On 9 July 2025, the Bank of England and the Prudential Regulation Authority (PRA) co-published a letter to PRA-regulated firms and relevant financial market infrastructures (FMIs) outlining the thematic findings from the 2024 Cyber Stress Test (CST24).

Key findings

Key messages from CST24 include:

  • It is important for systemic firms to consider the Financial Policy Committee’s tolerance for disruption to payments and settlement, and how the decisions they make in response to operational disruption may affect financial stability.
  • Complex and bespoke services mean that wholesale payments may not be substitutable or portable, however it is important for counterparties and customer firms to understand the impacts of infrastructure being disrupted and explore mitigations if their service provider is unavailable for an extended period.
  • Customer relationship managers or other incident ‘first responders’ may not be familiar with the Sector Response Framework or with their firm’s own operational resilience contingency procedures, and further work to improve awareness of these playbooks would be beneficial to ensure clear and accurate communication to customer firms.
  • Some CST24 participants chose not to process any transactions during the disruption because it would make reconciliation more difficult, which may delay the resumption of business services; or because they saw Financial Conduct Authority (FCA) rules on Treating Customers Fairly (TCF) as a barrier to prioritising some customers above others. The FCA has confirmed its view that ‘a failure to maintain market integrity or financial stability can have a significant impact on customers. Where that is the case, firms should consider prioritising payments that minimise the impact on market integrity and/or financial stability. Doing so is unlikely to breach TCF requirements. On the contrary, rigidly processing payments in the order they were submitted – without consideration of the wider impact on customers – is more likely to breach TCF requirements’. Firms may therefore wish to consider whether they have the data and processes in place to identify and prioritise transactions where this could play an important role in maintaining financial stability.
  • It is important for firms to ensure their disconnection (and reconnection) options are understood across business functions, are aligned to their risk appetites, and that playbooks reflect the potential financial stability impacts of a loss of key connections.
  • It is important for firms to explore whether a reduced or contingency level of connection could be maintained when needed, which would reduce the risk of contagion and facilitate mitigation options. Firms can then use this understanding to make risk-based decisions on disconnection and reconnection.
  • It is important for FMIs to work with the sector to ensure their members understand the complexity and implications of disconnection and reconnection and can make informed, risk-based decisions which reflect the financial stability implications of these impacts.
  • The work at the Cross Market Operational Resilience Group to define best practice reconnection processes, including informing firm-level reconnection decisions will be an important resource on this topic.

Annexes

The letter also has three annexes:

  • Annex 1: ‘Financial stability impact planning tools’, may provide a structure for firm or cross-firm planning and preparation for financial stability impacts and can be adapted and applied to a range of services and scenarios.
  • Annex 2: ‘Financial instability mitigation and related barriers’, provides some examples of mitigations across financial operational, and confidence impacts, the role of those mitigations, and potential barriers to effective mitigation.
  • Annex 3: ‘Scenario severity amplifiers’, includes a list of factors which firms can use to plan or vary a scenario to ensure it is sufficiently severe to challenge existing planning and preparation assumptions and therefore provides useful outcomes which will improve operational resilience of the processes being tested.

Next steps

PRA regulated firms and FMIs should consider the findings from CST24 alongside the findings from their own operational resilience testing, sector exercising, and lessons from real incidents. They should consider the implications of these findings for their own businesses, reflect on how planning and preparation for potential financial stability scenarios can be improved, and integrate those lessons into a cycle of continuous improvement.

Participant confidentiality regarding CST24 is now relaxed and firms that wish to do so are encouraged to share their experience of the stress test with their customers, sector groups and home state regulators, with a view to maximising the benefits of the test findings and continuing to improve the depth and maturity of operational resilience planning at firm and sector levels.