The deadline has been and gone. On 31 March 2025, the transitional period under the FCA's operational resilience rules (PS21/3) and the PRA's Supervisory Statement SS1/21 came to an end. By that date, in-scope firms were expected to have identified their important business services, set impact tolerances, completed mapping and scenario testing, and be able to remain within those tolerances through severe but plausible disruption.
So the work is done, right?
Not quite. The end of the transition period was not the finish line. It was the starting gun for what the regulators call the ongoing operational phase. And a year and more into that phase, the FCA has made two things very clear: It is actively reading firms' self-assessments, and it is not always liking what it finds. In this article, we look at what the ongoing phase actually requires, what the FCA's 2026 findings tell us, and what's coming next.
The UK operational resilience regime, established by FCA Policy Statement PS21/3 ("Building operational resilience") and PRA Supervisory Statement SS1/21, is built on a handful of deceptively simple requirements. In-scope firms must:
The rules came into force on 31 March 2022. The three-year transition ended on 31 March 2025. From that point, firms moved from building their resilience programme to running it.
The single biggest shift in the ongoing phase is this: the regulator no longer wants to see a plan — it wants to see a functioning programme with evidence behind it.
In practice, the ongoing phase means:
Resilience, in other words, is no longer a project. It's a discipline — and one the regulator is now inspecting.
In March 2026, roughly a year after the transition period closed, the FCA published its observations from reviewing firms' annual operational resilience self-assessments — a mix of good practice and pointed criticism.
Where firms are doing well:
Where firms are falling short:
The FCA has also pointed to recent real-world events as exactly the kind of scenarios firms should be testing against: major cloud-provider outages affecting the sector, and high-profile cyber attacks on household-name organisations in other industries. These aren't theoretical tail risks any more. They're last year's news — and next year's test.
The uncomfortable question for every board: If the FCA read your self-assessment tomorrow, would it read as evidence of a living programme — or as a compliance artefact frozen in March 2025?
The regime is not standing still. In March 2026, the FCA, PRA and Bank of England published final rules creating a single, unified framework for operational incident reporting and material third-party reporting (FCA PS26/2 with guidance FG26/3 and FG26/4; PRA PS7/26 and SS1/26). The new rules apply from 18 March 2027 — and the regulators have been explicit that the twelve-month runway is for preparing, not waiting.
In summary, the new regime will:
This lands on top of the critical third parties regime (PS16/24), which addresses concentration risk at sector level, and — for firms with EU operations, group entities or ICT services to EU financial entities — the EU's Digital Operational Resilience Act (DORA), which has applied since January 2025.
The direction of travel is unmistakable: regulators want continuous, evidenced visibility of how resilient firms actually are, with third-party dependency and concentration risk squarely in the spotlight.
If the ongoing phase has a to-do list, it looks like this:
Here's the trap in the ongoing phase: it's entirely possible to maintain a compliant-looking self-assessment while your actual resilience quietly degrades — platforms age, dependencies accumulate, key people leave, and testing drifts towards the comfortable.
That's why the most resilient firms treat measurement, not documentation, as the heartbeat of the ongoing phase.
If you've run cyber tabletop exercises, you've tested how your people respond on the day. The next step is measuring the underlying resilience beneath that response — and translating it into terms your board can act on.
That's precisely what our Operational Resilience Assessment is built for: a single facilitated session with your operational and board-level owners that produces a board-ready view of how resilient your critical services really are. They are scored on a five-level maturity model, mapped to your growth objectives, signposted against FCA/PRA expectations (and EU DORA where relevant), and delivered with a prioritised 12-month roadmap that drops straight into your risk register and your next self-assessment.
For the detailed technical picture behind the same findings, the evidence your IT teams need to remediate, its companion, the Technical Resilience Assessment, engages the people who build, run and recover your critical systems.
In the ongoing phase, the firms that thrive won't be the ones with the thickest self-assessment. They'll be the ones who can show, with evidence, that they measured their resilience, invested where it mattered, and matured — year after year.
Book a Scoping Call with us today to help us understand your exact needs. One short conversation, one measured baseline, one defensible story for your board and your regulator.
1. Did the FCA operational resilience deadline pass in March 2025?
Yes. The three-year transitional period under FCA PS21/3 and PRA SS1/21 ended on 31 March 2025. By that date, in-scope firms had to have identified their important business services, set impact tolerances, completed mapping and scenario testing, and be able to remain within tolerances through severe but plausible disruption. The end of transition was not the finish line — it marked the start of the ongoing operational phase, in which the regulator expects a functioning, evidenced programme rather than a plan.
2. What is the "ongoing phase" of operational resilience?
The ongoing phase is the period after 31 March 2025 in which firms must run their resilience programme, not just build it. Mapping, testing and the self-assessment must be kept current; scenario testing must keep maturing towards more empirical, evidenced approaches; vulnerabilities must be remediated and closure evidenced through re-testing; and the board must own and genuinely engage with the self-assessment. In short, the regulator now wants proof of resilience, not documentation of intent.
3. What did the FCA find when it reviewed firms' self-assessments in 2026?
In March 2026 — about a year after transition closed — the FCA published observations from reviewing firms' annual self-assessments. On the positive side, it saw strong engagement, clear methodologies for defining important business services, and genuine investment in resilience. Its main criticisms were incomplete third-party and dependency mapping, scenario testing that wasn't severe enough, stale self-assessments with sections but little substance, and impact tolerances stated without evidenced justification. The FCA pointed to recent cloud-provider outages and high-profile cyber attacks as exactly the kind of scenarios firms should be testing against.
4. What is changing with incident and third-party reporting from March 2027?
In March 2026 the FCA, PRA and Bank of England published final rules for a unified operational incident and material third-party reporting framework (FCA PS26/2 with FG26/3 and FG26/4; PRA PS7/26 and SS1/26), applying from 18 March 2027. The rules define an "operational incident" with common thresholds and require an initial report as soon as practicable — generally within 24 hours of determining a threshold is met, even where no important business service is affected. There are standard and enhanced reporting tiers, a requirement to notify new or significantly changed material third-party arrangements, and an annual register of material third-party arrangements submitted to the FCA.
5. Does an incident have to affect an important business service to be reportable?
No. Under the incoming PS26/2 framework, an operational incident can be reportable even if it does not affect an important business service, provided it meets the common FCA/PRA thresholds. This is a notable widening of scope, and firms should test whether their incident processes can determine reportability and produce a defensible report within 24 hours under pressure.
6. How does DORA relate to the UK operational resilience regime?
The EU's Digital Operational Resilience Act (DORA) has applied since January 2025 and is relevant to firms with EU operations, group entities, or those providing ICT services to EU financial entities. It sits alongside the UK regime (PS21/3, the critical third parties regime PS16/24, and the incoming PS26/2 reporting rules). Dual-exposed firms need to reconcile both frameworks rather than treat them in isolation.
7. What should firms do now in the ongoing phase?
Refresh the self-assessment substantively rather than changing the cover date; pressure-test scenarios against severe-but-plausible events like a major cloud outage or third-party ransomware; map concentration and dependency risk before the regulator asks; audit which third-party arrangements would count as "material" under the March 2027 rules; and measure resilience rather than assume it. Documentation proves you have a programme on paper, only assessment proves the capability behind it.