FCA Operational Resilience Requirements
UK Financial Conduct Authority rules requiring regulated firms to identify important business services and set impact tolerances for disruption, including from cloud infrastructure.
Definition
The FCA's Operational Resilience rules require UK-regulated firms to identify their important business services, map the systems underpinning them, and set impact tolerances defining the maximum tolerable disruption before harm occurs to customers or markets. Where AWS infrastructure underpins a regulated service, firms need to be able to demonstrate they've mapped that dependency and tested against their stated impact tolerance, a requirement that sits close to, and often overlaps with, disaster recovery planning.
In Practice
A regulated lender running its loan origination system on AWS needs to have already defined how long that service can be unavailable before it breaches its FCA impact tolerance, and to have evidence it can recover within that window.