AnyAccountThe Financial Conduct Authority published new operational-resilience good-and-poor-practice observations on 11 November 2026. They draw on the FCA's review of firms' 2025-26 self-assessments and build on its March 2026 insights.
The observations are not new requirements and do not replace the earlier findings. They are most relevant to firms already within scope of SYSC 15A, although the FCA says other firms may also find them useful. Whether the rules apply to a particular business depends on its regulated activities and circumstances.
The central theme is evidence of what a firm can deliver now during severe but plausible disruption. The FCA distinguishes that current position from improvements expected from planned remediation, transformation or future investment.
Evidence of current capability
The FCA says stronger self-assessments explain the vulnerabilities that remain, how disruption could cause harm, what evidence supports the firm's resilience position and how boards and senior management use that information to make decisions.
Examples include showing how important business services would be prioritised during prolonged disruption, using both time-based and non-time-based impact measures, and explaining the assumptions behind recovery options. The FCA also highlights the need to identify residual risks and capability gaps rather than presenting planned work as evidence of present resilience.
Where remediation has been completed, the FCA's stronger-practice examples look beyond closure of an action. They consider whether the change has been validated and, where necessary, re-tested so that the firm can show that resilience has actually improved.
Dependencies and severe disruption
The observations give particular attention to third parties, fourth parties, group services and shared infrastructure. Stronger mapping shows how an important business service is delivered end to end and how the loss of people, processes, technology, facilities, information or external dependencies could affect delivery.
The FCA's examples also distinguish testing a procedure from demonstrating resilience in practice. More mature firms test interconnected services and shared dependencies, including severe cyber disruption, data-integrity issues, supplier failure, loss of key staff and unavailable production environments.
Manual workarounds receive similar scrutiny. The FCA identifies weaker practice where firms rely on a workaround without showing that it would remain workable at scale or over a prolonged incident. Stronger assessments explain recovery assumptions, the limitations of workarounds and the risks that remain after testing.
Board challenge and assurance
The FCA says boards and senior management should receive enough information to understand current resilience, challenge assumptions, prioritise remediation and oversee residual risk. Board approval of the self-assessment alone is not treated as evidence of effective oversight.
Stronger examples show the nature of challenge, decisions and prioritisation. They also give UK entities visibility over dependencies managed through group or shared arrangements and include second- and third-line input, with findings tracked through to effective completion.
Questions for the next self-assessment
For an in-scope firm reviewing its evidence, useful internal questions may include:
whether conclusions about current capability are supported by scenario results rather than future plans;
whether mapping covers operational and group dependencies as well as technology;
whether workarounds have been tested for scale, duration and unavailable normal channels;
whether remediation has been validated and re-tested where appropriate;
whether residual risks and assumptions are clearly visible to decision-makers; and
whether records show the substance of board, second-line and third-line challenge.
These are general review questions drawn from the FCA's examples. They are not new duties created by the 11 November publication and are not a conclusion about any firm's compliance or readiness.
Status and source
The FCA page was published and last updated on 11 November 2026. It contains supervisory observations and examples, not a new rule, consultation or implementation deadline.
This article provides general information, not legal or regulatory advice. Firm-specific conclusions require review of the applicable rules and the firm's actual activities and evidence.