The March 2025 deadline has passed — has your programme actually kept up?

The UK’s operational resilience deadline — full embedding of Important Business Services, impact tolerances, dependency mapping and severe-but-plausible testing, under FCA PS21/3 and PRA SS1/21 — passed on 31 March 2025. Worth pausing on that, because “passed” quietly changes what good looks like.

Before the deadline, the honest question was “are we ready?” After it, the honest question is different: is the IBS register still current, or has it not been touched since sign-off? Has scenario testing actually been repeated, or run once to close out the programme? Has the board genuinely challenged the assumptions behind the impact tolerances lately, or just received the paper again?

None of that shows up as a compliance failure on its own — the framework exists, the boxes are ticked. It shows up the first time a real severe-but-plausible event actually happens, and the programme built to handle it turns out to have quietly stopped being maintained eighteen months ago.

Worth a genuine, honest look — not because a regulator’s likely to ask this month, but because the answer matters a great deal more the one time it’s actually tested for real.