Operational resilience after the transition deadline

What the source says

The FCA published its 'one year on' observations on 27 March 2026, following the end of the operational-resilience transition period on 31 March 2025. This is a briefing on that published material, not a claim that a new rule started today.

For firms in scope, the focus remains on keeping important business services within impact tolerances. The FCA's 2026 review discusses board decision making, dependencies and continued improvement. Check the current FCA scope and Handbook provisions for the relevant entity and activity; being a UK business does not by itself bring an organisation within this regime.

Why it matters in practice

A past assessment can become unreliable when the business, technology or suppliers change. The FCA's earlier implementation observations emphasised mapping the people, processes, technology, facilities and information supporting important business services. Outsourcing a dependency does not remove the regulated firm's responsibility for its own resilience.

Boards need enough information to understand unresolved vulnerabilities and decide what to prioritise. A statement that a plan exists is less informative than the scenario tested, result observed, limitation identified and improvement awaiting approval.

A useful next review

The following is an editorial review agenda for a firm that has confirmed it is in scope. Keep the conclusions linked to the applicable rules and the firm's approved approach.

• Check whether important services or their dependencies changed since the last assessment.
• Select a material vulnerability and inspect the evidence behind the claimed recovery capability.
• Review open remediation, realistic delivery dates and the authority for any interim decisions.
• Give the governing body a clear account of what was tested, what remains uncertain and the decision required.
• Record the next review or test and what would trigger an earlier reassessment.