Support your FCA resilience programme with tested, documented IT

Where the March 2025 deadline leaves you

The FCA’s operational resilience framework sits in policy statement PS21/3 and the SYSC 15A rules. The transition ended on 31 March 2025 for firms within scope. SYSC 15A does not apply to every FCA-authorised firm, so confirm your category and permissions before treating the framework as a direct obligation.

The three-year transition that opened in March 2022 has closed. If you identified services and set tolerances on paper, but left the underlying technology alone, you are exposed. The FCA asks you to demonstrate resilience, not describe it.

The next deadline is already set. Under PS26/2, operational incident and material third-party reporting becomes mandatory on 18 March 2027 — we set out what that means and the work to do now.

For an in-scope firm, technology is usually a significant dependency underneath important business services. Understanding that dependency is the starting point for useful testing and recovery planning.

What the FCA actually expects

The framework runs as a chain of five steps.

Identify the services that matter most. These are the services whose disruption would harm consumers, threaten market integrity or undermine your firm’s safety and soundness. For a wealth manager that is usually portfolio access and trade execution. For a payment firm it is transaction processing. For an advisory firm it may be regulatory reporting and client communication.

Set an impact tolerance for each one. An impact tolerance is the longest disruption you can absorb before the harm becomes intolerable. It is not a recovery time objective buried in an IT plan. It is a board-level commitment to a number.

Map every dependency underneath. Document the IT systems, data stores, cloud platforms, network links, third parties, buildings and people. Map at a level that exposes single points of failure and concentration risk.

Test whether you can hold the tolerance. Cover technology failure, cyber attack, third-party outage and data corruption. Keep the scenarios realistic, write up the results, and repeat them on a schedule.

Keep improving. The FCA does not expect perfection. It expects a credible programme driven by your own testing, incidents and business change.

Your IT provider as a regulated dependency

Your important business services sit on a chain of technology: servers, networks, cloud platforms, applications, backups and the controls protecting all of it. When the FCA asks whether you can restore a service inside your tolerance, it is asking how fast that chain recovers.

That makes a managed IT provider one of the dependencies your resilience programme may need to map and test.

Monitoring that spots a failure in minutes rather than hours cuts your recovery time directly. Backup and disaster recovery that restores data to a known good state decides whether you recover at all. Structured incident management gives your compliance team the evidence trail when the FCA asks questions.

Support processes, recovery tests and change records should therefore produce evidence the firm can review and retain.

A resilience programme on IT we test and document

We work with FCA-regulated firms across London, including hedge funds, private equity firms and wealth managers. Where SYSC 15A applies, we support the technology layer of the firm’s wider resilience programme.

We begin with dependency mapping. We record every system, application and third-party service behind your important business services. We show you the single points of failure and the concentration risks, then plan the remediation.

We align monitoring and alerting to your tolerances. If your tolerance on a client-facing platform is four hours, we escalate within minutes rather than hours. Our incident process classifies a disruption against your stated tolerance and triggers the matching response.

We build and maintain recovery capability against your own scenarios. Tabletop exercises, failover tests and full recovery simulations are scheduled and written up. When your compliance team needs proof that recovery works, the results are current.

We can produce technology reporting for boards and senior managers, covering incident trends, test outcomes, dependency changes and improvement actions. Your firm and its advisers determine the governance and regulatory conclusions.

This framework and DORA overlap heavily. Build the capability once, designed for both, and you avoid paying twice. We build that foundation with our managed IT support, cybersecurity and penetration testing services.