All insights
Operational ResilienceRegulation

Operational resilience: what 'beyond March 2025' actually looks like

The FCA's transitional period has closed. The interesting question now isn't whether you're compliant — it's whether the framework you built is doing any real work.

Oakwood Risk & Resilience8 min read

The 31 March 2025 deadline came and went, and most regulated firms can now point to a register of important business services, mapped dependencies and impact tolerances. The harder question — the one supervisors are increasingly asking — is whether those artefacts change anything about how the business is actually run.

We see three patterns separating the firms moving into a mature state from those who are not. First, impact tolerances that are challenged annually against real disruption data, not signed off and shelved. Second, scenario testing that goes beyond the comfortable, including concentration risk in critical third parties and cumulative outage modelling.

Third — and most overlooked — governance that treats resilience as a first-class operating discipline rather than a regulatory return. That means board packs with resilience indicators alongside financial ones, and an executive accountable for the gap between tolerance and reality.

If your resilience framework is a binder rather than a behaviour, the next eighteen months will expose it. The regulator no longer needs to ask if you've done the work — they'll ask what changed because of it.

Talk to us

Want to discuss how this applies to your organisation?

Speak with us