Bank of England cyber and operational resilience stress tests

The Bank of England uses hypothetical disruption exercises to examine how financial services respond and recover. CORST26 explores cloud-provider and third-party disruption; the scenario is a test, not a forecast of a banking collapse.

Cyber and Operational Resilience Stress Tests examine how disruption could affect financial services and the wider system. The Bank of England uses them to explore vulnerabilities, responses, recovery and the ways organisations may need to work together.

CORST26 began in April 2026 with a scenario involving a cloud service provider and other third parties. The Bank’s published timetable says it runs through 2026, with thematic findings due in summer 2027. That is the timetable recorded in November 2026, not a claim that results have already been published.

The exercise helps distinguish the availability of a service from the money recorded in an account. A payment can be delayed by operational problems without a thief emptying the account. Testing that possibility is preparation for disruption, not evidence that a particular failure is imminent.