UK regulators final policy on operational incident and third-party reporting

The UK Financial Conduct Authority (FCA), the UK Prudential Regulation Authority (PRA) and the Bank of England (BoE) have published final policy statements setting out a co‑ordinated framework for operational incident and third‑party reporting. This follows consultations published in 2024.

The regulators are collectively replacing sector‑specific incident reporting regimes with a single, unified operational incident reporting framework. Under this, firms will make one reporting submission through FCA Connect, regardless of the regulators involved. Payment service providers (PSPs) will also now report serious operational incidents only through the new consolidated regime. Changes to the reporting process for PSPs are reflected in amendments to the Payment Services and Electronic Money Approach Document. The rules will apply from 18 March 2027.

In PS26/2, the FCA finalised its new rules and guidance on operational incident reporting and material third‑party reporting. The final rules provide a definition for an "operational incident", set out the thresholds for when firms must report an incident and set out how firms should submit standard or enhanced incident reports. The final rules on third party reporting provide a definition for a "material third party arrangement", require firms to notify regulators of any new, or any significant changes to material third party arrangements and require firms to maintain a register for their material third party arrangements and to submit it to the FCA annually.

Alongside this, the PRA published final policy statement PS7/26, aligning closely with the FCA's approach. The regime also extends to UK credit unions with at least GBP50 million in total assets, although credit unions below this threshold and all third-country branches are excluded from the material third party notification requirements.

The BoE also published a policy statement setting out its approach to operational incident and outsourcing and third‑party reporting for financial market infrastructures (FMIs). It also includes a consultation with proposals to revoke Rule 4 of the Recognised Clearing House Rules Instrument 2018 for central counterparties, which duplicates the effect of the incident reporting rules. The deadline for responses is 18 June.

Return to main website.