1. What is Critical Business Service Mapping?

UK FCA/PRA definition: Important Business Service is defined as a service provided by a firm, or by another person on behalf of the firm, to one or more clients which, if disrupted, could cause intolerable levels of harm to clients, or pose a risk to soundness, stability or resilience of UK financial system.

EU DORA definition: Mapping of key business services and underlying ICT systems to understand critical components that contribute to overall operational resilience.

Goal: FCA and PRA will require firms to conduct mapping exercises to prepare impact tolerances for important business services that if disrupted could cause harm to consumers/market integrity and/or the financial system

RBI India: Under Master Direction on IT Governance 2023 and BCP guidelines, Banks must test their BCP/IT DR of critical applications regularly. RBI requires banks to maintain robust BCP and DR frameworks and classify critical systems. RTO for critical systems like RTGS or NEFT is usually less than 2 hours.

2. The 5 Mandatory Mapping Requirements

Requirement 1: Identify Important Business Services
Firms must identify their important business services, set impact tolerances, map the people, processes, systems, and third parties behind them, and prove through scenario testing that they can stay within tolerance during severe-but-plausible disruption

You cannot list everything. Common IBS for a bank:

• Retail payments / UPI / NEFT / RTGS
• Customer account access / Mobile banking
• Loan processing
• Treasury settlement
• Clearing and settlement

Requirement 2: End-to-End Resource Mapping
FCA operational resilience regulation states that a firm must identify and document the people, processes, technology, facilities and information necessary to deliver each of its important business services

Required map:

DORA adds: Firms must map the length and complexity of the chain of subcontractors providing ICT services that support critical or important functions.

And: DORA requires financial entities to manage ICT third-party risk, including subcontracting and concentration risk. Start with ICT services supporting critical or important functions, identify material subcontractors and shared dependencies

Requirement 3: Set Impact Tolerances
For each IBS set:

• Maximum tolerable duration of disruption
• Maximum tolerable volume of data loss
• Maximum tolerable extent of harm

FCA and PRA will require firms to identify and set impact tolerances for each of their important business services

Requirement 4: Scenario Testing
By March 31 2025 deadline: firms had to have identified their important business services, set impact tolerances, completed mapping and scenario testing, and be able to remain within tolerances through severe but plausible disruption

Test: Cyber attack, cloud region failure, third party insolvency, data corruption.

Requirement 5: Register and Evidence
DORA: A continuously updated register of information covering all contracts with ICT third-party providers which supervisory authorities can request
UK: Board must approve self-assessment and evidence remains current for board and regulators.

3. DORA vs UK vs RBI - Difference

DORA entered into force on 16 January 2023 and has applied since 17 January 2025. In November 2025, ESAs published first official list of 19 Critical ICT Third-Party Providers under DORA.

4. Case Laws / Enforcement Actions - Why Mapping Matters

Case 1: TSB Bank plc - £48.65m Joint Fine FCA + PRA - The Canonical Failure[2022]

The defining UK precedent is TSB Bank. In December 2022, the FCA and PRA jointly fined TSB £48.65 million for operational-resilience and risk-management failings tied to its 2018 core-banking migration, a botched transfer to a new platform that locked roughly two million customers out

FCA and PRA have fined TSB Bank plc a total of £48,650,000 for operational risk management and governance failures, including management of outsourcing risks, relating to the bank’s IT upgrade programme. Technical failures ultimately resulted in customers being unable to access banking services

Fine split: FCA £29.75m + PRA £18.9m. Without 30% settlement discount would have been £69.5m.

What went wrong on mapping:

• Failed to organise and control migration and outsourcing risk
• Did not obtain sufficient assurance from its critical supplier before readiness assurances were given to board
• Weak challenge, incomplete evidence, supplier dependence
• Every TSB branch and significant proportion of its 5.2 million customers affected.

Learning: Under old rules regulators could only sanction bank. Under DORA now, critical vendors themselves are designated and directly overseen. DORA closes gap.

Case 2: PRA v. Former CIO of TSB - Personal Liability of SMF

PRA fines former Chief Information Officer of TSB Bank plc for breach of Senior Manager Conduct Rules in relation to its 2018 IT migration programme. This follows enforcement against TSB.

Principle: Senior Manager personally liable if fails to ensure mapping and assurance of critical service.

Case 3: FCA Enforcement Pattern on Operational Resilience

Common failings identified in final notices of FCA enforcement action relating to operational and technology resilience issues include failure to address known IT vulnerabilities

5. How to Build a Compliant Map - Template

Step 1: List customer-facing services → Filter by intolerable harm test
Step 2: For each IBS, draw service chain: Customer → Front Office → CBS → Payment Hub → NPCI/SWIFT → Third Party Cloud
Step 3: For each node, attach owner, RTO, RPO, dependency type (sole/single)
Step 4: Identify vulnerabilities: Single point of failure, concentration, 4th party
Step 5: Test severe but plausible scenario: e.g., AWS Mumbai region down 24h - can UPI stay within 4h impact tolerance?
Step 6: Board sign-off + Register update

If you are a bank in India, start with RBI's 2023 Master Direction on Outsourcing: classify service as critical, maintain register of outsourced vendors, conduct risk assessment of subcontractors, and include exit strategy. RBI has made it mandatory for banks to deploy and demonstrate their business continuity and IT DR capabilities