Financial regulators are concerned that the ongoing digital transformation of the industry heightens operational risk, which is not well managed: This explains the recent emphasis by regulators and industry bodies on operational resilience. This paper builds on extant theoretical and empirical research in risk analysis and resilience to propose a normative theory of operational resilience. Adopting a ‘unified approach’, it presents a normative theory of resilience, expressed in an ontology of resilient activity systems and in three related auxiliary theoretical statements that elaborate the substantive dimensions viz. (1) Governance and structure of a complex adaptive organisation; (2) The integration of risk capabilities into operational activities; and (3) The role of knowledge in uncertainty reduction and creating resilient operational activities. The relevance of this study’s normative theory is that it helps practitioners implement the operational resilience principles articulated by regulators.