A 45-minute, CPD-assessed course built from the administrators, custodians, platforms and data feeds regulated firms actually rely on. Important business services, impact tolerances, third parties, incidents, and what reaches a firm even if the FCA's resilience chapter does not. Scheduled, chased and certified for you.
CPD assessed. Every pass issues a certificate carrying the CPD mark.The FCA's operational resilience chapter binds enhanced SMCR firms, banks and a handful of others. Many fund managers and MIFIDPRU firms are outside it. These still reach them.
No branch counters and no ATM outages: every example is a fund administrator, depositary, transfer agent, order management system, market data feed or cloud host.
Why resilience is a different question from business continuity and disaster recovery, where the rules live and which firms they bind, and the three other places the same obligations already live for a firm outside them.
What makes a service important, why the test is harm to clients rather than inconvenience to the firm, what the list tends to look like at a fund manager, two mistakes the FCA has already called out, and which services your own work sits inside.
Why a tolerance is set by where harm becomes intolerable, not by what the firm can manage today, why the gap is the point, why a tolerance is not a recovery time objective, and why time alone is a weak tolerance. Includes a filmed scenario.
What a good map surfaces, severe but plausible scenario testing, lessons learned, communications, and the written self-assessment and why an internal document gets this much attention.
The rule that the firm stays responsible, the stricter position for an AIFM, what managing a third party properly involves, concentration and the fourth party you have never heard of, critical third parties, and what is coming.
Why disruption rarely announces itself, what the firm must tell the FCA now, what changes in March 2027 and its three thresholds, and a decision on a Friday afternoon. Includes a filmed scenario.
The four things that belong to everybody: know which services you support, notice when something is not right, report it promptly to the right place, and never work around a broken control silently.
And what they rely on, including the provider whose name you only see on an invoice.
Disruption rarely announces itself. It usually looks like an ordinary Tuesday.
The same day, through the firm's route, without waiting until you are certain.
A quiet workaround hides the vulnerability the firm most needs to see.
The course teaches enough of the framework for people to see where their own job sits in it, then spends its last third on what an individual actually does. By the end, a learner can:
Two short films, shot for Fundsure with the same cast across the catalogue. In one, a meeting is about to set an impact tolerance at the figure the firm can manage today, and a colleague saw what the last outage did to clients. In the other, late on a Friday, an administrator’s system problem has left a fund dealing without a price. After each, the learner chooses what to do, and is told why the tempting answers are wrong: accepting the achievable figure, splitting the difference, leaving it with the administrator because it is their system, or emailing investors directly.
The test at the end draws 10 questions from a bank of 30, with a pass mark of 80%, and a pass issues a named, CPD-marked certificate that anyone can check online.
Checked against the Handbook and the FCA's published findings. Last checked Sept 2026.
SYSC 15A's transitional period ended 31-Mar-25. Firms in scope must now be able to stay within each impact tolerance in a severe but plausible disruption.
Published 27-Mar-26: separate tolerances for consumer harm and market integrity often missing, third parties still the weakest area, and some firms claiming no scenario breaches tolerance without genuinely severe testing.
A single regime run by the FCA, PRA and Bank of England for reporting operational incidents, with three thresholds, and separate FCA rules from the same day on notifying material third-party arrangements.
Failing to stay within a tolerance is the firm's responsibility even where the cause sits with a third party, and an AIFM's liability is unchanged by delegation.
Two suppliers that look like diversification but run on the same cloud region or data source, and the provider behind your provider that nobody has assessed.
Many AIFMs and MIFIDPRU firms are outside SYSC 15A. The course tells them to ask which they are, and shows what reaches them anyway.
The firm stays responsible for every service it outsources or delegates. The people who notice a provider failing, and who describe the real process when a map is drawn, are rarely the people who own the resilience framework, which is why the course is for them.
In the Fundsure Portal the course is scheduled for the people who need it, chased before the deadline, and every sitting, score and certificate is kept and carried into the compliance officer’s report to the board.
How the portal runs trainingOperational Resilience plus Cybersecurity, AIFMD and IFPR, Data Protection and the rest of the catalogue of 20, with no per-course fees.
The attacks most likely to cause the disruption, and the reporting regime arriving in 2027.
See the courseDelegation, the depositary, the ICARA and wind-down planning.
See the courseWhen an incident is also a personal data breach.
See the courseRunning the compliance function, including board MI and breaches.
See the courseWe will send you a link to take the whole course, filmed scenarios and test included, or walk you through the portal with a demonstration firm.
