Impact tolerance
Also called maximum tolerable disruption
An impact tolerance is the maximum level of disruption a firm sets for an important business service before clients or markets suffer intolerable harm. It is expressed at least as a length of time, such as four hours, and can include other metrics. UK operational resilience rules require one per important business service.
How it works
A firm sets a tolerance by asking when disruption would cause intolerable harm, not when it becomes inconvenient. A payments service might have a tolerance of one day. The firm then runs severe but plausible scenarios, such as a cyber attack or a supplier outage, to test whether it can recover within that limit. Gaps become remediation plans.
Impact tolerances differ from risk appetite. They assume disruption will happen and focus on recovery. Under FCA and PRA rules in force since 31 March 2022, firms had to be able to stay within tolerance by 31 March 2025. A breach is a sign that resilience is inadequate and is reported in the firm's self-assessment.
The rules
Published the rules requiring an impact tolerance for each important business service, in force from 31 March 2022.
Banks, insurers, enhanced SM&CR firms, payment and e-money firms, RIEsFirms had to be able to remain within impact tolerance for each important business service in severe but plausible scenarios.
FCA firms in scope of SYSC 15ASets PRA expectations for setting impact tolerances at the first point where disruption threatens safety and soundness or policyholder protection.
PRA-authorised banks, building societies and insurersCommon questions
How is an impact tolerance different from a recovery time objective?
A recovery time objective is an internal target for restoring a system. An impact tolerance is set from the client and market perspective for the whole service. A firm may restore one system quickly yet still breach tolerance if other dependencies fail.
Can a firm have two impact tolerances for one service?
Dual-regulated firms may set one tolerance for FCA purposes, based on harm to consumers and markets, and another for PRA purposes, based on safety and soundness. They can differ for the same service.
Is breaching an impact tolerance a rule breach?
The rules require firms to be able to remain within tolerance in severe but plausible scenarios. A real breach shows a resilience weakness. Regulators expect firms to learn from it, remediate and record it in their self-assessment.
Does an impact tolerance have to be a time limit?
It must include a maximum length of time. Firms can add other metrics, such as the number of clients affected or the volume of transactions disrupted, where they help measure harm.
