CyberCQR Thinking · Regulation
The 24-hour question: are you ready to tell the FCA?
From 18 March 2027, every FCA-regulated firm must report serious operational incidents through one portal, and the regulator expects most first reports within 24 hours of the firm deciding that an incident crosses the line. The form is short. Making that decision in time is not, because the first people to know are usually your IT provider and your software suppliers.
Summary
The point for boards. The new report is short, but the clock starts when your firm decides that an incident is reportable, and you cannot decide what you cannot see. If your IT provider, monitoring service or software supplier can take days to tell you about a problem, the 24 hours is out of your hands. Settle who decides, and how fast your suppliers must tell you, and the form looks after itself.
Who this is for. This briefing is written for firms the FCA regulates: wealth managers, financial advisers, insurance brokers, lenders, and payment and e-money firms. Law firms and accountancy practices without FCA permissions are not covered by these rules, although the advice on suppliers applies to them just as much.
What changes on 18 March 2027
In March 2026 the FCA published its final rules on operational incident and third-party reporting, policy statement PS26/2, with two sets of guidance: FG26/3 on incidents and FG26/4 on third parties [1] [2] [3]. The rules apply from 18 March 2027 [4]. The Prudential Regulation Authority (PRA) and the Bank of England published matching rules, so a firm submits one report through FCA Connect whichever regulator it is meant for [4].
| Question | The rule |
|---|---|
| Who must report | Every firm with a Part 4A permission, plus payment service providers and a few market bodies [1]. |
| What counts | An event, or a series of linked events, that disrupts a service to people outside the firm, or affects the availability, authenticity, integrity or confidentiality of their information [1]. |
| When it is reportable | When the firm reasonably believes the incident poses a risk of intolerable harm to consumers that they cannot easily recover from, a risk to the safety and soundness of the firm or other firms, or a risk to market stability, integrity or confidence [1]. |
| How fast | As soon as practicable. The FCA expects the first report within 24 hours of deciding that a threshold is met, and says firms should not simply wait for the 24 hours to run [2]. Payment service providers have 4 hours from first detecting the incident [1]. |
| Standard report | About 90% of firms: one short report, with no updates required [1]. |
| Enhanced report | Larger firms, including enhanced-scope firms under the Senior Managers and Certification Regime (SM&CR), CASS large firms, banks, building societies, insurers and payment firms: a first report, updates as things change, and a final report within 30 working days of resolution [1]. |
| Near misses | Not reportable under these rules, although Principle 11 still applies [1]. |
Table 1. The incident reporting rules in brief, from PS26/2 and FG26/3.
Some firms also have new third-party duties. Enhanced-scope SM&CR firms, CASS large firms, and e-money and payment institutions, among others, must tell the FCA before they commit to a new or significantly changed "material" third-party arrangement, and send it a register of those arrangements every year [1] [3]. The FCA's guidance says cloud hosting, data centres and certain cyber security services are normally material [3].
The clock starts when you decide
The test is a judgement, not a number. To make it, someone has to know which services are down, which clients are affected and whether data has left the firm. In a firm of a few hundred people, those facts rarely start inside the firm. They sit with the managed IT provider, the monitoring service or a software-as-a-service (SaaS) supplier.
The FCA's guidance is clear that an incident which starts at a supplier is still the firm's to report, and the report asks for the supplier's name [2]. Yet many supplier contracts say nothing about how quickly the firm is told, or what it is told. Some say "promptly". Some say 72 hours, borrowed from data protection rules.
Your real deadline is your supplier's notice period plus your own decision time.
If a supplier can take three days to tell you, the FCA's 24 hours can only be met by luck. Strictly, the 24 hours runs from your decision, so a slow decision does not break the rule on paper. In practice, a firm that took days to decide will have to explain to its supervisor why, and "our supplier did not tell us" is not an answer the firm controls.
We have seen this from both sides: as an in-house security specialist in financial services and utility companies, and as a consultant working alongside managed service providers. The pattern repeats. Inside the provider, an alert is checked and validated, escalated through internal management, and only then passed to an account manager to contact the client, often after someone has looked at whether the contract's service levels were met. Each step is reasonable on its own. Together they can add days, sometimes weeks, before the client hears. More than once, the provider's first instinct was to protect its own reputation before the client's business.
This is why we see the new rules as a decision and supplier problem first, and a compliance task second. Updating the policy is the easy part. The real work is agreeing in advance who decides, what "reportable" means for your services, and how fast your suppliers must speak up.
Watch the watcher
In many firms of this size, the company that runs the IT also monitors it for attacks. That is convenient, and often good value. But it means the first party to see a serious problem may also be the party whose service has failed, and whose contract may be at risk.
We are not suggesting that providers set out to hide incidents. We are suggesting that no firm should rely on one party to run its systems, judge its own failures and decide when to tell the client, because the provider's internal process will always be built around the provider. At the very least, alerts above an agreed severity should reach a named person at the firm directly, at the same moment they reach the provider, and the contract should say that notice cannot wait for internal sign-off or a check on service levels.
Six things to have in place before 18 March 2027
1. Your thresholds, in your own words
Write a one-page sheet with examples of "reportable" for each service you provide to clients, mapped to the FCA's three tests. Agree it with the board before you need it, so that nobody is interpreting the rules for the first time during an incident.
2. One decision-maker and a deputy
Name them, make sure one of them is always reachable, and give them authority to file without calling a meeting. The FCA accepts that a first report may be incomplete and asks firms to provide what they can [2].
3. Supplier notification terms
Require your IT provider, monitoring service and critical software suppliers to tell you within hours of detecting an incident that affects you, with a minimum set of facts that matches the FCA's form. Start with the contracts that renew before March.
4. A reporting step in the incident plan
Add "Is this reportable, and who files?" to the incident plan, with a recorded time for detection, decision and submission. Set up FCA Connect access for two people now, not on the night.
5. The third-party register, if it applies to you
Check whether your firm is in scope. If it is, decide which arrangements are material, build the register, and add an FCA notification step to buying decisions, before contracts are signed [3].
6. One rehearsal against the clock
Run a 90-minute exercise on an incident that starts at a supplier on a Friday evening, and time how long the decision takes. Most firms learn more from that one number than from any policy review.
Our Top 10 Actions sets out each step with the evidence behind it, and the Good Practice Guide shows how to put them in place, including supplier clauses and an exercise script.
Five questions for your next board meeting
- If our IT provider found a serious incident on a Friday night, when would we know, and who would decide whether to tell the FCA?
- Do we file a standard or an enhanced report, and do the third-party rules apply to us?
- What do our contracts with our IT, monitoring and key software suppliers say about how fast they must tell us about an incident?
- Who has access to FCA Connect today, and have they ever used it?
- When did we last rehearse an incident against a reporting deadline, and how long did the decision take?
Conclusion
For most firms the new rules are not onerous. The form is short, and the FCA accepts that early reports will be incomplete. What the rules expose is something a board should want to know anyway: whether the firm can find out about its own serious incidents quickly, and whether someone has the authority to act. Settle that before March, and meeting the FCA's expectation becomes routine.
Glossary
| Term | Meaning |
|---|---|
| CASS large firm | A firm holding client money or assets above the FCA's thresholds for the largest category under the client assets (CASS) rules. |
| Enhanced report | The fuller incident report for larger firms: a first report, updates, and a final report after resolution. |
| Enhanced-scope SM&CR firm | A larger firm in the top tier of the Senior Managers and Certification Regime, with extra governance requirements. |
| FCA Connect | The FCA's online portal for applications and notifications, used for the new incident reports. |
| Material third-party arrangement | A supplier arrangement whose failure could cause intolerable harm to clients, threaten the financial system, or put the firm's ability to meet its regulatory obligations in doubt. |
| Operational incident | An event, or linked events, that disrupts a service to people outside the firm, or affects the availability, authenticity, integrity or confidentiality of their information. |
| Part 4A permission | The permission, under Part 4A of the Financial Services and Markets Act 2000, that authorises a firm to carry on regulated activities. |
| Principle 11 | The FCA Principle requiring firms to be open with the regulator and tell it about anything it would reasonably expect to know. |
| Software as a service (SaaS) | Software the firm uses over the internet and the supplier runs, such as a client portal or practice management system. |
| Standard report | The short, one-off incident report most FCA-regulated firms will file. |
Table 2. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- FCA incident reporting: 10 actions before 18 March 2027
- Reporting Operational Incidents to the FCA: A Good Practice Guide
- Board Preparation for Cyber Incidents
- Third-Party and Supply Chain Ransomware
External
- FCA: Reporting operational incidents, including the report templates [5]
References
- [1]Financial Conduct Authority, PS26/2: Operational incident and third party reporting, March 2026.
https://www.fca.org.uk/publications/policy-statements/ps26-2-operational-incident-third-party-reporting - [2]Financial Conduct Authority, FG26/3: Operational incident reporting, finalised guidance, March 2026.
https://www.fca.org.uk/publication/finalised-guidance/fg26-3.pdf - [3]Financial Conduct Authority, FG26/4: Material third party reporting, finalised guidance, March 2026.
https://www.fca.org.uk/publication/finalised-guidance/fg26-4.pdf - [4]Financial Conduct Authority, FCA confirms new incident and third party rules to bolster resilience, 18 March 2026.
https://www.fca.org.uk/news/news-stories/fca-confirms-new-incident-and-third-party-rules-bolster-resilience - [5]Financial Conduct Authority, Reporting operational incidents.
https://www.fca.org.uk/firms/operational-resilience/reporting-operational-incidents
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help FCA-regulated firms get ready for the new reporting rules: who decides, what your suppliers must tell you, and a rehearsal against the clock, without vendor commissions or product resale.