Why financial services regulations in the UK & EU are changing

EXECUTIVE SUMMARY

• Operational disruption to financial services in the UK and EU is now increasingly seen as ‘inevitable’ by regulatory authorities.
• Regulations have shifted from reactive business continuity to the more comprehensive concept of operational resilience.
• For financial services data centers, backup power must now be treated as part of a wider resilience system, rather than an isolated equipment purchase.

How are UK & EU financial services regulations changing?

Across both jurisdictions, regulatory thinking has converged around a core assumption: operational failures in financial services — including disruption to the likes of credit card services and day trading activities — cannot be designed out completely. Increasing digitalization, reliance on complex IT systems, and deep interdependencies between institutions and third-party providers mean that disruption cannot be eliminated.

Previous regulations generally followed the concept of business continuity — focusing mainly on what happens after an operational incident occurs. However, given the complex interdependencies of today’s financial systems, regulations have shifted towards the more comprehensive concept of operational resilience; financial services providers are expected to show not only how they can recover from an incident, but also what they can do to prevent, withstand, adapt to, respond to and learn from disruption.¹

In the UK

The Financial Conduct Authority (FCA) has set out its operational resilience framework; in-scope firms must identify their important business services, set impact tolerances, map the resources supporting those services and test their ability to remain within those tolerances during severe but plausible disruption.²

In the EU

The Digital Operational Resilience Act (DORA) establishes a common digital-operational-resilience framework across much of the EU financial sector.³ It brings requirements covering ICT risk management, incident reporting, resilience testing and third-party risk into one regulatory structure.

What new financial services regulations mean for supporting data centers and backup power

Operational resilience is measured at the level of the service experienced by the customer or market, and not at the level of an individual server, UPS, or battery.

That makes dependency mapping critical. Payments, trading, account access, and settlement services rely on chains of physical and digital infrastructure. The data center is one part of that chain, and its electrical infrastructure is one of the dependencies that can determine whether an interruption remains contained.

Uninterruptible Power Supply (UPS) energy storage provides the immediate power bridge when the utility supply is interrupted or falls outside acceptable limits. Its condition, availability and lifecycle strategy can therefore influence the resilience of the wider power system.

1. For definitions of business continuity and operational resilience, see Viktorija Goryte and Stéphane Speich, “Business Continuity vs. Operational Resilience,” Business Continuity Institute, 15 November 2022, https://www.thebci.org/news/business-continuity-vs-operational-resilience.html.
2. Financial Conduct Authority, “Operational resilience,” first published 14 May 2017, updated 30 June 2026, https://www.fca.org.uk/firms/operational-resilience.
3. European Insurance and Occupational Pensions Authority, “Digital Operational Resilience Act (DORA),” https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en.