Operational resilience
Also called op res, digital operational resilience
Operational resilience is a firm's ability to prevent, adapt to, respond to, recover and learn from disruption. Regulators expect firms to keep critical services running, or restore them quickly, when systems fail, suppliers collapse or cyber attacks occur. The focus is on harm to customers and markets, not only on the firm.
How it works
In the UK, FCA and PRA rules require firms to identify their important business services, set an impact tolerance for each and map the people, processes, technology and suppliers behind them. Firms test severe but plausible scenarios and fix vulnerabilities. Boards approve an annual self-assessment. The rules applied from 31 March 2022, and firms had to be able to stay within tolerance by 31 March 2025.
In the EU, DORA has applied since 17 January 2025. It sets binding rules on ICT risk management, incident reporting, resilience testing including threat-led penetration testing, and ICT third-party risk. It also creates EU oversight of critical ICT providers. The UK has a separate regime for critical third parties designated by HM Treasury, which started on 1 January 2025.
The rules
Requires firms to identify important business services, set impact tolerances, map and test them, and remain within tolerance by 31 March 2025.
UK banks, building societies, insurers, PRA-designated investment firms, payment and e-money firms, recognised investment exchangesRequires ICT third-party risk management, contract terms, a register of information on all ICT providers and exit plans for critical services.
EU banks, insurers, investment firms, payment firms and other financial entitiesSets fundamental rules, operational risk and resilience requirements, incident reporting and testing duties for services that designated critical third parties provide to UK finance.
Third parties designated as critical by HM TreasurySets principles on governance, risk management, business continuity, mapping of interconnections, third-party management, incident management and ICT resilience.
Internationally active banks, applied through national supervisorsCommon questions
What is an impact tolerance?
An impact tolerance is the maximum tolerable level of disruption to an important business service, usually expressed as a time limit. UK rules require firms to be able to stay within it in severe but plausible scenarios.
How is operational resilience different from business continuity?
Business continuity focuses on recovering systems and sites after an incident. Operational resilience starts from the services customers rely on and assumes disruption will happen. It sets limits on harm and tests whether the firm can stay within them.
Does DORA apply to UK firms?
DORA applies to financial entities authorised in the EU, including EU subsidiaries of UK groups. UK-only firms follow the FCA and PRA operational resilience rules. ICT providers serving EU firms may be affected through contracts and oversight.
What incidents must be reported under DORA?
Financial entities classify ICT-related incidents and report major ones to their competent authority. Reporting follows set stages: an initial notification, an intermediate report and a final report, within deadlines set in technical standards.
