Resilience in deposit-taking firms is a service-chain problem
Banks and building societies often have complex links between account access, payments, cash availability, customer services, settlement, fraud controls, liquidity operations and external infrastructures. A serious disruption may affect consumers as well as the safety and soundness of the firm or the wider system. The PRA’s SS1/21 applies to UK banks and building societies, alongside relevant FCA requirements.
The first task is not to map every application. It is to identify important business services, establish meaningful impact tolerances and connect them to all material dependencies across the firm and relevant third parties.
Service outcomes and concentration risk
Potential important services can include access to deposits and payments, depending on the firm’s particular customer base and service definitions. A dependency map must look through user interfaces to authorisation processes, core banking, payment infrastructure, data integrity, specialist staff, cloud environments, providers and the facilities required to support them.
Shared dependencies matter. Two recovery routes may rely on the same security certificates, identity provider or small operations team. A scenario that removes only one application will miss these failure combinations.
Tests worth exploring
A severe-but-plausible exercise could combine a core platform outage with peak payment demand, unavailable authentication and degraded customer communications. Another may explore corruption of transaction data after apparently successful technical restoration. Measure consequences, decision timing, alternative capacity, customer harm and prudential effects against the relevant tolerance; capture what was observed rather than relying on a supplier’s theoretical SLA.
Governance and operational ownership
The board needs a clear summary of tolerance coverage, evidence limitations, supplier concentrations, tested failure points and unresolved remediation. The firm’s accountable senior managers and technical owners must be involved in accepting residual risk. External coordination and specialist testing do not transfer legal accountability.
Focused support rather than a generic large programme
Many deposit-taking firms already have extensive control frameworks. A targeted independent review of one important service, scenario suite or concentrated supplier may create more value than another broad policy rewrite. The appropriate engagement begins with the existing evidence and the board’s most material concerns.
Frequently asked questions
Does PRA SS1/21 cover UK banks?
Yes, the PRA lists UK banks and building societies among the entities to which the statement is relevant.
Does technology restoration prove service resilience?
Not by itself. Data integrity, process steps, staff, payments and customer effects must also be considered.
Can a bank commission only an independent exercise?
Yes. The scope should be agreed around relevant important services and evidence objectives.