Resilience and PS26/2: realising returns on your compliance investment

In March 2025 the FCA’s operational resilience rules came fully into force. This was a milestone, not an end point. What comes next is more demanding.

From March 2027, PS26/2 introduces a major new requirement. This is a unified operational reporting regime which FCA-authorised firms with Part 4A – and certain other categories – will be expected to follow. There is an obligation to provide an annual register of material third-party arrangements. Serious incidents will need to be reported through a standardised, coordinated single submission process across all regulatory bodies.

The statistics say the quiet part out loud: over 40% of reported cyber security incidents involved a third party. If your operational resilience planning doesn’t account for such incidents, your business has a sizeable blind spot.

For those without operationalised processes for recording, standardising and reporting the relevant information, this obligation threatens to be a major headache.

 

The market as a mirror

Resilience – and the ability to prove it – shouldn’t be understood simply in terms of the input costs. This is an inside-out view of things which misses the value of operational resilience.

In practice, clients do not see the cost and effort poured into ensuring resilience. They don’t feel the pain of maintaining the ever-increasing regulatory overhead. They simply see a partner they can trust to help them with their critical business requirements.

When done well, resilience and security are invisible to them because everything just works. It stands out by not standing out – in stark contrast with the alternative, which is very visible to them.

What they see in that instance is a brand they can’t rely on and a business they can’t trust with their data, which lets them down when they most need it and puts them in difficult situations with their own customers.

This perspective is key to understanding the return you get on operational resilience, which in turn informs decisions on where to invest further. It helps identify the arrival of diminishing returns and therefore avoid wasting investment in the wrong areas.

 

The opportunity cost of inaction

This is before considering the internal impacts of getting things wrong. A wealth manager whose advisors have to fight against poorly integrated systems is doing that instead of serving clients. It’s converting revenue into frustration. A speciality lender whose infrastructure hasn’t scaled with their business is a compliance risk, but “compliance risk” is an industry euphemism for having to rush an expensive remediation programme at a time not of your choosing.

Technical debt accrues interest, which will always be the more expensive option in the long-run.

Out of the financial services firms we work with, we’ve seen the most confident in the current climate are those who’ve treated resilience as a foundational investment. Getting that right has allowed them to excel at the bits which generate revenue. Fee-earner productivity. Client retention. Referrals borne of trust.

Blenheim Underwriting is a great example of this. Instead of playing catch up, they chose to set the pace. They have modernised a complex technology estate without disruption, stabilising workflows while business continued uninterrupted. This approach was chosen because unplanned downtime for a specialist underwriter carries a direct claims and reputational cost. They can now focus on revenue-generating activities, confident they’ll not be distracted by the same challenges faced by competitors who’ve not done the same.

 

Turning resilience into confidence

In practical terms, what does getting it right look like?

• Documented dependency mapping for critical business services. Not simply generic IT inventories, but specific maps of systems and relationships, how they underpin which services, and known failure modes.
• Tested recovery and continuity scenarios, with defined and achievable RTO/RPO* evidence. These should not be aspirational ‘in theory’ times drawn from a third-party SLA but rehearsed and documented to prove impact tolerances are realistic.
• An incident management process aligned to the PS26/2 reporting thresholds. Incidents should be clearly categorisable, so the firm knows when they cross the threshold for reporting and required notification can be provided in a timely, structured manner.
• Third-party governance that treats MSPs as a named, integral part of the regulatory picture. Something that is hidden is either not understood or not accounted for. These relationships should be documented and subject to their own governance evidence.

*Recovery Time Objective & Restore Point Objective. How quickly do you need to get back up and running, 
and how much data loss can you tolerate?

These measures are how you close the gap between merely being able to say you have confidence in your operational resilience and being able to show why you have that confidence. That’s the gap that PS26/2 will make more visible than ever, when a regulator says the words “show me”.