An impact tolerance is the maximum tolerable level of disruption to an important business service, as set by a financial firm under operational resilience rules. It marks the point beyond which continued disruption would cause intolerable harm to customers, or would threaten market integrity, the firm's own soundness or financial stability. It is expressed first as a length of time, such as a number of hours or days, and may be supplemented by other measures such as the number of customers affected or the value of transactions delayed.
The concept was introduced by the UK authorities, the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority, in rules published in March 2021. It assumes that disruption will happen and asks firms to decide in advance how much they can absorb, which differs from traditional operational risk management aimed at reducing the likelihood of failure.
How a tolerance is set
A firm first identifies its important business services, then sets a tolerance for each. The firm's board or governing body approves the result. Setting a tolerance involves working out who would be harmed by an outage, how the harm would grow over time and at what point it would become intolerable. Relevant factors include the number and vulnerability of the customers affected, whether substitutes are available, the time of day, month or year at which disruption would be most damaging, and the effect on other firms and markets.
Under the UK rules, firms regulated by both authorities set up to two tolerances for a service, since the regulators have different objectives. One is set by reference to harm to consumers and market integrity. The other is set by reference to the firm's safety and soundness, policyholder protection and financial stability. They may be the same or different, and the firm manages to the tighter one. A tolerance is not the same as a recovery time objective: the latter is a target for restoring a system or process, while the tolerance is an outer limit for the service as its users experience it, and should normally be longer than the recovery target.
Testing against tolerances
Once tolerances are set, the firm must be able to show that it can remain within them in severe but plausible scenarios. This requires operational resilience mapping: identifying and documenting the people, processes, technology, facilities and information needed to deliver each service, including those supplied by third parties. The firm then designs scenarios, such as a cyber attack that corrupts data, the loss of a data centre, the failure of a key supplier or the unavailability of staff, and tests whether the service could be restored in time.
Where testing shows that a tolerance would be breached, the firm must identify the vulnerability and invest to remedy it. Results are recorded in a written self-assessment, approved by the board and available to supervisors on request. Firms were required to have identified services and set tolerances by 31 March 2022, and to be able to remain within them by 31 March 2025 at the latest.
Role in governance
Tolerances give boards a concrete measure for decisions about resilience spending. They are distinct from risk appetite, which concerns how much risk the firm chooses to take on in pursuit of its objectives; a tolerance assumes that a risk has already crystallised. Under the Senior Managers Regime, responsibility for operational resilience sits with a named senior manager. Tolerances also shape contracts with suppliers, since a firm cannot meet a tolerance if a provider's recovery commitments are longer, and they feed into critical third party oversight and the firm's outsourcing register.
If a disruption occurs and a tolerance is breached, or is likely to be, the firm is expected to notify its supervisors and to communicate with customers. A breach is not automatically a rule violation, but supervisors will examine whether the firm had taken reasonable steps beforehand.
Use outside the United Kingdom
The Basel Committee's principles for operational resilience, published in March 2021, use the similar idea of a tolerance for disruption to critical operations. The Central Bank of Ireland's guidance adopts impact tolerances for critical or important business services. Australia's prudential standard on operational risk management, in force from July 2025, requires tolerance levels for critical operations, including a maximum period of disruption. The European Union's Digital Operational Resilience Act, which has applied since January 2025, does not use the term but sets related requirements for recovery objectives for critical or important functions.
Criticism and practical difficulties
Setting a tolerance requires judgement about harm that is hard to quantify, and firms offering similar services have set widely different figures, which makes comparison difficult. Time-based measures may not capture harm from data loss or corruption, where the damage does not depend on duration. Testing end-to-end services against extreme scenarios is costly and partly hypothetical, especially where the service relies on a shared market infrastructure or a cloud provider that the firm cannot test fully. Smaller firms have found the documentation demanding. Supporters argue that the approach has moved attention from individual systems to the outcomes that customers and markets depend on. The topic is related to recovery planning, which deals with financial rather than operational stress.