First Derivative can support firms across the regulatory change lifecycle — from initial assessment and regulatory interpretation through to implementation, testing, reporting and ongoing BAU support.
We have updated our Privacy Policy, click here for more information.
Thank you
Financial firms are operating in an increasingly interconnected environment, where a disruption to technology, a critical supplier, a business process or a key service can quickly have wider consequences.
Regulators in both the EU and UK have responded by placing greater emphasis on operational resilience — the ability of firms to continue delivering important services through disruption, recover effectively and understand the vulnerabilities within their operating model.
For firms operating across multiple jurisdictions, this creates an additional challenge. The EU’s Digital Operational Resilience Act (DORA) and the UK’s operational resilience framework share a number of common themes, including dependency mapping, resilience testing, third-party risk management, governance and regulatory reporting. However, they are not identical and have different areas of focus.
DORA is primarily focused on digital and ICT resilience, including ICT risk management, incident reporting, resilience testing and ICT third-party risk. The UK framework takes a more service-led approach, focusing on important business services, impact tolerances and the firm’s ability to withstand severe but plausible disruption.
For firms already investing in DORA or operational resilience, the opportunity is therefore not to create separate frameworks for every regulatory requirement, but to understand where existing capabilities can be reused — and where additional UK-specific requirements need to be addressed.
The Digital Operational Resilience Act (DORA) is an EU-wide regulatory framework designed to strengthen the digital operational resilience of financial entities.
At a practical level, DORA asks firms to understand:
For firms, this means operational resilience is increasingly becoming a combination of technology, data, processes, governance and third-party management, rather than a standalone technology or risk exercise.
The UK’s FCA/PRA operational resilience framework takes a broader, service-led view.
The central question is:
Can the firm continue to deliver its important business services through a severe but plausible disruption without causing intolerable harm to consumers or threatening market integrity?
Firms are expected to identify their Important Business Services, establish Impact Tolerances, understand the people, processes, technology, facilities, information and third parties that support those services, and test their ability to remain within tolerance during disruption.
The FCA’s latest observations also highlight that operational resilience should not be treated as a one-off compliance exercise. Firms are expected to continue developing their mapping, scenario testing, vulnerability management, governance and evidence as part of business-as-usual resilience.
Although the regulations have different scopes and terminology, there is a significant common foundation.
Both approaches require firms to understand the services, systems, processes and third parties that support critical activities.
Firms need to demonstrate that their resilience arrangements work in practice, rather than relying solely on documented policies and procedures.
Third-party dependencies are an increasingly important part of operational resilience. The FCA specifically highlights the need for firms to understand third-party dependencies and vulnerabilities within their Important Business Services.
Both frameworks require clear ownership, oversight and evidence that senior management understands the firm’s resilience position.
Effective resilience depends on having accurate, consistent and auditable information across services, dependencies, incidents and third parties.
The UK operational resilience landscape is also evolving, with new requirements coming into force on 18 March 2027. The FCA, PRA and Bank of England have introduced a new framework for reporting operational incidents and material third-party arrangements, giving regulators greater visibility of the third-party dependencies supporting financial firms.
For firms in scope, the new requirements will include notifying the FCA when entering into a new material third-party arrangement or significantly changing an existing arrangement, as well as maintaining and submitting a register of material third-party arrangements annually. Importantly, the scope extends beyond traditional outsourcing to include material non-outsourcing arrangements, reflecting the broader range of third-party dependencies firms rely on.
For firms already working through DORA, this creates an opportunity to leverage existing third-party data, governance and reporting capabilities, while assessing the additional requirements of the UK framework.
The key difference is the regulatory lens.
| DORA | UK Operational Resilience | |
|---|---|---|
| Primary focus | Digital / ICT operational resilience | Resilience of important business services |
| Key question | Can the firm manage ICT-related disruption and third-party ICT risk? | Can the firm remain within its impact tolerance during severe disruption? |
| Third parties | Strong focus on ICT third-party providers | Broader consideration of material third-party dependencies |
| Testing | Digital / ICT resilience testing | Scenario testing against important business services and impact tolerances |
| Reporting | Detailed ICT incident and ICT third-party requirements | Operational incident and material third-party reporting requirements |
| Third Party Register | Firms in scope are required to maintain a comprehensive Register of Information (RoI) covering their contractual arrangements with ICT third-party service providers. | From 18 March 2027, in-scope firms must maintain and submit an annual register of material third-party arrangements. The scope includes both outsourcing and non-outsourcing arrangements. |
This distinction is important because firms may already have significant DORA capabilities, but those capabilities may need to be extended beyond the ICT perimeter to fully support the UK requirements.
Why the register matters: For many firms, the DORA RoI is already a significant regulatory data and implementation exercise. The new UK register introduces a separate reporting requirement, with a broader focus on material third-party arrangements rather than DORA’s specific focus on ICT third-party service providers. Firms operating across the EU and UK will therefore need to understand where existing DORA data and processes can be reused, and where additional UK-specific data, assessment and reporting requirements may be required.
For organisations operating across the EU and UK, the challenge is not simply understanding two sets of regulations.
The bigger challenge is turning those requirements into a sustainable operational resilience capability.
Firms may need to consider:
Assess existing DORA, operational resilience and third-party risk capabilities against UK requirements.
Ensure mapping extends beyond technology to people, processes, facilities, information and third parties.
Use scenario testing and evidence to demonstrate that important business services can remain within their impact tolerances.
The UK’s new operational incident and material third-party reporting rules come into force on 18 March 2027. Firms affected by the new rules have a 12-month preparation period.
Operational resilience should continue to evolve as firms change their products, services, technology, suppliers and operating models.
The FCA’s latest observations explicitly reinforce this point, describing operational resilience as something that should continue to mature rather than remain a static compliance exercise.
First Derivative can support firms across the regulatory change lifecycle — from initial assessment and regulatory interpretation through to implementation, testing, reporting and ongoing BAU support.
First Derivative has supported financial institutions across DORA implementation, regulatory reporting, operational resilience and third-party risk.
Our experience includes:
As regulatory expectations continue to evolve, firms need an operational resilience approach that goes beyond compliance.
First Derivative can help you assess your current capabilities, identify regulatory gaps and build a sustainable resilience operating model across DORA and UK requirements.
