38 Firms Joined SIMEX26. Recovery Times Remain Undisclosed

The Bank of England's account of SIMEX26 says 38 large, systemically important banks and market infrastructure operators worked with the authorities on 8 October. It does not say how many services remained available in the scenario, how quickly any service recovered, or whether a cloud provider took part. Those omissions limit what the public can conclude about recovery capability.

SIMEX26 was the biennial exercise of the Cross-Market Operational Resilience Group, or CMORG. The Bank and UK Finance chair the group. Before the event, CMORG described simulated initial worldwide unavailability of a cloud provider's services, followed by recovery in some regions while some UK and western European services remained unavailable for three to five days or longer. That duration was a scenario assumption, not an observed recovery time. The exercise included a live meeting of the Bank-chaired Cross Market Business Continuity Group, which directs the sector's collective response to systemic incidents. The Bank expects firms to act on the exercise, but has published no participant-level results, pass rate or account of tested failover. The release does not disclose whether participants operated their own systems under simulated loss of cloud capacity or discussed decisions around a scenario.

That distinction matters because a coordinated response can help contain an incident even when underlying services cannot yet be restored. Regulators and firms need to decide who declares an incident, who communicates with customers and markets, and which services get priority. SIMEX26 appears designed to rehearse that collective machinery: the Bank's description of CMORG's Sector Response Framework calls it a key component of the exercise. Public evidence that the machinery was convened is useful, but it cannot quantify the continuity of a payment, trading or clearing service during a severe cloud outage.

The timing also invites a second, legally separate question. HM Treasury designated four cloud businesses as critical third parties from 13 July: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited. The Bank, Prudential Regulation Authority and Financial Conduct Authority now jointly oversee the resilience of the systemic services these legal entities supply to UK financial firms. The regulators' July announcement says oversight began on 13 July. It does not say any of the four joined SIMEX26. The Bank's October release names none of them as a participant.

Under the final critical-third-party policy, each designated provider must scenario-test its ability to continue providing each systemic third-party service within its appropriate maximum tolerable level of disruption under a severe but plausible event. Paragraph 2.156 says these tests should occur at least annually. A different requirement asks the provider to run an incident-management playbook exercise with a representative sample of its financial-firm customers. That exercise examines how effectively the provider communicates with and supports them during a simulated operational incident. Paragraph 2.167 requires the first within twelve months of designation and further exercises at least every two years. Firm participation is not mandatory under the final policy, although providers should open the exercise to all customers receiving systemic services.

SIMEX26 is CMORG's sector exercise. The public releases provide no basis to count it as any provider's annual scenario test or customer playbook exercise. Nor does the October announcement establish that any provider has missed a rule. The policy's interim self-assessment provisions require an initial diagnostic submission to regulators within three months of designation. The regulators expressly removed a requirement to share that interim assessment with customer firms. Later annual self-assessments must be shared with those receiving systemic services, subject to appropriate redactions. The exercise release and July designation announcement do not report whether an interim assessment was submitted or accepted. Those documents therefore establish neither compliance nor a breach.

For a bank, direct supervision of a cloud supplier does not transfer responsibility for its own services. The PRA's outsourcing statement expects a firm with a material outsourcing arrangement to maintain and test business-continuity and exit plans, including a stressed exit. For material cloud outsourcing, the firm should assess the resilience needed for its service and data, then choose suitable options such as multiple regions, a backup vendor, hybrid capacity or a route back on premises. The regulator does not prescribe one universal design. The FCA's operational-resilience guidance likewise requires firms in scope to identify important business services, set maximum tolerable disruption, map dependencies, test severe scenarios and maintain communications plans. Its guidance says third-party failure within a service remains the firm's responsibility.

A clearing house provides a sharper practical test. Under the Bank's currently effective statement for central counterparties, a CCP's business-continuity plan should enable it to resume operations within two hours after an outage and complete settlement by the end of the day even in extreme circumstances. For critical cloud outsourcing, the CCP is expected to assess recovery time and recovery point objectives, choose a suitable resilience design, maintain crisis communications and document a stressed exit. These are expectations for the clearing house's service, not a claimed SIMEX26 result or a blanket recovery guarantee from a provider. A cloud scenario only tests this obligation meaningfully for a particular CCP if it can show what happened to the clearing service against its own tolerance.

That leaves a specific evidence request for each bank or market operator after the drill: which important services depended on which cloud components and subcontractors; what maximum disruption and data-loss thresholds applied; whether fallback or restoration was actually exercised; when the provider, authorities and affected customers would be told; and who owns each fix, with a completion date. The FCA's 2026 review of firms' self-assessments identifies weak evidence of sufficiently severe testing, gaps in alternative communications, and remediation plans without clear owners or target dates. Those are sector-wide supervisory observations, not findings about SIMEX26 participants.

The Bank could narrow the public evidence gap by publishing an exercise method and an aggregate account of continuity against tolerances, communication delays, recovery choices and actions assigned, without exposing sensitive firm systems. Bank policymaker Liz Oakes said in May that a post-exercise report would summarise findings for industry. The related cloud-scenario CORST stress test is due to yield thematic findings in summer 2027. Until then, the supported conclusion is that the sector practised a shared crisis response. Whether vital services could recover within their own limits remains undisclosed.