UK FCA good and poor practice on demonstrating operational resilience in practice

The UK Financial Conduct Authority (FCA) published the findings from its supervisory insights and observations of firms' annual operational resilience self-assessments between 2025–26 on firms' compliance with its rules on operational resilience. The FCA notes that firms have made good progress on operational resilience since the transition period ended in March 2025. However, it finds that firms could do more to demonstrate what they can deliver now during severe but plausible disruption, rather than relying on planned remediation, transformation programmes or future investment.

The FCA identifies improving the quality of evidence as the main area for development in firms' next self-assessments. It also sets out other areas for improvement, where it has observed some firms:

• pointing to future improvements or transformation plans without explaining whether they can remain within impact tolerance now
• relying on assumptions about third-party, group, or shared service resilience without showing how those assumptions have been tested or challenged
• relying on manual workarounds without showing how they would operate during a severe disruption, and whether they are scalable for a large number of impacted users and/or services, particularly over an extended period
• reporting few or no vulnerabilities without evidence of how those conclusions were reached
• providing limited evidence that communications would work if usual channels were unavailable, degraded or compromised
• relying on board approval of the self-assessment as the main evidence of oversight, without showing the nature of challenge, decision making or prioritisation.

Firms are advised to demonstrate that they understand their residual risk, and how testing, incidents and second- and third-line input have informed decisions. The FCA will continue to discuss operational resilience with firms as part of its supervisory engagement.

Return to main website.