FCA operational resilience: which important business service only works because nothing severe has happened yet?

A platform can meet its uptime target and still leave customers exposed when a payment queue, identity provider or manual workaround fails under pressure. FCA operational-resilience rules ask in-scope firms to begin with the important business service and the intolerable harm caused by disruption, then map the people, processes, technology, facilities, information and third parties needed to stay within impact tolerance. The transition period ended on 31 March 2025; by 2026, the question is whether the evidence survives real change and severe but plausible testing. The first commercial opportunity is a one-service failure-mode review that connects impact tolerance to dependencies, scenarios, workarounds and remediation. This reading shows how a technology or cyber-resilience specialist can sell that bounded decision and build recurring testing assurance without promising uninterrupted service, regulator approval, incident prevention or recovery within every scenario.

By 31 March 2025, firms in scope were expected to have completed mapping and testing so each important business service could remain within its impact tolerance, with necessary investment underway or completed. The deadline did not end the obligation: services, tolerances, mappings, tests and self-assessments must keep evolving.

The FCA’s March 2026 observations show continuing focus on board challenge, clear methodologies, vulnerabilities and owned remediation. A dated transition plan is therefore not a mature evidence set. Buyers need to know which service has changed since its last credible test.

An impact tolerance marks the maximum tolerable disruption to an important business service before consumer harm or market-integrity risk becomes intolerable. A recovery-time objective concerns restoring a system; recovery may need to occur earlier so backlogs, manual processing and customer effects remain within the broader tolerance.

Use time with complementary measures where relevant: affected customers, transaction value, backlog, vulnerable-customer exposure or market impact. The rationale should explain why the boundary is intolerable, not merely copy a technology target.

The first purchase should review one important business service against one severe but plausible failure mode. It should end with a service boundary, tolerance rationale, dependency map, test evidence, workaround limits, vulnerabilities, named remediation and a decision to accept, fix, retest or escalate.

One service keeps the evidence room bounded while exposing the real operating model. The specialist interviews service, technology, operations, risk and supplier owners; the governing body retains responsibility for the firm’s judgements and self-assessment.

Useful mapping connects the service to people, processes, technology, facilities, information and third parties at enough depth to support testing and remediation. A cloud diagram alone misses decision rights, manual work, data quality, customer communication, physical access and supplier dependencies that can determine whether harm remains tolerable.

A severe but plausible scenario combines credible causes and stressed conditions that expose the service’s weakest dependencies without becoming fantasy. It should test decisions, communications, third parties, capacity and recovery over the full customer-impact period, not stop when a technical component returns online.

Use incidents, threat intelligence, supplier failures and near misses to design scenarios. Vary one important assumption at a time—duration, time of day, concurrent failure or staff availability—so lessons remain attributable and actionable.

A firm cannot outsource accountability for its important service. Supplier contracts, architecture, recovery evidence, incident communication, concentration and exit options must support the firm’s tolerance; where direct testing is limited, the firm needs alternative assurance and explicit uncertainty.

A supplier review should ask what the firm can observe and influence during disruption. Shared platforms may create correlated risk across services. Exit plans should identify data, competence, sequence and interim service—not merely a termination clause.

A recurring service refreshes service maps, samples changes, designs and observes scenarios, tracks vulnerabilities, challenges supplier evidence and updates self-assessment inputs. It earns renewal by keeping the resilience argument aligned with releases, incidents and business change rather than repeating one annual tabletop.

Cadence should follow material change and service risk. Report retest status, overdue remediation, untested workarounds, dependency concentration and assumptions that the board must accept or fund.

A cloud migration, core release, material outsourcing, merger, incident, failed test, new important service or board challenge creates a credible buying event. Outreach should name the service and evidence decision, not suggest that every technology change causes a regulatory breach.

Target firms in scope of the FCA policy and technology suppliers serving them. Search captures named concerns; risk and legal partners refer governance gaps; selected account outreach can use observable transformation events. The qualification call must reach both service and technical owners.

Launch when the specialist can work from an important business service, preserve regulatory and customer data, test a credible failure mode and deliver owned remediation without assuming the board’s judgement. The partner firm must provide service, technology, risk, operations and supplier access.

FCA PS21/3, Handbook rules and 2024–2026 observations bound public claims. The separate insurance draft should later become a vertical query path, not a duplicate framework. No results, tolerance or regulator outcomes are invented.

GetFishNet can test whether your resilience expertise, regulated audience, first review and delivery capacity form a credible acquisition opportunity. The free eligibility test examines current acquisition pain points and synergies without promising clients, revenue, uninterrupted service or regulatory outcomes.

If one important service carries a costly evidence gap, we can design a tailored multichannel route around that decision and test the market before expanding.

Test your eligibility