Operational resilience · RiskAtoms Academy

By the end you will be able to

1Explain operational resilience in terms of important business services and impact tolerances, and why it assumes disruption will happen.
2Map a service to the systems and suppliers it needs, and find where they concentrate.
3Test services against severe but plausible scenarios and say what would bring them within tolerance.
4Compare the UK regime with the Basel principles and the EU's DORA.

Why it matters

At 05:40 on 14 October 2025 a database upgrade failed on RiskAtoms Bank's payments platform. For 31 hours customers could not send Faster Payments, and businesses could send only their most urgent CHAPS payments, released by hand from hour 4. L3.7.09: Technology and change risk asks why the change failed. This lesson asks the regulators' question: given that something will fail, why could the bank not keep these services running for as long as its customers could bear?

Core explanation

Services, tolerances and maps

Illustrative dataRiskAtoms Bank plc's operational risk book

The same £67bn bank as Modules 3.5 and 3.6, at 31 December 2025: 1,107 records of losses of £10,000 or more and near misses over 2016–2025 (£240.5m of net operational losses), an RCSA of 17 key risks and 29 controls, ten key risk indicators, seven workshop scenarios and five important business services. Every event, person, supplier and figure is made up for teaching; none is any bank's data. The same book runs through every lesson in Module 3.7, so the figures agree.

The book defines five important business services, each with an impact tolerance, and the October outage cost £18.4m. The scenarios and recovery times in this lesson are extras, labelled where they appear.

Risk management asks how likely a loss is and how large. Operational resilience starts from the other end: assume the disruption happens, and ask whether the services customers rely on can carry on, or come back, before the harm becomes intolerable. The PRA asks firms to set their tolerances on the assumption that disruption will occur.

Important business services and tolerances

An important business service is something an outside user receives, named from their side: “send a payment”, not “the payments platform”. Each gets an impact tolerance, measured at least in time: the longest disruption the firm will accept before customers suffer intolerable harm.

Service	Who uses it	Tolerance	Other measure
IBS1 Retail payments out (Faster Payments)	5 million personal customers	24 hours	No more than 200,000 payments delayed beyond a day
IBS2 Access to accounts (app and online banking)	4 million digital users	24 hours	–
IBS3 Card payments and cash withdrawals	5 million cardholders	12 hours	–
IBS4 High-value payments for business customers (CHAPS)	60,000 business customers	4 hours	Same-day settlement of payments received by 2pm
IBS5 Mortgage payments and redemptions	300,000 mortgage customers	72 hours	Completions on the agreed day

CHAPS has the shortest tolerance because its payments are large, time-critical (house purchases, payroll, settlements) and must settle the same day. Mortgage servicing can wait three days because a payment taken a day late rarely harms anyone, as long as completions happen on the agreed day.

Sort itService or resource?

The first mistake firms make is to list systems as services. Sort each item.

Customers withdrawing cash at ATMs
The core banking system
Business customers sending same-day high-value payments
The contact-centre telephony contract
The operations team that releases payments held for review

Mapping

Mapping traces each service to the people, processes, technology, facilities, information and suppliers it needs. Its purpose is to find the points where one failure stops a service, and where several services share one point of failure.

Service	Tolerance	Payments platform	Core banking	Mobile and online banking	Card platform	Mortgage servicing
IBS1 Retail payments out (Faster Payments)	24h	●	●
IBS2 Access to accounts (app and online banking)	24h		●	●
IBS3 Card payments and cash withdrawals	12h		●		●
IBS4 High-value payments for business customers (CHAPS)	4h	●
IBS5 Mortgage payments and redemptions	72h		●			●

Supplier	Services that depend on it	Concentration
Cirrovane Cloud	IBS1, IBS2, IBS4, IBS5	4 of 5
Quillmoor Systems	IBS1, IBS2, IBS3, IBS5	4 of 5
Paxtorn Processing	IBS3	1 of 5
Velmarra Payments	IBS1, IBS4	2 of 5
Wrenhallow Telecom	IBS5	1 of 5

Two suppliers sit under four of the five services: Cirrovane Cloud, which hosts the payments, digital and mortgage platforms, and Quillmoor Systems, which supplies core banking. Neither has a tested exit plan (L3.7.10: Third-party and outsourcing risk).

Testing: severe but plausible

The firm then tests each service against severe but plausible scenarios. A test that every service passes was not severe enough. A breach is not a failure of the exercise: it shows where to invest.

Three things a test must answer

The formal version

For service $s$ under scenario $k$ , let $d_r$ be the hours until resource $r$ is back, $R(s)$ the resources the service needs, and $w_s$ the hours until a workaround runs (infinite if there is none). With $\delta$ hours to detect and decide:

\begin{aligned} D_{s,k} &= \delta + \min\Big(\max_{r \in R(s)} d_r,\; w_s\Big) \\ \text{breach} &\iff D_{s,k} > T_s, \qquad \text{headroom } H_{s,k} = T_s - D_{s,k} \end{aligned}

The service needs all its resources, hence the maximum; it needs only one route, hence the minimum. For the October outage, $D = 31$ hours for both payment services:

\begin{aligned} \text{IBS1: } & 31 - 24 = 7 \text{ hours over} \\ \text{IBS4: } & 31 - 4 = 27 \text{ hours over} \end{aligned}

Try it

Extra for this lessonFive scenarios (illustrative)

Recovery times today come from the bank's tests and the October outage; “after the fixes” assumes the open actions are delivered and tested.

Try itTest a scenario against the impact tolerances

Scenario

The bank's set-up

Extra hours to detect and decide0h

A database upgrade breaks the payments platform

The October 2025 outage: an upgrade fails overnight, there is no tested back-out plan, and the platform is restored from backup.

IBS1 Retail payments out (Faster Payments)31h of 24h · over by 7h

Back out the change in 6 hours with a rehearsed plan

IBS4 High-value payments for business customers (CHAPS)31h of 4h · over by 27h

Urgent CHAPS payments released first, 3 hours after the back-out starts

Bar: hours the service is disrupted. Vertical line: its impact tolerance.

Services outside tolerance2 of 2

Worst: IBS4 over by27h

The fix that matters: Actions A04 and A12: no high-risk change without a rehearsed back-out plan, and a review of change management. The CHAPS figure after the fixes also assumes a documented and rehearsed manual release of urgent payments, which none of the book's actions yet covers. Illustrative scenarios and recovery times; the tolerances are the book's.

Worked example

The October outage, tested against tolerance

From incident to remediation plan

Step 1 of 5

1
Map the failure
The payments platform supports IBS1 (Faster Payments) and IBS4 (CHAPS). Card payments, digital banking and mortgages run on other platforms and were not disrupted.

What the board's self-assessment records

Two services breached tolerance in a real event. The causes are known, the fixes are dated, and the retest shows every scenario within tolerance once they land. The narrowest margin, CHAPS, is where the next test should press hardest.

Regulatory lens

UK rules. The FCA (PS21/3) and PRA (SS1/21) published final rules on 29 March 2021. Firms had to identify their important business services, set impact tolerances, map and test by 31 March 2022, and be able to remain within tolerance by 31 March 2025. A board-approved self-assessment records the work. The PRA notes that recovery time objectives are set for resources, tolerances for services.
What the FCA found. Its observations a year after the deadline (March 2026) noted tolerances that did not separate harm to consumers from harm to market integrity, mapping focused on technology at the expense of people and processes, gaps on third parties, scenarios not severe enough, and communication plans that had not been tested.
Basel and the EU. The Basel Committee's Principles for Operational Resilience (March 2021) set the same ideas internationally. The EU's Digital Operational Resilience Act (Regulation 2022/2554) has applied since 17 January 2025, with a narrower focus on information and communication technology risk, incident reporting, testing and third-party providers.

Public dataTSB, FCA and PRA final notices, 20 December 2022

TSB's April 2018 migration to a new IT platform left many of its 5.2 million customers unable to use their accounts properly; normal service returned in December 2018. The FCA (£29.75m) and PRA (£18.9m) fined it £48.65m in all, after a 30% settlement discount from £69.5m, and TSB paid £32.7m in redress to customers.

Spark Atoms

Spark AtomTwo data centres that were not twins

An independent review of the TSB migration, published by TSB in November 2019, found that its two new data centres had in certain areas been configured inconsistently, although the bank had run nine dress rehearsals. A second site helps only if it can really take over.

Spark AtomFour of five services, one supplier

At RiskAtoms Bank one cloud provider sits under four of the five important business services. If it fails, four services fail together, however good each one's own plan. Mapping makes the concentration visible; it does not remove it.

Key takeaways

Operational resilience assumes disruption will happen and asks whether important services stay within an impact tolerance.
Services are named from the customer's side; tolerances are set from the harm, in time and other measures; RTOs belong to resources.
Mapping links services to people, processes, technology, facilities, information and suppliers, and exposes shared single points of failure.
Disruption = detection + min(slowest needed resource, workaround). The October outage breached IBS1 by 7 hours and CHAPS by 27.
The UK rules applied in full from 31 March 2025; Basel set principles in 2021; DORA has applied in the EU since 17 January 2025.

Reaction

Check what stuck

Glossary

Operational resilience: Operational resilience: a firm's ability to prevent, adapt to, respond to, recover from and learn from operational disruption, keeping its important services running.
Important business service: Important business service: a service the firm provides to an outside user (a customer or market participant) whose disruption could cause intolerable harm to consumers, or risk to market integrity, the firm's safety and soundness or financial stability.
Impact tolerance: Impact tolerance: the maximum tolerable level of disruption to an important business service, measured at least by a length of time, set at the point beyond which harm becomes intolerable.
Mapping: Mapping: identifying and documenting the people, processes, technology, facilities, information and third parties needed to deliver each important business service.
Severe but plausible scenario: Severe but plausible scenario: a disruption extreme enough to test whether the firm can stay within tolerance, yet possible in practice.
Recovery time objective: Recovery time objective (RTO): the target time to restore one resource, such as a system. It belongs to a resource; an impact tolerance belongs to a service.
Workaround: Workaround: a different way to deliver the service while the usual resources are down, such as releasing urgent payments manually.
Self-assessment: Self-assessment: the firm's written record of its services, tolerances, mapping, testing and remediation, approved by the board and available to supervisors.

Deep Dives & Origins

Deep Dives

Prudential Regulation Authority, SS1/21 Operational resilience: Impact tolerances for important business services, March 2021. Intermediate.
Basel Committee on Banking Supervision, Principles for Operational Resilience, March 2021. Intermediate.

Origins

Financial Conduct Authority, PS21/3 Building operational resilience, 29 March 2021, and Operational resilience: insights and observations one year on, 27 March 2026.
Prudential Regulation Authority, SS1/21, March 2021; Basel Committee, Principles for Operational Resilience, 31 March 2021; Regulation (EU) 2022/2554 (DORA).
Financial Conduct Authority, press release on the TSB fines, 20 December 2022; TSB, statement on the Slaughter and May independent review, 19 November 2019.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.