On October 8, 2026, thirty-eight of the largest banks and market infrastructure operators in the UK spent a day inside a failure none of them owned. The scenario for SIMEX26, the biennial sector exercise run by the Cross-Market Operational Resilience Group (CMORG), was a global disruption to cloud-based services — not a fire in one firm’s data center, not a breach at one bank, but the shared layer underneath all of them going down at once. The Bank of England published its account the next day. The exercise is finished. What it was rehearsing is the part of continuity that a single firm cannot practice alone.
CMORG is chaired by the Bank of England and UK Finance, with HM Treasury and the Financial Conduct Authority at the table alongside the firms. The day included a live meeting of the Cross Market Business Continuity Group — the Bank-chaired body that provides strategic direction to the sector’s collective response to systemic incidents. The Bank’s closing line was not a compliment; it was an assignment: it now expects firms to take action based on the exercise to strengthen their resilience against severe operational and cyber scenarios.
A failover test rehearses your systems. A sector exercise rehearses the space between them
Every firm in that room has run its own failover test. Those tests answer a bounded question: when our primary environment fails, do our services recover inside the tolerance we set? The question presumes the rest of the world is standing — the provider’s other regions, the market infrastructure down the street, the authorities, the payment rails. SIMEX removes the presumption. The failure sits outside every participant’s perimeter, in a dependency they all share, so the thing being tested is not any firm’s recovery. It is the coordination layer above recovery: who declares a systemic incident, who sets sector priorities when not everything can come back at once, and through what framework thirty-eight institutions and three authorities act as one response instead of thirty-eight separate ones.
That framework has a name in the UK system. CMORG oversees the sector’s approach to responding to systemic incidents through the Sector Response Framework, and the Bank describes the SRF as a key component exercised through SIMEX. A framework like that cannot be validated on paper, because its moving parts are decisions made by people in different organizations under time pressure. The live Cross Market Business Continuity Group sitting inside the exercise is the tell: the strategic-direction layer was not simulated by a control cell reading injects. It sat, with the authorities present, while the scenario ran.
Impact tolerance stops being your number when the dependency is shared
UK operational resilience rules require firms to identify their important business services and set an impact tolerance for each — the maximum tolerable disruption, after which harm becomes unacceptable. A firm sets that number against its own capabilities. A cloud outage at sector scale breaks the arithmetic twice over. First, the firm’s tolerance can be consumed entirely by a third party’s recovery timeline, over which it has no contractual control that matters on the day. Second, every other firm’s tolerance is being consumed simultaneously, so the queue for the finite resources of recovery — provider engineering attention, alternative capacity, market forbearance — is thirty-eight deep, and the order of that queue is a collective decision, not a term in anyone’s contract.
This is why the scenario choice matters. In 2022 and 2024, SIMEX considered cyber-attacks against a major bank and critical infrastructure disruption outside the financial sector. Both are severe; both still locate the failure somewhere — in one firm, or outside the sector looking in. The 2026 scenario locates it in the substrate the sector jointly rents. The Bank is explicit that the scenario was not drawn from any specific threat information; it was built with industry experts as the most instructive failure available, which is another way of saying the shared cloud is now the canonical systemic case.
Exit plans fail in formation
Third-party exit is the standard answer to concentration risk: if the provider fails, we leave. SIMEX26 exposes the formation problem. When one firm exits a failing cloud provider, it moves to alternative capacity. When thirty-eight systemic firms exit the same provider on the same morning, the alternative capacity is the scarcest asset in the market, and several of the realistic alternatives run on the same underlying infrastructure families as the thing being exited. CMORG’s recent programme of work — strengthening third-party engagement and resilience is listed first among its current priorities — is the authorities working the same seam from the other side: the exit has to be rehearsed at the level where the capacity actually exists, which is the sector, not the firm.
None of this argues against firm-level testing. It argues for knowing precisely which layer each test covers. A failover test proves a mechanism. It says nothing about the morning the mechanism’s assumptions — an intact market, a reachable authority, an uncontested alternative — are the casualties.
What to take from it, whatever your sector
The transferable lessons are structural, not financial. Test the dependency, not just your side of it: pick your most concentrated third party and run the scenario where it is down for everyone who uses it, including your competitors and your regulator. Rehearse the layer above your plan: the convening call, the shared picture, the decision about what the whole market restores first — if your industry has no equivalent of the Cross Market Business Continuity Group, that absence is itself a finding worth writing down. And treat the exercise the way the Bank framed this one: the scenario ending is the start of the work. “The Bank now expects firms to take action based on the exercise” is one sentence in a news release, and it is the entire doctrine — an exercise that produces no assigned, dated changes was a meeting with better costumes. The firm-level craft still matters — this desk’s guides to disaster recovery plan testing and HSEEP exercise design cover it — but SIMEX is the layer above that craft, the one most programs never rehearse at all.
Thirty-eight firms cannot make the cloud more reliable. What they rehearsed on October 8 is the thing they can control: whether, on the day the shared layer fails, they respond as a sector that has practiced together or as a crowd that happens to be down at the same time.
Our sister desk at Risk Coverage Hub reads the same exercise as an insurance problem — one cloud event, thousands of simultaneous claims, and what aggregation does to contingent business interruption.