Laura WilesA year on from the implementation of its operational resilience rules, the FCA has set out good and poor practice for firms. The regulator also noted that operational disruptions among cloud service providers in 2025, such as Amazon Web Services, Microsoft Azure and Cloudfare, have underlined the importance of resilience.
The FCA outlined good practice and areas for improvement in firms’ approaches to:
- Important business services and impact tolerance
- Mapping resources
- Scenario testing
- Vulnerability management
- Communications plans and strategy
- Governance
Overall, many firms had demonstrated maturity in governance, but the FCA noted that all firms should continue to focus on board engagement, robust frameworks and evidence-based self-assessment for sector-wide improvement.