Operational Resilience in Financial Services: Avoiding the Top 10 Post-Implementation Pitfalls

Introduction

Operational resilience remains a key supervisory priority for both the Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA). With the 31 March 2025 implementation deadline now passed, regulatory attention has shifted from programme delivery to evidencing effectiveness. Firms are expected not only to have operational resilience frameworks in place, but also to demonstrate that they are embedded within the business, regularly tested and capable of responding to real-world disruption.

Whilst the operational resilience rules apply to specific categories of regulated firms, recent regulatory communications, particularly from the FCA, have reinforced the importance of resilience across a broad range of business activities. Many of the principles underpinning the regime represent sound business practice and provide valuable guidance for any organisation seeking to strengthen its ability to anticipate, respond to and recover from disruption.

In an increasingly uncertain and interconnected operating environment, operational resilience has evolved beyond a purely regulatory requirement. Firms that can demonstrate robust resilience arrangements are better positioned to maintain customer trust, protect their reputation and deliver critical services during periods of stress. As regulatory expectations continue to develop, organisations must ensure that resilience is embedded throughout their operations and supported by effective governance, testing and continuous improvement.

This 2-hour live and interactive course is aimed at senior compliance practitioners, risk, operational resilience and operational staff (including SMF24 holders).

What You Will Learn

This live and interactive session will cover the following:

• Testing - the challenges involved in testing beyond the point of failure and how to overcome them
• Crisis management - how to actively involve the Crisis Management Team
• Third party risk management - there is an expectation that you understand your entire supply chain. How realistic is this and how do you achieve it?
• Communication plans - how to turn the policy that many firms have into a workable plan that can be deployed under stress
• Justification of impact tolerances and important business services is often inadequate - how you do this when they are probably correct to start with
• Mapping - how to avoid the Goldilocks scenario where your mapping is either too granular or not granular enough to satisfy the Regulators
• Self-assessment documents are getting more unwieldy with each iteration - this session will discuss how to prevent this happening and save a large amount of time on the exercise

Recording of live sessions: Soon after the Learn Live session has taken place you will be able to go back and access the recording - should you wish to revisit the material discussed.