PRA Supervisory Statement SS1/21 – Operational resilience: Impact tolerances for important business services

Why it Matters

SS1/21 is the PRA's statement of what good operational resilience looks like for the UK's largest financial firms, and it is the basis on which supervisors challenge boards. Its focus on services rather than systems changed how firms organize continuity, third-party, and technology risk work.

Key benefits include:

• Service-level accountability

Boards approve the list of important business services and the impact tolerance for each, so responsibility for resilience is explicit.

• Clear limits on disruption

Impact tolerances give every important service a measurable maximum tolerable disruption, expressed in time and other metrics.

• Visibility of dependencies

Mapping shows which people, processes, technology, facilities, information, and third parties each service relies on.

• Evidence from testing

Scenario testing against severe but plausible disruptions shows whether tolerances can be met and where investment is needed.

• Alignment with the FCA and international regimes

The PRA and FCA policies share concepts, and the same work supports DORA, the Basel principles, and ISO 22301.

How it Works

SS1/21 has nine chapters: Introduction; Important business services; Impact tolerances; Actions to remain within impact tolerance; Mapping; Scenario testing; Governance; Self-assessment; and Groups. Each chapter explains how the PRA interprets the corresponding rules in the Operational Resilience Part (for banks) and the Insurance – Operational Resilience Part (for insurers) of the PRA Rulebook, and what evidence supervisors expect to see.

Firms identify the services whose disruption could pose a risk to their safety and soundness, policyholder protection, or financial stability; set an impact tolerance for each; map the resources that deliver it; and test whether they can remain within tolerance under severe but plausible scenarios. Where they cannot, the PRA expects a prioritized plan, with the requirement to be able to remain within impact tolerances met no later than 31 March 2025. The board approves the self-assessment and reviews it regularly, and groups coordinate the work across entities.

Within SmartSuite, teams keep the register of important business services, the impact tolerance and rationale for each, the resource maps, the scenario test plans and results, and the remediation actions in one linked system, and generate the self-assessment and board reporting from live data.

Key Elements

• Important business services

Services provided to external end users whose disruption could threaten the firm's safety and soundness, policyholder protection, or UK financial stability.

• Impact tolerances

The maximum tolerable level of disruption to each important business service, set by the board and expressed with a time-based metric and other relevant measures.

• Actions to remain within impact tolerance

A prioritized plan and investment to close the gap between current capability and the tolerance, in effect no later than 31 March 2025.

• Mapping

Identification and documentation of the people, processes, technology, facilities, and information needed to deliver each important business service.

• Scenario testing

Tests of the firm's ability to remain within impact tolerance under severe but plausible scenarios, with lessons learned recorded.

• Governance and self-assessment

Board ownership of the approach and a written self-assessment that the PRA can request at any time.

• Groups

Expectations for how firms in a group identify services, set tolerances, and manage shared resources across entities.

Framework Scope

SS1/21 applies to UK banks, building societies, PRA-designated investment firms, and CRR consolidation entities, and to UK Solvency II firms, the Society of Lloyd's, and its managing agents. It covers the important business services those firms provide to external end users and the internal and outsourced resources that deliver them; it does not set requirements for firms regulated only by the FCA, which are covered by SYSC 15A.

Framework Objectives

The PRA's policy objective is to improve the resilience of firms and the wider financial sector to operational disruption.

Ensure firms identify the business services whose disruption would harm safety and soundness, policyholders, or financial stability.

Require boards to set and own a maximum tolerable level of disruption for each important business service.

Make firms understand and document the resources and third parties on which each service depends.

Prove through testing that firms can remain within impact tolerances under severe but plausible scenarios.

Drive investment where testing shows a firm cannot yet meet its tolerances.

Give supervisors a consistent, proportionate minimum standard to assess across the sector.

Framework in Context

SS1/21 was published on the same day as the FCA's PS21/3 and the rules in SYSC 15A, and the two regulators use the same concepts of important business services, impact tolerances, mapping, scenario testing, and self-assessment, so dual-regulated firms run one program. Internationally it aligns with the Basel Committee's Principles for Operational Resilience of March 2021 and with the EU's Digital Operational Resilience Act, and ISO 22301 supplies a business continuity management system that supports the mapping and testing expectations.

Common Framework Mappings

PRA SS1/21 is commonly mapped to the FCA's parallel rules, the Basel operational resilience principles, EU DORA, ISO 22301, and equivalent prudential regimes so that one resilience program satisfies several supervisors.

Mapped frameworks include:

FCA SYSC 15A (PS21/3)

BCBS Operational Resilience Principles

EU DORA

ISO 22301

APRA CPS 230