Important business service
IBSAlso called important business services
An important business service is a service a firm provides to external clients that, if disrupted, could cause intolerable harm to those clients or threaten market integrity or financial stability. UK operational resilience rules require in-scope firms to identify these services and plan to keep them running.
How it works
A bank lists its services from the client's point of view, such as making a payment or accessing a mortgage account. It then judges which disruptions would cause intolerable harm. For each important business service it maps the people, processes, technology, facilities, information and third parties needed to deliver it. The firm reviews the list at least once a year, and the board approves the self-assessment that records it.
The concept shifts resilience from protecting systems to protecting outcomes for clients. It decides where investment goes, because each important business service needs an impact tolerance and severe but plausible scenario testing. The FCA and PRA rules came into force on 31 March 2022, and firms had to be able to remain within tolerance by 31 March 2025.
The rules
Requires firms to identify important business services, set impact tolerances and remain within them by 31 March 2025.
Banks, building societies, insurers, enhanced SM&CR firms, payment and e-money firms, RIEsSets PRA expectations for identifying important business services, setting impact tolerances and testing against severe but plausible scenarios.
PRA-authorised banks, building societies, PRA-designated investment firms and insurersCommon questions
How many important business services should a firm have?
The rules set no number. Firms identify services based on the potential for intolerable harm to clients and markets. Larger banks typically identify more services than smaller firms, and regulators have challenged lists drawn too broadly or too narrowly.
Are internal services such as HR important business services?
No. An important business service is delivered to an external end user or participant. Internal functions such as HR or IT matter as resources that support important business services, and firms map them as dependencies.
Who must identify important business services?
Under FCA rules, banks, building societies, PRA-designated investment firms, insurers, recognised investment exchanges, enhanced scope SM&CR firms, and payment and e-money institutions. PRA rules apply to PRA-authorised firms.
What happens after a service is identified?
The firm sets an impact tolerance, maps its dependencies and tests whether it can stay within tolerance in severe but plausible scenarios. It records the work in a written self-assessment that the board approves and regularly reviews.
