The Financial Conduct Authority has confirmed that 31 March 2026 remains a non-negotiable deadline for all regulated firms to demonstrate they can remain within their stated impact tolerances for important business services, closing a three-year transition period that began in March 2022. In a supervisory statement issued on Thursday, the FCA said it expected firms to have completed rigorous scenario testing, mapped all critical third-party dependencies, and established clear remediation playbooks for disruption events affecting customer-facing services.

The deadline carries particular weight for the UK fintech sector, where rapid growth has often outpaced investment in operational resilience infrastructure. A survey by Deloitte found that 34 per cent of FCA-regulated fintech firms had not yet completed their impact tolerance testing as of August 2025, with cloud infrastructure dependencies and API reliability cited as the most common areas of concern. FCA head of technology, resilience, and cyber Megan Butler said the regulator would adopt a proportionate approach but warned that "a lack of resources or competing business priorities will not be accepted as a reason for non-compliance."

The Payments Association called on the FCA to provide additional support for smaller firms that lack dedicated compliance teams, noting that the average cost of meeting operational resilience requirements has been estimated at between £150,000 and £1.2 million depending on firm size and complexity. The FCA responded by launching a dedicated operational resilience helpline and publishing a set of worked examples for payments firms and e-money institutions. Industry consultancy Bovill predicted that at least a dozen enforcement investigations would be opened in the second half of 2026 targeting firms that fail to meet the deadline.