What it means

Operational resilience is the going-concern discipline of keeping a firm able to deliver its important business services through disruption, whatever the cause — a cyber attack, an IT failure, the loss of a key supplier, a physical incident or a pandemic. Rather than focusing only on preventing individual failures, the concept assumes that disruptions will occur and asks whether the firm can absorb them within acceptable limits and recover in an orderly way. Practically, it involves mapping important business services, identifying the people, processes, technology, facilities and third parties that support them, setting impact tolerances for how much disruption is acceptable, and testing against severe but plausible scenarios.

Distinction from operational continuity in resolution

Operational resilience is broader than, and should be distinguished from, operational continuity in resolution (OCIR). Operational resilience is a firm-wide, business-as-usual capability supervised on a going-concern basis. OCIR is the resolution-specific requirement that a failing bank can keep running the services underpinning its critical functions while a resolution tool is applied. The two overlap in substance — both depend on service mapping, third-party control and continuity of ICT — but they answer different questions and are overseen by different authorities. A firm can be operationally resilient in normal conditions yet still present resolvability gaps if its continuity arrangements are not robust to entry into resolution.

Operational resilience does not rest on a single provision. General internal-governance and business-continuity obligations flow from Article 74 of the Capital Requirements Directive (2013/36/EU). For the ICT dimension, the Digital Operational Resilience Act (Regulation (EU) 2022/2554) sets binding requirements from 17 January 2025. Internationally, the Basel Committee's Principles for Operational Resilience (2021) provide influential guidance rather than directly applicable law. Resolution authorities draw on these frameworks when they consider whether operational weaknesses could impede an orderly resolution.

Practical relevance

For banks, operational resilience frameworks and resolution planning increasingly rely on the same underlying analysis — service mapping, dependency identification and scenario testing — so aligning them reduces duplication and inconsistency. For investors and analysts, operational resilience is a source of risk that sits outside traditional capital and liquidity metrics but can crystallise sharply, through outages, cyber events or supplier failures. Because supervisory frameworks in this area are relatively recent and partly principles-based, the depth of implementation varies across firms and continues to evolve.