Operational resilience: where do we stand and what does this mean for cross-border banks?

Operational resilience is the ability of firms to prepare for, prevent, adapt and respond to, recover and learn from operational disruption. It is a complex and multi-faceted challenge for cross-border banks to prepare for and respond to. This is because potential causes of operational failure can enter a firm from several directions and their impacts can permeate numerous aspects of a firm’s operations.

Operational resilience has been a key priority for regulatory authorities since the events and fallout from the global financial crisis. The banking crisis in Spring 2023 reminded us of the importance of having robust operational resilience. The current global geopolitical environment has hastened action on digital and cyber resilience.

With new regulation on the horizon, where do the EU, UK and US currently stand when it comes to operational resilience requirements and what does this mean for cross-border banks?

The EU operational resilience landscape: a focus on digital operational resilience and cyber risks

In its priorities for 2024-2026, the European Central Bank (ECB) reiterated the importance of the topic of operational resilience. Banks still show vulnerabilities from their increasing operational reliance on third-party providers, but also from the need to continue strengthening their overall IT security. Cyber threats also remain a key area of focus in the current geopolitical environment.

For the medium to long term, banks must also make the necessary arrangements for their operational resilience frameworks to consider the changes and risks arising from digitalisation. This includes adapting their business strategy and risk management frameworks to ensure business model sustainability. It also requires identifying and mitigating potential risks related to their digital transformation plans and their use of innovative technologies.

In that regard, the European Commission introduced the Digital Operational Resilience Act (DORA) which aims to achieve a high common level of digital operational resilience in the financial services sector. DORA must be applied by 17 January 2025, with significant penalties for compliance failures. It has broad geographic jurisdiction, applying both to firms that have offices in the EU, as well as those that provide services to a financial institution which provides services in the EU. It also applies to critical technology suppliers, bringing IT firms within the remit of EU financial regulators for the first time. The purpose of DORA is clear; as digital transformation takes hold, financial services firms (and the markets in which they operate) are increasingly vulnerable to failure in the event of a serious cyber-attack.

“The regulations are far-reaching and highly prescriptive. Firms should start by conducting a gap assessment that identifies areas which require further investment and maturity. They also should produce a detailed register of information on their IT-related third parties, so decisions can be made on what to do next.”

Anton Yunussov, Director of Cyber Security, Forvis Mazars in the UK

DORA also requires all financial entities in scope to have available a granular register of information on all their contractual arrangements with ICT third-party providers. This must be submitted to their competent authority and serve as an internal risk management and supervisory tool. The first collection of registers will start in early 2025, after DORA enters into force. This is a significant undertaking, and financial firms are expected to start building data capacity and get familiar with the process (see the ITS and the templates and methodology).

It is to be noted that in June 2024 the ECB also published, for public consultation, its Guide on outsourcing cloud services to cloud service providers, in response to deficiencies identified in this area in banks’ operational resilience frameworks.

Particular areas where firms are anticipated to have difficulties include:

1. possessing the capabilities to assess cyber incidents comprehensively and systematically, as well as to analyse their root cause;
2. having penetration testing programs that satisfy the breadth of testing required by DORA, and
3. data collection and management for the EBA’s DORA registry of information is a significant task, especially for large banks with broad third-party relationships.

“Fulfilling the register of information is a huge challenge for firms due to the scope. It requires all contractual arrangements with ICT third-party providers available at the entity, sub-consolidated, and consolidated levels. It also entails reporting granular information for all ICT third-party providers. And they also need to keep the registers up to date.“

Emilie Legroux, Partner, Forvis Mazars in France

To help firms, the European Supervisory Authorities (ESAs) have launched a dry run exercise to collect relevant data until 31 August 2024. Lessons learnt will be shared by the ESAs in November 2024.

Read more in our recent articles on “How to move from operational risk management to operational resilience” and “The clock is ticking on DORA compliance.”

In the UK, the transition period for implementing the operational resilience requirements ends on 31 March 2025

The UK operational resilience requirements cover more than digital threats, but the framework also allows wider flexibility.

The Bank of England’s (BoE)/Financial Conduct Authority’s (FCA) framework for building operational resilience is coming towards the end of the transition period of 31 March 2025. By that date, firms will need to have:

• identified important business services (IBS) that, if disrupted, could cause intolerable harm to consumers, threaten the viability of the firms and other firms, or cause instability in the financial system;
• performed mapping and testing so that firms remain within impact tolerances for each IBS; and 
• made the necessary investments to operate consistently within their impact tolerance.

The FCA recently published its findings from a review of firms’ preparations for the new requirements. Good practices identified included:

• having documentation that provided clear rationales for why services are classed as IBS;
• detailing the logical reasoning for how impact tolerance metrics were derived and set;
• regularly testing severe, yet plausible scenarios. The most effective testing plans are informed by realistic scenarios and learning from previous testing.

For more details on the UK framework and the FCA’s recent review of firms’ preparations see our recent article “Operational Resilience – How are firms doing in meeting the March 2025 deadline?”

Like in the EU, the UK regulatory authorities are concerned about third-party services. Consequently, they are consulting on how they can oversee the resilience of services that third parties provide to financial services firms.

”The FCA’s recent review of firms’ preparations highlighted that the most effective operational resilience frameworks were those that were embedded within the firms’ enterprise-wide risk frameworks, and change management and strategic planning processes.”

Huseyin Sahin, Partner of Banking Risk Consulting, Forvis Mazars in the UK

In the US, the banking crisis of Spring 2023 reminded the importance of robust operational resilience  

The US regulatory operational resilience guidance, like in the UK, covers a wide range of disruptive events, including technology-based failures, cyber incidents, pandemics, and natural disasters. The current U.S. regulatory framework is laid out in the 2020 document, “Sound Practices to Strengthen Operational Resilience”.

This covers seven main areas:

• Governance: establishing robust oversight structures for resilience initiatives;
• Operational risk management: identifying, assessing, and mitigating risks to operations;
• Business continuity management: ensuring continuity of critical business functions during disruptions;
• Third-party risk management: managing risks associated with outsourcing and third-party services;
• Scenario analysis: conducting stress tests to prepare for various disruption scenarios;
• Secure and resilient information system management: protecting information systems from cyber threats;
• Surveillance and reporting: monitoring operations and reporting incidents to relevant authorities.

”Businesses today must anticipate any contingencies that could dramatically interrupt operations for a significant period of time, including natural disasters; employee vandalism; pandemics; cyber-attacks; terrorist attacks and political unrest.”

Scott Arden, Managing Director of Financial Services Consulting, Forvis Mazars US

What does this mean for cross-border banks?

A common theme across all operational resilience frameworks is the importance of having strong and effective coordination within firms. This must comprise multiple teams and divisions (Including risk management functions) working in conjunction to identify, plan for, document and test a firm’s capacity to withstand operational shocks.

For cross-border banks this requires even more collaboration across group entities and branches to ensure key weaknesses are identified in remote locations and acted upon efficiently. The increasing regulatory focus on the operational resilience of third-party systems adds a further cooperation dimension that must extend to banks’ external suppliers as well.

Maintaining sound operational resilience in the current rapidly evolving environment will remain an ongoing journey for banks as new issues arise and firms’ business activities and strategies change. Agility will be required to readily identify and adapt to new and emerging risks, including evolving competitive pressures, digitalisation, cyber risks, and third-party dependencies. It is clear that those firms with operational resilience processes that are deeply embedded into their risk management framework and culture are best placed to identify and manage these potential implications.

With increasingly stringent regulatory requirements being introduced to manage operational resilience, a very positive step has been some harmonisation across jurisdictions regarding operational resilience expectations. This is evidenced by increasing consistency in definitions of operational resilience and converging standards for recovery and resolution planning. Therefore, cross-border banks will encounter operational resilience frameworks overseas that are increasingly in alignment with those in their home jurisdictions.

Notwithstanding this, notable differences remain across jurisdictions that will pose implementation challenges for cross-border banks. The EU’s specific focus on digital operational resilience means there is a high level of prescriptiveness (including in Regulatory Technical Standards and Implementing Technical Standards) compared to the UK and US’s rules on digital resilience. Cross-border firms must closely monitor these changes and learn to navigate the different requirements.