Basel Committee on Banking Supervision – Principles for Operational Resilience (March 2021)

Why it Matters

The principles are the international reference point that national regulators, including the PRA, the FCA, and APRA, drew on for their own operational resilience regimes, and supervisors of internationally active banks assess against them. They shift the question from whether individual risks are controlled to whether a bank can keep its critical operations running when something goes wrong.

Key benefits include:

• An international baseline

One set of principles gives banking groups a consistent foundation across the jurisdictions in which they operate.

• Focus on critical operations

Resilience is organized around the operations whose disruption would harm the bank, its customers, or financial stability.

• Built on operational risk management

The principles use existing governance and operational risk functions rather than creating a parallel structure.

• Coverage of modern dependencies

Third-party relationships, interconnections, and ICT and cyber security are addressed explicitly.

• Alignment with national regimes

Meeting the principles supports compliance with PRA SS1/21, FCA SYSC 15A, EU DORA, and similar rules.

How it Works

The document explains the Committee's definition of operational resilience, its relationship to operational risk management, and then states seven principles: governance; operational risk management; business continuity planning and testing; mapping interconnections and interdependencies; third-party dependency management; incident management; and ICT including cyber security. Each principle is followed by explanatory paragraphs on what the Committee expects and cross-references to the corresponding principles in the revised PSMOR, which itself contains twelve principles covering the board, senior management, the risk management environment, ICT, business continuity, and disclosure.

Banks apply the principles by having the board approve an operational resilience approach and a tolerance for disruption to critical operations, identifying those operations and mapping the people, technology, information, facilities, and third parties that deliver them, testing business continuity plans against severe but plausible scenarios, managing third-party and intra-group dependencies, maintaining incident response and recovery plans, and running ICT and cyber security programs that protect, detect, respond, and recover. Supervisors review the approach as part of their assessment of the bank's operational risk management.

Within SmartSuite, teams record critical operations and the tolerance for disruption to each, map interconnections and third parties, manage business continuity plans and tests, track incidents and lessons learned, and report resilience status to the board against each of the seven principles.

Key Elements

• Governance

Banks use their existing governance structure to establish, oversee, and implement an effective operational resilience approach approved by the board.

• Operational risk management

Banks leverage their operational risk management functions to identify external and internal threats and potential failures in people, processes, and systems, and to assess and manage them.

• Business continuity planning and testing

Banks maintain business continuity plans and conduct exercises against a range of severe but plausible scenarios.

• Mapping interconnections and interdependencies

Once critical operations are identified, banks map the internal and external interconnections and interdependencies needed to deliver them.

• Third-party dependency management

Banks manage their dependencies on third parties and intra-group entities that support critical operations.

• Incident management

Banks develop and implement response and recovery plans to manage incidents that could disrupt critical operations, and learn from them.

• ICT including cyber security

Banks ensure resilient ICT, including cyber security, subject to protection, detection, response, and recovery programs that are tested and reviewed.

Framework Scope

The principles are addressed to internationally active banks and their supervisors and are implemented by member jurisdictions of the Basel Committee through their own rules and supervisory expectations. They cover the delivery of a bank's critical operations through disruption from any source, including pandemics, cyber incidents, technology failures, and natural disasters, and the governance, risk management, continuity, mapping, third-party, incident, and ICT arrangements that support it; they do not set capital requirements, which are addressed in the Basel III framework.

Framework Objectives

The Committee's objective is to promote a principles-based approach to improving operational resilience so that banks can withstand and recover from severe disruptions.

Give banks and supervisors a common definition of operational resilience centered on critical operations.

Ensure boards own an operational resilience approach and a tolerance for disruption.

Make banks understand the interconnections, interdependencies, and third parties behind their critical operations.

Require tested business continuity, incident response, and recovery capabilities.

Strengthen ICT and cyber security as an integral part of resilience.

Align the principles with the revised Principles for the Sound Management of Operational Risk so both are implemented together.

Framework in Context

The principles were issued alongside the revised Principles for the Sound Management of Operational Risk and build on earlier Committee guidance on corporate governance, outsourcing, business continuity, and operational risk. National regimes published in the same month, including PRA SS1/21 and FCA SYSC 15A in the United Kingdom, apply the same ideas of critical operations or important business services and tolerances for disruption, and EU DORA and APRA CPS 230 do so for the EU and Australia. ISO 22301 provides a management system for the business continuity elements, and the Basel III framework sets the capital standards that sit alongside the principles.

Common Framework Mappings

The BCBS Principles for Operational Resilience are commonly mapped to the national operational resilience regimes that implement them and to the continuity and capital standards that sit alongside them.

Mapped frameworks include:

PRA SS1/21

FCA SYSC 15A (PS21/3)

EU DORA

ISO 22301

Basel III

APRA CPS 230