If you run a small FCA-regulated firm, such as an IFA practice, a wealth manager or a mortgage broker, you’ve probably seen “operational resilience” everywhere. It’s easy to assume it all applies to you. Most of it doesn’t. Some of it does, and a new rule arriving in March 2027 applies to almost everyone.
Here is a plain answer, and what a proportionate response looks like for a small firm.
Who the operational resilience rules apply to
The FCA’s operational resilience rules (policy statement PS21/3, set out in SYSC 15A of the FCA Handbook) apply to a defined list of firms. In the FCA’s words, “The rules apply to: banks, building societies, PRA-designated investment firms, insurers, Recognised Investment Exchanges, Enhanced scope Senior Managers and Certification Regime firms”, along with payment and e-money institutions and a few others (FCA, operational resilience).
Most small advice and broking firms are core or limited scope under the Senior Managers and Certification Regime, not enhanced scope. If that’s you, the full regime of important business services, impact tolerances and mapping does not apply to you directly.
Check your own SM&CR category. If you’re unsure, your compliance support will know.
What applies to every firm anyway
Being outside SYSC 15A doesn’t mean IT resilience is optional. The general rules still apply:
- Principle 3. “A firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems” (FCA Handbook, PRIN 2.1).
- Systems and controls. The general organisational requirements in SYSC apply to firms proportionately. They include effective control and safeguards for information processing systems (SYSC 4.1).
- Outsourcing. For most small firms, the outsourcing rule in SYSC 8 applies as guidance rather than a hard rule. The FCA still expects you to oversee what your IT provider does on your behalf (SYSC 8.1).
- Notifications. Firms must tell the FCA about matters with serious regulatory impact. A significant failure in systems or controls is one example given (SUP 15.3).
The change that does apply to you: incident reporting from March 2027
In March 2026 the FCA published final rules on operational incident and third-party reporting (PS26/2). Two parts matter here.
- Incident reporting applies to all firms with a Part 4A permission. That includes small IFAs and brokers. Operational incidents that meet the FCA’s thresholds will have to be reported in a standard format.
- Third-party reporting applies only to the larger firms already in scope of operational resilience. Smaller firms don’t have to keep and submit a register of material third parties.
The new rules come into force on 18 March 2027. A cyber attack that takes your systems or client data offline is exactly the kind of operational incident the rules are about. A small firm will need to know, quickly, what happened, what was affected and what was done about it.
A proportionate approach for a small firm
You don’t need the full SYSC 15A machinery. You do need to be able to show you’ve thought about it. A sensible minimum:
- Know your important services. What would hurt clients most if it stopped: advice, payments, access to records?
- Know which IT suppliers they depend on. Microsoft 365, your platform providers, your back-office system, your IT provider.
- Test recovery, don’t assume it. Could you restore email and client files after ransomware? How long would it take? When did you last try?
- Be able to detect and describe an incident. With incident reporting coming, you need logs, alerts and someone who can tell you what happened.
- Write it down. A short, current document beats a long one nobody has read.
Where IT fits
Most of that list lands on your IT. In practice it means:
- Microsoft 365 secured to a known standard: multi-factor authentication, conditional access, email protection.
- Backup that is independent of Microsoft 365, with restores that have actually been tested.
- Monitoring that would notice an incident, including out of hours, and records good enough to report from.
- Supplier oversight: knowing what your IT provider does, what they don’t, and what happens if they fail.
For a wider view of how resilience and compliance connect, see our guide to cyber resilience and compliance.
A note on DORA
The EU’s Digital Operational Resilience Act applies to financial entities in the EU, and has done since January 2025. It isn’t UK law. A UK firm is affected only if it has an EU-authorised entity, or supplies ICT services to EU financial firms that pass the requirements down by contract.
This post is general information, not compliance advice. Confirm your firm’s position with your compliance adviser.
Related: IT leadership for professional firms
Find out where your IT stands
Book a free 15-minute call. If it’s a fit, the next step is our IT Risk and Ownership Review: £295 + VAT, using read-only access to your Microsoft 365, and credited against your first month.
