An impact tolerance is the maximum tolerable level of disruption to an important business service, measured by a length of time and any other relevant metrics, set at the point where any further disruption would cause intolerable harm to the firm's clients or a risk to the soundness, stability or resilience of the UK financial system. That is the FCA's definition, and the PRA's is the same in substance with the firm's safety and soundness as the test. Under SYSC 15A and the PRA's Operational Resilience Part, every important business service must have one, the board approves it, and since 31 March 2025 a bank must be able to stay within it in severe but plausible scenarios. The difference from a recovery time objective is the point of the concept: a tolerance measures harm to the people outside the bank, while a recovery time measures how fast its systems come back. Botminds' Operational Resilience Management is an agentic solution that times every scenario against those tolerances, from evidence, so a board can see how far each service sits from the line it set.
The worked example is the solution's fictional sample bank, Corvane Bank UK, and its service Make a Faster Payment for personal customers, with a tolerance of 4 hours. Definitions are quoted from the regulators and linked.
Three clocks on one outage: when systems recover, when customers are served, and the tolerance
Systems recovered 4 h 20 m
Routing and screening re-pointed to the alternate gateway
Service restored for customers 6 h 10 m
41,000 in-flight payments reconciled and replayed
With the fix the bank accepted 3 h 5 m
Warm standby gateway, keys pre-exchanged, routing automatic
Impact tolerance, 4 hours: the point the board judged harm to customers becomes intolerable
What is an impact tolerance?
It is a limit on harm, expressed as a limit on disruption. The FCA defines it as "The maximum tolerable level of disruption to an important business service, as measured by a length of time in addition to any other relevant metrics, reflecting the point at which any further disruption to the important business service could cause intolerable harm to any one or more of the firm's clients or pose a risk to the soundness, stability or resilience of the UK financial system or the orderly operation of the financial markets" (FCA glossary, as quoted in its March 2026 observations).
The PRA's wording keeps the structure and changes the test. Its rules "define an impact tolerance as the maximum tolerable level of disruption to an important business service as measured by a length of time in addition to any other relevant metrics", set "at the point at which any further disruption to the important business service would pose a risk to the firm's safety and soundness" or, for firms meeting the criteria, UK financial stability (PRA SS1/21, 3.1–3.2). A dual-regulated bank sets a tolerance for each regulator's objective and may set them at the same point. The Basel Committee uses a related term, "tolerance for disruption", defined as "the level of disruption from any type of operational risk a bank is willing to accept given a range of severe but plausible scenarios" (BCBS, Principles for operational resilience, 2021); the UK version is narrower and harder, because it is fixed at the point of intolerable harm rather than at the bank's appetite.
What is the difference between impact tolerance and RTO?
A recovery time objective is how long the bank allows itself to bring systems back; an impact tolerance is how long customers can bear the disruption before harm becomes intolerable, and the second is longer because work remains after systems recover. The FCA put it directly in its 2024 observations.
It's also worth noting that impact tolerances are different from recovery time objectives. A recovery time objective is the maximum time taken to recover the service. But in most cases, to avoid intolerable harm, processing will need to be undertaken once recovery of services is complete.
FCA, Operational resilience: insights and observations for firms, May 2024
The FCA's conclusion follows: "It's common therefore to see recovery time objectives set well within impact tolerances to ensure you can remain within tolerance." The figure at the top of this page shows why. In the sample scenario, routing and screening are re-pointed to the alternate gateway at 4 h 20 m, which is when the systems have recovered. Customers are not served until 41,000 payments caught in flight have been reconciled and replayed, at 6 h 10 m. A recovery time objective of 4 hours would have been missed by 20 minutes; the tolerance is missed by 2 h 10 m, because the processing after recovery is part of the customer's wait.
The PRA treats recovery objectives as tools for meeting the tolerance, not substitutes for it. Setting a tolerance lets firms set requirements for the resources behind a service, and "These requirements might include capacity specifications, recovery time objectives, and recovery point objectives", set "to enable the firm to deliver the important business service within its impact tolerance" (SS1/21, 3.14).
Impact tolerance vs MTD and RPO: whose harm each one measures
The continuity measures most banks already use are defined around the organisation; the impact tolerance is defined around its clients and the market. The US National Institute of Standards and Technology's definitions, from its contingency planning guide SP 800-34, make the contrast plain.
Impact tolerance, RTO, MTD and RPO: what each limits, and whose harm it measures
| Measure | Definition | Whose harm | Set by |
|---|---|---|---|
| Impact tolerance | "The maximum tolerable level of disruption to an important business service" in time and other metrics, at the point of intolerable harm (FCA) | Clients and the market (FCA); safety and soundness, stability (PRA) | The firm; approved by the board |
| Maximum tolerable downtime (MTD) | "The amount of time mission/business process can be disrupted without causing significant harm to the organization's mission." (NIST) | The organisation | Business impact analysis |
| Recovery time objective (RTO) | "The overall length of time an information system's components can be in the recovery phase before negatively impacting the organization's mission or mission/business processes." (NIST) | The organisation's processes | Technology and continuity owners |
| Recovery point objective (RPO) | "The point in time to which data must be recovered after an outage." (NIST) | Data loss tolerance | Technology and data owners |
The column that matters is "whose harm". An MTD answers how long the bank's process can stop before the bank is hurt; a tolerance answers how long the bank's customers can wait before they are. The two can be close for some services and far apart for others. A payment service whose customers have rent due today has a short tolerance even if the bank could survive a day without it.
Can an impact tolerance be more than time?
Yes: time is required, and other metrics are encouraged. The PRA says an impact tolerance "must, in all cases, include a time-based metric", and that firms must consider using it "in conjunction with additional metrics, such as the volume or value of transactions that the firm can tolerate being interrupted for that period of disruption" (SS1/21, 3.6). An example it gives is a tolerance stating that the firm "will not tolerate the business service delivering less than a certain percentage of normal operating capacity for a specified period of time."
The FCA has pressed the point twice. In 2024 it observed that tolerances "across the industry have also been primarily set as time-bound tolerances", suggesting additional metrics from "types of customers, values and types of transactions, criticality of transaction and estimated losses" (FCA, May 2024). In 2026 it listed as good practice "the increased use of quantitative non-time-based metrics when setting impact tolerances (e.g. transaction volumes, financial thresholds) alongside time-based measures, informed by real-world incidents" (FCA, March 2026). The sample bank sets each service a time and a customer metric; for Make a Faster Payment the customer metric counts time-critical payments that miss their due day, which is what its Impact agent measures in each scenario.
How do you set an impact tolerance?
Assume the service has failed, extend the outage in your head until the harm becomes intolerable, and set the tolerance there, at peak demand. The PRA describes that method: firms may assume the service "is unavailable for a specified period of time" and judge the impact, and if it is tolerable, "consider the impact of a longer disruption" (SS1/21, 3.7). Two instructions shape the answer. "Firms should not consider the cause or probability of disruption when setting their impact tolerances" (3.5), and tolerances "should apply at peak times as well as in normal circumstances" (3.9).
Setting an impact tolerance in seven steps
- Start from the service, not the system.
A specific outcome for an identifiable user, such as making a Faster Payment, not "payments".
- Assume it has failed.
Ignore cause and probability (SS1/21, 3.5); the tolerance is about the harm, not the odds.
- Count who is hurt, hour by hour.
Customers, vulnerable customers, payments due that day, value; from real volumes, not annual averages.
- Use the peak, not the average.
Payday, month-end, the busiest hour (SYSC 15A.2.8G, SS1/21 3.9).
- Find the point of intolerable harm and write down why.
The rationale is what the FCA found missing in 2024; put it in the self-assessment.
- Add a non-time metric.
Volume, value or customers affected, alongside the time (SS1/21, 3.6).
- Separate consumer harm from market harm.
The FCA's 2026 review flagged firms that did not set distinct tolerances for each.
What a tolerance must not be is a description of current capability. The FCA's 2024 observations found "a wide range of impact tolerances identified by firms, with limited rationale for when intolerable consumer harm or a risk to market integrity is reached", and a tolerance that happens to equal the last test result is the most common way to have no rationale at all. The PRA's own example shows the method working the other way: a custodian judges that after six hours of disruption customers cannot settle trades, and after eight its own safety and soundness is threatened, and invests to meet the shorter of the two (SS1/21, 4.11).
One service, drawn as a chain under its tolerance clock
Who approves an impact tolerance?
The board. The PRA requires boards to approve the important business services and the tolerance set for each (SS1/21, 7.1; quoted in who maps, tests, checks and signs), and the FCA requires its governing body to approve the self-assessment, which records each tolerance and "the justification for the level at which they have been set" (SYSC 15A.6.1R(2), 15A.7.1R). Tolerances must be reviewed after a material change and at least once a year.
Changes are where tolerances drift. A service owner who cannot bring a service inside its tolerance has an easy alternative: widen it. In the sample bank, a proposal to widen "Use online and mobile banking" from 6 to 8 hours, after customer research, went first to the head of operational resilience and then the SMF24 before the board, with the Impact agent's note beside it setting out how the change would absorb the service's tested gap without any fix. Who proposes, checks and approves follows that chain role by role.
A request to widen a tolerance, with its effect on the tested headroom
What happens if you breach an impact tolerance?
A breach in a test is a vulnerability to fix; a breach in a real disruption is a regulatory event. In testing, the firm must make improvements after lessons learned (SYSC 15A.5.9R), put the vulnerability and its planned action in the self-assessment, and re-test after the fix (15A.5.7R). The PRA expects tests that breach: firms should include scenarios in which they expect to exceed the tolerance (SS1/21, 6.12).
In a real disruption, "the FCA expects to be notified of any failure by a firm to meet an impact tolerance" (SYSC 15A.2.11G). A tolerance does not force reckless recovery, though. The FCA says a firm should generally not stay within it if doing so would breach another obligation or increase the risk of harm, and the PRA that firms "should not be forced into inappropriate actions because of their impact tolerances in the event of a disruption" (SS1/21, 3.16); restoring a service whose data cannot be trusted can be worse than waiting (3.15). Response plans buy time: in the sample bank's case, a priority queue for rent, bill and loan payments cuts harm while the slower fix is built.
Severe but plausible: the disruption a tolerance must survive
It is a disruption serious enough to test the limits of a service but realistic enough to happen, which the rules use as the standard a bank must be able to recover from within tolerance. SYSC 15A.2.9R requires a firm to stay within tolerance through a severe but plausible disruption, and SYSC 15A.5.6G lists five scenario types to consider, from data corruption to a third-party failure. How to choose, run and time those scenarios is covered in its own guide.
Operational resilience vs business continuity: why the tolerance is the dividing line
Business continuity recovers the firm's operations; operational resilience keeps the firm's services to its customers within a harm limit the board has set. The tolerance is what separates them. Continuity measures such as MTD and RTO, as the NIST definitions above show, are framed around the organisation's mission and processes; operational resilience assumes the disruption has happened, ignores its probability (SS1/21, 3.5), and measures recovery from the customer's side, processing included.
The rules keep the two connected but distinct. The PRA tells firms to reference continuity planning in their self-assessment "only" where it directly pertains to the Operational Resilience Part (SS1/21, 8.2), and the Basel Committee treats continuity plans and exercises as one of the means to "deliver critical operations through disruption" (BCBS, 2021). In practice, continuity plans and recovery objectives become inputs: the steps a scenario is timed from. To see a bank's services drawn against their tolerances, start from Operational Resilience Management.
Questions people ask
What is an example of an impact tolerance?
The PRA's SS1/21 gives a custodian that judges customers cannot settle trades after six hours of disruption to safekeeping. In the sample bank, Make a Faster Payment has a tolerance of 4 hours, set because after that same-day payments start to fail, with a customer metric on time-critical payments alongside.
Is an impact tolerance the same as risk appetite?
No. Risk appetite is how much risk a bank chooses to take; an impact tolerance is a fixed limit on disruption at the point harm becomes intolerable, set assuming the disruption happens. The Basel Committee's "tolerance for disruption" sits closer to appetite, which is one reason the UK term is stricter.
How many impact tolerances does each service need?
At least one per important business service, and the PRA expects a time metric in all of them. A dual-regulated bank sets a tolerance for the FCA's objectives and one for the PRA's, which may be at the same point; the FCA's 2026 review also wants consumer and market harm distinguished.
Can an impact tolerance change?
Yes, after a material change and at the annual review, with the board's approval and the reason recorded in the self-assessment. A change made because a service failed a test is the one to challenge: the tolerance measures harm, which a failed test does not alter.
What is impact tolerance in operational resilience under the FCA?
Under SYSC 15A.2.5R a firm must set an impact tolerance for each important business service, and under 15A.2.9R it must be able to stay within it in severe but plausible scenarios. Since 31 March 2025 the transition period has ended, so failing to do so is a compliance question, not a plan.