PRA SS1/21: what the supervisory statement covers
PRA Supervisory Statement SS1/21 sets expectations for operational resilience around important business services and impact tolerances. It is relevant to UK banks, building societies, PRA-designated investment firms, UK Solvency II firms, the Society of Lloyd’s and its managing agents. The PRA approach reflects the safety and soundness of firms, policyholder protection and, where relevant, wider financial stability. That framing is related to but not identical to the FCA’s consumer-harm and market-integrity focus.
Firms subject to both regulators should not build competing service inventories simply because two rulebooks exist. They should identify common evidence and make any different objectives, impact measures and governance needs explicit.
The important-business-service question
SS1/21 is concerned with the services whose disruption could create significant adverse outcomes. The selection should not simply mirror internal organisational departments. A firm’s dealing service may depend on an external market-data provider, key staff, an authentication mechanism and a settlement process; all may need to be mapped to understand where disruption could exceed tolerances.
Impact tolerance versus internal recovery targets
An impact tolerance expresses the maximum disruption that can be absorbed before the relevant harm occurs. Internal IT recovery time objectives are operational design targets and may need to be significantly shorter. A technology vendor’s uptime SLA is not evidence that the firm can continue its important service if the vendor fails. Tolerances should reflect relevant harm and be revisited as services, customers or risks change.
Mapping and testing
Document resources sufficiently to reveal vulnerabilities: people, processes, technology, facilities, information and relevant suppliers. Exercises should cover severe but plausible disruptions of differing natures and durations. Supplier outages, staff or site unavailability, loss or corruption of data, and disruption to other market participants are among scenarios firms should consider where relevant.
Record exercise design, assumptions, the effect on important services, what is known about recovery and which weaknesses need remediation. A scenario testing spreadsheet without observations or actions will not offer meaningful assurance.
Board oversight and written evidence
The governing body should be able to approve and review important services, impact tolerances and the written self-assessment using information that makes challenge possible. Maintain an evidence trail linking decisions to mapping, tests and remedial work. Governance is stronger when exceptions are visible rather than edited out to make an annual pack appear complete.
Using a specialist review
An external diagnostic can check the alignment of existing work against both PRA and FCA requirements where relevant, then prioritise the practical gaps. The result is not a regulatory opinion from the PRA or a substitute for management accountability.
How to prepare evidence for a PRA-focused discussion
A PRA-supervised firm should be able to explain important business services, impact-tolerance rationales, mapping, testing, vulnerabilities and governance in a way that allows challenge. A useful opening pack includes a service inventory, the most recent self-assessment, the scenario plan, a register of unresolved vulnerabilities and a concise statement of where the firm’s evidence is limited.
Do not present an FCA-only guide as a complete statement of PRA expectations. The prudential perspective considers financial-system stability and the firm’s role, and the exact supervisory requirements must be checked against the live statement, rulebook and regulatory perimeter. A consultant can prepare an evidence index and facilitate review; the firm must validate the underlying operational facts and accountable decisions.
Frequently asked questions
Is PRA SS1/21 the same as FCA SYSC 15A?
They are related regimes with shared operational-resilience principles, but scope and regulatory objectives differ.
Do all investment managers fall under SS1/21?
No. It applies to the PRA-regulated categories specified in the supervisory statement; ordinary FCA-only investment firms require a separate perimeter analysis.
Can the same test support both regulators?
Potentially, if the scenario, assumptions, metrics and evidence address the relevant objectives and obligations of each.