FCA Operational Incident Reporting: What Firms Need to Know.

The FCA’s 2027 reporting framework puts third-party dependencies and operational resilience under greater scrutiny.

PREPARING FOR THE FCA OPERATIONAL INCIDENT REPORTING FRAMEWORK

The FCA’s new operational incident and third-party reporting framework comes into force on 18 March 2027. There is a tendency to regard regulatory reporting as the slightly less glamorous end of operational resilience. Something goes wrong, someone fills in a form, Compliance sends it to the regulator, and everyone gets back to work. Job done.

Well, not anymore.

For firms, the challenge now is not simply understanding what needs to be reported. It is understanding the dependencies that could cause disruption in the first place, recognising when an incident crosses a regulatory threshold and being able to demonstrate that the right decisions were made when something goes wrong.

That matters because the difficult question is unlikely to be “can we complete the return?” It is more likely to be “do we actually know what happened, what caused it, who was affected, which third parties were involved and why we decided to report, or not report, it?”

For some firms, that may expose a rather larger gap between having an incident-reporting process and being able to operate it effectively.

THREE PAPERS, THREE QUESTIONS

In March 2026, the FCA published PS26/2, alongside FG26/3 on Operational Incident Reporting and FG26/4 on Material Third Party Reporting. Together, they establish a more consistent framework for reporting operational incidents and material third-party arrangements.

Currently, payment service providers (PSPs) are required to notify the Financial Conduct Authority (FCA) of certain major operational or security incidents under the Payment Services Regulations 2017 (PSRs), with the reporting approach based on guidelines developed by the European Banking Authority (EBA).

However, from 18 March 2027, the new framework will replace this approach with a single incident-reporting regime. For payment firms, the existing major incident reporting requirements will be subsumed into the new framework, while the underlying obligation to report and specific requirements, including reporting timelines, will remain.

The FCA’s objective is broader than improving the quality of individual incident reports. It wants better visibility of the dependencies underpinning financial services and the concentrations that could create wider resilience risks. In 2025, more than 40% of cyber incidents reported to the FCA involved a third party.

The three publications can be reduced to three questions:

What went wrong?
Who were we relying on when it happened?
When does the FCA need to know?

Those questions sound straightforward. In practice, answering them reliably during a live incident may be considerably harder than they appear.

WHAT IS CHANGING IN PRACTICE?

From 18 March 2027, firms within scope will operate under a standardised operational incident reporting framework.

An operational incident is broadly an event, or series of linked events, that disrupts a firm’s operations and affects the delivery of services to external end users or the availability, authenticity, integrity or confidentiality of information relating to them.

Not every operational problem will be reportable. The incident must meet one or more regulatory thresholds relating to:

intolerable levels of consumer harm;
the safety and soundness of the firm or other market participants; or
market stability, integrity or confidence in the UK financial system.

For payment firms, the existing PSP major incident reporting framework will be replaced by the new regime, with specific PSP provisions retained.

For many firms, however, the more immediate challenge may be the introduction of material third-party reporting, particularly where existing incident-reporting arrangements are not yet fully embedded. The new requirements do not simply ask whether firms can report an incident. They require them to understand the dependencies that sit behind their services and to identify which of those dependencies are sufficiently important to warrant regulatory reporting.

That is where this starts to move beyond a reporting exercise and into the firm’s underlying operational resilience framework.

FROM OUTSOURCING TO DEPENDENCY

The FCA is deliberately looking beyond traditional outsourcing arrangements. Firms will need to identify material third-party arrangements (MTPAs) and notify the FCA of new MTPAs and significant changes to existing arrangements. They will also need to maintain and submit an annual register.

The test for materiality of an arrangement is broadly the same as for a reportable incident. It is whether disruption or failure of the arrangement could, among other things:

cause intolerable levels of harm to clients;
threaten the soundness, stability, resilience, confidence or integrity of the UK financial system; or
cast serious doubt on the firm’s ability to satisfy its threshold conditions, comply with the Principles or meet its operational resilience obligations.

The important point, however, is that an MTPA is broader than outsourcing.

For a payment firm, the relevant population could include safeguarding and settlement providers, payment processors, cloud infrastructure, core technology platforms, fraud and financial crime systems, data providers and other services supporting regulated activities.

The question is therefore changing from, “what have we outsourced?” to “what do we depend upon?”

And that, frankly, is a much more useful question from an operational resilience perspective – but it is also a much harder one to answer comprehensively.

A firm may have a well-maintained outsourcing register and still have a poor understanding of its operational dependencies. That becomes a problem when a service fails and the firm needs to establish quickly whether the failure is isolated, whether other providers are affected, what customer services are dependent upon it and whether the event has crossed a regulatory reporting threshold.

LOOK BEYOND THE IMMEDIATE SUPPLIER

The FCA also expects firms to consider dependencies further down the supply chain.

A payment firm may rely on a processor which relies on a cloud provider. A technology provider may depend on another infrastructure provider. A banking partner may itself rely on external payments infrastructure.

The FCA wants the data from the new reporting regime to help it identify common dependencies, concentrations and potential critical third parties across the sector.

This has an important practical implication: a third-party register consisting principally of supplier names, contract values and renewal dates is unlikely to be enough.

Firms instead need to understand the relationship between the third party, the service it provides, its importance to the firm and what its failure would mean in terms of customer impact.

The real test is therefore not whether the firm has a register. It is whether someone could use that register during a live incident to understand what has been affected, what depends on it and what needs to happen next.

That distinction matters. A register can be complete from a procurement perspective and still be of limited value from an operational resilience perspective.

CONCLUSION

PS26/2, FG26/3 and FG26/4 reinforce a broader expectation that firms should understand what their services depend upon, what happens when those dependencies fail and how they will respond.

The FCA wants better information about individual incidents, but it also wants to see the bigger picture: common dependencies, concentration risk and the operational infrastructure supporting financial services.

For firms, therefore, the real challenge may not be the new reporting form. It is whether the organisation has enough joined-up information, governance and evidence to make the right decision when something goes wrong – and to demonstrate afterwards why that decision was made.

That is a rather different proposition from simply having a reporting process.

Rather neatly, this brings us back to the three key questions: