Redefining operational resilience

Operational resilience has been a regulatory concern for decades but in the aftermath of the 2008 financial crisis it took a back seat to the development of new rules and frameworks for financial resilience. Over the last few years, however, operational resilience has risen to the top of the regulatory agenda and has now been brought into even sharper focus by the COVID-19 pandemic. Regulators are acutely aware that the threat of disruption to financial firms, and by extension to their customers, is heightened in times of stress. Technology-led business transformation, high-profile instances of disruption and recognition of the interconnectedness of the financial system have led to increased attention on operations and how things are done.

• Different jurisdictions are moving at different speeds but all agree that operational resilience is a priority. As definitions of operational resilience grow broader and more complex, regulators are taking different approaches, from high level principles to the introduction of new operational resilience frameworks.
• The COVID-19 pandemic has highlighted the benefits and challenges of managing the risks of financial institutions' interactions with third parties. The resilience of third parties themselves is in focus, with regulators concerned, among other things, about concentration of providers, contractual terms, access rights and oversight.
• Cyber resilience continues to be of critical importance. However, in the new reality the focus is expanding to the broader ICT risk environment, and the EU has introduced a technology-driven definition of “digital operational resilience”.
• Firms must be mindful of the differences in definitions from one regulator to another as they develop their approaches to operational resilience. However, underpinning all the regulatory initiatives is the common desire to create a financial services sector that is more resilient to disruption, hence reducing the potential for wider contagion, financial instability and harm to end-customers.
• COVID-19 has not changed the direction of travel from a regulatory perspective. If anything, it has accelerated the regulatory drive to push ahead and reinforced the clear and continuing need for robust operational resilience.