Embedding Operational Resilience beyond regulatory compliance

Operational Resilience is now a key, Board-level agenda item for all financial services firms. The past two years have shown that building operation resilience provides strategic value that goes beyond compliance.

Operational Resilience is more important than ever, which was proven at the 2023 Davos Summit where the concept of ‘poly-permacrisis’ was the most debated topic. Recent geopolitical and economic events have also proven that firms need to strengthen their Operational Resilience and crisis management frameworks to enhance their preparedness, response capabilities and cross-sector resilience to future crises.  Firms are now looking at how they can move to a more outcome-focussed mindset, where they prioritise the ongoing provision of services to the customers or markets in which they operate.

Over the next five years, the UK payments space will be undergoing a material change. Operational Resilience is now a cornerstone of the UK financial services sector strategy and will be foundational to enabling the country’s enhanced payments infrastructure and safety. The sector is facing the challenge of implementing RTGS Renewal, New Payments Architecture, and CBPR+. Payment service providers (PSPs) leveraging this infrastructure, will need to demonstrate that they have modernised their aging technology and are able to maintain the resilience of their market facing services. 

In the FCA’s recent Dear CEO letter, FCA Priorities For Payments Firms, the regulator explicitly identifies Operational Resilience as a cross cutting priority. We are part way through the transition period for the Operational Resilience implementation across the FS industry. This requires all firms, including payments firms, to identify their important business services and set impact tolerances. By March 2025, firms must have performed mapping and testing so that they are able to remain within impact tolerances for each important business service. Firms must also have made the necessary investments to enable them to operate consistently within their impact tolerances (Source: SYSC 15A - FCA Handbook). 

Instead of seeing Operational Resilience as another regulatory hurdle to overcome, firms should view this as a catalyst to drive change across the business, taking a long-term strategic view on the current technology and operational stacks.  In the sector, we have seen Boards and senior management now prioritising Operational Resilience when making remediation or investment decisions. Investment appraisals now assess the impact on service resilience, alongside a potential impact on customer and payment market eco-system resilience. 

Having a documented knowledge and understanding of your end-to-end payment services, overlayed with technical and operational controls is vital in ensuring control over the activities being undertaken around payment processing. Alongside this, comprehensive recovery playbooks, communication plans and mapping documentation will allow identification of failures in the journey and aid in the recovery should a disruption occur. In doing so, firms are considering their customer propositions and service offerings in the market, as well as identifying business and operational efficiencies.

Firms that operate in a number of markets have always looked at ways to industrialise their processes and technologies, with some looking towards payment service providers to support delivery of industry change outlined earlier. This has enabled hub approaches with a central hub linking to local markets and looking to pass transactions in a consistent method. These firms have an opportunity to align their operational resilience regulatory requirements across markets, identifying the intricacies of each individual market to ensure compliance, while creating a uniform approach to managing outages of their important business services.

As we see more firms outsourcing services to payment service providers, it is crucial that the it is crucial that the reliance on them is monitored across all important business services, including technology and banking services. Where there is greater reliance on a payment service provider, firms must have the appropriate contingency plans in place to move providers if necessary (Source: FCA Portfolio Letter 2023).

KPMG Powered Resilience solution includes pre-configured global accelerators for target operating models, processes and technology configurations to support clients to embed Operational Resilience and obtain strategic benefits. Our accelerators are a proven way to fast-track and support sustainable change within your business.

If you would like to find out more about the impact of Operational Resilience on your firm, please do get in touch.