1 January 2027: What the BMA's Resilience Code Asks of a Bermuda Bank's Board
The policies exist. The evidence is what the BMA will ask for.
Adam Wenham | Founder & Managing Director, Garrison · November 2026
The first self-assessment is due on day one
The BMA set the dates in its stakeholder letter of 15 September 2025: banks on 1 January 2027, every other relevant entity by 31 March 2028. From 1 January the board approves an annual self-assessment that the BMA can request at any time, and a service that goes outside its impact tolerance has to be reported to the BMA within 24 hours.
The board approves five things, not one policy
Exhibit 1. What the code asks a bank's board to approve
Source: BMA, Operational Resilience and Outsourcing Code, and stakeholder letter of 15 September 2025.
The UK went first, and the weak points were evidence
The UK's operational resilience rules, the regime closest to the BMA's new code, took effect in March 2022 with a three-year run to March 2025. In May 2024 the FCA published what it had found across firms:
- Tolerances without a rationale. Most were set as a length of time only, with little reasoning about when harm becomes intolerable, and some were recovery time objectives under another name.
- Mapping still immature. Two years in, many firms could not yet show the full chain of people, systems, data and suppliers behind each service.
- Testing on paper. Scenario testing was mostly desk-based, severity was rarely stepped up, and third parties were rarely included.
- Third parties treated as someone else's problem. Firms were not actively managing their suppliers' resilience, though a supplier's failure remained the firm's own.
- Self-assessments boards could not rely on. They lacked the justification and detail a board needs, and concerns about staying within tolerance were not written down.
At the Bank of England, the tolerances that held up were the ones we had tested; the ones set in a workshop didn't. A Bermuda bank faces the same work with weeks rather than three years. That changes what the first year should aim for.
Suppliers carry most of the risk
A modern bank runs largely on supplied technology: core banking, payments, cloud, card processing, US dollar clearing. Each material arrangement needs a register entry, an owner, oversight and, for the critical ones, an exit plan the board believes. An exit clause in a contract is not an exit plan. Services drawn from a parent or group count too, and have to be evidenced in Bermuda.
The cyber work is already half the evidence
Much of the evidence already exists in the bank's cyber work. The asset inventory, third-party security reviews and recovery tests behind a cyber answer are also resilience evidence, and reading the two together avoids doing the work twice.
What the weeks before January can still do
A clean first self-assessment that cannot be evidenced is worse than an honest one with gaps. The code is applied in proportion to a bank's size and complexity, so a small bank's list is shorter, not different. Before 1 January, a board can expect four things:
- Services and tolerances approved. A short list of important business services, each with a tolerance and the reasoning behind it. 1.
- The outsourcing register complete. Every material supplier recorded, the critical ones identified, and an exit plan in place or dated. 2.
- Each tolerance owned and measured. A named owner, a measure, and a tested route to the board and the BMA if a service breaches. 3.
- An honest self-assessment. What is in place, what is not, and a funded, dated plan for each gap, which the board can stand behind when the BMA asks. 4.
Five questions for the board before it signs
- Which services have we named as important, and what is the reasoning behind each tolerance? 1.
- Have we tested each service against a severe scenario that includes a supplier failing? 2.
- Which critical suppliers have an exit plan we have tried, not just a clause in the contract? 3.
- How would we know within 24 hours that a service had gone outside tolerance? 4.
- If the BMA asked for our self-assessment on 4 January, what evidence would we hand over? 5.
An independent read before the board signs
Garrison offers banks a two-week read of the draft self-assessment against the code, in time for the December board: what is in place, what is missing, and the evidence behind each answer, ending in a gap register and a board paper. On any piece of work Garrison either assesses or delivers, never both. Ask for the bank brief: adam@garrison.re
About the author. Adam Wenham is the founder of Garrison, a Bermuda firm that provides senior technology leadership to Bermuda's regulated firms: covering technology seats, running programmes, bringing in specialists and getting firms ready for the BMA's technology codes. He led technology transformation and operational resilience at the Bank of England, held senior roles across operations, engineering, architecture, innovation and change during seventeen years at Credit Suisse, and led the technology modernisation function at StoneX. At both Credit Suisse and StoneX he led the technology side of mergers and acquisitions. He began his career at Barclays, where he ran the technology for the move of BZW's 3,500-strong investment bank and its 1,300-position dealing room to Canary Wharf. adam@garrison.re
Sources: BMA, Operational Resilience and Outsourcing Code, and stakeholder letter of 15 September 2025; FCA, "Operational resilience: insights and observations for firms", 28 May 2024.
Garrison · Hamilton, Bermuda · November 2026 · Practitioner analysis, not legal advice.