UK PS21/3 Operational Resilience Requirements for Financial Services Firms

Financial services organisations face unprecedented regulatory expectations around operational resilience, with UK supervisory policy PS21/3 establishing comprehensive frameworks that extend far beyond traditional business continuity planning. Published jointly by the Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA), alongside complementary requirements from the Bank of England, PS21/3 required full compliance by March 2025 and establishes comprehensive GRC structures that can withstand severe operational disruptions.

The policy creates binding obligations for firms to map their operational dependencies, establish clear accountability frameworks, and demonstrate measurable resilience capabilities across their entire operational ecosystem. Unlike previous regulatory approaches, PS21/3 requires firms to prove they can maintain critical services even when facing multiple concurrent disruptions.

This analysis examines the core requirements, implementation challenges, and operational strategies that financial services firms need to establish comprehensive operational resilience programmes that satisfy regulatory compliance expectations whilst strengthening actual business continuity capabilities.

Executive Summary

PS21/3 operational resilience requirements represent a fundamental shift in how financial services firms must approach business continuity and security risk management. Rather than focusing solely on disaster recovery, the policy demands comprehensive programmes that identify critical business services, establish measurable impact tolerances, and create governance frameworks capable of maintaining operations during severe disruptions. Firms must demonstrate they can continue serving customers and meeting market obligations even when facing multiple concurrent operational challenges. This requires systematic mapping of dependencies, robust third-party risk management, and continuous testing programmes that validate resilience assumptions under realistic stress scenarios. The requirements extend beyond traditional IT continuity to encompass operational processes, staff availability, physical infrastructure, and external dependencies that could impact service delivery.

Key Takeaways

1. Critical Service Identification. PS21/3 requires firms to systematically identify and prioritise critical business services through dependency mapping and impact tolerance setting.
2. Measurable Impact Tolerances. Firms must establish quantitative thresholds for service degradation that trigger clear escalation procedures during disruptions.
3. Extended Governance Structures. Accountability must reach from senior management to operational teams with documented decision-making and regular testing protocols.
4. Third-Party Risk Management. TPRM becomes central, requiring ongoing assessment, monitoring, and alternative arrangements for external service dependencies.

Understanding Critical Business Service Identification

Financial services firms must establish systematic methodologies for identifying and categorising their critical business services under PS21/3 requirements. This process extends beyond obvious customer-facing services to include supporting functions, market operations, and regulatory reporting capabilities that underpin the firm's ability to meet its obligations.

The identification process requires firms to examine their entire operational ecosystem from the perspective of potential customer and market impact. Critical services typically include payment processing, lending operations, investment management, custody services, and market-making activities, but the specific categorisation depends on each firm's business model and market role.

Firms must document the rationale for each service classification, establishing clear criteria that demonstrate why specific functions qualify as critical to the organisation's operations. This documentation becomes essential during supervisory reviews and helps ensure consistent application of resilience standards across different business areas.

Dependency Mapping and Interconnection Analysis

Effective critical service identification requires comprehensive mapping of operational dependencies, including technology systems, third-party providers, staff functions, physical infrastructure, and regulatory connections. These dependencies often create complex webs of interconnection that can amplify disruption impacts across seemingly unrelated business areas.

Technology dependencies extend beyond core applications to include data centres, network connectivity, security systems, and cloud services that support critical operations. Firms must understand how these systems interconnect and identify single points of failure that could cascade across multiple business services.

Third-party dependencies require particular attention under PS21/3, as external service disruptions can directly impact a firm's ability to maintain critical services. This includes outsourced functions, technology suppliers, market infrastructure providers, and utilities that support operational continuity.

Establishing Impact Tolerance Frameworks

Impact tolerance setting represents one of the most challenging aspects of PS21/3 implementation, requiring firms to define measurable thresholds that indicate when service disruptions become unacceptable. These tolerances must reflect genuine business impact rather than arbitrary technical metrics.

Effective impact tolerances typically combine multiple dimensions including service availability, processing capacity, customer experience, and market impact. For example, a payment processing service might establish tolerances around transaction volumes, processing delays, and customer access timeframes that reflect genuine business continuity requirements.

Firms must ensure their impact tolerances align with customer expectations, regulatory obligations, and market commitments. This requires careful analysis of contractual obligations, service level agreements, and regulatory deadlines that could be compromised during operational disruptions.

Quantitative Metrics and Escalation Procedures

Impact tolerance frameworks require quantitative metrics that provide clear escalation triggers and enable objective assessment of service degradation. These metrics must be measurable during crisis situations and should reflect genuine operational impact rather than technical performance indicators.

Processing volume tolerances might specify minimum transaction throughput levels, maximum processing delays, or acceptable error rates that trigger specific response procedures. Customer access tolerances could define maximum system downtime, acceptable queue lengths, or minimum service availability windows.

Escalation procedures must specify clear decision points, communication requirements, and resource allocation triggers that activate when services approach their impact tolerance thresholds. These procedures should enable rapid response whilst maintaining appropriate governance oversight during crisis situations.

Governance and Accountability Structures

PS21/3 requires firms to establish governance structures that ensure operational resilience receives appropriate senior management attention whilst enabling effective operational response during disruptions. These structures must balance strategic oversight with operational flexibility.

Board-level governance typically includes regular reporting on resilience programme effectiveness, periodic review of critical service classifications, and approval of significant changes to impact tolerance frameworks. Senior management must demonstrate active engagement with resilience planning and clear accountability for programme outcomes.

Operational governance structures should enable rapid decision-making during disruptions whilst maintaining appropriate controls and documentation. This includes clear escalation procedures, communication protocols, and decision-making authorities that function effectively under stress conditions.

Cross-Functional Coordination and Communication

Effective operational resilience governance requires coordination across traditionally separate functions including risk management, business continuity, technology operations, and business management. These functions must work together seamlessly during both planning and response phases.

Communication structures should enable rapid information sharing during disruptions whilst avoiding information overload or conflicting instructions. This typically requires clear communication hierarchies, predefined messaging templates, and established channels that remain functional during crisis situations.

Regular coordination meetings, cross-functional exercises, and joint planning sessions help ensure different functions understand their roles and can coordinate effectively when operational resilience capabilities are tested by actual disruptions.

Third-Party Risk Management and Outsourcing Oversight

Third-party risk management becomes a cornerstone of operational resilience under PS21/3, requiring firms to assess, monitor, and manage dependencies on external service providers that could impact critical business services. This extends beyond traditional vendor risk management to include comprehensive resilience assessment.

Firms must evaluate their third-party providers' own operational resilience capabilities, including their business continuity plans, redundancy arrangements, and crisis management procedures. This evaluation should consider the provider's ability to maintain service during various disruption scenarios.

Contractual arrangements should specify service level requirements, resilience standards, and notification obligations that align with the firm's impact tolerance frameworks. Providers should be required to demonstrate their resilience capabilities through testing, reporting, and periodic assessments.

Concentration Risk and Alternative Arrangements

Concentration risk analysis helps firms identify situations where multiple critical services depend on the same third-party provider or where alternative providers share common dependencies. These concentrations can create systemic vulnerabilities that amplify disruption impacts.

Alternative arrangement planning requires firms to develop credible options for maintaining critical services when primary third-party providers experience disruptions. This might include backup providers, insourcing capabilities, or alternative service delivery methods.

Regular testing of alternative arrangements helps ensure these options remain viable and can be activated quickly when needed. Testing should include communication procedures, data transfer processes, and operational handover requirements that enable smooth transitions during crisis situations.

Testing and Scenario Planning Requirements

Continuous testing and scenario planning replace traditional periodic business continuity exercises under PS21/3, requiring firms to validate their resilience assumptions regularly and adapt their programmes based on testing outcomes. This testing must examine realistic disruption scenarios rather than isolated system failures.

Scenario development should consider multiple concurrent disruptions, cascading failure modes, and extended duration events that could challenge the firm's resilience capabilities. Scenarios should reflect genuine risk environments rather than best-case assumptions about disruption characteristics.

Testing programmes must examine both technical recovery capabilities and human response effectiveness, including decision-making processes, communication systems, and coordination mechanisms that operate during crisis situations. Regular testing helps identify capability gaps before they become critical vulnerabilities.

Continuous Improvement and Adaptive Response

Testing outcomes should drive continuous improvement in resilience capabilities, with firms adapting their programmes based on lessons learned and changing risk environments. This requires systematic capture of testing insights and structured improvement planning processes.

Adaptive response capabilities enable firms to modify their resilience strategies based on emerging threats, changing business models, and evolving regulatory expectations. This flexibility helps ensure resilience programmes remain effective as operational environments continue to evolve.

Regular programme reviews should examine the effectiveness of current resilience arrangements and identify opportunities for enhancement. These reviews should consider both internal testing outcomes and external events that provide insights into potential vulnerabilities or improvement opportunities.

Conclusion

PS21/3 has reshaped how UK financial services firms think about resilience, moving the discipline well beyond legacy business continuity planning. Firms that comply successfully share five characteristics: they systematically identify and prioritise their critical business services; they set measurable impact tolerances with clear escalation triggers; they extend governance and accountability from the boardroom into operational teams; they treat third-party risk management as central to resilience rather than a separate compliance exercise; and they replace one-off continuity tests with continuous, scenario-based validation.

Taken together, these requirements mean operational resilience can no longer be treated as an IT or disaster-recovery function. It is now a firm-wide discipline that touches technology, staffing, physical infrastructure, and external dependencies alike — and one that UK financial services firms must be able to demonstrate to the FCA and PRA on an ongoing basis, not just at a single point-in-time assessment. For firms also operating across EU markets, it is worth noting that PS21/3 shares common ground with the EU's Digital Operational Resilience Act (DORA), though the two remain distinct, separately enforceable obligations following the UK's departure from the EU.

Kiteworks Private Data Network

Operational resilience programmes inherently involve extensive data flows, system interconnections, and third-party relationships that create expanded attack surfaces for sensitive information. Financial services firms must ensure their resilience capabilities don't compromise the security posture of customer data, transaction records, and confidential business information that flows through recovery and continuity processes.

The Kiteworks Private Data Network provides essential infrastructure for maintaining data privacy throughout operational resilience implementations. The platform secures sensitive data in motion across all resilience-related communications using FIPS 140-3 validated encryption and TLS 1.3, is built on a FedRAMP High-ready authorised architecture, ensures tamper-proof audit logs for compliance demonstration, and enables zero trust architecture verification of data access during both normal operations and crisis response procedures.

Kiteworks integrates directly with existing SIEM, SOAR, and ITSM workflows that support operational resilience programmes, providing data-aware security controls that adapt automatically to changing risk contexts during disruption scenarios. This integration ensures that enhanced resilience capabilities strengthen rather than compromise overall security posture whilst maintaining the comprehensive audit trails documentation required for PS21/3 compliance demonstration.

UK financial services firms ready to strengthen their PS21/3 compliance posture can explore how the Kiteworks Private Data Network supports operational resilience programmes. Schedule a custom demo to see integrated data security controls in action.