Sector Lessons That Travel

Some lessons from one sector genuinely help another, and some do not, and telling the two apart is itself a resilience skill. The lessons that travel are about method: name the service first, map its dependencies, state what harm would be intolerable, test a severe but plausible disruption, and keep evidence that the test changed something. Those steps work in retail banking, in insurance, in asset management, and in market infrastructure, because they are questions about any service, not answers specific to one. The lessons that do not travel are the answers: the tolerance, the recovery order, the communication, and the fallback. Those belong to a named service, its users, and its harm, and copying them across sectors is how a good plan in one sector becomes a misleading plan in another.

The first travelling lesson is to start with the user task, not the system. In every sector in this cluster, the useful question is the same: what was the person or firm trying to do when the service stopped, and what do they lose while it is down? A retail customer trying to pay, a policyholder trying to report a claim, an investor trying to sell, a merchant trying to trade, and a retiree waiting on a benefit are trying to do different things, but the discipline of describing the task before describing the system helps in all five cases. It prevents a plan that lists platforms while never following a single task to completion.

Tolerances do not travel. A tolerance is a statement about a named service and its users, and it reflects how quickly harm becomes intolerable for those users. A payment tolerance reflects lost sales and stranded customers at a till. A pension tolerance reflects missed benefits for retirees and record accuracy over long periods. An insurance tolerance reflects hardship after a loss and surge capacity after a widespread event. Copying a tolerance across those services produces a number that looks precise and means nothing, because it was calibrated to a different harm. Each sector guide in this cluster therefore treats tolerance as a sector decision, to be set for its own service, not imported from a neighbouring guide.

Concentration is the lesson that travels most widely, because it appears in every sector in a different disguise. In payments, it appears as a shared scheme, acquirer, or sponsor bank. In asset management, it appears as a shared pricing vendor, custodian, or administrator. In fintech, it appears as a shared cloud provider or banking partner. In market infrastructure, it appears as the infrastructure itself, shared by all participants. In ICT provision, concentration is the service: the provider is the shared dependency. The disguise changes, but the question stays the same: what happens if the thing many firms share fails at once, and who recovers in what order?

Borrowing well starts with translation, not transcription. Take the lesson in abstract form, then re-derive it for the new service. A payments lesson about reconciliation after an outage translates into an investment question about order state, and into a pension question about record correction, but the translation has to be done explicitly: what is the equivalent of a duplicated payment in this sector, what is the equivalent of a lost transaction, and how would the firm detect either? A lesson borrowed without that translation step is a slogan, not a control, and it will fail at the first test that follows the new service rather than the old one.

Check whether any lesson you plan to borrow has been translated for your service: the user, the harm, the dependency, and the recovery sequence all restated in your sector's terms. Check whether tolerances, recovery order, and communication have been set afresh for your service, rather than imported. Check whether concentration has been mapped to its shared roots, not only to immediate suppliers. And check which regime is being applied: DORA, which applies from 17 January 2025, and the UK regime under FCA PS21/3 and PRA PS6/21 are labelled separately in this guide.