Technology, Data and Operational Resilience
What this domain tests
This domain tests the systems and data that run securities operations, the standards for reference and market data, and the operational resilience obligations to identify important business services and stay within impact tolerances.
Systems and data
- Core platforms include order management, settlement and custody processing, corporate actions, reconciliation and static data. Reference data (SSIs, ISINs, LEIs, calendars, tax rates) is the most frequent source of downstream error, so it needs ownership and independent validation.
- Messaging is migrating to ISO 20022; APIs, RPA and machine learning are used for matching and exception handling, but controls and audit trails are still required.
- Distributed ledger and tokenisation are being piloted; the legal and settlement finality questions remain open in many markets.
Operational resilience
- UK FCA/PRA rules require firms to identify important business services, set impact tolerances (maximum tolerable disruption), map the people, processes, technology and third parties supporting them, run scenario testing including severe-but-plausible events, and evidence self-assessment. The deadline for remaining within impact tolerances was 31 March 2025.
- Outsourcing and cloud remain the firm's responsibility: due diligence, exit plans, audit rights and concentration risk must all be managed.
- Cyber controls, access management, patch management, incident reporting and tested recovery objectives (RTO/RPO) form the day-to-day layer.
Worked example
A firm maps "settlement of UK equities" as an important business service. Reasoning: it identifies a tolerance of no more than four hours of disruption before client harm becomes unacceptable. Mapping shows dependence on the CSD, a SWIFT service bureau, the reconciliation platform and one cloud provider. Scenario testing of a service bureau outage reveals that the manual fallback has never been rehearsed, so the firm adds a rehearsed workaround and a secondary connectivity route, then records the vulnerability in the resilience self-assessment.
Traps that cost marks
- Confusing business continuity (recovering the firm) with operational resilience (avoiding harm to clients and markets).
- Treating outsourced activity as outsourced accountability.
- Ignoring reference data governance as an operational risk control.