Sector Response Framework (SRF) Group Spotlight on the BOCC

What is the role of your group?

During a major disruption impacting multiple firms, the Business & Operational Continuity Committee (BOCC) is a forum for sharing trusted updates and providing a conduit for the flow of information to and from the UK financial authorities, including sharing sector-level updates and decisions from the Cross Market Business Continuity Group (CMBCG).

Where does your group sit within the Sector Response Framework?

The BOCC is one of three tactical-level Sector Response Groups coordinated by UK Finance, operating alongside the Incident Communications Group (ICG) and the Cash Policy Committee (CPC) as required. The BOCC also works closely with the Financial Sector Cyber Collaboration Centre (FSCCC) during events which are suspected, or known, to be cyber related. 

While convening the BOCC is not dependent on the invocation of another group in the Sector Response Framework (SRF), the BOCC will coordinate the timing of meetings with CMBCG and other Sector Response Groups to reduce overlapping meetings and to support efficient information sharing. 

The BOCC provides information to other Sector Response Groups through verbal updates and longer, written situation reports, to support a shared understanding of what is happening.

Who makes up the membership of your group?

The BOCC is open to all UK Finance members and is usually attended by teams responsible for managing operational risk and resilience, covering disciplines such as business continuity, incident management, crisis management, and operational resilience.

What triggers the invocation of your group?

The BOCC is not a scenario-specific group and can be triggered by any systemically disruptive operational incident at the initiative of the UK Finance Operational Resilience team. The initial assessment may be triggered by reports from UK Finance members or other Sector Response Groups. 

How does the group operate in practice?

The BOCC is chaired by a member of the UK Finance Operational Resilience team, following a structured agenda, and gathering updates from members by industry segment, to develop a consolidated view of how the sector has been impacted. 

A summary of key updates, agreed actions, and key decisions are captured during each meeting and shared with all BOCC members, and other Sector Response Groups, to inform their own incident management processes. 

Recent highlights, lessons learned and useful links

• In August 2025, the BOCC completed a mass notification test, with incident notifications successfully received by at least one individual at 98% of BOCC member organisations via at least one communication method.
• In September 2025, the BOCC participated in the CMORG technical exercise to rehearse its incident assessment, group invocation, and information sharing processes. Firms participating in the exercise reported that BOCC communications were clear, and that incident response protocols were clear to follow. Lessons learned to improve for future exercises were also captured. 
• The BOCC has hosted guest speakers from financial services and non-financial services organisations to share lessons learned from significant incidents and support continuous improvement.
• The BOCC held a working group on crisis information sharing to support the development of an Incident Severity Matrix to assist firms in notifying BOCC of an incident at a consistent threshold, and a BOCC incident notification template to encourage firms to share relevant information with the BOCC. 

What should firms or stakeholders know about engaging with your group? 

UK Finance members wishing to learn more about the BOCC contact: boccadministration@ukfinance.org.uk.