A new standardised process begins on 18 March 2027
The FCA finalised its operational incident and third-party reporting policy on 18 March 2026 through PS26/2, with implementation beginning 18 March 2027. Under the new operational incident regime, a wider group of regulated firms will assess incidents against defined thresholds and submit standardised information. This population is broader than firms subject to the operational resilience rules in SYSC 15A.
The policy is a reporting change, not a reason to postpone existing requirements. Firms must continue to comply with relevant current duties under Principle 11, SUP 15 and any sector-specific incident requirements until the new regime takes effect.
Which organisations are in scope?
The FCA lists firms with a Part 4A permission, payment service providers, UK recognised investment exchanges, registered trade repositories and registered credit rating agencies. PRA- and Bank of England-regulated populations also have relevant rules. The applicable reporting pathway and detail differ by firm category; most FCA solo-regulated firms use a standard report and a smaller population uses enhanced reporting.
This is not interchangeable with the material third-party register requirement, which applies to a narrower defined set of firms.
Which incidents matter?
The FCA’s three threshold themes concern intolerable consumer harm that is not easily recoverable; risks to safety and soundness of firms or other market participants; and risks to market stability, integrity or confidence in the UK financial system. An incident can originate from cyber attack, failed system change or a third-party outage. The firm’s processes must establish whether a threshold is met using facts available at the relevant time, with the appropriate review and escalation mechanism.
How to prepare an incident reporting workflow
- Identify which regulated entities and activities the final rules cover.
- Update severity decision trees so operations, technology, compliance and senior managers use common thresholds.
- Identify the data needed for the applicable standard or enhanced report, and who can validate it rapidly during an incident.
- Exercise escalation from initial alert through assessment, regulator submission and subsequent communications where required.
- Retain an auditable timeline of decisions, evidence, amendments and closure activities.
Do not design the process around an invented universal 24-hour deadline; reporting timelines and updates are defined by the final regime and firm category. Consult PS26/2 and FG26/3 when setting the actual timers.
The opportunity for a resilience programme
A reporting exercise often exposes weak service maps, uncertain ownership or missing supplier data. Prepare the reporting controls alongside—not instead of—the existing resilience programme. A managed service can maintain the evidence owners, test the workflow and surface unresolved weaknesses before the first new reporting period.
Reporting readiness: controls to test before the go-live date
The rules’ existence does not resolve which entity must report or whether its incident meets the thresholds. Before configuring technology or buying a reporting tool, document the in-scope legal entity, responsible senior manager, incident detection routes, approval sequence, data sources and regulator reporting method.
A dry run might simulate a supplier disruption first noticed by a customer-support team. Ask whether compliance is told promptly, whether the right threshold is applied, whether the report captures reliable initial facts instead of guesses, and how later corrections would be approved. Do not confuse a technically completed reporting form with incident resolution or demonstrated resilience.
The FCA says most solo-regulated firms will make a standard report, with an enhanced process for a smaller group. A decision matrix should therefore distinguish incident classification from reporting detail and subsequent update duties. PS26/2 and FG26/3 remain the controlling source; avoid applying a universal ‘24-hour rule’ without checking the specific category and timeline.
Practical template to use with your team
- Download the 2027 reporting readiness checklist — adapt, verify and approve before operational use.
Frequently asked questions
Does PS26/2 replace all existing reporting duties immediately?
No. The new regime starts on 18 March 2027; existing notification obligations remain relevant in the meantime.
Will every firm file the same incident report?
No. The policy distinguishes standard and enhanced reporting populations and applicable obligations.
Does every IT outage have to be reported?
No. Firms assess the relevant thresholds and their existing obligations against the actual facts of the incident.