The FCA’s final rules
On 29 March 2021, the Financial Conduct Authority (FCA) published final rules that will create a new operational resilience framework for banks, building societies, solvency II firms, recognised investment exchanges, enhanced scope senior managers and certification regime firms, and those authorised or registered under the Payment Services Regulations 2017 or Electronic Money Regulations 2011.
The new rules will apply from 31 March 2022 and will require firms to identify important business services and set maximum impact tolerances. Further, firms will need to have identified weaknesses within their operational resilience arrangements. In order to give firms additional time to comply with the new rules, firms will be required to perform the mapping and testing exercise as soon as possible after 31 March 2022 and no later than 31 March 2025 so that they are able to remain within impact tolerances for each important business service.
The PRA’s final policy
The Prudential Regulation Authority (PRA) also published its final Policy Statement (PS) 6/21 alongside the FCA. This includes new Operational Resilience Parts of the PRA Rulebook and a new Supervisory Statement (SS), both of which are also effective from 31 March 2022. The policy implementation section in the SS sets out that firms must have identified their important business services and set impact tolerances by this date, as well as having a prioritised plan in place which sets out how they will comply with the operational resilience requirements. The PRA has made amendments to align its policy with that of the FCA overall. For example, the Operational Resilience Parts have been amended to further align definitions and requirements with those of the FCA.