On 11 November 2026 the FCA published Operational resilience: demonstrating resilience in practice, a good and poor practice review based on firms' 2025–26 self-assessments. It builds on the March 2026 "one year on" observations rather than replacing them. These are observations and not new rules.
The FCA credits firms with solid progress since the transition period ended in March 2025. However, its main concern now is the quality of evidence.
Here are the seven things every firm should take from it.
Too many self-assessments leaned on planned remediation, transformation programmes or future investment. The FCA wants evidence of what you can deliver now during severe but plausible disruption.
That doesn't mean you can't mention future plans. It means you should separate current capability from expected improvements. Until those improvements land, the FCA expects Boards and senior managers to make decisions on the current position, its assumptions and its residual risk, not on where you hope to be.
If a major outage hit tomorrow, could we stay within impact tolerance with what we have in place today? If the honest answer is "not yet", say so, and say what you'd do in the meantime.
The FCA flags over-reliance on time-based tolerances as poor practice. A maximum outage of "four hours" tells you little about who is actually being harmed, or when harm becomes intolerable.
Stronger firms combine time-based measures with non-time-based ones, such as:
• Number of customers affected
• Transaction volumes and values
• Financial and non-financial harm indicators
• Backlogs of outstanding work
• Customers in vulnerable circumstances, or those who can't use digital alternatives
These metrics help you prioritise during an incident and show whether your response is actually reducing harm. The FCA also expects firms to explain how harm differs across customer groups, clients and market participants. Material changes to your business, technology, suppliers or operating model should trigger a fresh look at your IBSs, tolerances and mapping, not just the annual review.
First negative finding is around maps that focus heavily on technology and under-cover people, processes, facilities and information. Second, firms assuming that third parties, group functions or shared services are resilient without testing or challenging that assumption.
Good practice looks like end-to-end mapping of each important business service, covering third and fourth parties, group services, financial market infrastructures and shared platforms. The best firms then use those maps to drive testing, remediation priorities, investment decisions and Board reporting. A map that sits in a drawer isn't doing its job.
For firms also preparing for or operating under DORA, this will feel familiar. The register of information and third-party risk work you do there should feed straight into your FCA mapping.
The FCA explicitly lists claiming recovery within tolerance for every scenario, without evidence, as poor practice. Testing that isn't severe enough or that isn't linked to the vulnerabilities your mapping found, gets the same treatment.
Mature firms test whether each service can actually stay within tolerance, not just whether the plan exists. Their scenarios include major cyber disruption, data integrity problems, third-party and group failures, loss of key staff, degraded communications and loss of production environments. They also test what happens when a shared dependency takes out several services at once.
Watch out for manual workarounds. The FCA wants evidence they would hold up at scale, across many users and over an extended period. And where a scenario genuinely can't be recovered within tolerance, stronger firms explain how they would limit, delay or prevent intolerable harm through contingency arrangements, minimum service levels and clear prioritisation.
The FCA draws a sharp line between completing a remediation action and proving that resilience has improved. Stronger firms validate their fixes and re-test where needed.
Good self-assessments separate vulnerabilities into remediated, open and accepted, and explain how the firm could still recover despite the open ones. Each remediation item has a named owner, a target date, prioritisation criteria, a funding decision and a governance route.
Many firms showed limited evidence that their communications would still work if usual channels were down, degraded or compromised. That is exactly the situation a serious cyber incident creates.
Mature firms test communications inside their resilience scenarios. They identify internal and external audiences, escalation thresholds, approval routes, alternative channels and decision points in advance. They also plan specifically for vulnerable customers, customers who can't access services, market participants and regulators, and use live customer impact data to shape what they say during a prolonged incident.
Treating Board approval of the self-assessment as the main proof of oversight is called out as poor practice. The FCA wants to see the challenge, the decisions and the prioritisation behind that approval.
That means giving the Board clear information on current capability, residual risk, open vulnerabilities, remediation progress and investment trade-offs, with current capability kept separate from planned improvements. It also means clear ownership of each IBS, tolerance, map, test and remediation item, plus visible second and third line challenge.
For UK entities within larger groups, there is a specific point. Where services depend on group functions or shared platforms, UK Boards and senior managers must keep enough visibility and accountability. "Group handles it" is not an answer and it sits awkwardly with SM&CR responsibilities.
