Operational Resilience
What is operational resilience?
Financial firms build resilience to withstand disruption to their business. New rules require UK firms and market infrastructure to prepare for incidents and remain within pre-identified and limited tolerances for failure. EU firms and FMI will need to manage their ICT risks under the DORA framework. Policymakers around the world are developing similar standards.
When do the rules apply?
The UK rules started to apply on 31 March 2022, although there is a transition period before firms and market infrastructure are required to remain within tolerance levels. The EU’s Digital Operational Resilience Act starts to apply in January 2025.
Visit our timeline which includes links to the key regulatory publications.
Podcasts series
We have a range of resources available on operational resilience including webinars which are available via our Knowledge portal. We have also launched a podcast series where our lawyers take a closer look at what operational resilience means for financial services firms.
How can we help?
We have a market-leading financial regulation practice which provides clients with risk advisory services. We also have one of the longest-standing privacy and cyber security practices in the world, with practitioners who not only understand data and crisis, but also technology and sourcing.
Read our flyer for more about how we can support your operational resilience programme.
DORA Explored: How the EU’s rules for digital operational resilience affect you
Tuesday 4 October 2022, 09:00 to 10:00 GMT +1
Location: Global
The financial services sector has gone digital. The technology that firms rely on brings benefits but also introduces new risks when firm’s operations are disrupted. To address this, the EU is expected to finalise a digital operational resilience act in the coming weeks.
Known as DORA, the new regulation will require practically all financial entities in the EU to apply uniform standards for managing ICT risks. Join our webinar to hear our panel of experts discuss what DORA does, what happens next and experiences of implementing the equivalent UK requirements.
US: Congress passes new cyber incident reporting requirement
15 March 2022
The Cyber Incident Reporting for Critical Infrastructure Act has been unanimously approved by the U.S. Senate. This requires critical infrastructure entities and federal agencies to report significant cyber incidents within 72 hours of the incident and within 24 hours if a ransomware payment was made.
Global Tensions Trigger Surge in Cyber Attacks: 5 Key Preparedness Steps
25 February 2022
In the past few weeks, governments around the world, including the UK, US, Australia and New Zealand, have issued warnings that Russia’s invasion of Ukraine could lead to intentional or spillover cybersecurity attacks on organizations outside the region. It Is clear from our conversations with third parties and our threat intelligence partners that there is without a doubt increased malware activity, as well as scans targeting corporations.
US: Today’s cyber threat is far from over…and the SEC knows that
26 January 2022
Russia’s crackdown on hacker group, REvil, is a good sign but days later Ukrainian government sites were taken down, allegedly by Russian hackers. The link between cybersecurity and US national interest has not escaped the SEC who are expected to continue to take a tough stance on cybersecurity.
UK: Telecommunications (Security) Act 2021 heralds a step change in cyber laws
25 November 2021
The Telecommunications (Security) Act 2021 is likely to impose some of the world’s toughest cyber security obligations. We consider the reasons for this step change and the practical compliance challenges.
As Cyber Threats Grow, So Do Your Compliance, Litigation and Arbitration Risks: Are you Ready?
23 November 2021
In our eighth webinar of the Global Business Crime Outlook Series, we will be discussing a range of topics including compliance, litigation and arbitration in the event of a cyber-attack with a particular focus on Latin America.
How AI in financial services is regulated in the UK
7 October 2021
Using artificial intelligence in the financial sector requires careful consideration of the regulatory framework. For example, UK firms deploying AI must take into account not only high-level principles, activity-specific rules and their reliance on third parties, but also how the novel features of AI models interact with individual accountability requirements.
US - The SEC makes its mark on cyber
2 September 2021
The SEC is done playing around. This summer it has demonstrated its resolve bringing actions against public companies for alleged poor disclosures, and against SEC registrants for alleged poor cybersecurity controls.
US - NYDFS Issues Ransomware Guidance: What’s a Lawyer to Do?
22 July 2021
The New York Department of Financial Services has joined the fight against ransomware issuing guidance to assist companies prepare and respond to ransomware. We consider the lawyer’s role in responding to this guidance.
5 Steps You Can Take Today to Improve Your Organization’s Cybersecurity Preparedness
28 June 2021
Our global cybersecurity team shares 5 key steps you can take today to improve your organization's cybersecurity.
Timetable set for financial firms to bounce back from business disruption
20 April 2021
The UK financial services regulators have put the final touches to their new set of rules on operational resilience. Firms have been given one year to get ready before the regime starts to apply.
Operational Resilience: Firms told to build their bouncebackability
29 March 2021
Nearly three years in the making, the FCA, PRA and Bank of England have finalised their proposed rules on operational resilience. The first key deadline for compliance is 31 March 2022.
Approaching the UK’s operational resilience reforms: How to ensure you do it once and do it right
25 March 2021
In this speech at the OpRisk Global conference, Julia Dixon and Pansy Wong share their insights on how financial institutions can set themselves up for success when implementing their Operational Resilience Programs.
What a review of IT upgrades says about FCA’s plans for operational resilience
19 March 2021
Nothing causes as much despair in the world of IT as an “upgrade” that goes wrong. For a financial services firm, a failed IT upgrade can cause severe disruption to customers and so the UK Financial Conduct Authority (FCA) has recently looked at how financial services firms update their technology. Its findings are a prelude to incoming rules on operational resilience.
How the EU plans to use DORA to build operational resilience in financial services
18 March 2021
As technology entrenches itself in financial services, policymakers are looking more closely at the sector’s exposure to the risks of digitalisation. In this briefing we summarise the European Commission’s proposals for a Digital Operational Resilience Act, known as DORA, which would apply to not only EU financial entities but also some technology service providers.
Operational resilience in a nutshell
18 March 2021
The incoming UK operational resilience regime represents a major exercise in regulatory change management. This one-pager provides a high level overview of the main rules, key defined terms and upcoming dates.
Operational resilience: A case study for Boards
10 March 2021
The UK regulators are preparing to require firms to embed an operational resilience framework within BAU operations by 2024. The three-year transition hints at the significant design and implementation work that will need to be completed. This regulatory change, which comes hot on the heels of recent high-profile disruption in financial services and the Covid-19 pandemic, makes operational resilience the perfect case study when it comes to considering effective Board oversight and governance.
Five lessons for firms’ operational resilience planning from the FCA’s review of technology change
9 February 2021
The FCA is due to finalise new requirements on operational resilience which will impact a broad range of UK financial institutions. Before then, it has released its findings from a review on how financial firms manage, or in some cases fail to manage, IT upgrades and other technology changes. In this summary we highlight some of the FCA’s findings and suggest lessons for firms to build into their operational resilience planning
Financial Regulation Insights
Our new FRG blog where you will find insights, commentary and news on recent developments in financial regulation from our dedicated financial regulatory lawyers in London.
Timeline and links to publications
December 2019 UK Consultation Papers
- FCA Speech: The View from the Regulator on Operational Resilience
- BoE/PRA/FCA Joint Forward: Building Operational Resilience – Impact Tolerances for Important Business Services
- FCA Consultation Paper: CP19/32 on Buidling Operational Resilience
- PRA Consultation Paper: CP29/19 on Building Operational Resilience
- PRA Consultation Paper: CP30/19 on Outsourcing and Third Party Risk
- BoE Consultation Paper: Operational Resilience for Central Counterparties (CCPs)
- BoE Consultation Paper: Operational Resilience for Recognised Payment System Operators and Specified Service Providers
- BoE Consultation Paper: Operational Resilience for Central Securities Depositories (CSDs)
October 2020 UK Consultations close
- Consultation process ended on 1 October 2020
March 2021 UK Final rules
- BoE/PRA/FCA Joint Policy Paper on Operational Resilience
- FCA Policy Statement: PS21/3 Building Operational Resilience
- PRA Policy Statement: PS6/21 Operational Resilience: Impact Tolerances for Important Business Services
- PRA Supervisory Statement: SS2/21 Outsourcing and Third Party Risk Management
- Bank of England Policy Statements
31 March 2022 UK Rules take effect
- Deadline for identifying vulnerabilities in their operational resilience, identifying important business services, setting impact tolerances and carrying out mapping and testing.
- Firms must remain within impact tolerances for each important business service as soon as possible after this date.
17 January 2025 EU rules under DORA to apply
- DORA starts to apply two years after entry into force
January 2023 EU finalises DORA
- DORA enters into force
31 March 2025 All UK rules to apply
- Longstop deadline for remaining within impact tolerances.
