The 31st March 2025 deadline has now passed, marking the end of the transition period set out in the FCA’s PS21/3: Building Operational Resilience policy. So, what now? You have implemented your operational resilience framework, but you may now be wondering: what does good really look like?
That is exactly the right thing to be thinking about, and I would like to offer some reflections to bring this to life.
The most resilient organisations don’t just manage disruption well, they actively look for areas where they may be vulnerable. Instead of focusing only on safe, predictable scenarios, they test themselves with challenging, uncomfortable (but realistic) stress tests. At times, this may lead to failure, and that’s precisely the value. These experiences offer important opportunities to learn and adapt before the consequences become real. The regulator is not expecting zero incident, but it does expect firms to know how to fail safely, learn quickly, and recover effectively.
The most resilient organisations don’t just have plans, they build confidence with their customers, business partners, and the wider UK market. Beyond written policies and procedures, their people understand their roles, their processes stand up under pressure, and their systems are built to adapt rather than break. Most importantly, they foster a mindset that expects uncertainty and is prepared to manage it.
Communication is another essential factor: resilient organisations consider it early. If usual channels aren’t available, they have a Plan B and often a Plan C. They don’t rely on improvisation in critical moments; instead, they’ve prepared and rehearsed what to say, and how to say it, when it matters most.
However, the greatest differentiator is culture. In these firms, operational resilience is not a checkbox buried in a report or in a written assessment, it is a board/senior management-level conversation. It shapes how products are designed, how incidents are reviewed, and how leadership decisions are made. They are not chasing perfection, they are building an organisational muscle.
Similarly to Consumer Duty, Operational Resilience is never a finished product, but those who treat it seriously are ahead: not only because they can withstand shocks, but because they emerge stronger each time.
Does this resonate with you? I would be happy to discuss further.
Contact us
