Having Implemented the PRA's Operational Resilience Framework. Here's What It Means for BMA OpRes.

The conceptual architecture will be familiar to anyone who has worked with PS6/21. The BMA's seven-step lifecycle follows the same logic the PRA established:

Board accountability sits at the top. Proportionality governs the application. The principle is identical: understand what matters most, define how much disruption you can tolerate, prove you can stay within those limits, and improve continuously.

Carriers with UK group parents who have already been through PS6/21 have a genuine head start. The vocabulary translates. The governance model translates. The conceptual framework translates. And carriers already complying with the BMA's existing operational risk management requirements have a foundation to build on:

That said, the step from operational risk management to operational resilience is larger than many carriers expect. The legal analysis published by Bermuda's leading firms provides excellent guidance on what the code requires and how it relates to existing obligations:

What follows is a complementary perspective: not what the code says, but what implementation looks like in practice.

Four differences will catch carriers who assume this is simply PS6/21 with a Bermuda stamp.

The PRA treats operational resilience and outsourcing as separate supervisory instruments — PS6/21 for resilience, SS2/21 for outsourcing. The BMA has coupled them into a single code. This is not a drafting convenience. It reflects a fundamental truth about Bermuda's market: the operational resilience of most carriers depends entirely on the resilience of their outsourced service providers:

For many Bermuda carriers, these third parties don't support the operation. They are the operation.

And this obligation extends beyond carriers. Insurance managers, brokers, and marketplace providers are equally covered by the OpRes Code — meaning the outsourcing chain runs in both directions. The carrier must assess its insurance manager's resilience. The insurance manager must demonstrate its own. For a market built on outsourced service delivery, the implications are systemic.

The PRA designed PS6/21 for institutions with tens of thousands of employees and billions in assets. The BMA is applying the same principles to carriers with twenty people and a single line of business. The code explicitly states that compliance will be assessed on a proportionate basis, based on the "nature, scale and complexity" of the entity. But proportionality is not simplification. A twenty-person carrier still needs to identify its important business services, map its resources, set its tolerances, and test its scenarios.

The practical risk: carriers will download PRA-scale templates from their group parent or their consultant and attempt to localise them. A framework built for Barclays does not become appropriate for a Class 3A Bermuda reinsurer by changing the logo on the cover page. The proportionality exercise requires a ground-up assessment of what matters for that specific entity — not a top-down reduction of someone else's framework.

UK firms have had more than three years to develop operational resilience capabilities. The PRA published its policy statement in March 2021. By March 2025, when the full framework took effect, firms had built teams, run multiple rounds of scenario testing, refined their impact tolerances through practical experience, and developed a shared understanding of "what good looks like" across the industry. Bermuda has strong foundations in operational risk management — but resilience-specific implementation experience is limited. There is no established peer benchmark for what a proportionate Bermuda OpRes framework looks like. Many entities will be building their resilience-specific capabilities from a standing start, with eighteen months to reach a standard the UK market took four years to achieve.

The PRA supervises operational resilience through a combination of on-site reviews, desk-based assessments, and ongoing supervisory engagement. The BMA, with a smaller supervisory team relative to the number of regulated entities, will necessarily rely more heavily on the annual self-assessment document as its primary evidence of compliance. This is not a criticism of the BMA's approach — it reflects the practical reality of regulating a large number of entities with a focused team. But it means:

Business continuity planning asks: "Can we recover from a disruption and return to normal operations?" Operational resilience asks a different question: "Can we continue to deliver our important business services within tolerable limits during the disruption?" These are not the same question. A carrier that submits its BCP test results as evidence of resilience testing has answered the wrong question.

Many carriers assess their outsourced providers through vendor management processes:

The OpRes Code requires something different. It requires carriers to assess whether their third parties can remain operationally resilient under stress — not whether they deliver on their SLAs under normal conditions. An insurance manager with an excellent track record but no tested disruption response plan is a resilience risk, regardless of service quality.

The BMA's code shares its conceptual DNA with the PRA's framework, but the market it applies to is structurally different. Bermuda's insurance sector is characterised by:

A framework designed for a UK bank or a Lloyd's syndicate will not fit a Bermuda Class 3A carrier without significant adaptation.

The March 2028 deadline creates a false sense of comfort. Eighteen months sounds like time. It is not — not when the starting point is a gap analysis that many carriers haven't yet conducted. Artex's recent article on the eight governance questions every Bermuda insurer should be asking in 2026 provides a useful starting framework for boards. But the gap analysis needs to go deeper than governance questions — it needs to assess operational capability against each of the seven lifecycle steps.

Three actions that should begin before the end of this quarter:

Regulatory compliance is often described as a cost. Operational resilience is different.

For boards, the OpRes Code creates a structured framework for a conversation many have been avoiding: do we actually understand how our business operates, where it is vulnerable, and what happens when something goes wrong? That conversation has value far beyond a regulatory filing.

The carriers that treat March 2028 as a deadline will comply. The carriers that treat it as an opportunity will emerge as better businesses. As the BMA's own 2025 Cyber Risk Report demonstrated — and as the Authority's 2026 business plan reinforces through its continued investment in supervisory technology and RegTech — the direction of travel is toward continuous, data-enabled oversight.