Retail Online & Mobile Banking — impact tolerance ≤ 4 hours — ITOL

Impact tolerance: ≤ 4 hours — during peak hours (7am–10pm local) with > 25% of active-session users affected (illustrative default — trace the derivation, then replace with your own harm analysis)

Definition: Digital channels for retail customers to view balances, transaction history, transfer funds, deposit checks by mobile capture, and manage account settings. Consumer mobile remote-deposit capture (RDC) rides this channel — it is the check-deposit fallback when branches close.

Why it is designated: This is the bank's primary customer-service channel. The UK Prudential Regulation Authority's SS1/21 requires firms to set a time-based impact tolerance for services like this at the point where further disruption would threaten safety and soundness. Extended outages drive complaint spikes, deposit outflow risk, and regulatory attention.