firm’s regulatory perimeter and its current self-assessment. Create a dated evidence index, select one important service with material supplier dependencies and trace from tolerance through mapping, test results and remedial actions. If the trail cannot be followed, improve that chain before producing additional policy documents.
Frequently asked questions
Was 31 March 2025 an implementation deadline?
Yes. It marked the end of the transition period for in-scope firms to achieve mapping and testing sufficient to stay within impact tolerances.
Do the rules apply to all authorised wealth managers?
No. Applicability requires checking the specific regulatory status, including whether the firm is enhanced-scope or another listed category.
How often should services and tolerances be reviewed?
SYSC 15A requires review following relevant material change and, for specified assessments, no later than one year after the last assessment.