FINANCIAL SERVICES / POLICY BRIEF
Reporting starts
before the form.
The FCA’s reporting changes take effect on 18 March 2027. Build the escalation, supplier visibility and decision records before the new forms arrive.
An incident report is the visible end of a much longer chain. Someone has to recognise the disruption, understand which services and customers are affected, decide whether the reporting threshold has been met, and reach an authorised person while the facts are still changing.
The FCA’s PS26/2 makes that chain a practical preparation priority. Its new operational-incident and material third-party reporting arrangements take effect on 18 March 2027. This is work for operations, procurement, compliance and the board together—not a form to hand to IT on the deadline.
THE EXECUTIVE BRIEF
Prepare the operating decisions behind the report.
- Separate incident detection, threshold determination and submission; record when each happens.
- Look beyond outsourcing contracts when identifying material third-party arrangements.
- Test a shared escalation process, including supplier evidence and accountable decisions.
01
A reporting clock is not a waiting period.
For firms subject to the general operational-incident rules, the initial notification is due as soon as practicable after determining that a threshold is met. The FCA expects no more than 24 hours after that determination. The outer limit is not permission to wait while a reportable incident develops.
GENERAL OPERATIONAL-INCIDENT ROUTE
Three events. Three timestamps.
01
Detect
Record the first indication and begin assessing the impact.
02
Determine
Record when a reporting threshold is met, with the reasons and evidence.
03
Notify
As soon as practicable; the FCA expects no more than 24 hours after determination.
Different trigger for payment service providers: notification as soon as practicable and within four hours of first detecting the incident. Apply the route relevant to your firm. FCA FG26/3, paragraphs 7.4–7.6.
A useful rehearsal starts with incomplete information. Who can make the threshold decision out of hours? Which customer-impact information is available without a long investigation? Who can submit if the usual contact is absent? Treat an unanswered question as a preparation task with an owner.
The thresholds concern consequences, including intolerable consumer harm, safety and soundness, and market stability, integrity or confidence. A technical severity label can inform the assessment, but it should not substitute for understanding the business impact. Keep the assessment under review as the incident changes.
02
Map material dependencies beyond the outsourcing label.
The third-party changes bring material non-outsourcing arrangements into the reporting framework. That matters because a service can be important to the business without fitting the firm’s historic outsourcing inventory. A market-data feed, a technology dependency or an AI-enabled service may deserve scrutiny; the category alone does not make every arrangement material.
THE MATERIALITY WORKSHEET
Start with the service that would fail.
Business dependency
Which activities depend on the arrangement, and who relies on their continuity?
Consequence of disruption
What happens to customers, obligations and the firm if the supplier fails or becomes unavailable?
Substitution and concentration
Can the service be replaced in time? Are several important services dependent on the same provider?
Evidence and owner
Who approved the materiality decision, on what evidence, and when will it be reviewed?
CyberSolace preparation worksheet, not a replacement for the FCA’s materiality assessment or the detailed rules. Read the FCA’s third-party reporting overview.
Procurement, technology and business teams should reconcile their inventories rather than each maintaining a different answer. Include changes to an arrangement, not just new contracts. A register that is accurate only at onboarding will age quickly as services, access and subcontracting change.
The incident-reporting and third-party-reporting populations are not identical. Confirm which requirements apply to your firm instead of assuming that being in scope of one automatically settles the other. Within the third-party framework, preparation needs to cover notifications of new or significantly changed material arrangements and the annual register submission.
03
A simpler form still needs good underlying information.
The FCA intends a single reporting process through Connect. PS26/2 says around 90% of the firm population is expected to use the standard initial report, with ten required questions. Firms with greater systemic or market significance may face enhanced requirements. “Ten questions” is not a universal description of every report or every reporting stage.
| Reporting workstream | What the preparation must establish |
|---|---|
| Operational incidents | Thresholds, escalation, submission ownership and subsequent updates. |
| Material third-party notifications | A current process for identifying reportable new arrangements and significant changes. |
| Annual register | A maintained record, data ownership and a submission process for the FCA’s announced window. |
A short form can be difficult to complete if the business cannot identify the affected service, customer consequences or supplier dependency. Prepare a concise incident record that separates confirmed facts, estimates and outstanding questions. It should support updates without overwriting the evidence behind an earlier decision.
Do not invent an annual register deadline from the implementation date alone. The FCA will communicate the first submission window; its guidance describes a 90-calendar-day submission period after that window opens. Establish the data process now and confirm the actual window when notified.
04
Use the remaining preparation period to prove readiness.
DEFINE
Decisions and accountability
Confirm the firm’s scope, reporting routes, thresholds, decision authority and cover for absence. Give operations and compliance a shared escalation record.
RECONCILE
Arrangements and evidence
Join the supplier inventory to business services. Review materiality, missing owners, reporting clauses and access to incident information.
REHEARSE
A realistic disruption
Exercise a supplier outage with uncertain facts. Time the escalation, threshold decision and draft notification; record what slowed the team.
MAINTAIN
An operating record
Assign ownership for register updates, changed arrangements, training and lessons from tests. Readiness needs to survive personnel and supplier changes.
These are workstreams to run in parallel where practical, rather than four tasks that must wait for one another. A board or executive sponsor should resolve gaps that cross departmental boundaries: a supplier contract without timely notification, an inaccessible register, or a reporting decision that depends on one unavailable individual.
The existing reporting obligations continue during preparation. Do not treat March 2027 as a suspension of Principle 11, SUP 15 or other applicable notifications. The new regime changes the future process; incidents happening now still need to be assessed under the rules currently in force.
STATUS / 20 OCTOBER 2026
The new requirements are scheduled to apply from 18 March 2027. This review distinguishes future reporting arrangements from current duties; check the latest FCA implementation information before relying on a form or submission process.
THE CYBERSOLACE PERSPECTIVE
A well-run report starts with a well-rehearsed decision.
Ask the team to show one end-to-end example: detection, impact assessment, threshold decision, accountable approval and the evidence needed for notification. Then repeat it with the principal contact unavailable.
CyberSolace can help connect resilience planning, supplier oversight and incident readiness so the reporting process reflects how the business actually operates.
SOURCES & EDITORIAL REVIEW
Original publication date retained. Research and presentation reviewed 20 October 2026. Practical worksheets are CyberSolace guidance; firms must establish the requirements applicable to their own activities.