SIMEX26: the cloud outage drill that redraws board-level resilience duties

The Cross-Market Operational Resilience Group completed SIMEX26 on 8 October 2026, a biennial exercise built this year around a global cloud services disruption, with the 38 largest and most systemically important banks and market infrastructure operators in the room (Bank of England). The signal to senior leaders is unambiguous: the Bank now expects firms to take action off the back of the exercise to strengthen resilience against severe operational and cyber scenarios (Bank of England).

Key Executive Takeaways

• The UK's financial authorities have stress-tested a global cloud outage with the 38 largest banks and market infrastructure firms, and expect boards to act on the lessons.
• Cloud concentration is now treated as a systemic financial stability issue, not a procurement or IT matter, with Treasury, the FCA and the Bank jointly engaged.
• Senior managers should assume supervisory scrutiny of third-party resilience plans will intensify over the coming cycle, with evidence of post-exercise action expected.

From tabletop to supervisory expectation

Previous SIMEX rounds in 2022 and 2024 rehearsed cyber-attacks against a major bank and critical infrastructure disruption outside the sector (Bank of England). Pivoting the 2026 scenario to cloud services is pointed. It aligns with the Financial Policy Committee's September record, which placed interconnected technology risks firmly on the stability agenda, and it tells boards that reliance on a small number of hyperscale providers is no longer a theoretical worry. Katharine Braddick, Deputy Governor of Prudential Regulation and PRA CEO, framed preparedness as "essential to safeguarding financial stability" (Bank of England). That language matters: financial stability framings tend to precede firmer rules, not softer ones.

Governance implications for boards

The participation list makes clear who owns the response. CMORG is chaired jointly by the Bank and UK Finance, with HM Treasury and the FCA at the table, and the exercise was opened by the Economic Secretary to the Treasury and hosted by the London Stock Exchange Group (Bank of England). Boards should expect their next supervisory conversations to probe three things: whether exit and substitution plans for cloud providers are credible under a severe scenario, whether critical third-party dependencies have been mapped to important business services, and whether the firm's crisis governance mirrors the Cross Market Business Continuity Group's model of strategic coordination. David Postings of UK Finance tied the exercise directly to "confidence, stability, and growth" (Bank of England), framing resilience as a competitive, not just defensive, attribute.

The accountability question

For Senior Managers, the exercise effectively creates an evidentiary baseline. If a cloud-driven disruption occurs in the next supervisory cycle, firms that participated and failed to act on the lessons will have a thin defence. Expect internal audit and the second line to be asked for structured post-SIMEX remediation plans, with dated commitments. Risk committees should press for a candid read-out of where the firm's playbooks held and where they broke, not a sanitised summary. The exercise also tested the authorities' own coordination, which means supervisory tolerance for firms that treat cloud resilience as a vendor management problem is likely to narrow.

The cloud question has moved from procurement to prudential. Boards that treat SIMEX26 as a compliance footnote will find themselves out of step with where the Bank, Treasury and FCA have now anchored the debate.