Step 02 / Explore the pack
See every service mapped and every breach tracked.
A visual view of the Payment and e-money institutions edition before you open Excel. This pack is for firms in scope of SYSC 15A only. Choose a tab to explore the illustrative worked example.
- Choose sector
- Preview
- Download
Payment and e-money institutions
Operational resilience pack · illustrative example firm: Marlow Quay Payments Ltd
For firms in scope of SYSC 15A only. A firm that is not in the list in SYSC 15A.1.1R is outside the rules.
- 04
- Important business services
- 07
- Scenario tests
- 02
- Tolerance breaches
- 02
- Vulnerabilities
Each with a tolerance
Severe but plausible
Each with remediation
Tracked to closure
Status as at 30 Oct 2026
Tolerance breaches under remediation: 1
Important business services
4
Tolerance breaches found
2
Breaches under remediation
1
Breaches awaiting a retest
0
Vulnerabilities overdue
0
Services with no test
0
Services not fully mapped
0
Records needing attention
0
Self-assessment approval: Approved. The sponsor bank connection is a single point of failure; remediation is on track for 18 December 2026.
The board summary never says the firm is compliant or operationally resilient. It names what is missing, late or unfinished.
See the actual workbook · real Excel sheets, rendered from the example file
Built from the same data and formulas as the worked-example workbook, for an invented firm. Every name and figure is invented.
About the Payment and e-money institutions edition
Authorised payment institutions, authorised e-money institutions and registered account information service providers. SYSC 15A applies to an electronic money institution, a payment institution or a registered account information service provider, but for such a firm only to the provision of payment services and the issuance of electronic money and connected activities. Temporary-permission firms and firms with their head office outside the UK are outside it. From 18 March 2027 payment service providers must report a major incident within 4 hours, and authorised payment and e-money institutions must notify material third-party arrangements.
Small payment institutions and small e-money institutions: this pack reads them as in scope of SYSC 15A as a payment institution or electronic money institution under SYSC 15A.1.1R(3), but the Glossary definitions were not verified (see the limits). The new third-party notice and register rules (SUP 15.19 and SUP 16.33) name authorised electronic money institutions and authorised payment institutions only, so a small institution is not covered by them on the text we quote. Check your own status.
A registered account information service provider is in scope of SYSC 15A but not of the new material third-party notice and register rules, which name authorised e-money and payment institutions.
It is not for a firm that is not in the list in SYSC 15A.1.1R, such as a core or limited scope SM&CR firm that is not otherwise listed, a temporary-permission or temporary-authorisation firm, or a firm with its head office outside the United Kingdom. Check your own position.
The FCA does not set a template for an operational resilience self-assessment. This pack is a practical structure built on SYSC 15A and the FCA's incident and third-party reporting rules that start on 18 March 2027. See our payment services guidance, outsourcing due diligence and resource library.