BCBS Principles for Operational Resilience

Why does it matter?

The principles are the Basel Committee's international baseline for operational resilience. They are largely derived and adapted from existing guidance issued by the Committee or national supervisors, and the Committee recognizes related work by the Bank of England and FCA, the European Banking Authority, the Monetary Authority of Singapore, IOSCO, and the US federal banking agencies, and the European Commission's DORA proposal. They shift the question from whether individual risks are controlled to whether a bank can keep its critical operations running when something goes wrong.

Key benefits include:

• An international baseline

One set of principles gives banking groups a consistent foundation across the jurisdictions in which they operate.

• Focus on critical operations

Resilience is organized around the operations whose disruption would harm the bank, its customers, or financial stability.

• Built on operational risk management

The principles use existing governance and operational risk functions rather than creating a parallel structure.

• Coverage of modern dependencies

Third-party relationships, interconnections, and ICT and cyber security are addressed explicitly.

• Alignment with national regimes

The Committee cites related UK, EU, Singapore, IOSCO, and US work and aims to promote greater cross-sectoral collaboration, so banks should check how each of their jurisdictions applies operational resilience rules.

How does it work?

The document explains the Committee's definition of operational resilience, its relationship to operational risk management, and then states seven principles: governance; operational risk management; business continuity planning and testing; mapping interconnections and interdependencies; third-party dependency management; incident management; and ICT including cyber security. Each principle is followed by explanatory paragraphs on what the Committee expects and cross-references to the corresponding principles in the revised PSMOR, which itself contains twelve principles covering the board, senior management, the risk management environment, ICT, business continuity, and disclosure.

Banks apply the principles by having the board approve an operational resilience approach and a tolerance for disruption to critical operations, identifying those operations and mapping the people, technology, information, facilities, and third parties that deliver them, testing business continuity plans against severe but plausible scenarios, managing third-party and intra-group dependencies, maintaining incident response and recovery plans, and running ICT and cyber security programs that protect, detect, respond, and recover. Supervisors review the approach as part of their assessment of the bank's operational risk management.

Within SmartSuite, teams record critical operations and the tolerance for disruption to each, map interconnections and third parties, manage business continuity plans and tests, track incidents and lessons learned, and report resilience status to the board against each of the seven principles.

Key Elements

• Governance

Banks use their existing governance structure to establish, oversee, and implement an effective operational resilience approach approved by the board.

• Operational risk management

Banks use their operational risk management functions to identify external and internal threats and potential failures in people, processes, and systems, and to assess and manage them.

• Business continuity planning and testing

Banks maintain business continuity plans and conduct exercises against a range of severe but plausible scenarios.

• Mapping interconnections and interdependencies

Once critical operations are identified, banks map the internal and external interconnections and interdependencies needed to deliver them.

• Third-party dependency management

Banks manage their dependencies on third parties and intra-group entities that support critical operations.

• Incident management

Banks develop and implement response and recovery plans to manage incidents that could disrupt critical operations, and learn from them.

• ICT including cyber security

Banks ensure resilient ICT, including cyber security, subject to protection, detection, response, and recovery programs that are tested and reviewed.

What does it cover?

The principles are addressed to internationally active banks and their supervisors and are implemented by member jurisdictions of the Basel Committee through their own rules and supervisory expectations. They cover the delivery of a bank's critical operations through disruption from any source, including pandemics, cyber incidents, technology failures, and natural disasters, and the governance, risk management, continuity, mapping, third-party, incident, and ICT arrangements that support it; they do not set capital requirements, which are addressed in the Basel III framework.

What are its objectives?

The Committee's objective is to promote a principles-based approach to improving operational resilience so that banks can withstand and recover from severe disruptions.

Give banks and supervisors a common definition of operational resilience centered on critical operations.

Ensure boards own an operational resilience approach and a tolerance for disruption.

Make banks understand the interconnections, interdependencies, and third parties behind their critical operations.

Require tested business continuity, incident response, and recovery capabilities.

Strengthen ICT and cyber security as an integral part of resilience.

Align the principles with the revised Principles for the Sound Management of Operational Risk so both are implemented together.

Framework in Context

The principles were issued alongside the revised Principles for the Sound Management of Operational Risk and build on earlier Committee guidance on corporate governance, outsourcing, business continuity, and operational risk. The document cites related work by the Bank of England and FCA in the United Kingdom, the European Banking Authority and the European Commission's DORA proposal, the Monetary Authority of Singapore, IOSCO, and the US federal banking agencies. National regimes such as PRA SS1/21, FCA SYSC 15A, EU DORA, and APRA CPS 230 address operational resilience for their own jurisdictions. ISO 22301 provides a management system for the business continuity elements, and the Basel III framework sets the capital standards that sit alongside the principles.

Common Framework Mappings

The BCBS Principles for Operational Resilience are commonly mapped to national operational resilience regimes and to the continuity and capital standards that sit alongside them.

Mapped frameworks include:

PRA SS1/21

FCA SYSC 15A (PS21/3)

EU DORA

ISO 22301

Basel III

APRA CPS 230