Operational Resilience and Outsourcing - Stakeholder Letter (2025-09-15)

Summary

This is a BMA stakeholder letter summarising consultation feedback on the draft Operational Resilience (Op Res) and Outsourcing Code and its Guidance Notes, and confirming the finalised implementation timetable. It does not itself impose new rules but explains how the Code has been amended in response to comments and sets the dates from which Relevant Entities (REs) must comply.

• Implementation dates: The Code and Guidance Notes take effect on 1 January 2027 for REs licensed under the Banks and Deposit Companies Act 1999, and on 31 March 2028 for all other REs.
• Notification of significant developments: REs must notify the BMA of significant developments (e.g. changes to outsourcing, business model, or important business services) when or before they occur, per paragraph 33 of the Code.
• Breach of impact tolerance: REs must notify the BMA within 24 hours of becoming aware that an important business service (IBS) has failed to stay within its impact tolerance (amended paragraph 78); this requirement will be set out in law.
• New outsourcing notifications: A 30-day 'no objection' period applies after REs notify the BMA of new outsourcing arrangements, before proceeding, to allow the Authority to assess and potentially object.
• Governance: Boards must approve Op Res governance and programmes and remain ultimately responsible for operational resilience, though tasks may be delegated to a responsible party.
• Third-party mapping: REs must map their third parties and be aware of subcontracting arrangements used by their third-party service providers, as part of the outsourcing risk management requirements.
• Terminology changes: The Code and GN replace 'critical activities' with 'important activities' and 'consumer/customer' with 'client', and will supersede the 2019 Guidance Notes for sectors covered by the new Code.

The Authority states it will finalise the Op Res provisions, including any legislative amendments, before the Code and GN come into force, and that these instruments will be subject to further public consultation.

Key obligations

• REs licensed under the Banks and Deposit Companies Act 1999 must comply with the Operational Resilience and Outsourcing Code and Guidance Notes by 1 January 2027.
• All other Relevant Entities must comply with the Code and Guidance Notes by 31 March 2028.
• REs must notify the BMA of significant developments (changes to outsourcing, business model, or important business services) as required by paragraph 33 of the Code.
• REs must notify the BMA within 24 hours of becoming aware that an important business service has breached its impact tolerance (paragraph 78 of the Code).
• REs must notify the BMA of new outsourcing arrangements and observe a 30-day period before proceeding, allowing the Authority to object.
• Boards of REs must approve Operational Resilience governance and programmes and retain ultimate responsibility even where tasks are delegated.
• REs must map their third parties and maintain awareness of subcontracting arrangements used by those third parties.
• Digital Asset Businesses holding a Class F licence must determine which of their services constitute important business services under the Code.

Applies to

Relevant Entities (REs) licensed by the BMA, Banks and deposit companies licensed under the Banks and Deposit Companies Act 1999, Digital Asset Businesses (Class F licensees), Corporate Service Providers

Deadlines

• 1 January 2027: Operational Resilience and Outsourcing Code and Guidance Notes come into effect for REs licensed under the Banks and Deposit Companies Act 1999.
• 31 March 2028: Operational Resilience and Outsourcing Code and Guidance Notes come into effect for all other Relevant Entities.
• within 24 hours: REs must notify the BMA after becoming aware that an important business service has failed to stay within its impact tolerance (paragraph 78 of the Code).
• 30 days: Notification period REs must observe after notifying the BMA of a new outsourcing arrangement, before proceeding, subject to possible objection from the Authority.