Operational Resilience in The DIFC is a Board Focus Under CP170

Instead, the proposals introduce a service-focused, outcome-driven framework that places accountability firmly at the board level. The central question is no longer whether a firm can recover systems within set timeframes, but whether it can continue to deliver its most important services within defined thresholds of harm when disruption occurs.

This approach aligns the DFSA with international standards and comparable regimes already adopted by regulators such as the UK’s Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA), as well as the Hong Kong Monetary Authority (HKMA), Monetary Authority of Singapore (MAS), Australian Prudential Regulation Authority (APRA), Office of the Superintendent of Financial Institutions (OSFI) in Canada, and the Qatar Financial Centre Regulatory Authority (QFCRA). For firms operating across jurisdictions, this consistency is familiar. For others, it represents a meaningful step change in expectations.

Firms Will Need to Rethink How Resilience Is Defined and Governed

Several themes within CP170 stand out and require careful consideration.

• First, while all DFSA-regulated firms are in scope, not all will ultimately identify Critical Business Services whose disruption could cause significant harm to clients, the financial system, or confidence in the DIFC. That said, where such services do exist, firms will be expected to define Impact Tolerances that reflect the maximum tolerable level of disruption. These tolerances must be clearly articulated, evidenced, and approved at board level.
• Second, the concept of resilience extends beyond technology. Resource and dependency mapping will need to capture people, processes, third parties and infrastructure. In particular, concentration risk across outsourcing arrangements and key service providers is likely to face increased scrutiny.
• Third, scenario testing is expected to move beyond theoretical exercises. Firms will need to demonstrate that their testing frameworks support real decision-making under stress, including trade-offs between competing priorities and the potential for prolonged disruption.
• Finally, the emphasis on near-misses introduces a more dynamic supervisory lens. Firms may be expected to notify the DFSA not only when tolerances are breached, but when they are at risk of being breached. This reinforces the need for timely monitoring, escalation, and governance.

Why This Matters During Consultation

With a proposed 24-month implementation period, it may be tempting to view CP170 as a future-state consideration. In practice, experience from other jurisdictions suggests that firms that delay mobilisation often face challenges embedding a service-based approach into their operating model.

Operational resilience requires a different way of thinking. It cuts across organisational silos and requires alignment between compliance, risk, operations, technology, and the board. Identifying Critical Business Services, defining meaningful tolerances, and mapping dependencies are not purely technical exercises. They involve judgement, iteration, and, in many cases, cultural change.

Starting early allows firms to engage with the consultation from a position of insight. It also provides time to test assumptions, refine governance structures, and ensure that resilience considerations are embedded into strategic decisions, including outsourcing, change programmes, and growth initiatives.

Perhaps most importantly, firms should begin to consider not just what frameworks they have in place, but what they can credibly demonstrate. Supervisory focus is increasingly shifting toward evidence of effectiveness rather than documentation alone.