The FCA’s PS21/3 outlines key commitments and activities for 2024/25 to ensure firms meet operational resilience standards by March 31, 2025.

This applies to banks, building societies, PRA-designated investment firms, insurers, recognised investment exchanges (RIEs), enhanced scope SM&CR firms, and entities under the Payment Services Regulations 2017 (PSRs 2017) and the Electronic Money Regulations 2011 (EMRs 2011). It ensures critical business services, including those involving third parties, avoid intolerable harm to consumers and markets.

FCA highlighted key operational risks in the financial sector include:

  • Consumer impact – Disruptions can prevent access to essential financial services 
  • Market confidence - Disruptions can shake market confidence, leading to economic instability 
  • Cyber threats - Increasing cyber threats complicate maintaining operational resilience 
  • Geopolitical risks - The geopolitical landscape complicates risk prediction and mitigation 
  • Systemic risks from third parties – Reliance on critical third parties adds systemic risks. 

These points underscore the importance of the FCA’s 2024/25 activities to ensure firms meet operational resilience standards and address systemic risks from third parties. 

We help organisations meet compliance requirements through: 

Evaluating against the FCA 21/3 standard.

Conducting and reporting on their effectiveness. 

Managing risk profiles including third parties, and more.

Our diverse team of professionals in technology, business processes, and operational resilience is dedicated to helping clients achieve business continuity and regulatory compliance.