25 SYSC 15A controls. The 20-step incident runbook. The 18-item Recovery Box. Otto's 3 report formats — including the FCA Dry-Run mock supervisory interview — drafted from your live data in 60 seconds.
Trusted by 250+ UK-regulated firms · Built by compliance professionals, so you don’t have to be one.
14-day free trial · Take the tour
Compliance should be proportionate to the risk. Not sure? Our experts can help.
You have subscribed to the core module Compliance Monitoring Hub, AND
You have subscribed to the core module Compliance Monitoring Hub, AND
Note: In-scope firms have operational resilience obligations under SYSC 15A. The above speaks to which approach is appropriate for your needs. This does not represent advice.
SYSC 15A and PS21/3 ask for a living programme — IBS mapped, impact tolerances dated, threats benchmarked, recovery tested, the runbook ready when it actually matters. A PDF refreshed once a year cannot evidence any of that, and at 03:00 it's already too late to find out.
SYSC 15A requires dated, board-approved impact tolerances for every Important Business Service. Consumer-impact narratives, within-tolerance flags, the lot. Most firms can't name their IBS, let alone evidence a 4-hour maximum tolerable disruption.
A consultant-drafted BCP sits on a shared drive, never gets tested, and is stale the moment it's signed. You still own SYSC 15A accountability. A Word document can't prove a scenario was rehearsed, an impact tolerance was met, or a CMT deputy was briefed.
SYSC 15A.5 requires severe-but-plausible scenario testing across cyber, premises loss, key-person, supplier failure and pandemic. When the FCA asks "when did you last test?", "we talked about it in a meeting" doesn't meet the standard.
A real-incident BCP needs a printed runbook, offline contact lists, sealed passwords and charged spare phones. Most firms have a vague Recovery Box they couldn't find at 03:00, let alone produce on FCA request.
If your BCP lives in a Word doc, your IBS tolerances are undated, and your last stress test was in 2023, the operating system below is for you.
Three things make it the OS, not a Word doc. Nine capabilities turn it into the system the SMF24 actually runs the firm from when the incident hits at 03:00. One module covering every SYSC 15A obligation — live, scored, evidenced, year-locked.
Most BCPs are 48-page PDFs nobody opens until something breaks. The operating system below is built on three principles that change what the SMF24 can put in front of the FCA — and what holds up at 03:00 when the incident actually hits.
Live Incident Mode is a real-time workspace — not a planning artefact. Declare an incident and the FCA notification timer starts. Running log. Categorised topics. On close, it automatically logs a stress test. Every closed incident counts as a SYSC 15A.6 lesson learned, with no separate manual step.
Otto sits as an FCA Skilled Person and runs the 12-question SYSC 15A interview on your live BCP — RAG-graded, examiner observation, signable PDF. Plus two more report formats from the same data: the 14-section Full BCP and the Executive Summary.
11 of 17 sections compute their score from your live register data — IBS within tolerance %, threats within appetite %, suppliers with adequate BCP %, Recovery Box checked %. Self-certification without evidence is impossible by design. Every score is auditable to a specific data line.
Built for the incident that hasn't happened yet, the supervisor visit you haven't had yet, and the board paper due Friday. Every capability ships in the module. No tier gate, no add-ons.
Critical Functions, IBS with dated impact tolerances, Resource Dependencies, Threats, Stress Tests, CMT, Emergency Contacts, IT DR, Insurance, Recovery Box, Suppliers, Incidents, Tabletop Exercises, Playbooks. Fully editable, with CSV export per register.
14 registers · CSV-exportThe Resource Dependencies register maps people, tech, facilities and third parties for each IBS. When any line has no alternative, the platform automatically flags it as a single point of failure. Concentration risk surfaced without manual analysis — exactly what the FCA asks for.
SYSC 15A.4 · Auto-flagThe score is built from your live data, not opinion — most sections auto-calculate from IBS within tolerance, threats within appetite, suppliers adequate, runbook checked, Recovery Box current. Click the score to see exactly why you're at 1 point instead of 2.
RAG bands · Audit-gradeDeclare incident → severity (P1–P4), type, topics, assigned-to. FCA 4-hour notification countdown starts immediately and recalculates every second. + Log Entry to append timestamped entries. Close Incident captures debrief, lessons, FCA-notified flag.
FCA 4h timer · Live logPre-loaded steps, named owner per step. FCA notification sits at step 17 — after damage assessment, severity classification, alt-site decision, IT recovery, staff comms. Most BCP tools list FCA notification first, which is operationally wrong.
SYSC 15A.8 · Step-17 placementSysadmin passwords (sealed envelope), printed BCP, USB backups, spare laptop with VPN, cheque books, evac plans. Per-item attestation log: Green <90 days, Amber 90–120, Red >120 / never. The FCA inspector asking "can you show us your Recovery Box?" gets a printout, not a shrug.
SYSC 15A.5 · RAG-trackedFull BCP (14 sections) · FCA Dry-Run (12-question mock interview) · Executive Summary. Same data, three audiences. The score is calculated by the platform, not the AI, so the numbers never drift between reports.
3 formats · One data setOtto sits as the FCA Skilled Person and answers 12 set SYSC 15A questions in the firm's voice using the firm's actual BCP data. RAG-rates each answer. Writes the examiner observation. Signable PDF. Run the dry-run before the regulator does.
12 questions · RAG-graded · SignableSingle ZIP bundling all 12 register CSVs + the active Otto report + the FCA Dry-Run text + a manifest. The only module on the platform that ships Word as well as PDF — for board secretaries who require revision-tracking.
PDF · Word · ZIP25 controls cited to specific sub-rules. 11 auto-calculated registers feeding the 84-point score. 3 Otto formats drafted from your live data — including the FCA Dry-Run mock supervisory interview.
Included in the Pro plan · Unlimited users. No setup fee.
A transparent 84-point Resilience Health score — 34 section points plus 50 checklist points, every one auditable back to its evidence. A 25-item SYSC 15A checklist, with pre-drafted client-comms templates most firms still write reactively. Auto-SPOF detection surfaces single points of failure before a supervisor does. The Recovery Box sits outside the cloud stack it’s backing up. And every register feeds Otto’s 14-section board-ready BCP.
The compliance officer's 30-second status check. An overall Resilience Health score, a compliance breakdown across sections and the SYSC 15A checklist, operational-resilience KPIs, BCP test dates, crisis-management team, third-party dependencies, recovery plans and emergency contacts — every obligation on one screen.
Critical Business Functions and Important Business Services mapped under SYSC 15A. Criticality, RTO/RPO and dependencies on every function, plus Impact Tolerances with their maximum tolerable duration and breach status — named, dated and signed off, in one register.
The FCA SYSC 15A BCP Compliance Checklist. BCP in place, recovery strategies for critical functions, RTO/RPO defined, scenario testing, training, FCA notification and board oversight — each item Met / Partial / Not Met, turning "have we done this?" into "where exactly are the gaps?".
When something goes wrong, declare the incident. The FCA 4-hour countdown starts, the immediate-response runbook opens, evidence is captured as it happens — and the SYSC 15A Important Business Service notification is drafted and ready to send. Every closed incident keeps its notes and lessons learned.
Run the recovery with the guidance built in. The crisis-management team, the immediate-response procedure and per-scenario recovery steps in one place — with plain-English guidance on what good operational resilience looks like sitting right above the work your team reaches for at 03:00.
Your full Business Continuity Plan, the FCA Supervisory Readiness dry-run and the executive summary — all drafted by Otto in seconds from your IBS register, impact tolerances, recovery plans and tabletop history. Board-ready, evidenced and exportable to PDF or DOCX.
Three board-ready report formats from one data set — including the FCA Dry-Run mock supervisory interview Otto runs on your own live BCP. Built from your live registers, scored against the 84-point resilience model, signable as a PDF. Rehearse the supervisor's questions before the supervisor does.
12 set SYSC 15A questions. Each answered from your 17 live registers — IBS, impact tolerances, threats, stress tests, CMT roster, IT DR results. RAG-graded. Examiner observation noted. Signable PDF in 60 seconds.
The firm operates four Important Business Services as defined under PS21/3: Customer Onboarding & KYC, Payment Processing, Trade Execution and Client Reporting. Impact tolerances are derived bottom-up from customer-harm thresholds and financial-impact analysis, calibrated against severe-but-plausible disruption scenarios. The Payment Processing tolerance is 4 hours maximum disruption, evidenced by daily processed volume of £2.4m and the regulatory liquidity covenant under MIFIDPRU 7. Each tolerance is dated, owned by the SMF24, and reviewed at least annually.
Operational resilience accountability sits with the Chief Operating Officer (Nadia Bergström, SMF24), evidenced in the firm's SM&CR Statements of Responsibilities and re-attested in the firm's Q1 2026 review cycle. The Audit & Risk Committee Chair (Ines Kowalski, SMF4) is the named senior individual receiving quarterly resilience MI. The firm has not yet formally codified a deputy SMF24 in the event of incumbent absence; this is included in the Q2 2026 forward plan for resolution by 30 June 2026.
The most recent IT disaster-recovery test was conducted on 17 March 2026, owned by Oluwaseun Adeyemi (Head of IT Resilience, 1LoD). The test exercised a full air-gapped backup failover for the Payment Processing IBS against the 4-hour impact tolerance. Recovery was achieved in 3 hours 42 minutes, well within tolerance. Two minor lessons were captured (DNS propagation delay, alert-channel cascade timing) and tracked as actions due 30 May 2026, both with named owners.
Otto drafts all 14 sections of the Board-ready BCP from your own 17 live registers. IBS tolerances, threat register, stress tests, CMT roster, third-party dependencies, IT DR tests, communications plan, Recovery Box. Scored against the 84-point resilience model so a firm cannot claim 100% without the evidence trail to back it up.
Aspirational plans that cannot be executed under pressure provide false assurance. The FCA quotes it back at every thematic review. Every test here is dated, outcomed and remediated; lessons learned become tracked actions with a named owner and due date.
| Test owner | Scenario & impact tolerance | Tested | Result |
|---|---|---|---|
|
Nadia Bergström
SMF24 · Chief Operating Officer
|
Ransomware full-restore exercise: air-gapped backup failover for Payment Processing IBS. Impact tolerance: 4-hour max disruption. | Mar 17, 2026 | Pass · 3h 42m |
|
Oluwaseun Adeyemi
Head of IT Resilience · 1LoD
|
Loss of primary premises (simulated fire): DR site activation plus 48-hour remote-working stress. Tested DR failover and CMT SMS cascade. | Feb 24, 2026 | Partial · 2 actions |
|
Clara Montalvo
BCP Coordinator · 2LoD
|
Key-person absence (desktop walk-through): SMF17 and SMF4 simultaneously unavailable. Deputy MLRO plus Risk Deputy activation tested against RACI. | Feb 06, 2026 | Pass |
|
Hiroshi Tanaka
Third-Party Risk Lead · 2LoD
|
Critical supplier failure: core banking data feed outage > 6 hours. Manual failover to alternative supplier; FCA 4-hour notification threshold exceeded in dry-run. | Jan 22, 2026 | Fail · remediation Q2 |
SM&CR, proved. The Chief Risk Officer owns the resilience programme, the COO operates it, and the Board Chair attests. Once locked, the report stays traceable to the underlying registers and reproducible for every review the FCA runs across the three-year retention period.
Otto is trained on SYSC 15A.2 through 15A.8, PRIN 2A (Consumer Duty 4-hour tolerance), SM&CR accountability, Cyber Essentials Plus and the FCA's operational resilience policy statements. It answers your Op Res queries in seconds, and drafts your choice of Full BCP, FCA Dry-Run or Executive Summary — all from the 17 registers your firm has actually populated.
Otto does two things for Op Res. First, it answers any SYSC 15A query your team throws at it; rule-cited, handbook-grounded, with the specific figure from your own registers where relevant. Second, it drafts three different report formats from the same data, sized for the audience: a 14-section Full BCP for the regulator, a 1–2 page Executive Summary for the CEO, and a 12-question FCA Dry-Run mock supervisory interview that RAG-rates each answer in your firm's own voice. Speed via Otto AI, underpinned by 150+ expert documents.
“What impact tolerance should we set for Client Transaction Processing?” “When does SYSC 15A.8 require FCA notification?” “What does the FCA expect on third-party concentration risk?” Otto answers from the handbook, SYSC 15A, policy statements and your live Op Res registers in seconds, with citations.
Otto drafts your choice of 3 report formats from the same live data in seconds — the regulator gets the Full BCP, the CEO gets the Executive Summary, and you rehearse on the FCA Dry-Run. When an incident hits, the 7th-tab Incident Mode runs the 4-hour FCA notification clock and captures the post-mortem that auto-feeds your next stress-test cycle. See it all in a live demo.
Everything you need to know about SYSC 15A coverage, the 84-point scoring model, Otto's 3-format report engine, the Live Incident Mode, and how it sits inside RegTechPRO.
We use essential cookies to make the site work, and optional analytics cookies to understand how it's used. See our Cookie Policy.