Operational resilience: UK and EU supervisors shift their focus to execution

In the EU, the Digital Operational Resilience Act (DORA) entered into application on 17 January 2025, introducing a common framework for ICT risk management, incident reporting, operational resilience testing and ICT third-party risk. In the UK, the new requirements will take effect on 18 March 2027. 

The UK framework covers material operational incidents more broadly, while DORA focuses on major ICT-related incidents. The UK also relies more on regulatory judgement, whereas DORA applies harmonised classification criteria and quantitative thresholds. These differences will matter where the same incident affects both UK and EU entities. 

The two regimes differ in design, but the supervisory direction is similar. Both EU and UK supervisors have signalled that operational resilience is no longer only a compliance obligation but increasingly a business capability that must be demonstrated under stress. However, cross-border banks will still need to manage differences in scope, classification, reporting and supervisory judgement across the two jurisdictions. The challenge is to build common resilience capabilities without assuming that one incident assessment or recovery test will satisfy both UK and EU requirements. 

The test for firms is therefore becoming more practical: can the organisation continue to operate when key systems, providers or communications channels are unavailable? As emerging risks such as AI-enabled cyber threats continue to reshape the operating environment, operational resilience has become a central priority for supervisors across both the EU and the UK. 

This article compares the new UK requirements with the EU’s DORA framework and examines the practical implications for banks operating across both jurisdictions. 

C-suite takeaways 

• Recovery must be demonstrable, not simply documented: supervisors increasingly want evidence that that critical services can be recovered when systems, suppliers or normal communications are unavailable. 
• Incident management is becoming a source of supervisory evidence: recurring incidents, weak escalation or slow remediation may expose wider weaknesses in governance and operational resilience. 
• Operational resilience can no longer be assessed only at firm level: supervisors are extending their attention to shared infrastructure and dependencies that could transmit disruption across multiple firms and jurisdictions. 
• AI is testing the resilience of existing control frameworks: firms need to assess if current governance, resilience and third-party risk arrangements can cope with threats developing at greater speed and scale. 
• The same incident may be treated differently in the UK and EU: firms may need to apply different classification, reporting and supervisory requirements to the same underlying event. 

Incident reporting is becoming a supervisory intelligence tool  

In both the UK and the EU, the reporting frameworks are transforming incident reporting from a compliance requirement into a source of supervisory intelligence.  

Under DORA, incidents are assessed against harmonised criteria and quantitative thresholds. This gives supervisors a more consistent basis for comparing major ICT-related incidents across EU financial entities. The UK applies more judgement-based, outcome-focused thresholds, including whether an incident could disrupt an important business service or cause material harm.  

Both frameworks give supervisors clearer insight into how firms identify, assess and escalate disruption. The reporting decision itself may reveal as much about a firm’s governance and operational judgement as the underlying incident. 

For cross-border banks, the same incident may require different assessments under the two regimes. The group will need one view of the facts, affected services and dependencies, while applying the relevant classification, escalation and reporting requirements in each jurisdiction. 

Regulators can now access large quantities of structured data on real operational failures. The ESAs 2025 report on major ICT-related incidents¹ recorded 3,383 such incidents during the first year of DORA reporting, creating a level of visibility that supervisors have not previously had into the nature, frequency and impact of ICT disruptions across firms. 

Over time, that information should help regulators identify recurring vulnerabilities, common failure points and emerging sector-wide trends. It may also support thematic work on targeted technologies, providers or control weaknesses. The EBA and ESMA’s 2027 work programmes place greater emphasis on supervisory execution, resilience and technology risk, indicating that operational data will play a growing role in setting supervisory priorities. 

For firms, it also means supervisors may be able to ask more firm-specific questions on incident management capabilities. For example, recurring incidents involving the same technology, service provider or type of control weakness could become the basis for thematic reviews or firm-specific supervisory enquiries.  

Incident reporting is therefore becoming a window into the broader maturity of a firm’s resilience arrangements. Firms should also expect incident reporting to be used by supervisors as a tool for identifying future areas of supervisory focus.

Recovery capability is becoming a central supervisory test 

Preventative controls remain essential, but firms cannot assume that every cyberattack, technology failure or third-party disruption can be avoided. Supervisory attention is consequently extending from prevention to the ability to respond and recover. As the ECB recently observed, a bank may be financially sound yet still be unable to operate if its contingency arrangements prove ineffective.² 

DORA reflects this through requirements covering response and recovery, backup and restoration, communication and resilience testing. The purpose is not merely to maintain plans, but to establish whether they work and whether weaknesses identified through testing are remediated. 

The ECB’s 2024 cyber resilience stress test illustrates this supervisory direction. The exercise covered 109 banks, with 28 undergoing a more detailed assessment of their ability to respond to and recover from a severe but plausible cyber incident. By June 2026, almost three-quarters of the findings from the exercise had been addressed.  

In the UK, rather than focusing primarily on ICT recovery capabilities, firms are required to identify their important business services, set impact tolerances, map key dependencies and test their resilience against severe but plausible disruption scenarios. This makes the service outcome central. A system may have been restored successfully from a technical perspective, but the firm may still have failed if customers experienced intolerable harm, key decisions could not be taken or the service remained outside its impact tolerance. Supervisors are assessing resilience through the delivery of outcomes rather than the strength of individual controls. 

The FCA Cyber Coordination Group insights 2025³ reinforced this outcome-based approach. Industry participants highlighted the value of sustained senior-management participation in incident exercises, realistic testing environments and the participation of critical suppliers in response and recovery testing. 

Supervisors are moving their attention from recovery planning to whether firms can demonstrate robust recovery capability under difficult conditions. Firms should therefore be prepared to demonstrate fallback communications, crisis decision-making and supplier coordination in practice. 

For cross-border banks, the practical challenge is to develop a common group-wide testing approach that supports the different resilience requirements across the jurisdictions in which they operate, while allowing outcomes to be assessed against the requirements applicable to each entity. 

Third-party concentration: a systemic risk issue magnified by AI 

Technology resilience is increasingly shaped by organisations outside a firm’s direct control. Dependence on a relatively small number of cloud, technology and data providers means that disruption at one provider may affect several financial institutions simultaneously. DORA's framework for critical ICT third-party providers, together with the UK's Critical Third-Party regime, reflects growing recognition that operational resilience cannot be assessed only at firm level. 

DORA introduced direct oversight of designated critical ICT third-party providers and strengthened requirements around dependency mapping, contractual arrangements and concentration risk. The UK is moving in a similar direction through its Critical Third-Party regime and enhanced reporting requirements.  

More recently, the scope is expanding beyond ICT outsourcing. The EBA's guidelines on the sound management of third-party risk regarding non-ICT services reinforce expectations around governance, risk assessment, monitoring and exit planning across a wider range of third-party relationships.⁴  

The central concern is concentration. The failure of a single provider can affect multiple firms across jurisdictions and disrupt critical financial services at scale. 

For example, the UK-EU Memorandum of Understanding on critical third-party oversight reflects the need for coordinated oversight of cross-border dependencies. Supervisory attention is therefore extending beyond individual firms to shared infrastructure and concentration risk. 

The rise of AI is adding an additional layer to this challenge. European and UK supervisory publications describe frontier AI as a potential amplifier of existing operational resilience risk through faster vulnerability discovery, more scalable cyberattacks and the exploitation of common weaknesses across shared infrastructure.⁵  

The regulatory response has not been to create a separate operational resilience regime for AI. Instead, supervisors expect firms to apply and adapt their existing governance, resilience and third-party risk arrangements.  

Recent FCA work highlights weaknesses in governance, dependency management, vulnerability remediation and operational readiness.⁶ Publications from the ESAs and ECB similarly emphasise the need to understand technology dependencies, test resilience and identify concentrations across critical technology ecosystems. 

For firms, this means considering not only whether AI introduces a new threat, but if existing processes can cope with threats developing at greater speed and scale.  

Third-party risk can therefore no longer be treated simply as an outsourcing issue. It is becoming a broader question of how disruption could spread through a highly interconnected financial and technology ecosystem. Firms should identify single points of failure and test whether services can be recovered or moved to an alternative provider in practice, including where providers rely on common underlying infrastructure. 

For cross-border banks, the practical challenge is to maintain a common group-wide view of providers, infrastructure and concentration risk while meeting the different third-party requirements applying to each entity. This may require separate registers, classifications and governance arrangements across jurisdictions, even where the underlying providers and dependencies are shared. 

Firms will need to demonstrate resilience under pressure 

Operational resilience supervision in the EU and UK is moving beyond planning and initial implementation. Regulators now have more incident data, a clearer view of shared dependencies and a stronger basis for testing if firms can maintain critical services during severe disruption. 

The priority for firms is not to create another layer of documentation, but to ensure that existing arrangements can be executed. Senior leaders need to make timely and informed decisions with incomplete information, teams need to communicate when normal channels have failed, suppliers need to participate in recovery and weaknesses identified through incidents or testing need to be addressed promptly and effectively. 

As technology ecosystems become more interconnected and AI changes the speed and scale of potential disruption, the distinction between having a resilience framework and actually being resilient will become increasingly important. Firms will need to demonstrate that their frameworks can deliver resilience outcomes when they are needed most. 

For cross-border banks, the practical approach is to maintain common group-wide capabilities, including service and dependency maps, provider inventories and incident records, while retaining the classification, escalation and governance decisions required for each entity and jurisdiction. This avoids unnecessary duplication without assuming that one jurisdiction’s assessment will satisfy another’s requirements.