The transition period ended on 31 March 2025. Firms are now expected to be operating within their impact tolerances, and to be able to show it.
What is it?
The FCA\u2019s operational resilience rules, set out in PS21/3, require firms to identify their important business services, set an impact tolerance for each, map the people, processes, technology and third parties those services depend on, and test that they can stay within tolerance under severe but plausible scenarios.
The transition period ended on 31 March 2025. From that point firms were expected to have completed mapping and testing, made the investment needed to remain within tolerance, and had the whole thing approved by the board. This is supervision rather than certification, so there is no certificate at the end and no annual audit date. What there is instead is an expectation that you can produce the evidence when asked.
It is not a one-off. Important business services, impact tolerances and mapping must be reviewed at least annually, and whenever the business or the market changes materially. Firms also in scope of DORA through EU operations face two regimes that ask similar questions in different formats, and the overlap is worth exploiting rather than answering twice.
Compliance requirements
Five obligations, all of which the FCA expects to be evidenced rather than asserted.
Services whose disruption would cause intolerable harm to clients or risk to market integrity. Defined from the outside in, by the harm caused, not by your internal org chart.
A maximum tolerable disruption for each important business service, expressed as a specific metric rather than an aspiration.
The people, processes, technology, facilities and third parties each service relies on, in enough detail to find the single points of failure.
Testing against severe but plausible scenarios, with the results used to drive investment rather than filed.
A board-approved self-assessment document, kept current, that a supervisor can ask for at any time.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
We work from client and market harm rather than from your internal structure, which is where most firms get the definition wrong.
We set a defensible metric for each service, with the reasoning documented, because the number matters far less than the justification behind it.
Your compliance manager maps people, processes, technology, facilities and third parties to a depth that actually surfaces single points of failure.
We turn the mapping into a prioritised programme of work, sequenced by the risk of breaching tolerance.
We design and run severe but plausible scenarios, and document the results and the actions taken.
We produce the self-assessment document for board approval and keep it current through the annual review cycle.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone