Operational resilience compliance for UK firms and banks, with services that stay within tolerance when things break.

What it is

What are the Basel and UK operational resilience rules?

Operational resilience assumes disruption will happen and asks whether the services people depend on can keep going, or come back, before the harm becomes intolerable. The rules here come from two levels.

At the international level, the Basel Committee on Banking Supervision issued its Principles for operational resilience on 31 March 2021, alongside revised Principles for the sound management of operational risk. They are guidance for banks and supervisors, applied on a consolidated basis and in proportion to size and complexity. In the United Kingdom, the Prudential Regulation Authority and the Financial Conduct Authority set binding rules built on the same ideas: the PRA Rulebook's Operational Resilience Parts with supervisory statement SS1/21, and chapter SYSC 15A of the FCA Handbook.

EU financial entities subject to the Digital Operational Resilience Act should start with our DORA page.

Current position. The UK rules came into force on 31 March 2022, when firms had to have identified their important business services and set impact tolerances. The deadline to deliver the full outcome, being able to remain within those tolerances in severe but plausible scenarios, was 31 March 2025. FCA policy statement PS26/2, published in March 2026 and developed with the PRA and the Bank of England, adds operational incident and third party reporting from 18 March 2027.

Who it is for

Who needs operational resilience compliance?

The PRA's expectations reach UK banks, building societies, PRA-designated investment firms, UK Solvency II insurers and the Lloyd's market. The FCA's rules also cover recognised investment exchanges, enhanced scope SM&CR firms, payment and e-money institutions and several newer categories. Firms usually reach Sterling from one of four directions:

• Your supervisor has asked questions. A review, thematic letter or firm-specific request suggests tolerances, mapping or testing will not hold up.
• A client or tender asks how you stay resilient. Banks and insurers ask outsourcers and technology providers for mapping, test results and recovery evidence before contract award.
• You have a new permission or a new business line. Authorisation, a payments licence or an acquisition brings new important business services and puts the framework on a regulator's agenda.
• Your group runs several regimes at once. A UK subsidiary must line up with group Basel expectations, DORA in the EU or similar rules elsewhere, without three separate frameworks.

Requirements

What are the main operational resilience requirements?

The UK requirements follow the structure of SS1/21 and the PRA Rulebook's Operational Resilience Part, and SYSC 15A asks for the same building blocks with a focus on harm to consumers and markets. The Basel principles group the same ground into seven headings: governance, operational risk management, business continuity planning and testing, mapping of interconnections and interdependencies, third-party dependency management, incident management, and ICT including cyber security. This summary is in plain language; the regulators' texts decide.

• Important business services: identify the services which, if disrupted, could threaten the firm's safety and soundness, UK financial stability or, for the FCA, cause intolerable harm to consumers or markets.
• Impact tolerances: set, for each of those services, the maximum tolerable disruption, measured as a length of time plus any other relevant metrics.
• Actions to remain within tolerance: put in place the strategies, processes and systems that keep each service within its tolerance.
• Mapping: identify and document the resources, including third parties, that each important business service depends on.
• Scenario testing: test regularly whether each service can stay within tolerance in severe but plausible disruption scenarios, and learn from the results.
• Communications: the FCA expects internal and external communication plans ready for when an important business service is disrupted.
• Governance: the board approves and regularly reviews the services, the tolerances and the written self-assessment.
• Self-assessment: keep a written record of the approach, the testing, lessons learned, vulnerabilities and the remediation that follows.
• Groups: consider how group arrangements and shared services affect each entity's ability to remain within tolerance.

Achieving compliance

How do you achieve operational resilience compliance?

Compliance is not awarded; it is demonstrated to your supervisor, continuously. The work follows the logic of the rules themselves: decide what matters, decide how much disruption is tolerable, understand what could break it and prove you can recover.

1. 01
   Confirm which rules apply and to which entities.Establish whether the PRA, the FCA or both supervise each entity, which Rulebook Part applies and how group arrangements are handled.
2. 02
   Gap analysis: compare today's framework with the rules.Test services, tolerances, mapping, testing, communications, governance and the self-assessment against SS1/21, SYSC 15A and the Basel principles, and agree owners and dates.
3. 03
   Identify services, set tolerances and map them.Run workshops with business owners, agree metrics the board can approve and map each service down to its suppliers and systems.
4. 04
   Test severe but plausible scenarios and remediate.Design and run scenarios, record where tolerances would be breached, prioritise vulnerabilities and track the fixes to closure.
5. 05
   Approve the self-assessment and keep it current.The board approves the written self-assessment; reviews, retesting and updates follow whenever the business, its suppliers or its risks change.

Check the route before you sign. No body issues an operational resilience certificate in the UK, so treat any offer of one with suspicion. Ask a provider who will run the service workshops, how tolerances will be justified to the board, who designs the scenarios and whether the self-assessment will describe your firm or a template.

Cost

How much does operational resilience compliance cost?

Effort depends more on the shape of the firm than its size: a single payments entity with a few services differs greatly from a dual-regulated banking group with shared services. Every Sterling proposal is fixed, with each component shown.

Timeline

How long does operational resilience compliance take?

Plan in months. As an estimate, four to eight months takes a firm from a first gap analysis to a board-approved self-assessment backed by completed scenario tests. Firms with mature continuity plans and a clean supplier inventory move faster; groups with shared services and many outsourcers take longer, because mapping and remediation depend on other people's information.

Your engagement

What your operational resilience engagement includes

Sterling does not certify, attest or validate operational resilience; the PRA and the FCA supervise compliance, and we work alongside your legal advisers on questions of interpretation. The engagement follows Sterling OS™. You choose one of two support levels: Design™, where we guide your team through each deliverable, or Drive™, where our consultants manage the work and your people review and approve. Either way the outcome is the same, a framework the board owns.

• Gap analysis and plan

  Against SS1/21, SYSC 15A and the Basel principles, with owners, dates and board decisions set out.

• Services and tolerances

  Workshops, rationale papers and board papers for each important business service.

• Mapping and third parties

  Service maps that trace each service to the systems, teams, sites and suppliers behind it.

• Scenario testing

  A test plan, facilitated exercises, results and a remediation log tracked to closure.

• Self-assessment and governance

  A written self-assessment ready for board approval and supervisory review.

• Effivity and training

  Automate™ through Effivity, included at no additional cost, with Academy access and awareness training for your people.

Sustain™ follows approval: yearly refresh, new scenarios, supplier changes and the incident and third party reporting that applies from 18 March 2027.

Often combined with

Standards organisations pair with Basel and UK operational resilience

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
• BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
• CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• DORADORA compliance consulting for EU financial entities and ICT providers: ICT risk, incident reporting, resilience testing and third-party risk, evidenced.