Distinct relevant services are to be evaluated and treated separately. A collection of services should not be identified as a single important business service.

The factors to be considered when identifying an important business service include:

• nature of client base including client vulnerabilities
• ability of clients to use other providers
• time criticality for clients receiving the service
• number of clients to whom the service is provided
• sensitivity of data held
• potential to inhibit the functioning UK financial system
• potential to impact the soundness, stability or resilience of the UK financial system
• possible impact on the firm’s financial position and viability
• potential to cause reputational damage
• potential for a breach of legal or regulatory obligations
• level of inherent conduct and market risk
• potential to cause knock-on effects
• importance of the service to the UK financial system including:
  • market share
  • client concentration
  • sensitive clients

A firm is also required to set an impact tolerance for each of its important business services.

Compliance with the operational resilience requirements must be kept under review and amended within a year when there is a material change to the firm’s business.