Why the FCA’s latest message should command board attention

One year after the end of the FCA’s operational resilience transition period, the regulator’s message is clear: resilience frameworks are no longer being judged on whether they exist, but on whether they work in practice.

Drawing on firms’ annual self-assessments, the FCA’s latest observations reveal strong industry progress alongside persistent weaknesses that could undermine firms’ ability to prevent intolerable harm during real-world disruption.

In this paper, we examine what the FCA’s findings mean for boards and senior management, including:

• Why the focus has shifted from implementation to supervisory judgement
• Common weaknesses in impact tolerances and important business services
• Why third-party mapping is becoming a growing regulatory concern
• The FCA’s challenge to overly optimistic scenario testing
• The importance of dynamic vulnerability management and effective communications planning
• What boards should be doing now to challenge assumptions and strengthen resilience