Operational Resilience Is Now a Regulation

The Decision in Front of You

For two decades, business continuity in most firms meant a disaster recovery plan for the data center and a call tree. Regulators in four major jurisdictions now ask, for each service customers depend on, how long it can be down before the harm becomes intolerable, and whether the firm can prove it would recover inside that limit.

The decision is whether to build that capability now, on your own schedule, or to build it under a supervisor's finding or a customer's contract deadline. For a regulated financial firm the obligation already applies. For a technology, payments, data or outsourcing company that sells to financial firms, the same terms arrive through procurement, because those firms must show their regulators that each critical supplier meets them.

This paper takes no position on the rules themselves. It describes what they require and how to meet them.

What's Happening

Four regimes, one model

EU: DORA. Regulation (EU) 2022/2554, the Digital Operational Resilience Act, has applied since January 17, 2025, to 20 types of financial entity and to their technology providers ¹². It covers ICT risk management, incident reporting, resilience testing, third-party risk, and oversight of critical providers ¹. Firms identified by their supervisors must run threat-led penetration tests on live production systems at least every three years ². Every firm must keep a register of information listing all its contracts for technology services ². Contracts for services that support critical or important functions must include precise service levels, audit and access rights, exit strategies with transition periods, and the provider's participation in the firm's threat-led testing ².

UK: FCA PS21/3 and PRA SS1/21. The UK rules took effect on March 31, 2022. Firms had to identify their important business services, set an impact tolerance for each, and map and test them ⁵. An impact tolerance is the first point at which disruption to a service would cause intolerable harm to consumers or risk to market integrity ⁵. By March 31, 2025, firms had to be able to remain within those tolerances in severe but plausible scenarios and to have made the investments needed to do so ⁵. The rules cover banks, building societies, insurers, investment exchanges, payment and e-money firms, and larger investment firms ⁵⁶.

Australia: APRA CPS 230. The standard commenced on July 1, 2025 ⁷. Banks must treat payments, deposit-taking, custody, settlement and clearing as critical operations, and insurers must include claims processing ⁷. For each critical operation the firm sets a maximum period of disruption, a maximum data loss, and the minimum service it will run during disruption ⁷. It must notify APRA within 24 hours of a disruption outside tolerance, run an annual business continuity exercise against severe but plausible scenarios that include supplier failures, and keep a register of material service providers ⁷. Firms submitted their first registers by October 1, 2025, and an amended standard applies from July 1, 2026 ⁸.

United States: interagency sound practices. On October 30, 2020 the Federal Reserve, FDIC and OCC issued "Sound Practices to Strengthen Operational Resilience" for the largest banks, those with $250 billion or more in assets or $100 billion with other risk characteristics ⁹¹⁰. The paper draws on existing rules for operational risk, business continuity, third-party risk, cybersecurity and recovery planning, and does not add new requirements ¹⁰. It asks each firm to set a tolerance for disruption to its critical operations and core business lines, informed by severe but plausible scenarios ¹⁰. The Federal Reserve revised the attachment in June 2026 to remove references to reputational risk ¹⁰.

The rules now reach the suppliers

On November 18, 2025, the three European Supervisory Authorities designated the first critical ICT third-party providers under DORA ³. They built the list from the registers of information that financial firms had filed, assessing each provider's systemic importance, its role in critical functions, and how easily it could be substituted ³. The 19 providers named include Amazon Web Services, Microsoft, Google Cloud, Oracle, SAP, Bloomberg, LSEG Data and Risk, Equinix, Deutsche Telekom and several large outsourcing firms ⁴. Their lead overseer can inspect them and impose daily penalties of up to 1% of average daily worldwide turnover for up to six months ².

The UK built a parallel regime. Rules for critical third parties took effect on January 1, 2025, with HM Treasury deciding which providers to designate ¹⁷. From March 18, 2027 most UK firms must also keep a register of their material third-party arrangements, submit it to the FCA every year, and report new or changed arrangements ¹⁶.

A supplier that never appears on a designation list still feels this. Each financial customer must list the contract in its register, write DORA's mandatory terms into it, map it in its service maps, and include its failure in scenario tests ²⁷. EU supervisors counted about 15,000 technology providers serving the EU financial sector directly in 2023 ¹⁸.

Cases from 2024 to 2026

CrowdStrike, July 2024. A faulty security update crashed about 8.5 million Windows machines ¹². The FCA's review found that firms which had mapped their important business services and tested scenarios hitting several services at once could restore their most important services first ¹¹.

Barclays, January and February 2025. From January 31 to February 2, 2025, a failure in Barclays' mainframe processing caused about 56% of online payments to fail, on a payday and the UK self-assessment tax deadline ¹⁴. Barclays estimated £5 million to £7.5 million in compensation for that outage and up to £12.5 million for IT failures over two years ¹⁴. The House of Commons Treasury Committee gathered figures from nine banks and building societies showing at least 158 incidents and 803 hours of outages from January 2023 to February 2025 ¹⁴. The outage came two months before the deadline for UK firms to show they could stay within their impact tolerances ⁵.

Citigroup, July 2024. The Federal Reserve and OCC imposed penalties of about $135.6 million on Citigroup for slow remediation of data quality problems named in a 2020 enforcement action ¹⁵. The case concerned risk and data management, and shows how supervisors price remediation that runs years behind plan.

FCA findings, March 2026. A year after the UK deadline, the FCA reported that firms' mapping still focused mainly on technology and neglected people, facilities, processes and supplier testing ¹³. Some firms claimed no scenario was unrecoverable without showing they had tested scenarios severe enough to prove it ¹³. Remediation actions often lacked owners or deadlines, and it was unclear whether boards understood the investment needed ¹³.

Why the Usual Approach Fails

Most continuity programs are organized by system. They hold a recovery time and recovery point for each application, a disaster recovery site, and a yearly failover test of a few systems. The regulations are organized by service, and a service crosses many systems, teams, buildings and suppliers. The FCA's finding that mapping still centers on technology describes this gap ¹³.

Tests are chosen to pass. A planned failover of one database on a quiet weekend proves the runbook and little else. The rules ask what happens when a supplier, a region and a key team fail together ⁵⁷. The FCA saw firms claim every scenario was recoverable without testing severe ones ¹³.

Ownership sits with IT. Regulators expect the board to approve tolerances and self-assessments, and the FCA found unclear approval trails and actions with no owner ¹³. A program run by IT alone leaves the business without a decision on how much disruption it will accept.

Supplier evidence is missing. Contracts signed before 2025 rarely include exit plans, audit rights or a duty to join the customer's tests, and DORA requires them for critical functions ².

The Framework: The Tolerance Loop

The Tolerance Loop turns the regulations into one program that a non-regulated supplier can also run. It has five steps, repeated each year and after any major change.

flowchart LR
    A[Name<br/>critical business<br/>services] --> B[Set<br/>tolerance in time<br/>data and service]
    B --> C[Map<br/>people, systems<br/>sites, suppliers]
    C --> D[Test<br/>severe but<br/>plausible scenarios]
    D --> E[Fix and report<br/>gaps, owners<br/>to the board]
    E --> A

Name. List the services customers or markets depend on, in a customer's words: make a payment, settle a trade, pay a claim. CPS 230 gives a floor for banks and insurers ⁷. A supplier names the services its financial customers have marked critical.

Set. For each service, the business owner sets the maximum tolerable disruption, the maximum data loss and the minimum service level under fallback ⁷. Use non-time measures such as transaction volumes where they describe harm better ¹³. The board approves them.

Map. Record everything the service needs: applications, infrastructure, data, people, buildings and every supplier, including the supplier's own key suppliers. Use the DORA register of information or the APRA service provider register as the supplier half of the map ²⁷.

Test. Choose scenarios that combine failures, such as a cloud region and a key supplier lost together on a peak day. Include at least one test of a supplier failure each year, as CPS 230 requires ⁷. Record whether the service stayed within tolerance, and with what confidence.

Fix and report. Each breach of tolerance becomes a funded action with an owner and a date. The self-assessment the board signs lists the gaps, the investments and the residual risk ⁵¹³.

Costs, Risks, and Tradeoffs

How to Act

Questions to Ask Your Team

1. Which of our customers or regulators already expect us to meet DORA, the UK rules, CPS 230 or the US sound practices?
2. What are our critical business services, and who owns each one?
3. For each, how long can it be down, how much data can we lose, and who approved those numbers?
4. Which suppliers sit behind each service, and which of their contracts lack exit plans, audit rights or test participation?
5. What was the most severe scenario we tested last year, and did every service stay within tolerance?
6. If a key supplier failed tomorrow, which services would breach first, and how would we know?
7. What open gaps does the board know about, and when will each be fixed?

Closing

Financial regulators in the EU, UK, Australia and the United States now judge resilience by service, by tolerance and by test, and their reach extends through contracts to the suppliers behind each critical service. Name your critical services, set tolerances the business owns, map everything behind them, test against severe scenarios, and report the gaps to the board with owners and dates. The same body of evidence then serves regulators, customers and the incident team.