What is UK operational resilience?
The rules that require certain UK financial firms to identify their important business services, set an impact tolerance for each and stay within it in a severe but plausible disruption. They also require the firm to map what each service depends on, test it, learn from the tests and keep a written self-assessment that its governing body approves. The FCA's rules are in SYSC 15A; the PRA's are in two Parts of its Rulebook.
The FCA's rules, SYSC 15A, reach the firms listed in SYSC 15A.1.1R: an enhanced scope SMCR firm, a bank, a designated investment firm, a building society or a Solvency II firm; a UK recognised investment exchange; an electronic money institution, a payment institution or a registered account information service provider; and a consolidated tape provider. A payment institution, e-money institution or registered account information service provider that is in the chapter only for that reason is covered only for payment services, e-money issuance and the activities connected to them (SYSC 15A.1.8R). A firm whose registered office, or head office if it has none, is outside the UK is not covered (SYSC 15A.1.4R). Nor is a TP firm, TA PI firm, TA RAISP firm or TA EMI firm (SYSC 15A.1.3R). The PRA's Operational Resilience Part reaches CRR firms (a UK bank, a building society or a UK designated investment firm) and, for its chapter 8 on groups, CRR consolidation entities, which can be a parent holding company that is not itself a CRR firm. Its Insurance – Operational Resilience Part reaches UK Solvency II firms, the Society of Lloyd's and managing agents. A credit union is not named in SYSC 15A.1.1R and is not a CRR firm. Whether any of these reaches your firm is for your firm to establish, and Vivid Risk does not decide it.
SYSC 15A.2.2R, 15A.2.6R and 15A.4.3R require a review of important business services, impact tolerances and mapping at least once a year, and sooner after a material change. The PRA Parts set no review rule of their own. SS1/21, guidance, expects annual review of services and mapping and sets no annual date for tolerances.
SYSC 15A.6.2R. Under the PRA Parts it is the current version and every version from the preceding three years (Operational Resilience 6.3; Insurance – Operational Resilience 6.3).
No rule sets an annual test. SYSC 15A.5.7R(3) says "on a regular basis", and the firm sets how often.
Dates that matter
- 31 March 2022SYSC 15A, operational resilience, in force.
- 31 March 2025The SYSC 15A transition ended (FCA PS21/3), as did the PRA's transitional deadline in Operational Resilience 2.6 and Insurance – Operational Resilience 2.6.
What people get wrong
What the questions cover
Identifying important business services; setting an impact tolerance for each; mapping the people, processes, technology, facilities and information behind each service, including third parties; whether you can stay within each tolerance in a severe but plausible disruption; scenario testing and what you learn from it; the written self-assessment and how long you keep it; approval by your governing or management body; communications during a disruption; and group risks. The report names the provisions behind each finding, and a provision that is guidance rather than a rule ends in G.
You choose whether the questions are asked
Vivid Risk does not work out whether SYSC 15A or a PRA Part reaches your firm. You select the scope yourself: at registration, in Settings, or on the firm profile on Compliance Workspace and Team. A practice sets it on a client's record, and it is also on the new assessment form where your account sees it. Without it the questions are not asked and your score is the same as it would be without them. Once it is selected the questions are scored like the others, and where a duty does not apply to your firm, for example a PRA-only firm and a duty only SYSC 15A sets, the answer is Not applicable and the question is left out of the score. A saved assessment keeps the scope it was asked under.
The Coverage view reads what you have recorded
Beside the questions, the UK financial records area has a Coverage view. It lists each requirement of the rules your firm's recorded answers have not ruled out, and says whether you have recorded something for it: a service, a tolerance, a map, a test, a lesson, a communication strategy, a saved self-assessment. Recorded means your firm wrote something down. It does not mean you meet the rule or stay within a tolerance, and no row says so, beyond repeating a scenario-test result your firm recorded. It is not scored and writes nothing. Where the product has no record for a requirement, the row says "No record for this here".
What this is not
Answering the questions is a self-assessment. Vivid Risk files nothing with the FCA or the PRA and decides nothing, and no lawyer has reviewed the mapping. The rules were read from the FCA Handbook and the PRA Rulebook; the PRA's supervisory statement SS1/21 is guidance and is not cited as a rule. Bank of England rules for financial market infrastructures are not covered.
What Vivid Risk does with UK operational resilience
Scored assessment questions, asked only if your firm selects this scope, each cited to the FCA Handbook SYSC 15A provisions and the PRA Rulebook provisions (Operational Resilience, Insurance – Operational Resilience, and Group Supervision chapter 22) it asks about, read against the rule text. Beside them, an unscored Coverage view in the UK financial records area shows, requirement by requirement, what your firm has recorded there.
A self-assessment: answering these questions is not a finding that your firm meets the rules. Whether they reach your firm is yours to select. The Coverage view shows what your firm has recorded, not whether it meets a rule or stays within a tolerance, and it is not scored. Vivid Risk files nothing with the FCA or the PRA, and decides nothing. No lawyer has reviewed this mapping. Bank of England rules for financial market infrastructures are not covered.
Questions
Does Vivid Risk tell us whether these rules apply to us?
No. It lists who each rule reaches, and you decide whether your firm is one of them and select the scope. Nothing is inferred from your answers. Your own selection on the firm profile carries to your next new assessment, and a practice sets it for a client it manages.
Does answering the questions show that we meet the rules?
No. It is a self-assessment. Your answers change your score, the report cites the provisions behind each control, and it can be read by area of these rules, with a self-assessed readiness figure beside the number of questions it rests on and no overall figure for the rules. Whether your firm meets a rule is for the FCA or the PRA.
What does the Coverage view show?
For each requirement of the rules your firm's recorded answers have not ruled out, whether you have recorded something on the other tabs. Recorded means your firm wrote something down, not that you meet the rule. It does not score, change or file anything.
Does it report anything to the FCA or the PRA?
No. Vivid Risk files nothing with either regulator. The written self-assessment is yours to keep and to give your regulator when asked.
We are a payment or e-money firm. Which questions are for us?
SYSC 15A covers you only for payment services, e-money issuance and the activities connected to them (SYSC 15A.1.8R), and the first question says so. The PRA Parts do not reach you unless you are also a firm they name.
We are a credit union. Does this reach us?
A credit union is not named in SYSC 15A.1.1R and is not a CRR firm, so the PRA Operational Resilience Part does not reach it. Whether it falls in SYSC 15A through a type of firm that rule defines elsewhere is for your firm to establish.
Are Bank of England rules for financial market infrastructures covered?
No. Neither the questions nor the Coverage view cover them.
Is this the incident and third-party reporting rules?
No. Those are a separate duty with their own firms and dates, and they are on the FCA and PRA incident, third-party and operational resilience page, with the records for them.
One assessment, every cited framework
The same answers produce your citations across every framework your scored controls are cited to, rather than one questionnaire per regulation.