Embracing Operational Resilience

EXECUTIVE SUMMARY

• Operational disruption to financial services in the UK and EU is now increasingly seen as ‘inevitable’ by regulatory authorities.
• Regulations have shifted from reactive business continuity to the more comprehensive concept of operational resilience.
• For financial services data centers, backup power must now be treated as part of a wider resilience system, rather than an isolated equipment purchase.
• EnerSys projects in the UK show how lifecycle, maintenance, energy performance, and replacement exposure can all influence operational resilience strategy.

From business continuity to operational resilience: Why the regulatory landscape for financial services is changing

Across both the UK and EU, regulatory thinking has converged around a core assumption: operational failures — including disruption to the likes of credit card services and day trading activities — cannot be designed out completely. Increasing digitalization, reliance on complex IT systems, and deep interdependencies between institutions and third-party providers mean that disruption cannot be eliminated.

The regulatory question is therefore no longer limited to whether an incident could have been prevented. It also asks whether the organization understood its dependencies, remained within its impact tolerances and protected the delivery of important services. In the UK, the shift is clearest in the FCA operational resilience framework; in-scope firms must identify their important business services, set impact tolerances, map the resources supporting those services and test their ability to remain within those tolerances during severe but plausible disruption.

In the UK, the shift is clearest in the FCA operational resilience framework; in-scope firms must identify their important business services, set impact tolerances, map the resources supporting those services and test their ability to remain within those tolerances during severe but plausible disruption.¹

In the EU, the Digital Operational Resilience Act (DORA) establishes a common digital-operational-resilience framework across much of the EU financial sector.² It brings requirements covering ICT risk management, incident reporting, resilience testing, and third-party risk into one regulatory structure.

For financial entities operating across multiple markets, this replaces a more fragmented collection of sectoral and national approaches with a common baseline.

What new regulations mean for supporting data centers and backup power

Operational resilience is measured at the level of the service experienced by the customer or market, and not at the level of an individual server, UPS, or battery.

That makes dependency mapping critical. Payments, trading, account access, and settlement services rely on chains of physical and digital infrastructure. The data center is one part of that chain, and its electrical infrastructure is one of the dependencies that can determine whether an interruption remains contained.

Uninterruptible Power Supply (UPS) energy storage provides the immediate power bridge when the utility supply is interrupted or falls outside acceptable limits. Its condition, availability and lifecycle strategy can therefore influence the resilience of the wider power system.

1. Financial Conduct Authority, “Operational resilience,” first published 14 May 2017, updated 30 June 2026, https://www.fca.org.uk/firms/operational-resilience.
2. European Insurance and Occupational Pensions Authority, “Digital Operational Resilience Act (DORA),” https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en.