Field Notes · Financial Services

Is resilience regulation rising? A financial-services read

Operational resilience began as a financial-services regulatory discipline. This note reads the US federal rulemaking curve, 2000–2026, as the macro backdrop — and asks what it signals for the banks, insurers, and fintechs that have to absorb it.

By Olivier Lachaud WSquare Advisory Data · Federal Register API

Operational resilience — continuity, recovery, and third-party / ICT risk — is, at its core, the language of financial-services regulation: DORA in the EU, the PRA and FCA in the UK, NYDFS in New York, OSFI in Canada, and FFIEC and Federal Reserve guidance in the US. To gauge how fast that idea is spreading, this note uses the full US Federal Register as a macro barometer. One caveat up front: the series below is economy-wide federal rulemaking, not a financial-services-only cut — so read it as the direction and intensity of the trend, with the sector-specific regimes above stacking on top.

Answer: yes, but read it as intensity, not a clean ramp. The absolute count of final rules touching resilience is lumpy, but resilience's share of all federal rulemaking roughly doubled — ~1% in the 2000s to ~2–2.4% in 2019–2023, peaking at 3.85% in 2024 — even as total rule output fell (~4,500/yr → ~3,000/yr). The term "operational resilience" barely existed before 2012 and rose to a 2024 peak (69 rules), which is the clearest sign of a genuinely new and growing regulatory concept. 2024 is the high-water mark across every measure.

Annual final rules mentioning resilience terms

All federal agencies, all sectors. Bars = rule counts (left axis). Amber line = "business continuity" as a share of all final rules (right axis) — controls for total rulemaking volume.

Cumulative since 2000 — the literal "in force over time"

Cumulative count of final rules issued since 2000.

Read these caveats before using this.

Federal and all-sector. Federal Register = US federal rules across every sector — not a financial-services-only cut. The regimes that bind financial firms most directly — State (NYDFS), EU (DORA), UK (PRA/FCA), Canada (OSFI) — are not in this series and are themselves a large share of resilience pressure.
Keyword match, not subject. Counts are final rules whose full text mentions the phrase — some merely reference it in passing, so absolute levels are overstated. The methodology is identical every year, so the trend and share are meaningful even if the absolute count is noisy.
Cumulative overstates "in force." The cumulative curve sums rules issued and ignores repeals, sunsets, and superseding rules, so it rises mechanically. Treat it as "accumulated rulemaking," not a precise count of rules currently in effect. The annual and share views are the honest signal.
2026 is a partial year (marked * / faded) — through mid-2026 only; do not read its drop as a decline.

Data

Year	Business continuity	Disaster recovery	Operational resilience	All final rules	BC share
2000	55	33	0	4491	1.22%
2001	37	37	4	4136	0.89%
2002	35	25	2	4173	0.84%
2003	48	32	0	4285	1.12%
2004	48	20	1	4176	1.15%
2005	39	37	3	3978	0.98%
2006	47	53	3	3730	1.26%
2007	43	52	4	3590	1.20%
2008	63	41	2	3819	1.65%
2009	47	40	3	3468	1.36%
2010	53	48	3	3564	1.49%
2011	50	49	9	3805	1.31%
2012	61	46	17	3708	1.65%
2013	68	50	15	3658	1.86%
2014	58	51	12	3543	1.64%
2015	60	42	15	3408	1.76%
2016	93	71	29	3854	2.41%
2017	43	28	11	3281	1.31%
2018	29	31	12	3368	0.86%
2019	59	37	12	2964	1.99%
2020	96	70	28	3352	2.86%
2021	61	53	22	3257	1.87%
2022	55	38	21	3168	1.74%
2023	72	65	31	3018	2.39%
2024	125	121	69	3248	3.85%
2025	47	28	29	2441	1.93%
2026 *	28	14	13	1366	2.05%

* 2026 partial (year in progress).

Is resilience regulation rising? A financial-services read

Annual final rules mentioning resilience terms

Cumulative since 2000 — the literal "in force over time"

Data

Resilience is becoming a standing operating requirement

Facing a resilience or operating-model build?