Operational Resilience for Payment Firms: Meeting FCA Expectations in 2026

Operational resilience is a firm's ability to keep its most important services running for customers through severe disruption. For payment institutions and EMIs it has been a live legal obligation since 31 March 2025, the date by which every firm in scope had to be able to stay within its impact tolerances. The FCA's operational resilience framework, implemented through PS21/3, requires firms to identify their important business services, set impact tolerances and demonstrate that they can remain within those tolerances during severe disruption. For payment institutions, whose services are critical to customers and the wider economy, operational resilience is a regulatory priority. This article provides practical guidance for payment firms on meeting the FCA's expectations.

What Is Operational Resilience?

Operational resilience is the ability of a firm to prevent, adapt, respond to, recover and learn from operational disruptions. Unlike traditional business continuity planning, which focuses on recovering from incidents, operational resilience focuses on ensuring that important business services continue to be delivered to customers within acceptable parameters during and after disruption.

The FCA's framework is built on three pillars: identifying important business services, setting impact tolerances, and testing the firm's ability to remain within those tolerances.

Identifying Important Business Services

An important business service is a service provided by the firm to an external party (customers, market participants, the firm's counterparties) where disruption could cause intolerable levels of harm. For payment institutions, important business services typically include:

• Payment processing: the execution of customer payment transactions
• Safeguarding operations: the receipt, segregation and reconciliation of customer funds
• Customer onboarding: the ability for new customers to open accounts and begin using services
• Complaints handling: the ability for customers to raise and resolve complaints
• Customer access to funds: the ability for customers to see and withdraw their money

Firms should assess each service based on the potential harm that disruption could cause to customers, market integrity or the firm's own financial stability.

Setting Impact Tolerances

Impact tolerances define the maximum tolerable level of disruption to an important business service. They must be expressed in measurable terms, typically in terms of time, but potentially also in terms of the number of affected customers or the financial value of transactions impacted.

For payment processing, an illustrative impact tolerance might be expressed as: "Payment processing must be restored within 4 hours of a disruption, with no more than 2% of daily transaction volume affected." The specific tolerance will depend on the nature of the payment services provided, the customer base and the availability of alternative payment mechanisms.

Scenario Testing

Firms must conduct scenario testing to assess whether they can remain within their impact tolerances during severe but plausible disruption scenarios. Relevant scenarios for payment firms include:

• A cyber attack that disables the firm's core payment processing platform
• Failure of a critical third-party service provider (banking partner, technology vendor, cloud infrastructure provider)
• A major technology outage affecting multiple systems simultaneously
• Loss of access to a safeguarding bank account
• A sudden surge in transaction volumes beyond normal capacity

Scenario testing should involve all relevant teams, technology, operations, compliance, senior management, and should produce documented findings, identified vulnerabilities and remediation plans.

Third-Party Dependency Management

Payment firms are heavily dependent on third-party service providers: banking partners, technology platforms, cloud infrastructure providers, AML screening tools and customer verification services. The FCA expects firms to map these dependencies for each important business service, assess the risk of each dependency, and implement appropriate mitigations (contractual protections, alternative suppliers, manual fallback processes).

The Critical Third Party (CTP) regime, set out in PS24/16 and in force since 1 January 2025, lets the regulators oversee suppliers that the whole financial sector depends on. HM Treasury designated the first four CTPs on 10 July 2026, effective 13 July 2026: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited. The regime places duties on those suppliers, not on their customers. Payment firms remain fully responsible for their own resilience.

Key Dates

Under PS26/2, published on 18 March 2026, payment service providers must report significant operational incidents to the FCA. Authorised payment institutions and authorised EMIs must also keep a register of material third-party arrangements and submit it to the FCA every year.

What Firms Should Do Now

1. Confirm your important business services and impact tolerances are still accurate, and record the annual review that SYSC 15A requires.
2. Set measurable impact tolerances for each important business service.
3. Map end-to-end processes including all dependencies and potential points of failure.
4. Conduct scenario testing against realistic severe disruption scenarios.
5. Develop and test remediation plans for identified vulnerabilities.
6. Ensure the board receives regular reporting on operational resilience.

Regulatory Counsel advises payment firms on operational resilience framework development, impact tolerance setting, scenario testing and third-party risk management. Contact us for a written proposal.