What the DFSA’s New Operational Resilience Rules Will Require

There is a specific kind of silence that settles over a compliance meeting when someone asks: “So, what exactly is an impact tolerance?”

Get comfortable with that phrase. In March 2026 the DFSA published Consultation Paper 170, proposing a full operational resilience framework for DIFC firms. The consultation closed on 26 May. Final rules have not landed yet, and when they do, firms will have a 24 month transition period, with the DFSA expecting substantial progress inside the first 12 months.

That sounds generous until you attempt the first step. Which is why the useful time to start is while this is still preparation rather than catch-up.

Having read the paper so you don’t have to, here is what is coming and what I would quietly start doing about it.

What CP170 actually proposes

A new section in the DFSA’s General Module (GEN), built around one question: if something breaks, can your firm keep delivering the services that matter? Not “can you prevent every incident”, because regulators stopped believing in that years ago, but “can you take a hit and keep serving clients”.

The proposed framework stands on five elements:

• Critical business services. Identify the services whose disruption would cause material harm to clients or undermine confidence in the DIFC financial system. Not everything is critical, and part of the exercise is admitting that.
• Impact tolerances. For each critical service, define the maximum disruption you can absorb before the damage becomes unacceptable, measured in time or in something countable such as transaction volume or value. Real numbers, not adjectives.
• Mapping. Chart the people, technology, facilities and third parties each critical service depends on. This is where most firms discover that one quiet vendor sits underneath half the business.
• Scenario testing. Test whether you would stay inside your tolerances during severe but plausible disruption, including scenarios that hit several services at once. Emphasis on plausible: a cloud region down for a day qualifies.
• Notifying the DFSA. A duty to report disruptions that breach an impact tolerance, or come close to it.

It applies to Authorised Firms generally: banks, investment firms, insurers, advisers, fintechs and DIFC branches of international groups. The DFSA describes the framework as proportionate and principles-based, so a boutique firm will not be asked to build what a bank builds. A firm that concludes it has no critical business services is left with little more than a duty to revisit that conclusion periodically.

Why this rhymes with everything else

If this sounds familiar, it should. The UK regime, the EU’s DORA and ADGM’s cyber rules all point the same way: regulators now care less about your firewall brand and more about whether your business survives a bad Tuesday. The DFSA is aligning with that picture, which is good news, because the homework you do here counts in more than one jurisdiction.

What I would do before the rules land

Nothing in CP170 rewards heroic last-minute effort. Everything in it rewards an early, honest inventory.

Start with a one page list of your critical business services. Most firms have three to six, not twenty.

Then, for each one, sketch the dependency map: which systems, which people, which vendors. The recurring discovery in that exercise is a single point of failure nobody had written down. A client report only one person knows how to produce. A payment file that only works from one laptop. An admin account still tied to someone who left in March. Those are the findings you want surfacing in a workshop rather than during an outage.

Then draft your first impact tolerances. They will be wrong. Everyone’s first ones are wrong. But a wrong number you can argue about is far more useful than a blank page.

And finally, look at your existing business continuity plan. If it was last tested when masks were still mandatory, that is your starting point. Resilience you have never rehearsed is a rumour, not a capability.

What the DFSA is actually signalling

Consultation papers are not traps. The DFSA set out its direction well before anything becomes binding, precisely so that firms could prepare calmly instead of scrambling. The 24 month transition says the same thing: the regulator knows this work takes real time, and wants to see progress along the way rather than a rush at the end.

Firms that reach the deadline with a mapped, tested, documented resilience story will find the new regime almost boring. That is the goal. Boring is what resilience looks like when it works.

How TechnoPeak can help

We help DIFC firms map their critical services, find the dependencies nobody had written down, close the gaps and keep the evidence ready for the day someone asks. If you would like to know where you stand before the rules land, a short assessment is a practical place to start. No obligation, and an NDA on request.

Marina Ivashina is Head of Compliance at TechnoPeak. She helps DIFC and ADGM firms pass regulatory reviews without drama, and reads the consultation papers so you do not have to.