The countdown to the UK's new operational incident and material third-party reporting regime is now well under way. The FCA, PRA and Bank of England rules take effect on 18 March 2027, giving affected firms roughly six months to complete their preparation.

The direction is clear: reporting should be faster, more consistent and less fragmented across regulators. Under the new regime, firms will use a standardised process and a single submission route. For operational incidents, reports will be triggered where defined thresholds are met. Most FCA solo-regulated firms will use a standard report, while a smaller group will follow enhanced reporting requirements.

The third-party requirements are also significant. Firms in scope will need to notify the FCA when entering into, or significantly changing, a material third-party arrangement. They will also maintain and submit an annual register of material arrangements. The definition extends beyond outsourcing to other third-party services whose disruption could cause serious harm or threaten a firm's resilience or the wider financial system.

The case for preparation is not theoretical. The FCA says that over 40% of cyber incidents reported to it in 2025 involved a third party. That makes accurate service mapping, clear ownership and usable supplier information part of incident readiness, not simply procurement administration.

What firms should do now:

- Test the thresholds using realistic cyber, technology failure and supplier disruption scenarios.

- Clarify who makes the materiality judgement, approves the submission and keeps regulators updated.

- Map parallel duties under UK GDPR and, where relevant, DORA, so teams do not produce conflicting assessments or duplicate evidence under pressure.

- Check third-party registers link providers to important business services, dependencies, concentration risks and exit or continuity arrangements.

- Rehearse evidence capture so incident teams can collect the required facts while still managing recovery.

AV Resilience view: the new forms matter, but this should not be treated as a forms project. The real test is whether governance, incident management, operational resilience and third-party risk teams can make a sound threshold decision quickly, using consistent evidence, during a live disruption. A short scenario exercise before March 2027 can expose unclear decision rights, missing supplier data and competing notification timelines while there is still time to fix them.