FCA operational resilience incident reporting: ready by March 2027

FCA operational resilience incident reporting changes on 18 March 2027, when Policy Statement PS26/2 comes into force: from that date a firm must report an operational incident that crosses one of the regulators' thresholds through a single form shared by the FCA, the PRA and the Bank of England, submitting the initial report as soon as practicable and, the regulators expect, within 24 hours of deciding a threshold is met. The same policy brings a second duty for banks and other larger firms: notifying the regulators of new or significantly changed material third-party arrangements, and submitting a register of them every year. Until then, firms report material incidents under Principle 11. For a bank already working to SYSC 15A, the new rules ask for facts it should have to hand during an incident: which important business services are affected, how many customers, since when, and which suppliers are involved. Botminds' Operational Resilience Management is an agentic solution that keeps those facts current, linking live incidents to the services they hit and holding the supplier map the register is built from, while people decide what to report.

The rules and dates are the FCA's and PRA's, quoted and linked. Product examples come from the solution's fictional sample bank, Corvane Bank UK.

What are the new FCA incident reporting rules?

They are a single regime for reporting serious operational incidents to the FCA, PRA and Bank of England, through one form on the FCA's Connect system, replacing the patchwork of notifications that applied before. The FCA's summary: the final rules "Define what an operational incident is", "Set out the thresholds for when firms must report an incident", "Introduce a standardised reporting process so all firms make a single submission regardless of the regulator(s) the report is for" and "Set out how firms will submit standard or enhanced incident reports" (FCA, PS26/2).

Two tiers of reporting apply. "Most FCA solo-regulated firms will submit a short 'standard' report", while "A smaller subset of 'enhanced' reporting firms will need to give more information if there are significant changes to the status of an incident and to finalise their report after the incident is resolved" (FCA, reporting operational incidents). The policy statement puts standard reporting at "c. 90% of FCA regulated firms". Enhanced reporters follow three phases, initial, intermediate and final, on one form, with the final update "within 30 working days of the incident being resolved" and never more than 60 (PS26/2). The form also absorbs the separate incident reporting that payment service providers made under the Payment Services Regulations.

When do the FCA incident reporting rules apply?

From 18 March 2027. The FCA published the final rules on 18 March 2026 and gave firms 12 months: "Firms have 12 months to prepare ahead of the new requirements coming into force on 18 March 2027" (FCA, operational resilience). Until then, the FCA's page says firms "should follow this process for reporting incidents until new rules are introduced in March 2027": consider whether an incident is material, and if it is, tell the named supervisor or use the SUP 15 notification form, informing the PRA as well if dual-regulated.

Scope differs between the two halves. Incident reporting covers all firms with a Part 4A permission, payment service providers, recognised investment exchanges, trade repositories and credit rating agencies. Third-party reporting covers a narrower list that includes banks, building societies, designated investment firms, enhanced scope SMCR firms and Solvency II firms (PS26/2).

What counts as an operational incident?

An operational incident is a disruption that reaches someone outside the firm or their data. The FCA and PRA now share one definition: "either a single event or a series of linked events which disrupts the firm's operations such that it: 1. disrupts the delivery of a service to an end user external to the firm; or 2. impacts the availability, authenticity, integrity or confidentiality of information or data relating or belonging to such an end user" (PS26/2, chapter 2).

Only incidents that also cross a threshold must be reported. From 2027 the thresholds are risks "Of causing intolerable levels of harm to consumers from which consumers cannot easily recover", "To the safety and soundness of the firm and/or other market participants" and "To market stability, market integrity or confidence in the UK financial system" (FCA). The rules are explicit about what is out: "Firms do not have to report near-misses", and a planned, controlled interruption such as a routine update is not an incident unless it goes wrong. The FCA's finalised guidance gives a "series of linked events" example that a bank will recognise: a cloud provider's data centre fails, the bank's payments platform hosted there goes offline, and "The bank is unable to fail over to another vendor" (FCA, FG26/3).

How fast must operational incidents be reported?

The initial report is due as soon as practicable, and at the most within 24 hours of the firm determining that the incident meets a threshold. "We expect this to be, at the very most, within 24 hours of determining that it meets 1 or more of our thresholds," the FCA says, and payment service providers keep their tighter rule: "PSPs must continue to report within 4 hours of first detecting an incident" (PS26/2).

The clock starts at the determination, not at the first alert, which puts weight on how quickly a firm can decide. The PRA's version adds a realistic caveat: a firm "may take longer than 24 hours to submit a report" where an incident "requires all the firm's resources to address the incident" (PRA, PS7/26). The regulators want the early facts, not a complete picture; the FCA says the initial phase asks for information "firms would reasonably be expected to know at the early stages of an incident". Its experience of the July 2024 software outage explains why: "The timing and completeness of incident notifications to us varied extensively across affected firms" (FCA, October 2024).

Does the PRA have the same incident reporting rules?

Yes, in a single regime with the FCA and the Bank of England. The PRA published its own policy statement, PS7/26, on the same day, with implementation on 18 March 2027 and thresholds tied to its own objectives (PRA, PS7/26). A dual-regulated bank makes one submission, which reaches both regulators: "If a dual regulated firm needs to report an incident to both regulators, it will only need to make one submission" (PS26/2). The PRA's and FCA's timelines for the initial report are aligned at 24 hours.

What is a material third party arrangement?

It is a supplier arrangement so important that its failure could cause serious harm. Under the new rules, an arrangement is material where "its disruption or failure could: Cause intolerable levels of harm to the firm's clients", "Pose a risk to the soundness, stability, resilience, confidence or integrity of the UK financial system" or "Cast serious doubt on the firm's ability to satisfy the threshold conditions, or meet its obligations under the Principles, or under SYSC 15A (Operational resilience)" (FCA, reporting material third party arrangements). It covers outsourcing and non-outsourcing alike.

From 18 March 2027, firms in scope must tell the regulators when "entering into a material third party arrangement, or significantly changing an existing one", and submit a register of material arrangements once a year; the FCA expects the first window to open at the end of the implementation period, with "90 calendar days to submit the register". Timing is "at an early stage", before "making any internal or external commitments", and the FCA is clear that "The notification process is not, however, an approval mechanism" (PS26/2). The data will also feed the regulators' search for potential critical third parties.

A supplier view built to become the 2027 register

How do incident reporting rules affect the self assessment?

They make the self-assessment's evidence public to the regulators in near real time. Every reportable incident is a real disruption to an important business service, and SYSC 15A already requires a lessons learned exercise "in the event of an operational disruption" and improvements afterwards (SYSC 15A.5.8R–5.9R); from 2027 the regulators will see the incident before they read the lessons. A self-assessment that claims a service recovers within tolerance, beside an incident report showing it did not, is the inconsistency to avoid.

The third-party register has the same effect on maps. A supplier the bank reports as material in its register should appear in the maps of the services it supports, with its hosting, its subcontractors and its exit plan. In the sample bank, the Incident watch agent links each live incident to the services it hits and starts the disruption clock, and the Impact agent's counts of customers and payments are the numbers a report's harm questions need; the decision that a threshold is met, and the report, stay with people.

The harm counts a report's first questions need, ready before the incident

How do US incident notification rules compare?

The US rule is narrower and faster in a different way: it covers computer-security incidents, and the notice is due within 36 hours. Under the OCC's rule, a bank must notify its supervisor of a "notification incident" and "The OCC must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred" (12 CFR 53.3).

US operational resilience guidance is otherwise aimed at the largest banks. The interagency sound practices in SR 20-24 apply to firms with $250 billion or more in assets, or $100 billion with $75 billion in certain activity, and "are directed to the largest and most complex domestic firms" (Federal Reserve SR 20-24, revised June 2, 2026). The Federal Reserve says that "From mid-2025 through 2026" it "has prioritized reviews of liquidity, capital, and operational and cyber resilience" (Supervision and Regulation Report, June 2026). A UK bank with a US parent may answer to both clocks for the same event.

A readiness plan for the last 142 days

A firm that has read PS26/2 but not rehearsed it is not ready. The useful test is to take a real incident from the past year and fill in the template for it, timed, with the people who would do it on the day. The checklist is what that rehearsal should prove.

To keep the facts a report needs current, service by service, start from Operational Resilience Management; the customer counts it uses are explained in what customers lose in an outage.

Questions people ask

What is PS26/2?

PS26/2 is the FCA's policy statement on operational incident and third-party reporting, published on 18 March 2026 with finalised guidance FG26/3 (incidents) and FG26/4 (material third parties). It follows consultation CP24/28 and applies from 18 March 2027; the PRA's equivalent is PS7/26.

Do near misses have to be reported under the new rules?

No. The policy statement says "Firms do not have to report near-misses", and the rules apply to incidents that have crystallised and meet a threshold. Near misses still belong in a bank's own lessons learned and scenario design.

How do I report an operational incident to the FCA today?

Until 18 March 2027, if an incident is material, contact your named FCA supervisor or use the SUP 15 firm notification form, and inform the PRA if dual-regulated. The FCA's indicators include material disruption to services, a large number of customers affected, unauthorised access and significant data loss.

Does a data breach need reporting to the ICO as well?

Often, yes. The FCA's page reminds firms that a personal data breach may need reporting to the Information Commissioner's Office, which requires notice "within 72 hours of becoming aware of the breach, where feasible", separately from any FCA report.

Will the FCA publish incident data?

The FCA says the reports will help it understand incidents across the sector and identify shared third-party risks, and the PRA plans to share anonymised, aggregated findings on industry trends where appropriate. Individual reports are supervisory information.

When will the FCA review the incident reporting rules?

Two years after implementation, so from March 2029. The FCA says it will assess whether the policies meet both its needs and those of firms.