Operational resilience is a board obligation, not an IT project

Operational resilience is not business continuity renamed

The change these regimes made is a change of question. Traditional business continuity planning asked whether a firm could survive a shock and eventually restore its systems. Operational resilience asks something harder and more specific: for each service that matters to the outside world, what is the maximum disruption the firm can absorb before real harm is done, and can the firm stay inside that limit through a severe but plausible event. The UK regulators, the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority, define operational resilience as the ability to prevent, adapt to, respond to, recover from and learn from operational disruption. The verbs matter. Recovery is only one of five, and it is no longer the whole of the duty.

That reframing moves the obligation from the technology function to the board. A continuity plan can be written by an operations team and filed. An impact tolerance is a statement, owned by the board, about how much harm to customers and markets the firm is willing to risk, and it commits the firm to spend whatever it takes to stay within that statement. It cannot be delegated downward, because it is a judgement about the firm's obligations to the people who depend on it, not a technical recovery-time objective. The two regimes that now govern this, the UK's operational resilience rules and the EU's Digital Operational Resilience Act, arrive at that same board-level duty by different routes, and both point at the same uncomfortable place: the parts of the service the firm does not run itself.

This article sets out the UK regime under PS21/3, the concept of impact tolerance that drives it, the EU regime under DORA, how the two compare, the third-party problem both are really about, what changes next, and how the frameworks reach a cross-border group. It is a Risk Governance analysis for regulated firms and the groups that own them.

The UK regime under PS21/3

The UK framework was set by the regulators in March 2021 and has been binding since 2022. The FCA published Policy Statement PS21/3 and the PRA published PS6/21, together with supervisory statements, and the rules came into force on 31 March 2022. Firms in scope, which include banks, building societies, insurers, and a range of FCA-regulated investment and payment firms, were then given a transitional period running to 31 March 2025 by which they had to be able to remain within their impact tolerances for important business services in severe but plausible scenarios, having made the investment that requires.

The regime is built from a small number of defined steps, and each is a discipline rather than a document. The firm must identify its important business services, the services whose disruption would cause intolerable harm to clients or risk to market integrity or its own soundness, rather than listing its internal systems. It must set an impact tolerance for each. It must map the people, processes, technology, facilities and third parties that deliver each service, to the level of detail needed to find the weak points.

It must then carry out scenario testing against severe but plausible disruptions to confirm whether it can stay within tolerance. And it must produce and maintain a self-assessment document, approved by the board, that records all of this and the vulnerabilities it has found and is remediating. The self-assessment is the artefact a supervisor asks for first, and it is evidence of a live process or it is nothing.

Impact tolerance is the concept that changes the board conversation

The single idea that makes operational resilience different is the impact tolerance, so it is worth stating precisely. An impact tolerance is the maximum tolerable level of disruption to an important business service, usually expressed as a duration, before the disruption would cause intolerable harm to consumers or to market integrity, or threaten the firm's safety and soundness. It is not a recovery-time objective set by what the technology can currently achieve. It is set by what the outside world can tolerate, and the firm is then obliged to close the gap between the two.

That inverts the usual planning logic. Instead of asking how quickly systems can be restored and calling that the target, the board first fixes the point at which harm becomes intolerable, and the restoration capability then has to be built or bought to meet it. If a payment service cannot be down for more than a defined period without customers being unable to meet their own obligations, that period is the tolerance, and an internal recovery capability slower than it is a vulnerability the board must fund its way out of. The impact tolerance is therefore a spending commitment disguised as a metric, which is exactly why the regulators placed it at board level and why it is the number a supervisor probes first.

The EU regime under DORA

The EU reached the same destination through a single directly applicable regulation. The Digital Operational Resilience Act, Regulation (EU) 2022/2554, together with the accompanying Directive (EU) 2022/2556, has applied since 17 January 2025. It covers almost all EU financial entities, including banks, insurers and reinsurers, investment firms, payment and electronic-money institutions, and crypto-asset service providers, and it reaches their ICT third-party providers. Where the UK rules are outcome-focused and principles-based, DORA is more prescriptive and is built explicitly around digital and ICT risk.

DORA rests on five pillars. The first is ICT risk management, a governance framework owned by the management body. The second is ICT-related incident management, classification and reporting to competent authorities on defined timelines. The third is digital operational resilience testing, including threat-led penetration testing for the larger entities. The fourth is ICT third-party risk management, including contractual requirements and the Register of Information on all ICT third-party arrangements that Article 28(3) requires each entity to maintain and produce to its competent authority. The fifth is information sharing on cyber threats under Article 45.

Above the individual entity sits an EU oversight framework for critical ICT third-party providers, run by the European Supervisory Authorities, which brings the largest technology suppliers to the financial sector under direct supervision for the first time.

The two regimes compared

The UK and EU frameworks share a purpose and differ in method, and the differences decide what a firm in each has to build. The table sets them side by side on the axes that matter to a board.

The practical reading is that the UK asks a firm to prove it can keep its important services inside a tolerance through any severe disruption, while DORA asks it to run a detailed, testable ICT-resilience system with heavy third-party documentation. A firm caught by both does not get to choose one. It maps its important business services once, then satisfies the UK's outcome test and DORA's prescriptive requirements against the same underlying reality, which is more efficient to design together than to reconcile afterward.

The third-party problem both regimes are really about

Strip away the differences and both frameworks are aimed at the same exposure: the firm depends on suppliers it does not control, and a failure at one of them can take down a service the firm is answerable for. This is where the regimes have moved fastest.

DORA requires each financial entity to maintain a Register of Information on every contractual arrangement for ICT services under Article 28(3), at entity and group level, and to make it available to the competent authority, and it subjects providers designated as critical to direct EU oversight by the European Supervisory Authorities. The register is not a formality; it is the map regulators use to see where the whole sector is concentrated on a handful of cloud and technology suppliers.

The UK built a parallel mechanism. Under powers in the Financial Services and Markets Act 2023, the regulators made rules for a critical third parties regime, with the final rules taking effect from 1 January 2025, under which the largest suppliers to the financial sector can be designated by HM Treasury on the regulators' recommendation and then held to resilience requirements directly. The logic is identical on both sides of the Channel: a supervisor cannot ensure the resilience of the firms it regulates while ignoring the shared suppliers on which those firms have all come to depend. For a firm, the consequence is that third-party risk is no longer something to be managed quietly in procurement. It is mapped, registered, tested and, for the critical suppliers, supervised.

What changes next

The frameworks are still tightening, and the next steps are already dated. In the UK, the operational resilience regime is being extended by new operational incident and third-party reporting requirements: from 18 March 2027, firms will have to report material operational incidents to the regulators within short windows, reported as within 24 hours of determining that a threshold has been met, and within a shorter period for payment service providers, assessed against broad outcome-based tests rather than only incidents affecting an important business service. That moves the UK closer to DORA's prescriptive incident-reporting posture. On the EU side, the detailed regulatory and implementing technical standards under DORA continue to bed in, and the oversight of the first designated critical ICT third-party providers is moving from designation into active supervision.

The direction of travel is one to plan around rather than react to. Both regimes are converging on the same shape: mapped important services, defined tolerances, tested resilience, documented third-party dependencies, and fast incident reporting. A firm that treats each new requirement as a separate project will keep rebuilding the same map. A firm that maintains a single, current picture of its important services and the dependencies beneath them can meet each new obligation as an output of that picture rather than a fresh exercise.

The corridor dimension

For a cross-border group the frameworks stack rather than substitute, which is the point most easily missed. A UK-regulated firm is subject to the PS21/3 operational resilience rules and the UK critical third parties regime. An EU-regulated entity, including one established in Ireland, is subject to DORA in full. A group with both a UK-regulated firm and an EU-regulated entity is therefore subject to both frameworks at once, and the efficient response is to map the group's important services once and satisfy each regime against that single map, rather than run two disconnected programmes.

The reach also runs through the supply chain. A technology or outsourcing business, wherever it is established, that provides ICT services to EU financial entities can be drawn into DORA's third-party requirements through its clients' contracts and, if it becomes systemically important to the sector, into the critical-provider oversight framework. A group in the UK-UAE-Ireland corridor that either is a regulated financial entity or supplies critical services to one cannot treat operational resilience as a single-jurisdiction compliance item. The related governance obligations that sit alongside it, the UK Senior Accounting Officer duty and the failure-to-prevent-fraud regime, are set out in the Senior Accounting Officer analysis and the failure to prevent fraud analysis, and the financial-crime reporting layer that overlaps with ICT and data controls is examined in the CARF crypto reporting analysis.

Frequently asked questions

What is operational resilience?

Operational resilience is the ability of a firm to prevent, adapt to, respond to, recover from and learn from operational disruption, as defined by the UK regulators, the Bank of England, the PRA and the FCA. It is broader than business continuity, because it does not stop at restoring systems after an incident. It requires a firm to identify the services that matter to the outside world, decide how much disruption to each is tolerable before real harm is done, and be able to stay within that limit through a severe but plausible event. It is treated as a board-level obligation, not a technology task.

What is an important business service?

An important business service is a service a firm provides to an external client or to the market whose disruption would cause intolerable harm to consumers, risk to market integrity, or a threat to the firm's own safety and soundness. The concept deliberately looks outward. A firm identifies important business services rather than internal systems or processes, because the regime is concerned with harm to the people who rely on the service, not with the firm's internal architecture. Each important business service is the unit to which an impact tolerance is then attached and against which the firm tests its resilience.

What is an impact tolerance?

An impact tolerance is the maximum tolerable level of disruption to an important business service, usually expressed as a period of time, before the disruption causes intolerable harm. It is set by reference to harm to consumers and markets, not by what a firm's technology can currently deliver, which is what distinguishes it from a recovery-time objective. Once set, it becomes an obligation: the firm must be able to remain within the tolerance in severe but plausible scenarios, and must invest to close any gap between the tolerance and its actual capability. UK firms had until 31 March 2025 to reach that standard.

Who does DORA apply to?

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, applies to almost all EU financial entities, including banks, insurers and reinsurers, investment firms, payment and electronic-money institutions and crypto-asset service providers, and it reaches the ICT third-party providers that serve them. It has applied since 17 January 2025. Its reach extends beyond the EU in practice, because a non-EU technology provider that supplies ICT services to EU financial entities is brought within its third-party requirements through its clients, and can, if designated critical, fall under the EU oversight framework.

What is the difference between UK operational resilience and DORA?

Both pursue the same goal, but by different methods. The UK regime under PS21/3 is outcome-based and covers all operational disruption: it asks a firm to keep its important business services within defined impact tolerances through severe but plausible scenarios and to evidence this in a board-approved self-assessment. DORA is a prescriptive EU regulation focused specifically on digital and ICT resilience, built on five pillars with detailed technical standards and a Register of Information on ICT third parties. A firm subject to both maps its services once and satisfies the UK outcome test and the DORA rules against the same underlying picture.

What is a critical third party?

A critical third party is a supplier whose services are so widely relied upon across the financial sector that its failure could threaten the stability of the system, and which is therefore subject to direct regulatory oversight rather than being supervised only through its clients. In the EU, DORA creates an oversight framework for critical ICT third-party providers run by the European Supervisory Authorities. In the UK, the critical third parties regime under the Financial Services and Markets Act 2023, in force from 1 January 2025, allows the largest suppliers to be designated and held to resilience requirements directly. Both regimes recognise that shared suppliers have become a point of concentrated risk.

When did the operational resilience rules take effect?

In the UK, the FCA's PS21/3 and the PRA's PS6/21 were published in March 2021, the rules came into force on 31 March 2022, and firms had until 31 March 2025 to be able to remain within their impact tolerances for important business services in severe but plausible scenarios. In the EU, DORA has applied since 17 January 2025. New UK operational incident and third-party reporting requirements are due to take effect from 18 March 2027, moving the UK regime closer to DORA's prescriptive incident-reporting approach.

Does operational resilience apply to firms outside the EU and UK?

Directly, the regimes bind regulated financial entities in their respective jurisdictions, but their effect reaches further. A firm anywhere that provides ICT services to EU financial entities can be pulled into DORA's third-party requirements through its clients' contracts and into the critical-provider oversight framework if it becomes systemically important. A group operating across the UK, the EU and third countries such as the UAE will often find that a regulated entity in the group triggers one or both regimes, and that suppliers elsewhere in the group are drawn in as ICT third parties. The frameworks are territorial in form but global in reach through the supply chain.

---

Critical advisory. Operational resilience is a board obligation with a documented, testable output, and the two regimes that now govern it, the UK's PS21/3 framework with its critical third parties regime and the EU's Digital Operational Resilience Act, converge on the same demand: know your important services, know the tolerance beyond which harm becomes intolerable, know every dependency beneath them including the third parties you do not control, and be able to prove all three to a supervisor. For a group that spans the UK and the EU, or that supplies ICT services into the regulated sector, the frameworks stack, and mapping the group's services once against both is the difference between one coherent programme and several overlapping ones. Whether a particular entity is in scope, what its important business services are, and how the UK and EU obligations apply across a corridor group are questions that turn on the group's specific regulated permissions, structure and supply chain. We work with regulated firms and the groups that own them across the UK, the UAE and Ireland on exactly that mapping and the governance evidence behind it. This article is general information and not legal or regulatory advice, and a firm's own position should be confirmed against its specific facts and permissions before it acts.