UK Regime Enforcement and Supervision

Under the UK regime, supervision means ongoing engagement by the FCA and PRA with a firm's account of its operational resilience, testing whether that account matches the evidence from mapping, scenario testing and incidents. Supervisors may examine a firm's important business services, its impact tolerances, its maps, its test results and its self-assessment, and may challenge whether tolerances reflect intolerable harm, whether scenarios were severe enough, and whether remediation actions are credible. Enforcement, where it occurs, follows from the wider regulatory framework, and it is best understood as the consequence of a failure to meet regulatory expectations, rather than as a standalone operational resilience penalty regime described in isolation.

The supervisory approach is therefore evidence based and service specific. A supervisor is less likely to be persuaded by a general description of a resilience programme than by a clear account for a named service: its tolerance, its map, its test findings and its actions. A firm that can discuss a service in those terms, acknowledge gaps plainly, and show owned actions to address them, is in a stronger supervisory position than a firm that presents only strengths. Candour about gaps, with a credible plan, is itself evidence of governance.

Supervisory engagement may take several forms, including review of self-assessments, meetings with boards and senior managers, thematic reviews across firms, and follow up on incidents. In each form, the focus tends to return to services: which services the firm has identified, why those services were chosen, how tolerances were set, what testing showed, and what changed as a result. A supervisor may probe a particular service in depth, tracing its map, questioning a tolerance, or asking why a test finding was closed in a particular way. Depth of probing on one service often reveals more about a firm's approach than a shallow review of many services.

Supervisors test whether the evidence supports the claims in the self-assessment. A claim that a service was tested should be supported by scenario details, findings and actions. A claim that a map is complete should be supported by evidence of how the map was built and checked. A claim that a gap has been closed should be supported by evidence that the remedy was tested, not merely implemented. Where evidence is missing, inconsistent or generic, supervisors may question whether the underlying work was carried out as described, even if the self-assessment reads well.

When supervision finds weaknesses, the response is typically proportionate and focused on remediation. Supervisors may require a firm to address specific gaps, to improve its mapping or testing, to revise tolerances, or to provide further evidence that actions have been completed. The firm may be asked to report progress, to undergo further review, or to involve senior management more directly in the work. The emphasis, in the first instance, is usually on closing gaps and improving resilience, rather than on immediate sanction, although the wider regulatory toolkit remains available where failures are serious or persistent.

Boards should prepare for supervision by being able to discuss named services, tolerances and test findings without relying on programme staff to answer for them. That preparation requires board papers that present service outcomes clearly, rather than programme activity in general terms. It also requires board challenge to have taken place before supervisory engagement, so that weaknesses have already been surfaced internally and actions are already underway. A board that first learns of a service vulnerability during a supervisory meeting is in a weaker position than a board that already knew, had challenged, and had set an action in motion.

A common mistake is to present supervision with a polished document that differs from the working record used internally. Supervisors may detect that difference through detailed questioning, and the detection damages credibility more than an honest admission of a gap would have done. Another mistake is to treat supervisory challenge as a negotiation over wording, rather than as a prompt to improve the underlying work. Rewording a tolerance or a finding without changing the service, the map or the test leaves the vulnerability in place, and the next test or incident will reveal it again.

Copying material from another regime into a supervisory submission is a further mistake, for the reasons described in the comparison guide. A supervisor examining a UK account expects UK services and UK tolerances, and DORA material presented as UK evidence may be disregarded, or may raise questions about whether the firm understands the UK regime. Keeping regimes separate in supervisory submissions, as in internal documents, protects the credibility of both accounts.