PRA Supervisory Statement SS1/21

Why does it matter?

SS1/21 is the PRA's statement of what good operational resilience looks like for the UK's largest banks and insurers, and the basis on which supervisors challenge boards. The PRA considers that a proportionate minimum standard is needed because disruptions can affect firms' safety and soundness, undermine policyholder protection and, in some cases, affect financial stability (paragraph 1.2), and the policy gives supervisors an objective basis for assessing firms and an informed dialogue to drive change (paragraph 1.8). Its focus on services delivered to external users, rather than on systems or business lines (paragraphs 2.1 and 2.8), changed how firms organize continuity, third-party and technology risk work.

Key benefits include:

• Service-level accountability

Boards must approve the important business services identified and the impact tolerance set for each, and regularly review them together with the written self-assessment (paragraph 7.1).

• Clear limits on disruption

An impact tolerance is the maximum tolerable level of disruption to an important business service, measured by a length of time in addition to any other relevant metrics (paragraph 3.1), set on the assumption that a disruption will occur (paragraph 3.5).

• Visibility of dependencies

Mapping identifies and documents the people, processes, technology, facilities and information needed to deliver each important business service, whether provided in-house, within the group or by a third party (paragraphs 5.1 and 5.5).

• Evidence from testing

Firms test their ability to remain within impact tolerances in severe but plausible scenarios, focusing on recovery and response rather than prevention (paragraph 6.1), and record the scenarios in which they could not stay within tolerance (paragraph 6.12).

• One program for dual-regulated firms

Dual-regulated firms set separate PRA and FCA impact tolerances where a service is relevant to both regulators' objectives, may align them, and should reuse the work done for one regulator to meet the other (paragraphs 4.8 to 4.10).

How does it work?

SS1/21 has nine chapters: Introduction; Important business services; Impact tolerances; Actions to remain within impact tolerance; Mapping; Scenario testing; Governance; Self-assessment; and Groups. Each chapter explains how the PRA interprets the corresponding rules in the Operational Resilience Part (for banks) and the Insurance - Operational Resilience Part (for insurers) of the PRA Rulebook, cited in its footnotes, and what supervisors expect to see. The SS is to be read with the PRA's approach to banking and insurance supervision, the Fundamental Rules, the Operational Resilience Parts, the Statement of Policy on operational resilience and SS2/21 on outsourcing and third-party risk management (paragraph 1.9).

Firms identify the services whose disruption could pose a risk to their safety and soundness, to policyholder protection or, where the criteria in the rules are met, to UK financial stability (paragraphs 2.2 and 2.5), and review the list at least annually (paragraph 2.10). For each service they set at least one impact tolerance with a time-based metric, where appropriate combined with volume or value metrics (paragraphs 3.10 to 3.12), map the resources at the level of detail needed to find vulnerabilities (paragraph 5.4), update the mapping at least annually (paragraph 5.9), and build a testing plan whose type, frequency and coverage are proportionate to the firm (paragraph 6.6).

Where a firm cannot remain within an impact tolerance, the PRA expects a remediation plan with appropriate timing, prioritized by the risk the service poses, its time-criticality and the scale of improvement needed (paragraphs 4.3 and 4.4); complicated business models and cross-border delivery are vulnerabilities to address, not reasons for failing (paragraph 4.2). Where the Chief Operations Senior Management Function (SMF24) exists, that individual holds overall responsibility for implementing operational resilience policies and reporting to the board (paragraph 7.4). The written self-assessment records the reasoning, and the board is accountable for and approves it (paragraphs 8.1 and 8.3).

Key Elements

• Important business services (chapter 2)

Services provided to an identifiable external user whose disruption could pose a risk to the firm's safety and soundness, policyholder protection or UK financial stability; internal services such as payroll are not important business services on their own (paragraphs 2.1, 2.2 and 2.7).

• Impact tolerances (chapter 3)

The maximum tolerable level of disruption to each important business service, set by the board, always including a time-based metric and, where appropriate, volume or value metrics, and applying at peak times as well as in normal circumstances (paragraphs 3.1, 3.6 and 3.9).

• Actions to remain within impact tolerance (chapter 4)

A prioritized plan and investment to close the gap between current capability and the tolerance, in effect from 31 March 2022 and met no later than 31 March 2025 (paragraphs 4.3, 4.12 and 4.14).

• Mapping (chapter 5)

Identification and documentation of the people, processes, technology, facilities and information needed to deliver each important business service, including third-party and sub-outsourced resources, updated at least annually (paragraphs 5.1, 5.6 and 5.9).

• Scenario testing (chapter 6)

Regular tests of the firm's ability to remain within impact tolerance under severe but plausible scenarios, through paper-based assessments, simulations or live-systems testing, with lessons learned recorded (paragraphs 6.1, 6.6 and 8.3).

• Governance and self-assessment (chapters 7 and 8)

Board approval and regular review of services, tolerances and the self-assessment, which must list the services and why they were chosen, the tolerances and their rationale, the mapping and testing approach, lessons learned, and the vulnerabilities and remediation actions (paragraphs 7.1 and 8.3).

• Groups (chapter 9)

CRR consolidation entities and insurers identify a proportionate number of important group business services and impact tolerances at group level; CRR consolidation entities had until 30 June 2022 to comply with the group rules (paragraph 9.1 and footnote 35).

What does it cover?

SS1/21 is relevant to UK banks, building societies, PRA-designated investment firms and CRR consolidation entities, and to UK Solvency II firms, the Society of Lloyd's and its managing agents, collectively called firms (paragraphs 1.3 and 1.4). It covers the important business services those firms provide to external users, including retail and business customers, other legal entities, trustees, market participants and supervisory authorities (paragraph 2.6), and the internal and outsourced resources that deliver them; a firm remains responsible if a third party it relies on fails to remain within impact tolerance (paragraph 5.7). It is a PRA document: dual-regulated firms also set impact tolerances relevant to the FCA's objectives (paragraph 4.8).

What are its objectives?

The PRA's policy objective is to improve the resilience to operational disruptions of both firms and the wider financial sector (paragraph 1.1). The SS sets out to:

Ensure firms identify the business services whose disruption would harm safety and soundness, policyholder protection or financial stability (paragraphs 2.2 and 2.3).

Require boards to set and own a maximum tolerable level of disruption for each important business service (paragraphs 3.1 and 7.1).

Make firms understand and document the resources and third parties on which each service depends (paragraphs 5.1 and 5.5).

Prove through testing that firms can remain within impact tolerances under severe but plausible scenarios (paragraph 6.1).

Drive investment where testing shows a firm cannot yet meet its tolerances (paragraphs 4.2 and 4.3).

Give supervisors a proportionate minimum standard and an objective basis to assess firms (paragraphs 1.2 and 1.8).

Framework in Context

SS1/21 was updated once, in March 2022, after PS2/22 extended the group provisions to financial and mixed activity holding companies (annex). It works alongside SS2/21 on outsourcing and third-party risk management, which sets the expectations for assurance from third parties and whose contractual requirements for contingency testing take account of impact tolerances (paragraphs 5.6 and 6.13). On 18 March 2026 the PRA published PS7/26, Operational resilience: Operational incident and third-party reporting, which finalizes CP17/24, introduces SS1/26, Operational resilience: Incident reporting, and an updated SS2/21, with rules that apply from 18 March 2027. PS7/26 refers to SS1/21 for impact tolerances and does not amend or replace it, and the Bank of England lists no update to SS1/21 after March 2022.

Common Framework Mappings

PRA SS1/21 is commonly mapped to the parallel FCA rules and to the international and standards-based resilience regimes below, so that one program of services, tolerances, mapping and testing serves several supervisors.

Mapped frameworks include:

FCA SYSC 15A (PS21/3)

BCBS Operational Resilience Principles

EU DORA

ISO 22301

APRA CPS 230