FCA publishes insights into firms’ work on operational resilience rules

The FCA has recently published its observations on the work firms have undertaken so far to comply with the operational resilience rules which were introduced on 31 March 2022. This article looks at some of the insights from the FCA.

Background

In the aftermath of the disruption caused by Covid-19, the rules were developed to prevent harm to consumers and instability within the financial services sector due to operational disruption. Firms are currently within a transitional period and have until 31 March 2025 to comply with the rules.

Operational disruption has been a focus of the FCA, and minimising its impact is one of the FCA’s commitments in its 2024/2025 business plan. The operational resilience rules are just one part of the wider work that the FCA has been undertaking on operational resilience. It has also recently consulted, in conjunction with the Bank of England and the PRA, on proposed rules for the oversight of providers of critical third-party services. For more information on that consultation please see our Bulletin article here.

The rules

The operational resilience rules apply to all Solvency II insurers. Insurance intermediaries may also be in scope where they are enhanced scope SM&CR firms.

Under the rules a firm must:

1. identify its important business services;
2. set impact tolerances for each of those services;
3. use mapping to identify and document the people, processes, technology, facilities, and information necessary to deliver each of its important business services;
4. using severe but plausible disruption scenarios, identify vulnerabilities which may result in it failing to remain within its impact tolerances; and
5. develop testing plans that detail how it can remain within its impact tolerances.

Operational resilience is defined as the ability of firms, and the financial sector as a whole, to prevent, adapt, respond to, recover and learn from operational disruptions. The rules ask firms to assume that major operational disruptions will occur and have in place robust and reliable policies and procedures to deal with those disruptions within specific impact tolerances.

Business services will qualify as important under the rules where a firm provides services to an external end user and failure of those services could, among other things, threaten policyholder protection or cause intolerable levels of harm to consumers, market participants or market integrity.

Insights

Some of the observations that the FCA has made in its recent publication include that:

1. firms must be able to justify the services they have identified as important but equally must consider the rationale and justification for not identifying a service as important;
2. rationales for impact tolerances should be sufficiently detailed so that the FCA can fully understand how those tolerances have been set. Senior management must also be able to understand the tolerances that a firm has set and why;
3. some firms have shown limited:
   a. evidence of testing response plans; and
   b. understanding of whether they can remain within their impact tolerances,
4. the most effective operational resilience frameworks are embedded within firms’ overarching risk frameworks, including playing a part in a firm’s change management and strategic planning.

The high-level message from the FCA is that firms need to be working on embedding compliance with the rules into overall firm culture. The FCA has reminded firms that, whilst 31 March 2025 marks the end of the transitional period, the requirement to be operationally resilient is not a tick-box exercise.