Prudential Regulation Authority Rulebook

2.1

A firm must identify its important business services.

2.2

A firm must set an impact tolerance for each of its important business services.

2.3

The impact tolerance set for each important business service must specify the first point at which a disruption to the important business service would pose a risk to:

1. (1) where the firm is, or is controlled by, an O-SII, the stability of the UK financial system; or
2. (2) the firm’s safety and soundness.

2.4

The impact tolerance set for each important business service must specify the length of or point in time, in addition to any other relevant metrics, for which a disruption to that important business service can be tolerated.

2.5

A firm must ensure it can remain within its impact tolerance for each important business service in the event of a severe but plausible disruption to its operations.

2.5A

Where a firm is a member of a group, the firm must ensure it accounts for any additional risks arising elsewhere within its group that may affect the firm’s ability to comply with 2.5.

2.6

A firm must comply with 2.5 within a reasonable time of the rule coming into effect and in any event by no later than 31 March 2025.