What are Important Business Services?

What are important business services?

Important business services are the services a financial firm delivers to external customers or the market whose disruption could cause intolerable harm to clients or threaten the stability of the UK financial system.

The term is defined by the UK operational resilience rules. The FCA Handbook's SYSC 15A.2 requires every in-scope firm to identify its important business services and to set an impact tolerance for each one, and to review both at least annually. The PRA's supervisory statement SS1/21 sets the same expectation for banks, building societies, PRA-designated investment firms and insurers. The rules took effect on 31 March 2022, and under the FCA's PS21/3 firms had until 31 March 2025 to show they could stay within their impact tolerances during a severe but plausible disruption. The EU's DORA uses the parallel term "critical or important function" for financial entities.

Why it matters

• It sets the scope of the resilience program. Mapping, scenario testing and investment are organized around the list of important business services, so a wrong list produces the wrong priorities.
• It is a regulatory deliverable. The FCA and PRA expect a documented list, the reasoning behind it, and a board-approved self-assessment.
• It changes the question from "can we recover?" to "how much disruption can our customers bear?", which is what an impact tolerance measures.

How do firms identify important business services?

Start from what the firm provides to clients and the market, not from internal departments. FCA guidance in SYSC 15A.2.4G lists the factors to weigh: how vulnerable the client base is, whether clients can get the service elsewhere, how time-critical it is, how many clients rely on it, the sensitivity of the data involved, and the potential to disrupt the wider financial system. Each distinct service is assessed on its own. For every service on the list the firm then sets an impact tolerance, maps the people, processes, technology, facilities and third parties the service depends on, and tests whether the tolerance can be met.

Important business service, critical function or critical activity?

Related terms

• Operational resilience
• Business impact analysis (BIA)
• Risk appetite and risk tolerance
• Business continuity management (BCM)
• Third-party risk management (TPRM)
• Scenario analysis

In SmartSuite

SmartSuite Operational Resilience & Business Continuity holds the register of important business services and maps each one to its dependencies, owners and impact tolerances; vendor, supplier and technology dependencies are tracked against the services they support, with business impact analyses, scenario tests and remediation actions on the same records.

Frequently asked questions

Is an important business service the same as a critical business process?

No. An important business service is defined by harm to external clients or the market, which is why the regulators use it. A critical business process is an internal activity identified in a business impact analysis. Most important business services depend on several critical processes, so the two lists are linked but not identical.

How many important business services should a firm have?

The rules set no number. The FCA asks firms to assess each distinct service separately rather than group them, and the test is harm to clients or the system. Internal functions such as HR or facilities rarely qualify on their own; they appear instead as dependencies of a service that does, so the list is usually short.

How often must the list be reviewed?

SYSC 15A.2.2R requires a firm to review its identification of important business services after any material change to its business or the market it operates in, and in any case no later than one year after the previous assessment. The same annual cycle applies to the impact tolerances set for each service.