The
Prudential Regulation Authority’s (PRA) 2026 priorities for UK deposit takers focus on five key themes: Strategic Risk Management, Operational Resilience, Financial Resilience, Data Risk and Facilitating Competition and Growth.
From Airwalk Reply’s perspective, as a boutique consultancy focused on operational resilience across UK and European financial services, the letter is notably less about what is new and more about what it confirms. The PRA is clearly signalling that firms must move beyond framework implementation to demonstrable resilience.
This reinforces a message we increasingly hear in our day-to-day work with firms: operational resilience is not a compliance exercise, but a core management discipline that underpins strategic choice, innovation and trust.
From important business services to Minimum Viable Business
The PRA’s continued emphasis on embedding operational resilience into strategic decision-making (particularly when introducing new products, technologies, or outsourcing arrangements), aligns closely with how we see firms maturing their thinking.
Many organisations still treat ‘Important Business Services’ (IBS) as a static regulatory artefact. In practice, resilience becomes most powerful when firms use these services to articulate their Minimum Viable Business (MVB); the smallest set of capabilities, resources and dependencies required to continue operating within their Impact Tolerances (ITOL), the maximum tolerable disruption to critical business and customer services.
Viewed through this lens, MVB is not just a mapping exercise. It becomes a management tool that helps boards and executives understand trade-offs. For example, where growth, cost optimisation or technology change may erode resilience if not carefully designed. The PRA’s expectation is that boards routinely consider resilience impacts in strategic change, reinforcing the need for this clarity in decision-making.
Deep scenario testing and building organisational muscle memory
The PRA’s call for improved operational resilience testing, alongside lessons from sector-wide cyber stress tests and tools such as CBEST and STAR-FS, highlights a persistent industry challenge: testing that validates documents rather than behaviour.
We see increasing value in deep scenario testing, scenarios that are severe, plausible and deliberately uncomfortable. These tests go beyond tabletop discussions to explore how decisions are actually made under pressure, how information flows and where human, process, and technology converge under duress.
Done well, deep scenario testing builds organisational ‘muscle memory’. It helps teams practice recovery, understand tertiary impacts, and surface hidden dependencies, including those buried in third-party and sub/outsourcing chains, which the PRA rightly continues to emphasise. Over time, this shifts resilience from theoretical capability to performance tested (and optimised!).
Data foundations as the enabler of resilience and AI
The PRA’s focus on data risk as a cornerstone of prudential and operational resilience is particularly significant amid growing interest in AI and advanced analytics.
In our experience, firms often view AI as a discrete innovation agenda, separate from resilience. The reality is the opposite. By finding hidden trends in disparate data that business leaders would miss, AI amplifies existing weaknesses: poor data quality, fragmented architecture, unclear ownership and weak controls. Without robust operational data foundations, firms struggle to trust their insights in resilience planning, decision-making and response.
Strong data governance, lineage and quality are therefore not just regulatory hygiene; they are core enablers of effective resilience management and safe, value-driven adoption of AI technologies. The PRA’s linkage between data, resilience and advanced technologies makes this explicit.
Resilience as a driver of confidence and competitiveness
Finally, the PRA’s broader objective of supporting competitiveness and growth should not be viewed as in-conflict with operational resilience. Firms that clearly understand their Minimum Viable Business, rehearse severe but plausible disruption and invest in reliable operational data are better placed to innovate with confidence. Whether that involves new digital propositions, increased reliance on third parties, or experimentation with AI and distributed technologies.
For smaller firms and consultancies like ours, the 2026 priorities reinforce a simple truth: resilience is not about proving compliance; it is about enabling better decisions before disruption occurs and ensuring the survivability of core operations to avoid panic and maintain consumer and market confidence.
At Airwalk Reply, we partner with industry and thought leaders, including
Sheltered Harbor, to bring market-leading insight, implementation support and certification for Operational Resilience. If you would like to learn more,
get in touch.
Operational Resilience Learn more
