Impact tolerance: the limit of disruption before intolerable harm
Under FCA operational resilience rules, an impact tolerance is a service-level measure of maximum tolerable disruption. Time matters, but the firm must consider other relevant metrics and the consequences for consumers and the financial system. A round-number recovery objective copied from the IT service desk is not an adequate rationale on its own.
The FCA’s 2026 observations highlighted stronger use of quantitative non-time-based measures, while calling attention to firms that did not separately consider market-integrity and consumer-harm consequences when relevant.
A method for developing a tolerance
Define the service and customers affected. Consider how harm develops over time; how transaction volumes and seasonality affect exposure; whether vulnerable customers have viable alternatives; whether financial loss or access problems are reversible; and whether disruption could affect markets or other institutions. Consult owners across risk, compliance, operations and front-line services, then document assumptions and board decisions.
Example: an outage at a payment service
A firm may have an internal target to restore a processing application in 60 minutes. During a peak period, a smaller interruption could affect large volumes of time-critical payments or prevent vulnerable customers from reaching funds. A credible tolerance exercise should therefore consider the number and type of affected customers, failed transactions and the point at which harm becomes intolerable, not only the moment the application restarts.
The figures used in actual tolerances must be chosen and justified by the firm, not borrowed from a generic website example.
Testing against the tolerance
Design severe-but-plausible tests that could challenge the tolerance and capture what actually happens. A scenario that assumes every supplier’s service-level agreement will be met is not necessarily sufficiently demanding. Record alternate processes, elapsed time, capacity and confidence in evidence. If the firm cannot remain within tolerance, the result belongs in a vulnerability and remediation process.
Tolerance versus RTO and RPO
Recovery time objectives and recovery point objectives help engineers and process owners design recovery arrangements. They do not automatically express the maximum tolerable harm to a client-facing important business service. An effective programme aligns recovery design targets with service-level tolerances and reviews both after material change.
Frequently asked questions
Can an impact tolerance include transaction volume?
Yes. The FCA encourages relevant non-time metrics alongside time measures and appropriate harm analysis.
Who approves impact tolerances?
Applicable regulatory governance requirements involve the relevant governing body. Specialist support can develop evidence but not transfer approval responsibility.
What if our scenario test suggests a breach?
The firm should document the vulnerability, responsible owner, mitigation and appropriate governance decisions.