SYSC 15A for EMIs and payment institutions: resilience you can show the FCA

The FCA's operational resilience rules and guidance came into force on 31 March 2022. Firms had until 31 March 2025 to complete mapping and testing so they could stay within impact tolerances for each important business service. It is now an ordinary supervisory requirement.

For an EMI still applying for authorisation, the question comes up during the application: the regulator wants to see how the firm will manage disruption from day one. Our UK EMI licensing team runs the application and the regulator dialogue, and we cover the IT and operational side.

For a payment firm, typical candidates are accepting and executing payments, issuing and redeeming e-money, and customer access to accounts. The firm makes the call. When setting a tolerance, FCA guidance (SYSC 15A.2.7G) points to factors such as how many clients may be affected, the nature of the impact and any loss of functionality or access.

Mapping

SYSC 15A.4.1R requires the firm to document everything needed to deliver each service. In practice that means the safeguarding bank, the processor, the cloud, the KYC provider and key staff. We build the map from your real contracts and diagrams, mark single points of failure and show where a tolerance cannot be met today.

FCA guidance (SYSC 15A.5.6G) lists scenarios to consider: corruption, deletion or manipulation of critical data; loss of facilities or key people; failure of third-party providers; disruption to other market participants; and loss of the technology the service relies on.

How often to test

Under SYSC 15A.5.7R, testing is repeated after a material change to the business, services or tolerances, after improvements made in response to a previous test, and in any event on a regular basis. We write scenarios from your mapping, run tabletop exercises with your team and record the results in a form you can attach to the self-assessment.

The self-assessment pulls the work into one document: the list of important services and the rationale, tolerances, mapping, the testing plan and results, lessons learned and the improvement plan. Alongside it sits the internal and external communication strategy for a disruption (SYSC 15A.8).

PSRs regulation 98 risk assessment

Separately from SYSC 15A, every payment service provider sends the FCA an updated assessment of operational and security risks, and of the adequacy of its controls, at least annually under regulation 98 of the Payment Services Regulations 2017. We build both from one base so they stay consistent.

The operational incident reporting rules cover payment service providers. The mapping you build for SYSC 15A becomes the basis of the register of material arrangements, so it makes sense to prepare both together.

How we work

1. A paid 30-minute consultation and a scope letter: services, systems, dates, fixed price.
2. Current-state review with a plain-language gap report.
3. Mapping, tolerances, scenarios with your team; a person checks every finding.
4. Self-assessment and supporting documents for board approval.
5. Re-check after improvements.