‘You need to be able to respond and recover,’ Taylor said. ‘The regulators have understood this is not just a technology problem but a business problem.’

Under the new operational resilience rules, banks need to be mindful of their selection of critical operations, severe but plausible scenarios and tolerance for disruption. What’s more, this is not a one-off box-ticking compliance exercise but an ongoing expectation that banks will be able to provide services to their customers through any severe disruption. OR compliance will look different for different banks and it’s not just confined to the UK – or Europe, under the DORA legislation which hits next year – but is being applied in multiple jurisdictions in various guises.

Fast-changing technological changes, such as cloud computing, are being incorporated into these rules. Digital-first banks such as Allica Bank are already fully in the cloud, where they can leverage cloud mechanisms to build resilience while incumbents are having their migration journeys scrutinised and re-ordered in order to satisfy regulators. ‘There is a possible re-concentration risk if too many financial services institutions all use a particular cloud for a particular purpose,’ explained Giles Taylor of Lloyds Banking Group.