Have you met the UK Financial Conduct Authority’s (FCA’s) deadline for operational resilience? Firms across the UK financial sector have until 31st March 2025 to map and test their services to comply with the new requirements for building operational resilience.
But compliance isn’t just about checking boxes. It’s an opportunity to strengthen your business and potentially unlock better insurance coverage and premiums.
Understanding the new FCA operational resilience rules
The FCA’s new rules aim to ensure firms can withstand operational disruptions and continue providing essential services to their customers. This involves identifying “important business services“ (IBS), setting “impact tolerances” – the maximum tolerable disruption – and robustly mapping and testing these services. Ultimately, firms must stay within their impact tolerances. Failure to do so requires FCA notification.
Examples of IBS events that could require notification to regulators
- Third-party service provider software update failure (July 2024). See CrowdStrike example
- Financial crime control failures (October 2024). See Starling Bank example
- Anti-money laundering failures (November 2024.) See Metro Bank example
- Oversight of tech firms providing critical services (January 2025). See news report
- Compensation for IT Failures (March 2025). See Barclays example
Which firms are affected?
The regulations impact a wide range of firms, including banks, insurers, electronic money institutions, payment institutions, PRA-designated investment firms, and building societies.
The link between operational resilience and insurance
A firm with strong operational resilience is less risky and less likely to experience significant disruptions that lead to financial losses and insurance claims. The process of mapping and testing IBS forces firms to understand their vulnerabilities and expose potential failure points. This enables more accurate risk assessment and, therefore, more appropriate insurance.
If you can demonstrate to insurers that you have taken proactive steps to improve your operational resilience, it can lead to more favourable policy terms and premiums. Insurers will view your firm as a lower risk, rewarding your efforts with better deals.
How to turn compliance into a competitive advantage for insurance
Firms that have prepared for the March deadline can use this due diligence to improve their insurance position as follows:
- When renewing or seeking new insurance policies, present your operational resilience framework, including details on IBS identification, impact tolerances, and testing results.
- Quantify how your operational resilience improvements have reduced specific risks. For example, demonstrate how enhanced cybersecurity measures (identified through mapping and testing) have reduced the likelihood of a data breach.
- Work with your broker and insurer to identify areas where your steps to improve operational resilience can directly translate into lower premiums or expanded coverage.
- Insurance products designed to cover ongoing monitoring of operational resilience risk, such as those offered by Elmore, that take a proactive risk management approach through the Regulatory Audit as a Service (RAaaS).
Addressing common challenges
Recent webinars by fscom, the governance, compliance and risk consultancy, and the Payments Innovation Forum (PIF) have highlighted several common challenges firms face in implementing operational resilience. For instance, a vague or non-existent operational resilience strategy hinders effective implementation. Clearly defined roles and responsibilities are crucial. Identifying too many or too few IBS can lead to inefficiencies and gaps in coverage, and simply mirroring Recovery Time Objectives (RTOs) without considering backlog considerations is insufficient.
Impact tolerances should incorporate multiple metrics beyond just time. And while technology mapping is often strong, mapping dependencies on human behaviour is frequently weaker, leading to overlooked vulnerabilities. Finally, testing must involve critical third parties and simulate genuine disruption scenarios to be effective.
By addressing these challenges and implementing a strong operational resilience framework, firms can not only meet the FCA’s requirements but also unlock valuable improvements in their insurance coverage and premiums.
Make compliance a strategic opportunity
The FCA’s operational resilience regulations are more than just a compliance burden. They present a strategic opportunity for firms to strengthen their business, gain a deeper understanding of their risks, and improve their insurance outcomes. By embracing a proactive approach to operational resilience, firms can build a more resilient future and secure better insurance coverage along the way.
Find out how Elmore can help you build resilience.