Step 02 / Explore the pack
See every service mapped and every breach tracked.
A visual view of the Payment and e-money institutions edition before you open Excel. This pack is for firms in scope of SYSC 15A only. Choose a tab to explore the illustrative worked example.
- Choose sector
- Preview
- Download
Payment and e-money institutions
Operational resilience pack · illustrative example firm: Marlow Quay Payments Ltd
For firms in scope of SYSC 15A only. A firm that is not in the list in SYSC 15A.1.1R is outside the rules.
- 04
- Important business services
- 07
- Scenario tests
- 02
- Tolerance breaches
- 02
- Vulnerabilities
Each with a tolerance
Severe but plausible
Each with remediation
Tracked to closure
Every scenario test, with the disruption time found against the tolerance, and the vulnerabilities that remediate the breaches.
- T-01 · Sending payments18 Jun 2026 · Loss or reduced provision of technology · 3 hours against a tolerance of 4 hoursWithin tolerance
- T-02 · Sending payments2 Sep 2026 · Unavailability of a third-party service · 6 hours against a tolerance of 4 hoursBreach, remediating
- T-03 · Receiving funds and crediting wallets8 Jul 2026 · Data corruption, deletion or manipulation · 5 hours against a tolerance of 6 hoursWithin tolerance
- T-04 · Customer access to balances and statements12 Aug 2026 · Unavailability of facilities or key people · 14 hours against a tolerance of 24 hoursWithin tolerance
- T-05 · Card payment authorisation23 Sep 2026 · Loss or reduced provision of technology · 1.5 hours against a tolerance of 2 hoursWithin tolerance
- T-06 · Receiving funds and crediting wallets26 Aug 2026 · Unavailability of a third-party service · 4 hours against a tolerance of 6 hoursWithin tolerance
- T-07 · Card payment authorisation10 Feb 2026 · Loss or reduced provision of technology · 2.5 hours against a tolerance of 2 hoursBreach, remediated
Vulnerabilities
- V-01 · IBS-01Target 18 Dec 2026 · Single scheme connection through the sponsor bank and no rehearsed manual routeOpen
- V-02 · IBS-04Target 29 May 2026 · Standby authorisation host needed manual stepsClosed
See the actual workbook · real Excel sheets, rendered from the example file
Built from the same data and formulas as the worked-example workbook, for an invented firm. Every name and figure is invented.
About the Payment and e-money institutions edition
Authorised payment institutions, authorised e-money institutions and registered account information service providers. SYSC 15A applies to an electronic money institution, a payment institution or a registered account information service provider, but for such a firm only to the provision of payment services and the issuance of electronic money and connected activities. Temporary-permission firms and firms with their head office outside the UK are outside it. From 18 March 2027 payment service providers must report a major incident within 4 hours, and authorised payment and e-money institutions must notify material third-party arrangements.
Small payment institutions and small e-money institutions: this pack reads them as in scope of SYSC 15A as a payment institution or electronic money institution under SYSC 15A.1.1R(3), but the Glossary definitions were not verified (see the limits). The new third-party notice and register rules (SUP 15.19 and SUP 16.33) name authorised electronic money institutions and authorised payment institutions only, so a small institution is not covered by them on the text we quote. Check your own status.
A registered account information service provider is in scope of SYSC 15A but not of the new material third-party notice and register rules, which name authorised e-money and payment institutions.
It is not for a firm that is not in the list in SYSC 15A.1.1R, such as a core or limited scope SM&CR firm that is not otherwise listed, a temporary-permission or temporary-authorisation firm, or a firm with its head office outside the United Kingdom. Check your own position.
The FCA does not set a template for an operational resilience self-assessment. This pack is a practical structure built on SYSC 15A and the FCA's incident and third-party reporting rules that start on 18 March 2027. See our payment services guidance, outsourcing due diligence and resource library.