An important business service is a service that a financial firm provides to an external end user or participant where disruption could cause intolerable harm to customers, or could pose a risk to market integrity, to the firm's own safety and soundness, or to financial stability. The term comes from the operational resilience rules of the UK authorities, in force since March 2022. Firms must identify their important business services and set an impact tolerance for each one.
The concept moves attention away from individual systems and processes and towards the outcomes that customers and markets rely on. A payment system inside a bank is not a business service; the ability of a customer to make a payment is. The rules apply to banks, building societies, insurers, payment and e-money institutions, large investment firms and market infrastructures regulated by the Prudential Regulation Authority, the Financial Conduct Authority and the Bank of England.
Identifying important business services
A firm starts by listing the services it delivers to people outside the firm. A service must have an identifiable user and a clear outcome; internal activities such as payroll, human resources or a technology platform do not count, though they may support a service. Collections of products are generally too broad, and each service should be described at a level that allows a tolerance to be set and tested. Typical examples are making and receiving payments, withdrawing cash, giving access to account balances, paying out insurance claims, settling securities trades, and valuing and dealing in fund units.
The firm then decides which of those services are important. Factors set out in the rules include the following.
- The users. How many people or firms depend on the service, and how vulnerable they are.
- Substitutability. Whether users could readily obtain the service elsewhere, and how quickly.
- Time sensitivity. How soon harm would arise, and whether there are critical dates such as salary payment days or tax deadlines.
- Wider effects. The effect of disruption on the firm's financial position and reputation, on other firms and on confidence in the financial system.
The list is approved by the firm's governing body and reviewed at least once a year, and whenever there is a material change to the business or its market. Firms of similar type often arrive at different lists, since the assessment depends on their own customers and market position.
What firms must do for each service
Having identified a service, the firm sets one or more impact tolerances, measured primarily in time. It then carries out operational resilience mapping, documenting the people, processes, technology, facilities and information on which the service depends, including outsourced and third-party elements. Mapping reveals single points of failure and dependencies that were not previously understood, such as several services relying on one supplier.
The firm tests its ability to stay within tolerance under severe but plausible scenarios, invests to address weaknesses, and prepares internal and external communication plans for use during an incident. The whole exercise is recorded in a self-assessment document. The transitional period for being able to operate within tolerances ended on 31 March 2025.
Relationship to similar concepts
Several regulatory terms look alike but have different purposes.
- Critical functions, used in bank resolution planning, are activities whose discontinuation would disrupt the real economy or financial stability, viewed from the system's side.
- Critical or important functions, used in European rules on outsourcing and in the Digital Operational Resilience Act, are functions whose failure would materially impair a firm's compliance, financial performance or continuity of services.
- Critical operations, in the Basel Committee's principles and in Australia's prudential standard, play a similar role to important business services.
- Business continuity planning traditionally focuses on recovering internal processes and sets a recovery time objective for each.
A service identified as important will usually rest on functions that are critical under the other regimes, but the lists are prepared separately and do not match exactly. International groups therefore maintain several overlapping inventories.
Third parties and supervision
Many important business services depend on technology suppliers, cloud providers and market infrastructures. The firm remains responsible for the service whoever performs the underlying work, so contracts, exit plans and the outsourcing register must reflect what the service requires. A separate UK regime allows the authorities to oversee suppliers designated as critical to the sector directly, which complements firms' own oversight of critical third parties.
Supervisors review firms' lists, tolerances and testing, and have said that some firms defined services too broadly or omitted services important to particular customer groups. Responsibility lies with senior management under the Senior Managers Regime. The framework sits beside, and does not replace, the management of operational risk and the capital held against it.
Limitations
The approach relies on firms' own judgement, so its consistency across the sector is uncertain. Mapping is laborious and quickly goes out of date as systems change. Services delivered through long chains of providers are hard to test realistically, and common dependencies, such as a single cloud region or payment scheme, cannot be resolved by any one firm.