Central Bank of Ireland thematic assessment: Operational resilience in the MiFID Investment firm sector

In December 2021, the Central Bank of Ireland (Central Bank) published its Cross Industry Guidance on Operational Resilience (OpRes Guidance). The OpRes Guidance applies to all regulated financial service providers and came into effect on 1 January 2024. The OpRes Guidance was updated in July 2025 to include updates informed by recent developments including the Digital Operational Resilience Regulation (DORA) and ongoing industry engagement, as further detailed in our briefing on these updates here.

In 2022, the Central Bank carried out an operational resilience maturity assessment (2022 Assessment) to gain an understanding of the level of preparedness across the financial services sector in advance of the OpRes Guidance coming into effect. The 2022 Assessment found that several MiFID investment firms, which were included in the process were in the early stages of developing operational resilience frameworks (based on a self-assessment) at that time.

In the Central Bank's 2025 Regulatory & Supervisory Outlook report published in February, the Central Bank set out that enhancing operational resilience across the financial sector is a key priority for the Central Bank for 2025/2026.

More recently, the Central Bank conducted a thematic assessment of operational resilience on a cohort of MiFID investment firms (Firms) (2025 Assessment). This thematic assessment included two phases:

• Phase 1 – maturity assessment survey and desk-based review and
• Phase 2 – targeted assessment.

Key findings

By way of reminder, the Central Bank considers operational resilience to be the ability of a firm, and the financial services sector as a whole, to identify and prepare for, respond and adapt to, recover and learn from an operational disruption that affects the delivery of critical or important business services.

On 12 January 2026, the Central Bank published the results of its 2025 Assessment noting an overall maturing of operational resilience frameworks across the MiFID investment firm sector, welcoming the progress made in preparing for and recovering from disruptions. Many Firms now maintain documented frameworks that align with the Central Bank's principles and supervisory expectations, supported by clear governance structures where boards hold ultimate responsibility and senior management maintains functional oversight. Furthermore, several Firms have demonstrated good practices in management information reporting, fostering a culture of effective challenge at both the board and senior leadership levels.

Despite the overall progress, the assessment revealed significant variances in framework maturity across Firms and identified that some need significant enhancement in identifying their critical or important business services. Key deficiencies included a lack of granularity in mapping the people, processes, and third-party providers required to deliver important business services, which hinders the effective identification of vulnerabilities and the design of remediation plans. Furthermore, many Firms need to improve the robustness and range of their scenario testing and ensure their operational resilience frameworks are fully integrated with existing risk management frameworks. The Central Bank noted operational resilience is an evolution of operational risk and business continuity management and, as such, should be aligned with existing or developing frameworks in these areas.

The Central Bank has signalled a heightened focus on cyber and digital resilience in response to escalating cyber threats and a concentrated reliance on a limited number of third-party ICT service providers. While the 2025 Assessment did not focus specifically  on DORA, the Central Bank expects firms to build upon their existing operational resilience foundations to withstand future technological disruptions. To ensure these standards are met, the Central Bank intends to conduct further supervisory work in this area throughout 2026 and 2027.

Next steps

The Central Bank expects all MiFID investment firms, their boards, and senior management to revisit the OpRes Guidance to consider their adherence to it, noting also the updates made in July 2025 to align with DORA. Effective leadership should ensure that resilience is fundamentally built into a firm’s strategic decisions and allows boards to prioritise activities and target investment towards making critical or important business services more resilient.

The Central Bank recommends particular attention should be given to the following Guidelines in the OpRes Guidance, which relate to the identification and mapping of critical or important business services: 

• Guideline 4: A firm should identify its critical or important business service 
• Guideline 7: A firm should understand and map out how its critical or important business services are delivered
• Guideline 8: A firm should  capture third party dependencies in the mapping of critical or important business services

The Central Bank expects operationally resilient firms to have established frameworks that enable them to recover their critical or important business services from a significant unplanned disruption, while minimising negative impacts on their customers and protecting the integrity of the financial system.

While the findings from the 2025 Assessment was focused on MiFID investment firms only, the findings provide a clear indication of the Central Bank's expectations of compliance with the OpRes Guidance. Accordingly, the key findings will be of interest to all regulated firms within the scope of the OpRes Guidance in assessing their operational resilience frameworks and to further ensure readiness for the Central Bank's 2026/2027 supervisory engagement.

If you have any queries on the content of this advisory and/or the impact that it may have on you and your business, please speak to your usual contact in Walkers or connect with any of the contacts listed below.