Reviewed and updated on 20 October 2026.
The FCA’s operational resilience rules took effect on 31 March 2022. Firms in scope had until 31 March 2025 to complete the work needed to operate important business services within their impact tolerances. That deadline was the end of a transition period, not the end of the work.
Check the FCA’s scope and requirements with the person responsible for your firm’s compliance. The rules do not apply identically to every financial services business.
Start with the service customers depend on
An important business service is more than a server or application. Map the people, processes, technology, information and external suppliers needed to deliver it. This helps show how a failure in one dependency could affect customers.
An impact tolerance concerns the maximum tolerable disruption to that service. An IT recovery target is one input to the wider assessment; restoring a server alone does not demonstrate that the service can operate within tolerance.
Turn recovery plans into evidence
For the technology supporting each service, keep records of:
- The systems, data and suppliers it depends on.
- Who can authorise recovery and contact the relevant teams.
- What was tested, the scenario used and the observed result.
- Gaps, responsible owners and the dates for remediation and retesting.
- Changes that could affect recovery, including migrations and supplier changes.
Scenario testing should explore severe but plausible disruption. Include dependencies outside your direct control, rather than assuming every supplier and communication channel remains available.
Keep the review active
The FCA’s observations one year after the deadline reinforce the need for continuing improvement. Review evidence as services change and use test results to direct investment.
Where CIS can help
CIS can support the underlying IT work through managed support, cyber security and backup and recovery. Your firm remains responsible for its regulatory assessment, impact tolerances and compliance decisions.
Talk to CIS about the technology and recovery evidence your firm needs.
