UK Regime Timeline and Deadlines

The UK operational resilience timetable, under FCA and PRA policy statements published in March 2021, unfolded in two main phases. By 31 March 2022, UK firms subject to the regime were to have identified their important business services and set impact tolerances for each one. By 31 March 2025, firms were to remain within tolerance for severe but plausible scenarios, which meant that mapping, scenario testing and remediation work had to have been carried through to the point where services could withstand demanding disruption without intolerable harm. Self-assessment runs alongside that timetable, as the record of how each phase was met and where gaps remained.

Understanding the timetable as phases, rather than as a single deadline, helps explain why early work mattered. Identification and tolerance setting could not be left until the later phase, because mapping and testing depend on them. A firm that identified services late would have had little time to map them, test them and fix what testing revealed before the later date. The timetable therefore rewarded firms that treated the first phase as the foundation for the second, rather than as a standalone compliance exercise.

By 31 March 2022, the expectation was that firms had named their important business services and set an impact tolerance for each service. That work required the harm based reasoning described in the guides on identification and tolerances: understanding who uses each service, what harm disruption would cause, and where the line of intolerable harm falls. It also required board engagement, because tolerances embody judgements about harm that cannot be made by a programme team alone. A firm that met the first date only on paper, with services listed but tolerances unchallenged, had not built the foundation the second phase required.

By 31 March 2025, firms were to remain within tolerance for severe but plausible scenarios. That expectation goes beyond having documents in place. It requires that scenario testing has been carried out, that findings have been acted upon, and that services, with their people, processes, technology and third parties, can actually withstand demanding disruption. A firm that had identified services and set tolerances, but had not tested them severely or fixed the weaknesses testing revealed, would not meet the substance of the second phase, even if its paperwork appeared complete.

After the timetable dates, the work shifts from building the regime to maintaining it credibly. New services need identification and tolerances. Changed services need their maps and tolerances reviewed. New suppliers need to be mapped and, where they are critical, tested. Incidents need to be learned from, with maps and procedures updated as a result. Supervisory engagement continues, and supervisors may examine whether a firm's account of its resilience matches the evidence from testing and incidents. A firm that treats the dates as the end of the work risks gradual drift, as its maps and tolerances lose touch with its services.

Timetable confusion often arises from merging the UK timetable with another regime timetable. The UK dates above belong to the FCA and PRA regime, and they should not be replaced by dates from DORA or from any other framework. The comparison guide in this cluster sets the two regimes apart in detail, and readers who need to work with both regimes should keep their timetables, documents and tests separate, even where the same firm is subject to both. Merging timetables creates the risk that a firm believes it has met a UK expectation when it has in fact met a different expectation on a different date.

A reader can use the timetable to judge whether a firm's account is coherent: whether identification and tolerances were in place by the first date, whether mapping and testing followed in a sequence that could plausibly lead to remaining within tolerance by the second date, and whether self-assessment shows continued testing and remediation after the second date. Gaps in that sequence, such as testing that began only shortly before the second date, raise questions about whether findings could have been properly addressed. A coherent sequence, by contrast, suggests that the firm treated the timetable as a programme of work rather than as a set of isolated deadlines.

This guide is educational only and describes the UK timetable in general terms. Firms subject to the regime should refer to the FCA and PRA policy statements and supervisory guidance for the authoritative account of expectations, and to the comparison guide in this cluster where a firm is also subject to DORA and needs to keep the two regimes distinct.