Operational Resilience Metrics for US Banks

Which Operations the Metrics Cover

Resilience metrics attach to the operations a bank delivers, and each system is measured through the operations it supports. An interagency paper, issued by the OCC, the Federal Reserve and the FDIC describes resilience as the ability to deliver operations, including critical operations and core business lines, through a disruption from any hazard.

Critical operations are those whose failure would threaten US financial stability. Core business lines are those whose failure would cause a material loss of revenue, profit or franchise value.

The paper is directed at firms with $250 billion or more in average total consolidated assets, or $100 billion with $75 billion in specified risk measures. A community bank or credit union can build its own list from its business impact analysis and from the services that reach a material portion of its customer base. The metrics form the measurement layer of an operational resilience framework.

Setting the Tolerance Before the Metric

Under the interagency paper, the board sets the number each metric is compared against. It approves and periodically reviews the firm’s appetite for disruption, at the enterprise level and for each critical operation and core business line.

The Basel Committee’s 2021 Principles for Operational Resilience define tolerance for disruption as the level of disruption a bank is willing to accept given a range of severe but plausible scenarios.

A business impact analysis turns that tolerance into working targets, and the FFIEC Business Continuity Management booklet uses three:

Maximum tolerable downtime

The total time a business process can be disrupted, all impacts considered.

Recovery time objective (RTO)

The longest a system resource can stay unavailable before the impact on other resources and processes becomes unacceptable.

Recovery point objective (RPO)

The point in time before a disruption to which data can be recovered.

Mapping the interconnections behind each operation, including significant third parties, shows which systems and providers each metric has to watch.

The Core Operational Resilience Metrics

Leading indicators warn that a tolerance is at risk before a disruption occurs. These key risk indicators track conditions such as emergency or failed changes, critical systems unpatched past policy, single points of failure without a tested alternative, and key roles without trained cover.

Seven operational resilience metrics form the core set, each tracked per critical operation and compared against a fixed reference:

Thresholds, Escalation and Board Reporting

A threshold on each metric triggers action before the tolerance is breached. The Basel Committee’s revised Principles for the Sound Management of Operational Risk (March 2021) describe monitoring metrics and trends against agreed thresholds or limits, with reports covering breaches of the bank’s risk appetite and tolerance statement.

The interagency paper asks firms to monitor exposure relative to their tolerance for disruption, detect anomalous activity in a timely manner, and give senior management and the board enough information for timely decisions.

A banking organization must notify its primary federal regulator no later than 36 hours after determining that a notification incident has occurred. A bank service provider must notify affected bank customers as soon as possible after covered services are disrupted for four or more hours.

Federally insured credit unions report qualifying cyber incidents to the NCUA within 72 hours. Escalation paths that start these clocks automatically keep the deadlines inside the metric set.

What Supervisors and Recent Disruptions Show

No US rule prescribes specific operational resilience metrics as of October 2026, so expectations come from guidance. On June 2, 2026, the agencies revised the sound practices paper to remove references to reputational risk.

On September 11, 2026, they proposed third-party risk management guidance to replace the 2023 interagency guidance, and issued a statement on community bank engagement with core service providers that calls for service level agreements with measurable performance standards and timely disclosure of operational issues and security incidents.

Recent disruptions show why third-party measures belong in the set. Microsoft estimated that the faulty CrowdStrike update of July 19, 2024 affected 8.5 million Windows devices, less than 1% of all Windows machines.

Between May 1, 2025 and April 30, 2026, credit unions reported 588 cyber incidents to the NCUA, including third-party provider incidents, according to its 2026 Cybersecurity and Credit Union System Resilience Report.

Frequently Asked Questions