UK FCA findings from multi-firm review on the operational resilience of trading venues

The UK Financial Conduct Authority (FCA) published the findings from its multi-firm review assessing the cyber and operational resilience of a sample of UK trading venues. The FCA found that trading infrastructure is generally resilient, but states that there are lessons to learn, and that venues need to understand all their dependencies and test resilience right across their supply chains.

Areas of good practice included clear ownership of important business services, clear links between mapping and testing, formal tracking of lessons learned and remediation and regular testing of business continuity and disaster recovery arrangements. The most common areas for improvement included the following:

• Accountability and independent assurance: some venues had limited evidence that their boards had reviewed, challenged or approved resilience activities and remediation plans. Some venues that were part of a wider group of firms had not clearly defined the responsibility of the UK regulated entity for the resilience of its UK activities. Several venues relied on frontline teams to identify and assess reliance risk, but venues did not always provide sufficient independent challenge and assurance over these resilience risks.
• End-to-end understanding of business services and their dependencies: mapping sometimes failed to consider wider group dependencies. Some venues did not know the dependencies between third parties supporting important business services and had a limited understanding of their concentration risk.
• Managing intra-group and third-party services: while third-party contractual arrangements were generally in place, venues' due diligence, contractual standards and exit plans were not always suited to the importance of the service.
• Testing response and recovery arrangements: venues did not always test whether they could recover services as part of their change activities. They focused on whether a change had been implemented successfully, rather than what would happen if it caused disruption.
• Incident escalation, lessons learned, and remediation: some venues relied on informal processes to escalate issues, such as staff group chats, without keeping governance records. It was not always clear from venues' risk frameworks how lessons from incidents informed their remediation practices.

The FCA is not introducing new requirements at this stage. Instead, the FCA advises venues to review the findings in the context of their own business models and broader changes in the market. It also reminds them to prepare for the FCA's operational incident reporting rules, which come into force on 18 March 2027, so they can consider any changes they need to make to their processes and systems.

Return to main website.