Firms must evidence the resilience they can deliver now

The year-2 operational resilience self-assessment page of November 11, 2026 asks in-scope firms to evidence the services they can deliver during severe but plausible disruption, building on the March 27, 2026 insights while SYSC 15A stays in place.

That reading, in Operational resilience: demonstrating resilience in practice, treats evidence quality as the main area for development. Policy Statement 21/3 required mapping and testing by March 31, 2025 so firms could remain within impact tolerances, after the rules took effect on March 31, 2022. What follows is the change for an in-scope broker or payment firm. A separate trading-venue review appeared the same day, and the account here stays with the self-assessment page.

Key facts

• The observations were published and last updated on November 11, 2026, drawing on firms’ 2025 to 2026 operational resilience self-assessments.
• Policy Statement 21/3 brought the rules into force on March 31, 2022 and set the mapping-and-testing milestone at March 31, 2025.
• Firms review SYSC 15A at least annually, and also when a material change reaches the business, the technology, a supplier or the market.
• Stronger files explain remaining vulnerabilities, the path from disruption to harm, the evidence for the current position, governing-body use of it, and priorities when several firms are disrupted together.
• In 2025, 27% of incidents firms reported were attributed to a third party, and 37% of those were cyber-related, on the July 24, 2026 account by Mark Francis and Simon Dixon.
• The Final Notice of December 20, 2022 imposed a sterling penalty of £29.75 million on TSB Bank plc under section 206 of the Financial Services and Markets Act 2000.

Methodology and sources for the year-2 reading

The primary document is the good-and-poor-practice note of November 11, 2026. It builds on, and keeps in place, the insights published on March 27, 2026, almost a year after the transition period ended on March 31, 2025. The rules sit in SYSC 15A, made by Policy Statement 21/3 on March 29, 2021, with scope restated on the operational resilience firms page. Later commentary, including guidance on decentralised-finance use of SYSC 15A, is a different instrument. Comparison uses Prudential Regulation Authority Supervisory Statement 1/21, Regulation (EU) 2022/2554 and Australian CPS 230. The enforcement example is the TSB Final Notice and joint press release of December 20, 2022. The page gives themes and leaves the sample size unstated, so the findings are qualitative, and the figures below come from those documents, with adjacent coverage on the regulation desk.

Related:Digital Asset Basic Act leaves Korean exchange ownership unsettled

What the year-2 page asks firms to evidence now

The year-2 operational resilience self-assessment is the supervisory reading, published on November 11, 2026, of how firms evidenced SYSC 15A in the 2025 to 2026 cycle. It asks a firm to show the service it can deliver during severe but plausible disruption at the time of the assessment, including where remediation, a transformation programme or further investment is still in train. Stronger assessments carry enough evidence to respond to severe cyber disruption, to manage material third-party dependencies, to limit intolerable consumer harm and threats to market integrity where full recovery inside the impact tolerance is still ahead, and to support the current position, its assumptions and the residual risks. Policy Statement 21/3 fixed the mapping-and-testing milestone at March 31, 2025, after the rules took effect on March 31, 2022. The November page adds an evidence standard for the next return and records observations beside that rule text.

Six themes carry that standard, and several were already live in March 2026. Mature firms explain why each important business service was identified, how disruption would cause intolerable harm or threaten market integrity, and how the tolerance was calibrated with a time measure plus customer numbers, volumes, values, other harm indicators and outstanding work. A material change in the business, technology, a supplier or the operating model reopens the list, the tolerances and the map, on top of the annual review. Weaker files point at a future programme and leave the present position inside the tolerance unstated. Mapping has to show end-to-end delivery, including third parties, group services and shared platforms, and weaker maps omit the test of a supplier assumption.

Scenario testing is where the evidence gap is sharpest. Plans must show the firm can remain within impact tolerance through severe but plausible disruption, using known vulnerabilities, dependencies and earlier incidents. Where full recovery inside the tolerance is out of reach, stronger firms show the contingency or minimum service that limits intolerable harm, and they test severe cyber disruption, data-integrity failure and a third-party outage. A manual workaround needs demonstrated scale across many users and a long window, and validating a fix is distinct from closing an action. The governing body should still see current capability where a group platform delivers the service.

How the United Kingdom test compares with DORA and CPS 230

A broker or a payment firm inside SYSC 15A faces a United Kingdom evidence test that measures harm to consumers and to market integrity, distinct from the European Union regime and from Australia’s prudential standard. Policy Statement 21/3 requires each important business service to stay within an impact tolerance, and the mapping-and-testing milestone of March 31, 2025 is now behind the sector. The November 11, 2026 page asks for evidence of the service deliverable in the present. Regulation (EU) 2022/2554 has applied since January 17, 2025, with response and recovery under Article 11 and testing under Article 24. Article 35(8) provides a periodic penalty payment on a critical ICT third-party provider of up to 1% of average daily worldwide turnover, covered in the account of EU, United Kingdom and United States third-party oversight. Australia’s CPS 230 took effect on July 1, 2025 and keeps critical operations within tolerance, so one disruption can sit in three files at once.

Sources: PS21/3, SYSC 15A, PRA SS1/21, Regulation (EU) 2022/2554, APRA, July 1, 2025, and the TSB press release, December 20, 2022. Table current as of November 15, 2026.

"The Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) regulate individual firms, and set out operational resilience policies which require regulated firms to deliver important business services within impact tolerances, even under severe but plausible disruption."

— Liz Oakes, member of the Financial Policy Committee, Bank of England (speech, May 14, 2026)

Oakes stated the firm-level duty the self-assessment is meant to evidence, under shared infrastructure that can carry an incident past the first firm hit. That dependency is what the November page puts on the map when several firms are disrupted together.

What the TSB notices show about evidence and outsourcing

The leading published United Kingdom penalty the regulators described as an operational-resilience case is the pair of notices against TSB Bank plc on December 20, 2022. The Final Notice imposed £29.75 million under section 206 of the Financial Services and Markets Act 2000, after a 30% stage-1 discount from an undiscounted £42.50 million. The joint press release records a Prudential Regulation Authority penalty of £18.9 million, a combined £48.65 million, and an undiscounted combined £69.5 million. The migration was in April 2018, and customers lost access to banking services. The notice records 225,492 complaints between April 22, 2018 and April 7, 2019 and redress of £32,705,762.

The notices apply the operational-risk and outsourcing standards then in force, which predate SYSC 15A’s commencement on March 31, 2022. The Final Notice finds shortcomings in control of the migration and in outsourcing risk at the critical third-party supplier. The year-2 page’s weaker patterns echo that record: an untested supplier assumption, a transformation narrative standing in for today’s service, and oversight that is a signature. The November page leaves the requirement in the Handbook and wants volumes, values and vulnerable customers beside any clock. Mark Francis and Simon Dixon wrote on July 24, 2026 that 27% of incidents reported in 2025 were attributed to a third party, 37% of them cyber-related.

What the page changes for a broker or a payment firm

SYSC 15A reaches an enhanced-scope Senior Managers and Certification Regime firm and a PRA-designated investment firm, together with banks and recognised investment exchanges, while a core-scope brokerage sits outside the chapter. Inside it, the year-2 standard changes the file. Order execution, margin movements, withdrawals and confirmations are the broker services whose disruption most naturally meets the glossary test the page repeats. A voice-dealing fallback has to scale across many clients and a long window if the firm relies on it while full recovery is still ahead. The page also asks how priorities move when several firms share a platform or a liquidity provider, and a United Kingdom board taking its platform from a group company needs that dependency visible.

Payment institutions, electronic money institutions and registered account information service providers are on the March 27, 2026 list, matching Policy Statement 21/3. Buying an FCA-registered payments firm moves the shares, and the important business services move with the permissions. The harm test lands on initiating a payment, issuing and redeeming e-money, and telling the customer the payment’s true state. The page asks for evidence those outcomes survive a severe cyber event or a failure at a scheme, a processor or a cloud host. Where full recovery is still ahead, the file shows which payments are prioritised and what customers hear when the app is down. A later systemic sterling issuer moves onto a separate Bank of England split, set out in the account of that split for systemic sterling issuers.

"As well as identifying their own operational vulnerabilities and have plans to mitigate them, CPS 230 requires entities to have a detailed level of understanding and mitigation planning in relation to their most critical third-party service providers. This will require an entirely new mindset about where the boundaries of responsibility sit."

— Therese McCarthy Hockey, APRA member, Australian Prudential Regulation Authority (APRA news release, July 1, 2025)

McCarthy Hockey spoke as CPS 230 took effect on July 1, 2025. A firm that buys processing or cloud from outside the sector is being told that the legal edge of the firm is a weak place to stop the map, which is the same dependency point the November page puts into the next self-assessment.

What supervisors have left open for the next self-assessment

Section 3 of the November page expects the next self-assessment to show stronger evidence of current resilience, including residual risk and the way testing, incidents and second-line and third-line work informed decisions. Individual feedback has already gone where the supervisor judged it necessary. Until remediation is delivered, the governing body is expected to understand today’s position and its assumptions, as distinct from the position the spend is meant to produce later, including where earlier issues remain open.

Neighbouring regimes are easy to mix up with that expectation. On March 18, 2026 the firms page recorded new incident-reporting and third-party notification requirements and placed them in 2027, a reporting instrument beside the year-2 evidence standard, while the Handbook duty remains the one Policy Statement 21/3 made. Liz Oakes said on May 14, 2026 that sector exercises would share a cloud-provider scenario, with findings the following summer, and each firm’s own pack remains the self-assessment record. The live question is whether the United Kingdom file describes the service available on the day the governing body approves it.

TL;DR

The year-2 operational resilience self-assessment note of November 11, 2026 tells firms inside SYSC 15A to evidence the services they can deliver now during severe but plausible disruption, kept separate from remediation still in train. It builds on the March 27, 2026 insights. Handbook rules have applied since March 31, 2022, with a mapping-and-testing milestone of March 31, 2025 under Policy Statement 21/3. Stronger files show vulnerabilities, assumptions, governing-body challenge and priorities when several firms are hit together. For an in-scope broker or payment firm the shift is scaled workarounds, metrics other than a clock, and a tested view of third parties. In 2025, 27% of reported incidents were attributed to a third party, Mark Francis and Simon Dixon wrote on July 24, 2026.

Frequently asked questions

What does the year-2 operational resilience self-assessment page ask firms to evidence?

The page asks for evidence of the service a firm can deliver during severe but plausible disruption at the time of the assessment. Stronger files show a response to severe cyber disruption, management of material third parties, and a way to limit intolerable consumer harm where full recovery inside the impact tolerance is still ahead. They also support the current position, its assumptions and the residual risks still open. Those duties remain in SYSC 15A, which Policy Statement 21/3 brought into force on March 31, 2022, with the mapping-and-testing milestone of March 31, 2025.

Which brokers and payment firms fall inside the SYSC 15A perimeter?

The March 27, 2026 scope list names enhanced-scope Senior Managers and Certification Regime firms, PRA-designated investment firms, banks, building societies, Solvency II firms, United Kingdom recognised investment exchanges, payment institutions, electronic money institutions, registered account information service providers and consolidated tape providers. A broker is inside when it meets one of those categories, and a core-scope brokerage sits outside the chapter. Payment and e-money firms authorised or registered under the 2017 or 2011 regulations are inside. The November page adds that the observations may still help firms outside that list think about harm to clients and to market integrity.

How does the November page relate to the March 2026 operational resilience insights?

The November 11, 2026 page says it builds on the March 2026 insights and keeps those findings in place. The earlier note, dated March 27, 2026, reviewed self-assessments almost a year after the March 31, 2025 milestone and stressed methodologies for services and tolerances. The later note uses the 2025 to 2026 cycle and asks whether the file shows resilience in practice, including where a March theme is still live. Both documents are supervisory observations, and the binding text remains SYSC 15A, made in Policy Statement 21/3 on March 29, 2021 and in force from March 31, 2022.

What does the file show when full recovery inside the impact tolerance is still ahead?

Stronger firms keep going once a scenario shows full recovery inside the tolerance is currently out of reach. They identify when disruption would cause intolerable consumer harm or threaten market integrity, and they evidence the contingency, the prioritisation or the minimum service that limits that harm. Volumes, values and the type of end user make the judgement readable to the governing body. A manual workaround needs proof it scales across many users over a long window. Remediation that is still planned stays labelled as future work until it is delivered and, where the risk warrants it, re-tested.

How do DORA and CPS 230 differ from the United Kingdom self-assessment?

Regulation (EU) 2022/2554 has applied since January 17, 2025 and centres on technology risk, with response and recovery in Article 11 and testing in Articles 24 and 26. Article 50 leaves financial-entity penalties to Member States, while Article 35(8) sets a periodic penalty on a critical ICT provider of up to 1% of average daily worldwide turnover. CPS 230 took effect on July 1, 2025 and requires critical operations to stay within tolerance. The United Kingdom file is the SYSC 15A self-assessment, which the November page wants evidenced as present capability.

Why do the TSB notices of December 2022 still matter beside SYSC 15A?

On December 20, 2022 the Final Notice imposed £29.75 million on TSB Bank plc under section 206 of the Financial Services and Markets Act 2000, and the Prudential Regulation Authority imposed £18.9 million, £48.65 million combined. The case is the April 2018 migration, judged under the operational-risk and outsourcing standards then in force, which predate SYSC 15A. The pattern still matches the year-2 weaker-practice list, and the notice records 225,492 complaints and £32,705,762 of redress between April 22, 2018 and April 7, 2019.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.