What is SIMEX26, and what can smaller firms learn from it?

16 October 2026

What would happen if one of the major technology providers your business relies on suddenly became unavailable? For many financial services firms, the answer isn't straightforward. Email, cloud platforms, specialist applications and client-facing services may all depend on technology supplied by a relatively small number of providers. That's why the Bank of England's SIMEX26 exercise is worth understanding, even if your firm wasn't involved.

What is SIMEX26?

SIMEX is a biennial, market-wide simulation exercise coordinated through the Cross Market Operational Resilience Group (CMORG), bringing together major financial institutions and public authorities to rehearse responses to severe disruption.

The 2026 exercise took place on 8 October and focused on a global disruption to cloud services. It involved 38 of the largest and most systemically important banks and market infrastructure operators, working through how the financial sector would respond to a major outage.

The aim wasn't simply to test individual firms. It was to explore how organisations and authorities would coordinate their response to a disruption that could affect the wider financial system.

The Bank of England has said the exercise should help firms strengthen their resilience and response to severe operational and cyber scenarios.

Why should smaller firms pay attention?

Your business may not be large enough to participate in a sector-wide exercise, but you could still rely on the same types of technology providers.

Think about the systems your team needs to operate each day. If your main cloud platform became unavailable, would you know which services would be affected first? Could staff access the information needed to continue working? How would you communicate with clients if your usual channels were unavailable?

These aren't questions that only matter to large banks.

For smaller financial services firms, the challenge is often understanding how much of the business depends on the same provider, and what alternatives are realistically available if that provider fails.

Start with one realistic scenario

You don't need a large simulation exercise to find gaps in your own arrangements.

Set aside an hour with the people responsible for IT, operations and client communications. Work through this scenario:

Your main cloud services provider is unavailable for six hours. What happens next?

Talk through the following questions:

• Impact: Which systems and business services stop working? What can continue?

• People: Who coordinates the response, and who makes decisions if the usual contact is unavailable?

• Clients: Who needs to be informed, by whom and through which alternative channels?

• Workarounds: Can staff continue essential tasks safely, or does the business need to pause certain activities?

• Recovery: What needs to be restored first, and who confirms that services are working again?

• Dependencies: Does your fallback plan rely on another system or provider that could be affected by the same outage?

Don't worry about having a perfect answer to every question. The purpose is to identify assumptions, agree responsibilities and work out what needs to change.

Record the gaps you uncover, assign owners and set deadlines for resolving them.

What about regulatory requirements?

Operational resilience requirements depend on the type of firm and the services it provides.

For firms subject to the FCA's operational resilience rules, the focus includes identifying important business services, understanding the resources and dependencies supporting them, and testing the ability to remain within impact tolerances during severe but plausible disruption.

The PRA has separate requirements and expectations for firms within its remit.

There are also new operational incident reporting requirements scheduled to take effect on 18 March 2027 for specified firms. Applicability depends on the relevant regulatory rules, so firms should check the requirements that apply to them rather than assume they are all the same.

Even where a particular exercise or reporting rule doesn't apply to your business, understanding your dependencies and testing your response is still sensible risk management.

Maple's view

SIMEX26 is a reminder that operational resilience extends beyond your own systems. Your business also depends on suppliers, infrastructure and services that you don't directly control. You may not be able to prevent a major provider outage, but you can prepare for the impact. Start by identifying the services your business couldn't operate without, understanding what they depend on and agreeing what your team would do if one of those dependencies failed. A short, realistic exercise can reveal problems that a written plan won't.

Want to review your business's IT resilience?

Maple works with businesses that need dependable IT, clear processes and a practical approach to security and continuity. Email connect@mapletech.co.uk or call 020 3900 4300 to arrange a no-obligation conversation.

Sources

• Bank of England, SIMEX26: sector-wide cloud outage simulation exercise.

• Bank of England, Operational resilience of the financial sector.

• Bank of England, SS1/26: Operational resilience, incident reporting.