Step 02 / Explore the pack
See every service mapped and every breach tracked.
A visual view of the Payment and e-money institutions edition before you open Excel. This pack is for firms in scope of SYSC 15A only. Choose a tab to explore the illustrative worked example.
- Choose sector
- Preview
- Download
Payment and e-money institutions
Operational resilience pack · illustrative example firm: Marlow Quay Payments Ltd
For firms in scope of SYSC 15A only. A firm that is not in the list in SYSC 15A.1.1R is outside the rules.
- 04
- Important business services
- 07
- Scenario tests
- 02
- Tolerance breaches
- 02
- Vulnerabilities
Each with a tolerance
Severe but plausible
Each with remediation
Tracked to closure
The services the invented firm considered, with the impact tolerance, mapping and status the workbook works out.
| Service | Tolerance | Tests | Status |
|---|---|---|---|
| IBS-01 · Sending payments | 4 | 2 | Breach unresolved |
| IBS-02 · Receiving funds and crediting wallets | 6 | 2 | Complete |
| IBS-03 · Customer access to balances and statements | 24 | 1 | Complete |
| IBS-04 · Card payment authorisation | 2 | 2 | Complete |
| IBS-05 · Marketing website | n/a | n/a | Not an important service |
Tolerance in hours unless a number of days is shown.
See the actual workbook · real Excel sheets, rendered from the example file
Built from the same data and formulas as the worked-example workbook, for an invented firm. Every name and figure is invented.
About the Payment and e-money institutions edition
Authorised payment institutions, authorised e-money institutions and registered account information service providers. SYSC 15A applies to an electronic money institution, a payment institution or a registered account information service provider, but for such a firm only to the provision of payment services and the issuance of electronic money and connected activities. Temporary-permission firms and firms with their head office outside the UK are outside it. From 18 March 2027 payment service providers must report a major incident within 4 hours, and authorised payment and e-money institutions must notify material third-party arrangements.
Small payment institutions and small e-money institutions: this pack reads them as in scope of SYSC 15A as a payment institution or electronic money institution under SYSC 15A.1.1R(3), but the Glossary definitions were not verified (see the limits). The new third-party notice and register rules (SUP 15.19 and SUP 16.33) name authorised electronic money institutions and authorised payment institutions only, so a small institution is not covered by them on the text we quote. Check your own status.
A registered account information service provider is in scope of SYSC 15A but not of the new material third-party notice and register rules, which name authorised e-money and payment institutions.
It is not for a firm that is not in the list in SYSC 15A.1.1R, such as a core or limited scope SM&CR firm that is not otherwise listed, a temporary-permission or temporary-authorisation firm, or a firm with its head office outside the United Kingdom. Check your own position.
The FCA does not set a template for an operational resilience self-assessment. This pack is a practical structure built on SYSC 15A and the FCA's incident and third-party reporting rules that start on 18 March 2027. See our payment services guidance, outsourcing due diligence and resource library.