FCA Shares Lessons From Defence, Security, and Resilience Lab on Systemic Risk

Key Takeaways

• The FCA has published findings from its Defence, Security, and Resilience (DSR) Lab, a joint exercise with the Ministry of Defence that tested firms' preparedness for systemic, sector-wide shocks such as satellite spoofing, subsea cable damage, and cyberattacks on critical infrastructure.
• While not formal guidance or a statement of regulatory obligations, the update signals growing supervisory focus on shared dependencies and national resilience, and provides a self-assessment framework compliance teams should use proactively.

Deep Dive

This update is non-binding guidance rather than a new rule, but it reflects a clear shift in the FCA's supervisory lens from firm-level operational resilience toward systemic, sector-wide and national security risk. Compliance and operational resilience teams should treat this as an early signal of future regulatory expectations, particularly around mapping shared infrastructure dependencies (subsea cables, satellite systems, communications networks, public sector databases) that sit outside any single firm's control but could trigger simultaneous, sector-wide disruption.

Key themes include the recognition that firms often do not know the extent to which they share critical infrastructure or suppliers with competitors, and that back-up systems may not be genuinely independent from primary systems during a stress event. The FCA also highlights dual-use technology and defence-sector access to finance as emerging areas of interest, suggesting potential future engagement with firms on client due diligence and sector access issues involving defence and dual-use companies.

No formal deadlines or mandatory requirements are introduced. However, the FCA has flagged three areas for further investigation: intelligence-sharing mechanisms with the financial sector, the need for fail-safe/back-up technology standards, and frictions in defence-sector access to banking and finance. Firms should monitor these workstreams closely, as they may evolve into formal consultations or supervisory priorities.

Recommended actions include conducting a systemic (not just firm-level) dependency mapping exercise, stress-testing crisis communications plans for multi-firm or sector-wide events, reviewing whether back-up providers introduce concentration risk, and engaging with industry bodies on cross-sector resilience initiatives, particularly cybersecurity information-sharing. Firms with defence or dual-use clients should also assess their capability to support this sector's access to finance.

The risk implications are primarily reputational and operational rather than immediate enforcement risk, given the non-binding nature of the publication. However, firms that fail to anticipate the FCA's evolving focus on systemic and national resilience risk may face heightened supervisory scrutiny once these themes mature into formal policy, making early engagement a prudent, low-cost risk mitigation step.

Source: Financial Conduct Authority