The FCA’s new operational incident and material third-party reporting requirements take effect on 18 March 2027. Here’s what financial services firms need to understand, where the challenges lie and how to prepare.
Financial services firms increasingly depend on complex networks of technology providers, outsourced services and other third parties. While these relationships support day-to-day operations, they also introduce risks that can quickly spread across an organisation.
A disruption affecting a technology provider, for example, could impact several business services simultaneously, potentially affecting customers, regulatory compliance and the wider financial system.
Recognising these challenges, the Financial Conduct Authority (FCA), Prudential Regulation Authority (PRA) and Bank of England have introduced a more consistent framework for reporting operational incidents and material third-party arrangements.
Published through Policy Statement PS26/2, the new requirements will come into effect on 18 March 2027.
For affected firms, this means reviewing more than just reporting procedures. Organisations will need reliable incident records, better visibility of third-party relationships and clear processes for identifying, escalating and reporting significant events.
What is FCA PS26/2?
FCA PS26/2 introduces an aligned regulatory framework covering two areas:
Operational incident reporting: Requirements for reporting significant operational incidents to the relevant regulator.
Material third-party reporting: Requirements for identifying, notifying regulators about and maintaining records of material third-party arrangements.
The aim is to improve regulatory visibility of operational disruptions and the dependencies that could affect the resilience of financial services.
Importantly, these are two distinct reporting obligations. Firms should assess which requirements apply to their organisation rather than assume that being in scope of one automatically means being in scope of the other.
1. New operational incident reporting requirements
The new framework introduces a standardised approach to reporting operational incidents that meet defined regulatory thresholds.
An incident may become reportable where it presents a risk of intolerable harm to consumers, threatens the safety and soundness of a firm or other market participants, or risks affecting market stability, integrity or confidence in the UK financial system.
There are two reporting approaches:
Standard reporting
Most FCA-regulated firms will follow the Standard reporting process, providing a single report containing the required information about the incident.
Enhanced reporting
Certain firms will follow an Enhanced reporting process, involving initial, intermediate and final reports as the incident develops and is resolved.
Reporting deadlines are particularly important:
Most firms must report as soon as practicable and within 24 hours of determining that an incident meets the relevant reporting thresholds.
Payment service providers face a shorter initial reporting deadline of four hours from first detecting the incident.
Enhanced reporting may require further updates as circumstances change, followed by a final report.
These requirements place greater emphasis on the ability to capture accurate incident information quickly.
Organisations cannot afford to spend valuable time locating records, identifying responsible teams or reconstructing the sequence of events while simultaneously managing an operational disruption.
2. Material third-party reporting: Understanding your dependencies
The second part of PS26/2 focuses on material third-party arrangements.
For firms within scope, the requirements include:
Notifying the FCA about new material third-party arrangements.
Reporting significant changes to existing arrangements.
Maintaining a register of material third-party arrangements.
Submitting the register annually.
The requirements extend beyond traditional outsourcing arrangements to include material third-party relationships more broadly.
This means firms need a clearer understanding of the services they depend on, the providers delivering them and the potential consequences if those relationships change or fail.
For example, significant changes may involve:
Changes to the services provided or their scope.
Changes to how or where sensitive information is stored or processed.
Changes in the ownership or financial position of a provider.
Changes involving key subcontractors.
Changes to the third party responsible for delivering a service.
The challenge is not simply creating a register. It is ensuring that the information remains accurate as relationships, services and dependencies evolve.
3. Why fragmented risk information creates a problem
One of the biggest challenges organisations may face is the availability and consistency of information.
Incident details might be recorded by IT teams, while customer impact assessments sit with operations, regulatory considerations are handled by compliance and supplier information is maintained by procurement.
When these processes operate independently, important information can become fragmented.
This creates several practical challenges:
Delayed incident reporting
Teams may struggle to gather the information required for a regulatory submission within tight reporting deadlines.
Limited visibility of third-party dependencies
Without a centralised view of supplier relationships, organisations may find it difficult to identify which business services depend on particular providers.
Inconsistent records
Different departments may maintain separate versions of the same information, creating uncertainty around accuracy, ownership and accountability.
Reactive regulatory preparation
Rather than maintaining information continuously, firms may find themselves reconstructing records when a notification or annual submission is due.
The underlying issue is that regulatory reporting depends on the quality of everyday risk management processes.
A reporting template can standardise what needs to be submitted, but it cannot compensate for incomplete information or unclear responsibilities.
4. Six steps firms should take before March 2027
With implementation approaching, organisations should use the remaining preparation period to review their existing processes and identify potential gaps.
1. Establish which requirements apply
Review the scope of both operational incident and material third-party reporting requirements.
Identify whether the organisation falls within the relevant requirements and consider any additional obligations arising from PRA regulation.
2. Review existing incident management processes
Assess how incidents are currently identified, recorded, escalated and investigated.
Consider whether existing processes capture the information needed for regulatory reporting and whether teams can access it quickly during a disruption.
3. Review third-party registers
Identify material third-party relationships and assess whether existing records provide sufficient information about providers, services, dependencies and ownership.
Check how changes to existing arrangements are identified and recorded.
4. Define roles and responsibilities
Establish who is responsible for assessing incident reporting thresholds, determining materiality, escalating significant changes and preparing regulatory notifications.
Clear ownership is particularly important when decisions must be made under time pressure.
5. Improve information sharing across departments
Identify where relevant information is held across technology, operations, procurement, risk and compliance teams.
Where possible, connect these processes so that information can be accessed and updated without repeatedly requesting the same details from different departments.
6. Test reporting and escalation procedures
Conduct scenario-based exercises to assess how effectively the organisation could respond to a reportable incident or material third-party change.
Test reporting timelines, information availability, escalation routes and approval processes.
Identifying weaknesses before implementation provides an opportunity to address them before the new requirements take effect.
5. Bringing incident management and third-party risk together
Operational incidents and third-party risks are closely connected.
A disruption caused by an external provider can quickly become an operational incident, potentially affecting several business services and creating regulatory reporting obligations.
However, if incident management and third-party risk management operate in isolation, organisations may struggle to establish these connections.
An integrated approach can help firms:
Maintain a clearer view of incidents, associated risks and contributing third parties.
Identify dependencies between suppliers and critical business services.
Track actions arising from incidents and supplier assessments.
Maintain consistent records across departments.
Improve accountability through clearly assigned owners and responsibilities.
Access relevant information when preparing regulatory reports.
This is not simply about meeting a new reporting deadline. It is about developing a more connected understanding of operational risk and organisational resilience.
How Symbiant GRC supports incident and third-party risk management
Preparing for FCA PS26/2 requires organisations to maintain reliable information and establish processes that support timely decisions.
Symbiant provides an integrated GRC platform that helps organisations manage risk information, incidents, controls and third-party relationships within a connected environment.
Symbiant Incident Reporter module enables organisations to record, investigate and manage incidents, assign responsibilities and track actions through to resolution.
The Risk Register provides a centralised view of organisational risks, including assessments, ownership, controls and mitigation activities.
Through Due Diligence and Questionnaires & Assessments, organisations can structure the collection and assessment of information relating to third parties and other external relationships.
Together, these capabilities can help organisations improve visibility, maintain more consistent records and connect incident management with wider risk management activities.
Rather than treating regulatory reporting as a separate exercise, firms can build the underlying information and accountability into their everyday GRC processes.
References
Financial Conduct Authority (2026). PS26/2: Operational Incident and Third Party Reporting. https://www.fca.org.uk/publications/policy-statements/ps26-2-operational-incident-third-party-reporting
Financial Conduct Authority (2026). FG26/3: Operational Incident Reporting. https://www.fca.org.uk/publication/finalised-guidance/fg26-3.pdf
Financial Conduct Authority (2026). FG26/4: Material Third Party Reporting. https://www.fca.org.uk/publication/finalised-guidance/fg26-4.pdf
Financial Conduct Authority (2026). Reporting Operational Incidents. https://www.fca.org.uk/firms/operational-resilience/reporting-operational-incidents
Financial Conduct Authority (2026). Reporting Material Third Party Arrangements. https://www.fca.org.uk/firms/outsourcing-and-operational-resilience/reporting-material-third-party-arrangements
Financial Conduct Authority (2026). FCA confirms new incident and third party rules to bolster resilience. https://www.fca.org.uk/news/news-stories/fca-confirms-new-incident-and-third-party-rules-bolster-resilience
Preparing for 18 March 2027
FCA PS26/2 represents an important development in how financial services firms report operational incidents and manage information about material third-party relationships.
The organisations best prepared for implementation will be those that understand their reporting obligations, maintain accurate information and have clear processes for managing incidents and third-party changes.
The deadline is approaching. Reviewing existing arrangements now can help identify gaps, reduce reliance on manual information gathering and strengthen operational resilience.
Discover how Symbiant can help your organisation connect incident management, third-party risk and wider GRC processes. Book a demonstration.
