With the Financial Conduct Authority’s (FCA) March 2025 Operational Resilience deadline rapidly approaching, many UK financial services firms still have work to do to achieve full compliance.
The financial sector’s initial focus on front-office, IT and cybersecurity systems, which followed the introduction of the new rules, led to rapid improvements. But now, just months before the deadline, back-office processes are emerging as potential weak links in achieving full compliance.
Parseq’s research shows that nearly a third of firms remain uncertain about meeting the FCA’s new requirements, a situation that could pose significant risks if not addressed.
Technology is not the problem. When the audits start, we believe the FCA will find the greatest room for improvement in back-office functions that rely more heavily on people – such as inbound customer communications, contact centre operations, and document and cheque processing.
Our study shows that this is particularly true for firms with fewer employees and less financial firepower to commit to total compliance.
Principles of Resilience
The FCA’s Operational Resilience rules, which apply to institutions including banks, insurers, investment firms, and payment service providers of all sizes, aim to ensure financial institutions can withstand and recover from operational disruptions. The goal is to protect consumers and maintain stability within the financial system.
They require firms to identify their most important business services, establish impact tolerances for those services, and implement robust plans to remain within those tolerances under stress.
Divided Sector: Big and Small, Internal and External
Parseq’s study shows that only 69% of financial leaders are “very confident” that their internal processes will comply with the FCA rules by the March 2025 deadline. Confidence is higher for outsourced operations, with 74% of respondents trusting their third-party suppliers to meet requirements.
In addition to this notable gap between processes conducted internally and externally, our findings also revealed a divide between large and small firms. Larger institutions are ahead: 88% expressed high confidence in their internal compliance, rising to 94% for processes outsourced to third parties.
For financial SMEs, firms employing fewer than 250 people, just 58% are highly confident their internal processes will comply by the deadline. This figure was 62% for those done externally.
There are multiple reasons why SMEs struggle more with compliance. Larger players have more people dedicated to compliance and the functions affected by Operational Resilience rules, so they have a greater ability to address their resilience issues through investment, recruitment, outsourcing and robust business continuity plans. Financial SMEs don’t have that firepower.
Financial SMEs are more likely to operate from a single facility or a small number of geographically concentrated branches, making them more vulnerable to localised disruptions – such as natural disasters, power outages, or cyberattacks – that can severely impact business continuity.
These smaller firms also tend to handle a proportionately larger level of their back-office functions, which can often be labour-intensive, in-house. They rely on a single small team or just one individual to manage important but niche back-office processes such as inbound mail handling, scanning, and document processing, and they will be more exposed in the event of a technical, people, or facility failure.
The Edge in Resilience
For smaller institutions, handling back-office processes in-house can present a significant challenge. These firms may struggle to maintain operations without preemptive planning or external support if an unforeseen disruption occurs – be it technical, personnel-related, or facility-based.
Larger firms have a structural advantage here, enjoying the resilience that comes with scale, large teams, and multiple facilities, as well as leveraging third-party providers with stringent business continuity and disaster recovery systems. These partners ensure resilience by distributing risk across their facilities and specialist teams, employing many people dedicated to delivering processes common to financial services firms.
These partners are also used to maintaining stringent service-level agreements (SLAs). They will have thought through the risks and contingencies required to deliver processes so they can get paid. They are more likely to have automated key process elements to boost efficiency and ensure they can complete tasks on time despite operational challenges they might encounter.
The Path Forward
There are many financial SMEs that have already done everything they need to ensure they can consistently comply with Operational Resilience, as well as large institutions with plenty of work to do. The confidence disparity between SMEs and larger firms underscores the need to close the gap through targeted investments or outsourcing, an option that can provide more immediate resilience benefits.
For example, outsourcing mailrooms eliminates a tedious task from the to-do list and ensures customer communications are processed efficiently, even during technical or staffing disruptions. Similarly, third-party contact centre services provide extra capacity or a failover option to firms encountering surging demand for customer interactions or needing to mitigate the risks associated with office closures or equipment failure.
The benefits of getting this right go beyond compliance. Addressing these vulnerabilities helps ensure resilience and enhances the ability of financial institutions to serve customers promptly and efficiently.
The countdown to March 2025 leaves no room for complacency. While larger institutions are better positioned to withstand scrutiny, there is work to do for many organisations of all sizes.
Article by Gordon MacKinnon, Director of Client Services and Growth
Posted 6th January 2025
