Why operational resilience matters to financial firms and what UK, EU and US rules require

Operational resilience has become an area of increasing focus in recent years, particularly in the financial services sector, and rightfully so. The financial sector is interconnected and interdependent. Operational disruption in one area of the market can threaten other areas and cause huge market turmoil. It is therefore of no surprise that it is vital for consumers, firms and financial markets to remain resilient to avoid financial failures and to protect market integrity.

What is operational resilience?

Operational resilience is a firm's ability to keep delivering its most important services through a disruption.

The Basel Committee on Banking Supervision (BCBS) defines it in its March 2021 Principles for operational resilience as “the ability of a bank to deliver critical operations through disruption.”

A firm is operationally resilient when a cyber-attack, a technology failure or a pandemic does not stop customers from getting the services they depend on. A bank that keeps payments flowing while it repairs a failed system is one example.

Operational resilience is owned by each firm and overseen by its regulators. The BCBS says a bank should assume that disruptions will occur. In the UK, the FCA's rules in SYSC 15A require a firm to identify its important business services and to set an impact tolerance for each one.

The 2008 reforms left operational resilience unaddressed

Following the 2008 financial crisis, we saw reforms to bank frameworks and structural changes that address and strengthen financial resilience. These changes, however, did not address operational resilience. In 2021, the BCBS noted that action was needed to strengthen financial firms' ability to absorb operational risk-related events, such as pandemics, cyber-attacks and technology failures.

The war in Ukraine is a clear example of the importance of investment in operational resilience strategies. The sudden geopolitical uncertainty brought on by the war triggered sudden policy responses, including sanctions imposed on Russia, escalated commodity prices, and influenced energy market and infrastructure stress, all of which contributed to increased volatility and risk aversion. This was magnified by the demand and supply chain disruptions brought on by the post-COVID-19 environment.

The layers upon layers of disruptions over the past few years have persistently kept operational resilience near the top of the agenda in all sectors, particularly in the financial sector. But are all financial firms confident in their operational resilience?

Credit Suisse bank collapsed in March 2023 after a colorful history of errors and scandals, eventually destroying the bank's market confidence. Silicon Valley Bank collapsed in the same month after a poor risk management strategy left the bank with insufficient funds to meet the needs of their clients. Operational resilience may seem like a buzz word, but without it, organizations can crumble.

UK, EU and US firms face different obligations

UK firms must identify important business services and set impact tolerances

The UK introduced a new operational resilience framework which took effect in March 2022. Under this new regime, firms and FMIs must identify their important business services, set impact tolerances for each service and ensure they are able to deliver on each service and remain within the impact tolerance during severe (but plausible) scenarios.

Another statutory framework, created by the Financial Services and Markets Act 2023, manages systemic risks raised by critical third parties (CTPs).

EU firms: the Digital Operational Resilience Act has applied since January 17, 2025

In the EU, the Digital Operational Resilience Act (DORA) was adopted by the European Parliament in 2022 and has applied since January 17, 2025. Similarly to the UK, DORA aims to improve the operational resilience of financial institutions. It requires financial institutions to have a fully comprehensive ICT risk management framework and to assess risks relating to third-party services.

US firms: sound practices drawn from existing guidance

The US federal banking regulators issued the interagency paper “Sound Practices to Strengthen Operational Resilience” on October 30, 2020. It identifies and consolidates existing guidance that can be used to form an operational resilience framework for the largest and most complex domestic banking organizations.

Continuous risk assessment keeps financial firms inside their impact tolerances

Financial firms need to take a proactive and comprehensive approach to operational resilience, continuously assessing their risks and implementing measures to prevent, detect and respond to potential disruptions. For a firm, the practical meaning is knowing which services matter most, how much disruption each can take and whether it can stay inside that limit under a severe but plausible scenario.