What is operational resilience?

Financial firms build resilience to withstand disruption to their business. New rules require UK firms and market infrastructure to prepare for incidents and remain within pre-identified and limited tolerances for failure. EU firms and FMI will need to manage their ICT risks under the DORA framework. Policymakers around the world are developing similar standards.

Explore our regulatory insights.

When do the rules apply?

The UK rules started to apply in 2022, although there is a transition period before firms and market infrastructure are required to remain within tolerance levels. The EU’s Digital Operational Resilience Act started to apply in January 2025.

Visit our timeline which includes links to the key regulatory publications.

Podcasts series

We have a range of resources available on operational resilience including webinars which are available via our Knowledge portal. We have also launched a podcast series where our lawyers take a closer look at what operational resilience means for financial services firms.

Listen to our podcast.

How can we help?

We have a market-leading financial regulation practice which provides clients with risk advisory services. We also have one of the longest-standing privacy and cyber security practices in the world, with practitioners who not only understand data and crisis, but also technology and sourcing.