On 11 November 2026, the Financial Conduct Authority (FCA) published its findings following a review of a sample of trading firms, to highlight good practices and where they could deal with incidents more effectively.

Background

The FCA assessed the cyber and operational resilience of a sample of trading venues, to highlight good practices and see where they could deal with incidents more effectively. The FCA’s assessment follows its March 2026 Regulatory Priorities report for wholesale markets, where the regulator committed to reviewing the cyber and operational resilience of wholesale firms, including trading venues.

The review is relevant to UK trading venues, including multilateral trading facilities (MTFs), organised trading facilities (OTFs) and recognised investment exchanges (RIEs).

Key findings

Key findings from the review include:

  • Governance, accountability, risk and assurance
  • Trading venues were more resilient when they had clear ownership, appropriate senior oversight and management information that helped them understand risks and priorities. Many trading venues had established committee structures to help the board oversee resilience risks, but some had limited evidence that their boards had reviewed, challenged or approved resilience activities and remediation plans. Venues should define and document their escalation procedures, so that senior management and staff understand them and can raise significant issues quickly and consistently.
  • Several trading venues relied on frontline teams to identify, assess and test resilience risks. While these teams often had the best understanding of business services and processes, they did not always provide sufficient independent challenge and assurance over these resilience risks.
  • Understanding of services and third-party management
  • Trading venues generally understood their core services, but some did not have a complete view of the people and technology that deliver them, including third parties. Their mapping sometimes failed to consider wider group dependencies.
  • While third-party contractual arrangements were generally in place, trading venues’ due diligence, contractual standards and exit plans were not always suited to the importance of the service. Trading venues often only had high-level exit strategies for third-party providers, with limited evidence of how they would maintain or restore important business services without them
  • Continuity testing, change and recovery
  • Trading venues had set impact tolerances and metrics for their important business services. More developed approaches had clearer rationales and considered potential harm to clients and markets more fully.
  • Most venues had worked on how to limit the impact of a disruption and which aspects of important business services they should prioritise for recovery. However, they did not always link this to their impact tolerances or have clear information for staff about how the recovery would work in practice.
  • Trading venues did not always test whether they could recover services as part of their change activities.
  • Incident response, communications and learning
  • Most venues had established incident management processes, but some were weak on how they escalated incidents, documented their decisions and improved their resilience.
  • Some venues relied heavily on predefined severity ratings and escalation thresholds to assess incidents. These can help them take a consistent approach, but all venues should also consider the wider impact on important business services, market participants and recovery objectives. Effective approaches combine thresholds with management’s judgement.

Next steps

Trading venues should review the FCA’s findings in the context of their own business models and broader changes in the market.

The FCA adds that markets are evolving rapidly with the growth of AI, the emergence of new technology such as quantum computing, and the more widespread adoption of extended trading hours. As such the FCA warns that it is vital for trading venues to assess the risks associated with these changes and develop their resilience measures accordingly.

Venues should also prepare for the FCA’s operational incident reporting rules, which come into force on 18 March 2027, and consider any changes they need to make to their processes and systems.