Harper James is a UK full-service commercial law firm advising fintech start-ups, scale-ups and established businesses on the laws of England and Wales, including financial services regulation and commercial contracts. Operational resilience is the ability to continue delivering important services during disruption, including cyberattacks, technology failures, supplier outages and staff shortages.
A fintech should first identify the services whose disruption could cause intolerable harm to customers, market integrity or the firm’s safety and soundness. Examples include processing payments, safeguarding client money, providing access to customer accounts, executing trades or operating a lending platform. For each service, the board should approve an impact tolerance that defines the maximum acceptable duration and level of disruption.
The assessment should distinguish between a service and the systems supporting it. A payments service may depend on cloud hosting, identity verification, banking partners, data feeds, telecommunications and specialist staff. Mapping these dependencies creates a documented view of how the service operates, where single points of failure exist and which controls require investment.
Testing should reflect realistic disruption scenarios rather than only checking whether individual systems function. Suitable exercises include a ransomware incident, loss of a cloud region, failure of a banking partner, corrupted data, a telecommunications outage and the unavailability of key personnel. Tests should measure whether the fintech can remain within its impact tolerance, restore records, communicate with customers and meet regulatory obligations.
The results should produce assigned actions, deadlines and evidence of board oversight. Incident response plans should identify decision-makers, escalation routes, customer communications, regulatory notifications and legal preservation requirements. Firms handling personal data should also integrate UK GDPR breach assessment, while firms regulated by the FCA or PRA should align their arrangements with the applicable operational resilience rules and reporting expectations.
Outsourcing does not transfer responsibility for resilience. Contracts with cloud providers, payment processors, banking partners and software suppliers should address service levels, incident notification, access to information, audit rights, business continuity, subcontracting, data location, exit assistance and termination rights. A supplier register should record the services each provider supports, its criticality and available alternatives.
The fintech should also maintain tested exit plans. These plans cover data extraction, migration, replacement suppliers, customer communications and continued access to essential records. Contractual protections are useful only when they match the firm’s technical ability to recover or replace the service.
Operational resilience should form part of ordinary risk management, not sit solely with the technology team. The board should receive reports on important business services, impact tolerances, test results, incidents, remediation and material supplier changes. Responsibility should be allocated across operations, information security, compliance, legal and senior management.
A practical programme begins with a service inventory, dependency map and gap assessment. The fintech can then prioritise remediation according to customer impact, regulatory significance and recovery capability. Reviews should follow major incidents, material changes to the technology stack, new outsourcing arrangements and changes to the firm’s regulated activities.