PS26/2 readiness: operational incident and third-party reporting
From 18 March 2027, the FCA, PRA and Bank of England run a single regime for reporting operational incidents and material third-party arrangements (FCA PS26/2, PRA PS7/26). Firms will need clear thresholds, a tested process for making reports quickly, and an up-to-date register of material third parties.
BOOK A 30-MINUTE SCOPING CALLDOWNLOAD THE READINESS CHECKLIST (PDF)
What changes
- Operational incidents that meet the regulators' thresholds must be reported through one standard submission, whichever regulator(s) it is for.
- One incident form, completed in three phases: initial, intermediate and final. The PRA expects the initial report within 24 hours of the firm deciding the threshold is met, and the final phase within 30 working days of resolving the incident (up to 60 in total where more time is justified).
- Firms must notify the regulators before entering into, or significantly changing, a material third-party arrangement.
- Firms must keep a register of material third-party arrangements and submit it annually.
- Submissions go through FCA Connect.
Who it applies to
The FCA's scope lists firms with a Part 4A permission, enhanced scope SM&CR firms, designated investment firms, Solvency II firms and CASS large firms, with different parts applying to different firms. The PRA policy covers UK banks, building societies, PRA-designated investment firms, UK Solvency II insurers, the Society of Lloyd's and its managing agents, and credit unions with at least £50 million in total assets (for third-party reporting). Check the policy statements for your exact position.
How we help
- Readiness gap assessment: where your current incident management, notification and third-party processes fall short of the new rules.
- Thresholds and decision-making: practical criteria and a named decision path so the 24-hour clock starts cleanly.
- Material third-party register: identify material arrangements, fill data gaps and set up ownership for the annual submission.
- Rehearsal: a scenario exercise that runs an incident from detection to initial, intermediate and final report, including a third-party-caused outage.
- Links to your existing operational resilience work: important business services, impact tolerances and mapping.
PS26/2 readiness checklist
Governance
- Named accountable Senior Manager for incident and third-party reporting
- Board/committee briefed on PS26/2 and PS7/26 and the 18 March 2027 date
- Readiness plan with owners and milestones to March 2027
Incident reporting
- Reporting thresholds documented for each relevant regulator (FCA, PRA, Bank of England)
- Clear decision path and decision-makers for "threshold met", 24/7
- Process to submit the initial phase within 24 hours of the threshold decision
- Process and owner for intermediate updates as facts change
- Process for the final phase within 30 working days of resolution (root cause, impact, lessons)
- Report templates mapped to incident management data you already capture
- FCA Connect access set up for the right people, with cover
- Links to existing incident, crisis and major-incident procedures updated
Third parties
- Criteria for what counts as a material third-party arrangement agreed
- Inventory of third-party arrangements reviewed against those criteria
- Material third-party register built with the required data fields
- Owner and process for the annual register submission
- Procurement and change processes trigger a notification before new or significantly changed material arrangements
- Contracts support timely incident information from suppliers
Testing
- Scenario exercise run end to end, from detection to initial, intermediate and final reports
- Scenario includes an incident caused by a third party
- Lessons learned tracked to closure
Alignment
- Links to important business services, impact tolerances and mapping checked
- Consistency with other regimes you report under (e.g. DORA, NIS) checked
DOWNLOAD THE CHECKLIST (PDF)
Sources
General guidance only. Check the policy statements for your firm's own obligations.
