Client
Starting point
Name each service by the outcome a client gets.
Importantbusinessservices
Identify and prioritise what matters most.
What important business services are under PS21/3, which services count, and how to identify, map and review them.
TL;DR
- Important business services are the UK operational resilience rules' own term: the FCA's PS21/3 (SYSC 15A) and the PRA's SS1/21. Identifying them is the first step, and everything else in the rules is built on them. See the four PS21/3 stages.
- An important business service (IBS) is a service a firm provides to its clients that, if disrupted, could cause them intolerable harm or put the UK financial system or markets at risk (FCA definition).
- UK firms regulated by the FCA or PRA must identify their important business services, set an impact tolerance for each, map what each one depends on, and review the list at least once a year (SYSC 15A.2).
- A service is an outcome for an identifiable client, such as making a payment. A business line such as mortgages, or an internal function such as payroll, is not one on its own (PRA SS1/21).
- Australia calls the same idea critical operations, under APRA CPS 230. The EU calls it critical or important functions, under DORA.
What are important business services?
Important business services (IBS) are the services a firm provides to clients that, if disrupted, could cause intolerable harm to those clients or risk to the financial system. They anchor resilience planning.
Map
Dependencies
The people, processes, technology, facilities and information behind each service.
Year
Review cycle
Review the list at least once a year, or after a material change.
Which services count as important business services?
A service counts when it delivers a specific outcome to an identifiable client and disruption could cause that client intolerable harm. The PRA separates services from business lines: mortgages is a business line made up of several services and activities, and each service is judged on its own (PRA SS1/21).
Typical examples in financial services:
- Making and receiving payments
- Taking and managing deposits
- Custody, settlement and clearing
- Processing insurance claims
- Investment management and fund administration
- Handling customer enquiries
These are the operations APRA's CPS 230 treats as critical by default for banks, insurers and superannuation funds. They are a sensible starting list for a UK firm too, though each firm decides its own. More worked cases are in operational resilience examples.
Internal functions do not count on their own. The PRA says internal services such as HR or payroll should not be identified as important business services by themselves. If a client-facing service depends on them, they go into that service's map and testing.
Same idea, different names. The FCA and PRA say important business services. Australia's APRA says critical operations. The EU's DORA says critical or important functions, defined around a financial entity's performance and the continuity of its services (DORA Article 3). The regime guides set out the detail: FCA operational resilience, APRA CPS 230 and DORA.
Why it matters
Why do important business services matter?
Important business services are where operational resilience starts. Impact tolerances, dependency maps and scenario tests are all set per service, so the wrong list means the rest of the work protects the wrong things.
Focuses effort. Teams prioritise the services that matter most to clients and regulators, so budgets go where disruption would hurt.
Enables measurement. Impact tolerances, continuity plans and resilience measures all hang off a clear list of services.
Improves communication. Each service has a named owner, and a short summary per service gives the board a shared picture.
Identification
How do you identify important business services?
Start from the client, not the organisation chart. List the services you provide to clients, then ask which could cause intolerable harm if they stopped. The FCA lists the factors to weigh, including the nature of your client base, how time-critical the service is for clients and how many clients use it (SYSC 15A.2.4G).
- List client-facing services. Name each one by the outcome a client gets, such as "make a payment" or "settle a claim". Keep distinct services separate rather than grouping several under one name.
- Assess the harm. For each service, ask what disruption would do to clients, to the market and to the firm's own safety and soundness.
- Leave internal functions off the list. HR, payroll and similar teams belong in the map of the services that rely on them.
- Record why, and get it approved. Write down why each service made the list. In the UK this goes into the written self-assessment, which the governing body approves and regularly reviews (SYSC 15A).
Mapping
How do you map an important business service?
Mapping means recording the people, processes, technology, facilities and information each important business service needs, so you can see where it could break and test whether it can stay within its impact tolerance. The PRA expects maps detailed enough to do both (PRA SS1/21).
- Trace the service end to end. Follow it from the client's request to delivery and note each step.
- Record the resources behind each step. People, processes, technology, facilities and information, including anything a supplier or another group company provides.
- Mark the weak points. Single points of failure, suppliers with no alternative and steps nobody owns.
- Link the tolerance and the tests. Keep each map with the service's impact tolerance and the scenarios used to test it.
- Keep it current. Update the map at least once a year and after any significant change.
First steps for your service list
Run a workshop
Bring product, operations and risk leaders together to shortlist the services you provide to clients.
Score each service
Weigh each one against the harm factors: who your clients are, how time-critical the service is and how many clients use it.
Write a one-page summary
Summarise each important business service on one page, so owners and the board work from the same facts.
Related terms
Terms you will meet alongside important business services
Impact tolerance. The most disruption an important business service can take before the harm becomes intolerable. See impact tolerance, explained.
Mapping. Recording the people, processes, technology, facilities and information a service depends on.
Critical operations. APRA's term under CPS 230 for the same idea in Australia. See CPS 230, explained.
Self-assessment. The written record of how a UK firm meets the operational resilience rules, approved by its governing body.
How Drova helps
RunReady, the operational resilience module of Drova's RunGood platform, maps important business services and their dependencies, runs scenario testing against impact tolerances and keeps the evidence ready for the board and the regulator. See how RunReady works.
FAQs
Important business services, answered
How many important business services should we have?
There is no set number. The PRA expects the list to be proportionate to the business, so larger firms usually have more (PRA SS1/21). Each one should be a distinct service, not a whole business line.
Is payroll or HR an important business service?
Not on its own. The PRA says internal services such as HR or payroll should not be identified as important business services by themselves. If a client-facing service depends on them, include them in that service's map and testing.
Who approves the list?
Your board or governing body. In the UK the governing body approves and regularly reviews the firm's written self-assessment, which records each important business service and why it was chosen.
How detailed should service maps be?
Detailed enough to find the weak points and to test whether the service can stay within its impact tolerance. Map the people, processes, technology, facilities and information behind it, including what suppliers provide, rather than every task.
Do services change over time?
Yes. Review the list at least once a year, and sooner after a material change such as a new product, a restructure or an acquisition (SYSC 15A.2.2R).
What does IBS mean in business?
In operational resilience, IBS stands for important business services: a regulatory term for a service your firm provides to its own clients that could cause them intolerable harm if disrupted. It is not the same as "business services" in the everyday sense, meaning services one company buys from another, such as IT support or cleaning.
Once you know your important business services, the next stage is deciding how much disruption each one can take.
Next in PS21/3: Set an impact tolerance for each service
Operational resilience
Explore related topics
Operational resilience hub
See how important business services fit into the resilience framework.
Impact tolerance
Set the limit each service must not cross.
Scenario testing
Test each service against severe but plausible events.
Business continuity
Plan how each service keeps running or recovers.
Operational resilience strategy
Prioritise the work across your services.
Operational resilience examples
See resilience scenarios worked through.
Financial services resilience
What regulators expect of banks, insurers and funds.
FCA operational resilience
PS21/3 and SYSC 15A explained.
APRA CPS 230
Australia's version: critical operations.
DORA overview
The EU's version: critical or important functions.
