Reporting operational incidents to the FCA: a good practice guide

Summary

From 18 March 2027, the Financial Conduct Authority (FCA) requires firms to report serious operational incidents through a single process, and some firms to notify it about material third-party arrangements [1]. For most firms the report is short. The hard part is having the people, the information and the authority to decide quickly whether an incident is reportable.

1. The rules in brief

The FCA published its final rules in policy statement PS26/2 in March 2026, with guidance on incident reporting (FG26/3) and on material third parties (FG26/4) [1] [2] [3]. They apply from 18 March 2027. Reports go through FCA Connect, and one submission serves the FCA, the Prudential Regulation Authority (PRA) and the Bank of England [4].

An operational incident is an event, or a series of linked events, that disrupts a service to people outside the firm, or affects the availability, authenticity, integrity or confidentiality of their information [1]. It must be reported when the firm reasonably believes it poses a risk of:

• intolerable harm to consumers, from which they cannot easily recover;
• the safety and soundness of the firm or other market participants; or
• market stability, market integrity or confidence in the UK financial system [1].

Table 1. Who reports what, and when. Near misses are not reportable under these rules, although Principle 11 still applies [1].

Two points in the guidance are easy to miss. First, an incident does not have to affect an important business service to be reportable: a cyber attack that gives someone access to client data can be reportable on its own [2]. Second, a planned change that goes wrong, such as a failed upgrade, counts if it meets a threshold [2].

2. Roles and decision rights

The FCA expects clear accountability but does not prescribe who makes the call [2]. In our experience the roles below are enough for a firm of this size. Several can be held by one person, but the decision-maker and deputy should never both be unavailable.

Table 2. A minimum set of roles. Record names, deputies and out-of-hours numbers on one page, kept where it can be reached if your systems are down.

3. Deciding whether an incident is reportable

The FCA's guidance asks firms to consider the direct impact on clients and the wider sector, the firm's reputation, its legal and regulatory obligations, its ability to provide services, the safeguarding of data, and the firm's own classification of the incident [2]. It warns that these are not a tick-box list [2]. The best preparation is a one-page sheet of examples, written for your services and approved in advance.

Questions for each test

• Consumer harm. Can clients reach their money, place instructions or get advice they need now? Has their personal or financial information been exposed? Could they lose money in a way that is hard to put right?
• Safety and soundness. Could the incident threaten the firm's finances, its ability to operate, or other firms that depend on it?
• Market integrity. Could it affect orders, prices or confidence in a market? For most small and mid-sized firms this test applies rarely, but it should still be considered.

One signal deserves a rule of its own. If an incident has been escalated to a senior manager, or the firm has activated its crisis arrangements, treat that as a strong prompt to make, and record, a reporting decision straight away.

Worked examples

Table 3. Illustrations to help a firm write its own sheet. They are our judgement for a typical wealth manager or broker, not FCA rulings; the outcome depends on the facts.

4. Timing and records

The rule is to report as soon as practicable. The FCA expects a first report within 24 hours of deciding that a threshold is met, and says firms should not default to waiting the full 24 hours [2]. Payment service providers count their 4 hours from first detection, not from the decision [2].

A first report does not need every answer. The guidance says firms should provide what they can, and that some fields may not be known at first [2]. For an urgent incident, firms can also phone or email their usual FCA contact, but must still submit the report [2].

For every serious incident, record:

• when the firm first knew, and how (an internal alert, a supplier, a client);
• when the reporting decision was made, by whom, and the reasons, including decisions not to report;
• when the report was submitted, and its reference.

The gap between the first two times is your decision time. The gap between the incident starting and the firm first knowing is often your supplier's notice time. Both are worth reporting to the board.

5. What the standard report asks for

The FCA publishes the report templates [5]. The fields in the standard report include those below [2]. Most can be prepared in advance or gathered quickly, provided you know who holds the information.

Table 4. Main fields of the standard report, from FG26/3. Enhanced reports ask for more, including root cause and lessons learned in the final report.

6. Suppliers: what to put in the contract

In a firm of this size, the facts needed to make the decision usually sit with the managed IT provider, the monitoring service or a software-as-a-service (SaaS) supplier. The incident is still the firm's to report [2]. So the contract has to make the information arrive in time.

What to ask for

• Speed. Notice within a set number of hours of the supplier becoming aware, by phone and email, to named people at the firm, not a general support inbox.
• Escalation path. Notice comes directly from the team that detected the incident. It is not routed through account management, and it is not held back for internal validation, management approval or a check on whether service levels were met. Ask the supplier to show you its escalation path in writing; every internal step adds time.
• Content. At first notice, at least: what happened, when it was detected, which services and which data are affected, what the supplier is doing, and when it expects to recover. These match the FCA's fields.
• Updates. Regular updates until resolution, at an agreed interval.
• Root cause. A written root cause and remediation report within a set number of working days. Firms on enhanced reporting need this for their final report.
• Direct alerting. Where the supplier monitors your systems, alerts above an agreed severity go to the firm at the same time as to the supplier's own team.
• Co-operation. Help with regulator questions and access to the information the firm needs to report.

Example clause

"The Supplier shall notify the Customer's nominated contacts by telephone and email within [two] hours of becoming aware of any incident that affects, or is reasonably likely to affect, the Services or Customer Data, giving the information then known about the nature, time of detection, affected services and data, actions taken and expected time to recover, and shall update the Customer at least every [four] hours until the incident is resolved. Such notice shall not be delayed for internal validation, management or account approval, or any assessment of the Supplier's performance against service levels."

An illustration of the kind of wording to seek, not legal advice. Agree the final wording, the time limits and the remedies with your lawyers, and start with contracts that renew before March 2027.

Watch the watcher

Where one company both runs your IT and monitors it for attacks, the first party to see a serious failure may be the party responsible for it. We have worked on both sides of this, in-house in financial services and utility companies and as consultants alongside providers. A provider's internal checks, management escalation and account-management steps, often with an eye on whether its service levels were met, can add days or weeks before the client hears. We do not suggest providers set out to hide incidents; we do suggest designing out the conflict. Direct alerting is the minimum. For many firms, a monitoring service that is independent of day-to-day IT is the better answer.

7. Material third parties (firms in scope only)

The third-party rules apply to enhanced-scope SM&CR firms, banks, designated investment firms, building societies, insurers, CASS large firms, e-money and payment institutions, and some market bodies [1]. If your firm is not in that list, these duties do not apply, although a register of critical suppliers is still good practice.

Deciding what is material

An arrangement is material if its disruption or failure could cause intolerable harm to clients, risk the stability or integrity of the UK financial system, or cast serious doubt on the firm's ability to meet its regulatory obligations [1]. The FCA's guidance asks firms to consider how directly the service supports regulated activities, the size and complexity of what it supports, and how easily it could be replaced or brought in-house [3]. If buying or changing the arrangement needs senior management or board sign-off, that suggests it is material [3].

Table 5. Indicative examples from FG26/4 [3]. Each arrangement still needs its own assessment.

Notifying, and the register

• When to notify. When entering into, or significantly changing, a material arrangement, and before making any internal or external commitment [1] [3]. The FCA does not approve the arrangement and may not respond [3].
• Significant change. One that materially alters the nature, scale or complexity of the risk, such as a change in how sensitive data is handled or where it is stored, the supplier's ownership or finances, or a change of supplier or key subcontractor [3].
• The register. Kept up to date and submitted once a year through FCA RegData, within 90 days of the FCA opening the window, with data as at 31 December [3].
• Supply chain. The register ranks the chain: group companies 0, direct suppliers 1, their suppliers 2, and so on. Firms should identify the most critical parts of the chain, not every link [3].

The practical step is to add a materiality check and an FCA notification step to the buying and renewal process, so that notification happens before signature rather than after.

8. Rehearse it: a 90-minute exercise

An exercise with a clock running finds the gaps no review will. The script below is an illustration, designed to test the supplier path and the decision, not the technical recovery.

Table 6. An illustrative exercise. Adapt the systems and roles to your firm.

Measure three things: how long before the firm knew, how long before it decided, and how long before a draft report was ready. Record the actions, assign owners, and report them to the board.

9. What the board should see

A short quarterly summary is enough for most boards:

• incidents assessed for reporting, how many were reported, and the reasons for those that were not;
• the time from detection to decision for each serious incident;
• how quickly suppliers notified the firm, against their contracts;
• open actions from the last exercise;
• for firms in scope, changes to material third-party arrangements and notifications made.

10. Readiness checklist

Every FCA-regulated firm

• Category confirmed in writing: standard, enhanced or payment service provider.
• Decision-maker and deputy named, with written authority to file.
• Submitter named; FCA Connect access working for at least two people.
• Thresholds sheet written, with examples for each client service, and approved by the board.
• Reporting decision step added to the incident plan, with the three times recorded.
• Report template downloaded and pre-filled with firm details.
• Notification timeline covering the FCA, ICO, NCSC, Report Fraud, insurer and clients.
• Critical suppliers listed, with their legal entity identifiers.
• Supplier contracts checked; notification clauses agreed for those renewing first.
• Serious alerts reaching a named person at the firm directly; tested out of hours.
• Exercise run against the clock; actions recorded and owned.
• Quarterly board summary agreed.

Firms in scope of the third-party rules

• Materiality assessment applied to every third-party arrangement, including group companies.
• Register built, with data as at 31 December.
• Notification step added to buying and renewal decisions, before commitment.
• Significant-change triggers agreed with procurement and IT.

Glossary

Table 7. Terms used on this page (alphabetical).

Further reading

From CyberCQR

• The 24-hour question: are you ready to tell the FCA?
• FCA incident reporting: ten actions before 18 March 2027
• Board Preparation for Cyber Incidents
• Third-Party and Supply Chain Ransomware

External

• FCA: Reporting operational incidents, with report templates [5]

References

1. [1]Financial Conduct Authority, PS26/2: Operational incident and third party reporting, March 2026.
   https://www.fca.org.uk/publications/policy-statements/ps26-2-operational-incident-third-party-reporting
2. [2]Financial Conduct Authority, FG26/3: Operational incident reporting, finalised guidance, March 2026.
   https://www.fca.org.uk/publication/finalised-guidance/fg26-3.pdf
3. [3]Financial Conduct Authority, FG26/4: Material third party reporting, finalised guidance, March 2026.
   https://www.fca.org.uk/publication/finalised-guidance/fg26-4.pdf
4. [4]Financial Conduct Authority, FCA confirms new incident and third party rules to bolster resilience, 18 March 2026.
   https://www.fca.org.uk/news/news-stories/fca-confirms-new-incident-and-third-party-rules-bolster-resilience
5. [5]Financial Conduct Authority, Reporting operational incidents.
   https://www.fca.org.uk/firms/operational-resilience/reporting-operational-incidents