Operational Resilience and TPRM

Operational disruptions can cause wide-reaching harm to consumers and pose a risk to market integrity, threaten the viability of firms and cause instability in the financial system. Following several high profile operational failures and the widespread disruption during the Coronavirus pandemic, regulators felt it necessary to improve resilience. 

In 2021, the FCA, PRA and the Bank of England published a policy statement (PS21/3) setting out new requirements to strengthen operational resilience in the financial services sector. 

Operational resilience is the ability of firms and the financial sector to prevent, adapt, respond to, recover and learn from operational disruptions. It’s not a new concept and there’s no prescription for how to achieve operational resilience. Firms choose how they get there, but being operationally resilient is not optional.

The regulation applies to banks, building societies, designated investment firms, insurers, Recognised Investment Exchanges (RIEs), enhanced scope senior managers’ and certification regime (SM&CR) firms and entities authorised or registered under the Payment Services Regulations 2017 (PSRs 2017) or the Electronic Money Regulations 2011 (EMRs 2011), UK Solvency II firms, the Society of Lloyd’s and its managing agents (insurers), Central Counterparties; Recognised Payment System Operators and Specified Service Providers; Central Securities Depositories

The long transition period for compliance ended in 2025, and firms now need to be able to continually operate within their impact tolerances, and maintain evidence that this has been tested successfully.

The huge expansion of cloud computing services, various “as a Service” (aaS) offerings (e.g. Banking as a Service, BaaS; Software as a Service, SaaS), has resulting in most firms’ infrastructure stack being dependent on multiple third parties, in addition to traditional group dependencies.

While simplifying systems development and reducing time to market and up-front investment, these complex third-party tech stacks rely on complex networks of connectivity. The failure of a single element of a third party service can cause critical service failure. Replacing a third party (or group support) due to service level agreement failures can be difficult, time consuming and costly.

Regulators have responded to the increasing risk posed by these complex interdependencies by strengthening their oversight of third parties (including group service providers).

Third Party Risk Management (TPRM) and managing Material Third Parties (MTPs) is an essential operational and regulatory obligation. It is a challenge for many firms, who may be dependent on these same third parties for the expertise required to manage them, creating conflicts and confusion.