Why we assembled this resource
The same financial firm may have existing operational resilience obligations, new incident reporting duties commencing in March 2027 and a different, narrower test for material third-party arrangement reporting. Another FCA-authorised firm may be outside SYSC 15A yet still need to prepare for incident reporting. Treating every regulator publication as a single universal checklist creates both irrelevant work and missed obligations.
This tracker compares who might be covered, when a change applies, which records may be useful, and who could own them. It does not determine a firm’s legal position: regulatory permissions, prudential designation, activity, domicile and exemptions require review against the controlling texts.
Three important distinctions
Established resilience duties versus new reporting requirements. The FCA’s 31 March 2025 transition deadline is in the past. The 27 March 2026 good-and-poor-practice observations are not six new statutory rules. PS26/2 reporting starts on 18 March 2027.
Incident reporting versus material third-party registers. All Part 4A permission firms and payment service providers appear among the FCA’s incident-reporting categories. Its new material third-party reporting category is narrower and includes particular named classes such as authorised payment and e-money institutions. A generic “FCA regulated” field is insufficient to decide both.
UK versus EU rules. EU DORA may be relevant where an EU entity or an ICT service relationship is in scope. DORA does not automatically apply to every UK FCA-authorised entity, and its ICT register is not the same regulatory record as the FCA’s 2027 material-arrangements register.
Method and limitations
Version 1.0 · sources checked 12 October 2026. The input records are the FCA Handbook and relevant FCA publications, PRA/Bank of England supervisory guidance, the EU regulation on EUR-Lex and the ISO standard landing page. We extracted published milestones and broad applicability descriptions and reorganised the evidence implications into a consistent working matrix. It is an original curated comparison, not a proprietary market survey, regulator-provided decision tree, individual legal opinion or report of delivered customer outcomes.
Only core instruments and guidance needed to distinguish UK operational resilience, 2027 incident and third-party reporting, EU DORA and continuity standards are included. We deliberately exclude company-specific exceptions, unconfirmed permissions, regional requirements outside scope and licensed clauses from ISO 22301. Each record links directly to the authority responsible for the primary publication. The matrix is dated so later revisions can be versioned and checked.
How to turn this into an internal action register
Start with the exact regulated legal entity, not its marketing name. For each potentially relevant obligation, document the permissions/scoping conclusion, controlling passage, evidence currently held, remaining gaps, accountable owner and review date. Apply the actual final regulatory texts before reporting deadlines or materiality decisions. Do not treat a spreadsheet as automatic evidence of compliance.
The CSV is available without registering or sharing confidential records. To see what an evidence trail could look like in practice, examine our fully worked fictional payments outage scenario.
Reference library
- FCA, SYSC 15A
- FCA, 27 March 2026 operational resilience observations
- FCA, PS26/2 and FG26/3/FG26/4
- PRA, SS1/21 current supervisory statement
- EUR-Lex, Regulation (EU) 2022/2554
- ISO 22301:2019
Editorial status: independent source synthesis awaiting approval by an appropriately qualified regulatory practitioner before public indexing.
Find obligations, source documents and suggested evidence
Review prompts, not legal determinations. Exact firm permissions, jurisdiction, exemptions and implementation status require qualified professional verification.
9 source records shown
| Instrument | Indicative scope | Evidence or action | Primary reference |
|---|---|---|---|
| SYSC 15A FCA · In force 31 Mar 2025 transition ended | Defined UK financial-services populations Includes enhanced-scope SMCR firms, payment/e-money institutions, registered AISPs and exchanges subject to application provisions | Service inventory, harm-based impact tolerances, dependency mapping, scenario-test evidence, self-assessment Suggested owner: Board and service owners The transition date is not a new deadline. | Official source ↗ |
| SS1/21, current March 2022 version PRA · In force 31 Mar 2022 | PRA-regulated banks/insurers UK banks, building societies, PRA-designated investment firms, Solvency II firms, Lloyd's and its managing agents, as relevant | Important services, impact tolerances, severe scenarios, supervisory self-assessment Suggested owner: Board and operational risk Check the current statement, not its superseded 2021 PDF. | Official source ↗ |
| Operational resilience observations FCA · Supervisory observations 27 Mar 2026 | Relevant in-scope firms Examples from annual self-assessments; observations do not introduce universal new obligations | Review mapping beyond technology, harm metrics, scenario severity, vulnerabilities, communications and governance Suggested owner: Service owners and risk Good and poor practice, not six new statutory rules. | Official source ↗ |
| PS26/2 operational incident reporting FCA/PRA/BoE · Future effective 18 Mar 2027 | Broad incident-reporting population Includes Part 4A permission firms, payment service providers, UK RIEs, registered trade repositories and credit-rating agencies; jurisdiction matters | Threshold decision tree, report owners, incident escalation and dry-run evidence Suggested owner: Compliance and incident response Review standard versus enhanced reports and firm-specific timing. | Official source ↗ |
| FG26/3 operational incident guidance FCA/PRA/BoE · Published guidance 18 Mar 2026 | Incident-reporting firms Guidance accompanying the new incident-reporting regime | Scenario threshold examples, escalation and reporting workflow Suggested owner: Compliance and incident response Published guidance is linked from PS26/2. | Official source ↗ |
| PS26/2 material third-party reporting FCA/PRA/BoE · Future effective 18 Mar 2027 | Narrower third-party-reporting population Includes enhanced-scope firms, banks, Solvency II firms, CASS large firms, RIEs, authorised payment/e-money institutions, and consolidated tape providers | Materiality register, new/significant-change notifications, annual register Suggested owner: Procurement and compliance Do not apply the broad incident-reporting population to this narrower duty. | Official source ↗ |
| FG26/4 material third-party guidance FCA/PRA/BoE · Published guidance 18 Mar 2026 | Third-party-reporting firms Guidance accompanying new material-arrangement notification and annual registers | Field dictionary, materiality decisions and supplier data validation Suggested owner: Outsourcing and compliance Use official PS26/2 reporting templates as applicable. | Official source ↗ |
| DORA, Regulation (EU) 2022/2554 EU · In force 17 Jan 2025 | EU in-scope financial entities Separate EU legal entities and ICT provider obligations may be relevant; UK FCA authorisation alone is not determinative | EU entity applicability, ICT risk controls and third-party register where relevant Suggested owner: EU legal and risk DORA and FCA third-party registers are distinct. | Official source ↗ |
| ISO 22301:2019 and 2024 amendment ISO · Voluntary standard 2019 and 2024 | BCMS programmes BCMS requirements standard, not a general FCA certification mandate | BCMS scope, BIA, exercise plan, management review and improvement register Suggested owner: Continuity lead Standard text is licensed and not replicated here. | Official source ↗ |
Download complete CSV ↧ · Last source check: 12 October 2026