CyberCQR Top 10 · Regulation
FCA incident reporting: ten actions before 18 March 2027
The FCA's new rules mean every regulated firm must be able to spot a serious operational incident, decide whether it is reportable, and tell the regulator quickly. These are the ten things a board should have in place before the rules apply.
Summary
The point for boards. The report itself is short. What the rules really test is whether your firm finds out about a serious incident quickly, has someone with the authority to decide, and has suppliers who are obliged to tell it in time. Those are governance questions, and they are best answered before an incident, not during one.
What has changed
Today, firms tell the FCA about material incidents under Principle 11 and the general notification rules [5]. From 18 March 2027 there is a single, defined regime. The FCA published the final rules in policy statement PS26/2 in March 2026, with guidance on incidents (FG26/3) and on third parties (FG26/4) [1] [2] [3].
An operational incident is an event, or a series of linked events, that disrupts a service to people outside the firm, or affects the availability, authenticity, integrity or confidentiality of their information [1]. It is reportable when the firm reasonably believes it poses a risk of intolerable harm to consumers that they cannot easily recover from, a risk to the safety and soundness of the firm or other firms, or a risk to market stability, integrity or confidence [1].
About 90% of FCA-regulated firms will file a short standard report, once [1]. Larger firms, including enhanced-scope firms under the Senior Managers and Certification Regime (SM&CR), CASS large firms, insurers and payment firms, file an enhanced report with updates and a final report [1]. Payment service providers must report within 4 hours of first detecting an incident [1]. Some of the same larger firms must also notify the FCA about material third-party arrangements and keep a register of them [3].
The ten actions
1. Confirm which rules apply to your firm
Why it matters. The duties differ sharply between a standard firm, an enhanced firm and a payment service provider, and only some firms have the third-party duties [1]. Getting this wrong means preparing for the wrong deadline.
What to do.
- Ask compliance to confirm, in writing, whether the firm files standard or enhanced reports.
- Confirm whether the firm is a payment service provider, and so on the 4-hour clock.
- Confirm whether the material third-party notification and register rules apply.
2. Name who decides, and give them the authority
Why it matters. The FCA expects a first report within 24 hours of the firm deciding that a threshold is met, and says firms should not simply wait for the 24 hours to run [2]. A decision that needs a meeting will rarely be quick, especially at a weekend.
What to do.
- Name one decision-maker and at least one deputy, so someone is always reachable.
- Give them written authority to submit a report without convening the board.
- Name who submits the report through FCA Connect, if that is someone else.
3. Write down what "reportable" means for your services
Why it matters. The FCA sets no numbers for most firms; the test is a judgement [1]. Its guidance lists factors to weigh, such as the effect on clients, data and the firm's ability to provide services, and warns against treating them as a tick-box list [2]. A judgement made for the first time during an incident is slow and hard to defend.
What to do.
- For each service you provide to clients, write two or three examples of incidents that would be reportable, and one that would not.
- Map each example to the FCA's three tests: consumer harm, safety and soundness, market integrity.
- Note that a cyber attack exposing client data can be reportable even when no important business service is disrupted [2].
- Have the board approve the sheet, and review it every year.
4. Make "is this reportable?" a fixed step in the incident plan
Why it matters. Most incident plans are written for recovery. Few have a point where someone must stop and decide whether to tell the regulator, and who does it. Without that step, the question is asked late or not at all.
What to do.
- Add a regulatory decision step early in the plan, not at the end.
- Record three times for every serious incident: when it was detected, when the reportability decision was made, and when the report was sent.
- Record the reasons when the decision is "not reportable" too. Those are the decisions a supervisor is most likely to ask about later.
5. Oblige your suppliers to tell you in hours, with facts
Why it matters. An incident that starts at a supplier is still the firm's to report, and the report asks for the supplier's name [2]. In a firm of up to 2,000 people, the first to know is often the managed IT provider, the monitoring service or a software supplier. If their contract allows days, your 24 hours depends on luck.
What to do.
- List the suppliers whose failure could trigger a report.
- Check what each contract says about incident notification: how fast, to whom, and with what information.
- Ask each supplier to show how an alert reaches you: who validates it, who approves contacting you, and whether an account manager or a service-level check sits in the path. Each step adds time.
- Add clauses requiring notice within hours of detection, direct from the team that found the problem, with a minimum set of facts that matches the FCA's form. Start with contracts that renew before March.
6. Make sure serious alerts reach you, not only your provider
Why it matters. Where one company both runs the IT and monitors it for attacks, the first party to see a serious problem may be the party whose service has failed. In our experience, a provider's internal validation, management escalation and account-management steps can add days, sometimes weeks, before the client is told. That is not an accusation; it is a conflict of interest that a board should design out.
What to do.
- Agree a severity level above which alerts go to a named person at the firm at the same time as the provider.
- Test that path: send a test alert outside working hours and see who receives it.
- Consider whether monitoring should sit with a different supplier from day-to-day IT.
7. Set up FCA Connect access now
Why it matters. Every report goes through FCA Connect, shared with the Prudential Regulation Authority (PRA) and the Bank of England where relevant [4]. Discovering on the night that nobody has a working login wastes the hours that matter.
What to do.
- Give at least two people working access, and check it every quarter.
- Download the FCA's report template and keep a copy with the incident plan [5].
- Pre-fill what does not change: firm details, contacts and the decision-maker.
8. Line up the other notifications on one timeline
Why it matters. The FCA is rarely the only one to tell. A personal data breach may need reporting to the Information Commissioner's Office (ICO) within 72 hours where feasible, and the FCA also points firms to the National Cyber Security Centre (NCSC) and Report Fraud [5]. Insurers usually have their own notice terms.
What to do.
- Build one page listing every party to notify, the deadline, who sends it, and where the contact details are kept.
- Include your insurer's notification terms; see our briefing on the cyber insurance proposal form.
- Keep the page somewhere you can reach if your own systems are down.
9. If in scope, build the third-party register and notify before you sign
Why it matters. In-scope firms must tell the FCA about a new or significantly changed material third-party arrangement before making any internal or external commitment, and submit a register every year [1] [3]. The FCA does not approve the notification, but it expects to hear before the contract is signed [3].
What to do.
- Assess which arrangements are material. The FCA says cloud hosting, data centres and certain cyber security services are normally material, and consultancy, legal and audit services normally are not [3].
- Build the register now, with data as at 31 December; the FCA gives firms 90 days to submit once it opens the window [3].
- Add an FCA notification step to buying and renewal decisions, so it happens before commitment.
10. Rehearse against the clock, then every year
Why it matters. A plan that has never been tried will fail at the first awkward question: who is on call, who has the login, and who can say yes. A rehearsal finds those gaps cheaply.
What to do.
- Before March, run a 90-minute exercise on an incident that starts at a supplier on a Friday evening.
- Time three things: when the firm learns of it, when it decides, and when a draft report is ready.
- Fix what the exercise finds, record it in the board minutes, and repeat it every year.
A plan to 18 March 2027
| When | Actions | Owner |
|---|---|---|
| November 2026 | 1. Confirm which rules apply. 2. Name the decision-maker and deputy. 5. List critical suppliers and their notice terms. | Compliance; chief operating officer |
| December 2026 | 3. Draft the "reportable" sheet. 4. Add the decision step to the incident plan. 9. If in scope, start the register with data as at 31 December. | Compliance; IT lead |
| January 2027 | 3. Board approves the sheet. 6. Agree the alert path and test it. 7. Set up FCA Connect access and the template. 8. Build the notification timeline. | Board; IT lead |
| February 2027 | 5. Contract changes for suppliers renewing first. 10. Run the rehearsal. | Chief operating officer; all |
| March 2027 | Fix what the rehearsal found. Rules apply from 18 March. | Decision-maker |
Table 1. A suggested order. Numbers refer to the ten actions above. Firms on the 4-hour clock, or with the third-party duties, should start sooner.
Five questions for your next board meeting
- Do we file standard or enhanced reports, and do the third-party rules apply to us?
- Who decides whether an incident is reportable, and can they file without calling a meeting?
- Which suppliers would know about a serious incident before we did, and what must their contracts make them tell us?
- Who has a working FCA Connect login today?
- When will we rehearse an incident against the clock, and who will be in the room?
Glossary
| Term | Meaning |
|---|---|
| CASS large firm | A firm in the largest category under the FCA's client assets (CASS) rules. |
| Enhanced report | The fuller incident report for larger firms: a first report, updates, and a final report within 30 working days of resolution. |
| Enhanced-scope SM&CR firm | A larger firm in the top tier of the Senior Managers and Certification Regime. |
| FCA Connect | The FCA's online portal, used for incident reports and third-party notifications. |
| Important business service | A service which, if disrupted, could cause intolerable harm to clients or risk to the market, as identified under the FCA's operational resilience rules. |
| Material third-party arrangement | A supplier arrangement whose failure could cause intolerable harm to clients, threaten the financial system, or put the firm's ability to meet its regulatory obligations in doubt. |
| Operational incident | An event, or linked events, that disrupts a service to people outside the firm, or affects the availability, authenticity, integrity or confidentiality of their information. |
| Principle 11 | The FCA Principle requiring firms to be open with the regulator and tell it about anything it would reasonably expect to know. |
| Standard report | The short, one-off incident report most FCA-regulated firms will file. |
Table 2. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- The 24-hour question: are you ready to tell the FCA?
- Reporting Operational Incidents to the FCA: A Good Practice Guide
- Incident Response: Top 10 Actions for Boards
External
References
- [1]Financial Conduct Authority, PS26/2: Operational incident and third party reporting, March 2026.
https://www.fca.org.uk/publications/policy-statements/ps26-2-operational-incident-third-party-reporting - [2]Financial Conduct Authority, FG26/3: Operational incident reporting, finalised guidance, March 2026.
https://www.fca.org.uk/publication/finalised-guidance/fg26-3.pdf - [3]Financial Conduct Authority, FG26/4: Material third party reporting, finalised guidance, March 2026.
https://www.fca.org.uk/publication/finalised-guidance/fg26-4.pdf - [4]Financial Conduct Authority, FCA confirms new incident and third party rules to bolster resilience, 18 March 2026.
https://www.fca.org.uk/news/news-stories/fca-confirms-new-incident-and-third-party-rules-bolster-resilience - [5]Financial Conduct Authority, Reporting operational incidents.
https://www.fca.org.uk/firms/operational-resilience/reporting-operational-incidents
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help FCA-regulated firms prepare for the new reporting rules with independent reviews, supplier contract checks and timed rehearsals, without vendor commissions or product resale.