FCA & PRA Operational Resilience — Important Business Services & Impact Tolerances
UK banks, insurers, payment firms and many investment firms must identify their important business services, set impact tolerances for maximum tolerable disruption, map the people, technology and suppliers behind them, and prove through scenario testing that they can stay within tolerance.
Since 31 March 2025 firms must be able to remain within those tolerances. Mutex Systems connects operational resilience to cyber reality — ransomware, cloud outages and supplier compromise — and strengthens the technical controls behind each service.
- Category
- Compliance Framework
- Jurisdiction
- United Kingdom
- Issuing Body
- Financial Conduct Authority and Prudential Regulation Authority
- Current Version
- PS21/3 and SS1/21 — firms had to remain within impact tolerances by 31 March 2025
- Who It's For
- FCA and PRA-regulated firms, and technology providers supporting their important business services.
Core Domains
A Practical Compliance Path
- 01
Review IBS & tolerances
Challenge and refine important business services and impact tolerances.
- 02
Map dependencies
Map systems and suppliers that each service relies on.
- 03
Cyber scenario testing
Test ransomware, cloud and supplier scenarios, including technical recovery.
- 04
Remediate & self-assess
Fix vulnerabilities found and update the self-assessment.
Resilience proven technically
We test cyber scenarios against real systems — backups, failover, detection — so the self-assessment reflects what will actually happen.
- Ransomware and cloud-outage scenarios
- Supplier dependency mapping
- Links to DORA for firms with EU entities
Operational resilience and DORA together
grComply maps PS21/3 and SS1/21 requirements to DORA and ISO 22301, tracks scenario-test results and keeps the self-assessment evidence current.
- IBS and tolerance register
- Scenario test evidence
- Cross-mapping to DORA and ISO 22301
- Third-party register
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About UK Operational Resilience
What is an impact tolerance?
The maximum tolerable level of disruption to an important business service, usually expressed as a maximum time, beyond which consumers or market integrity would suffer intolerable harm.
What was the 31 March 2025 deadline?
By that date firms had to be able to remain within their impact tolerances for each important business service in severe but plausible scenarios.
How does UK operational resilience relate to DORA?
They pursue similar goals. UK firms follow FCA and PRA rules; their EU-authorised entities follow DORA. Many groups align both to a single control set.
Ready to Start Your UK Operational Resilience Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.