This article is for informational purposes only and does not constitute financial or legal advice. You should consult with a qualified professional before making any decisions about your choice of platform.
What Operational Resilience Assurance Should I Seek From My Platform Provider?
Ask your platform provider which services could affect your clients during an outage, what its tested recovery arrangements cover and what evidence it can share. Check the applicable FCA operational-resilience obligations for each firm rather than assuming one rule applies to every adviser.
An outage may prevent clients from viewing valuations, dealing or accessing a service when they need it. Identify which activities your firm depends on and what client harm an interruption could cause before deciding what assurance to request.
For each material dependency, record the assurance your firm needs and who will assess it. Check the regulatory obligations that apply to the firms and services involved rather than assuming all advisers fall within the same regime.
Moving Beyond the Marketing Spiel
A continuity plan is a starting point, not the whole assessment. Ask how it connects to the services you use, the recovery tests performed and the actions still outstanding.
Use the following areas to structure your evidence request, while checking the scope and current requirements of the applicable operational-resilience regime:
- Identify Important Business Services: What are the critical services you provide to your customers?
- Set Impact Tolerances: How long can each of those services be disrupted before it causes intolerable harm to your customers or the market?
- Map the Dependencies: What are the people, processes, technology, and third parties that support each important business service?
- Scenario tests: have the reviewer establish the requirements relevant to the firm's services and tolerances. Agree disruption scenarios, run the tests and record their limits and unresolved recovery gaps.
Your Operational Resilience Due Diligence Questionnaire
The retained questionnaire below identifies areas to discuss with the provider. Review each question for relevance, including its dated testing period and role assumptions, before sending it; it is not confirmation that every item is a requirement for your firm.
| Due Diligence Area |
Key Questions for Your Platform Provider |
| 1. Important Business Services |
Can you provide us with a list of your identified important business services that are relevant to us and our clients (e.g., client onboarding, dealing, valuations, transfers)? |
| 2. Impact Tolerances |
What are the impact tolerances you have set for these services? Can you explain the methodology you used to determine these tolerances and how you have considered the risk of consumer harm? |
| 3. Scenario Testing |
Can you provide us with a summary of your scenario testing programme for 2025/2026? What severe but plausible scenarios have you tested against (e.g., a major cyber-attack, a key third-party supplier failure, a prolonged data centre outage)? What were the outcomes of these tests, and what lessons have you learned? |
| 4. Third-Party Dependencies |
Can you provide us with a mapping of your key third-party dependencies, particularly your underlying technology provider? What assurance have you obtained from them about their own operational resilience? What is your contingency plan if one of these key third parties fails? |
| 5. Governance and Accountability |
Who is the Senior Manager on your board responsible for operational resilience? How does the board satisfy itself that the firm is meeting its operational resilience obligations? Can you provide us with a summary of your operational resilience self-assessment? |
What Good Assurance Looks Like
Look for answers that connect the service, dependencies, test results and remediation actions. Ask what information can be shared with your firm and what alternative assurance is available where detailed material is restricted.
A generic answer leaves an evidence gap; it does not by itself prove the provider is failing. Record the missing information, seek clarification and decide what further checks or contingency work your firm needs.
The Bottom Line: Resilience is a Condition of Trust
Treat operational resilience as a service-dependency assessment. Confirm the regime’s scope and the applicable duties before using PS21/3 as the basis for a legal or regulatory conclusion.
Compare the available assurance with the client impact of an outage. Document the gaps, the owner’s decision and the contingency arrangements rather than treating a provider’s disclosure policy as the sole measure of resilience.
If assurance is missing, escalate the gap and decide what evidence or mitigation is needed. A decision to retain or replace a provider should consider the full dependency assessment, not just willingness to share a document.
Take the Next Step
If AI or automation forms part of the service dependency you are reviewing, scope that work separately. An AI Audit is not a substitute for provider-specific operational-resilience assurance.
Book a Discovery Call → or learn more about the AI Audit.
Need help assessing an AI workflow and its unresolved risks?
Map where AI can improve decisions, service and operations while keeping Consumer Duty, SM&CR, model-risk and client-data controls visible.
