New FCA rules and guidance on operational incident reporting in UK: what regulated firms need to know

From March 2027, the majority of Financial Conduct Authority (FCA)-regulated firms will be required to report serious operational incidents to the regulator – many for the first time. The new regime marks a step-change in the FCA's supervisory approach and will demand significant investment in internal processes, systems and governance. 

New UK framework

In March 2026, the FCA published its Policy Statement PS26/2 (Operational Incident and Third Party Reporting) and accompanying finalised guidance FG26/3 and FG26/4.

PS26/2 created a new UK framework for (a) reporting serious operational incidents and (b) reporting material third party arrangements. This Insight focuses on the operational incident reporting requirements set out in PS26/2 and FG26/3. For a discussion of the material third-party reporting requirements introduced by PS26/2 and FG26/4, please see this Insight.

The new rules will take effect on 18 March 2027.

Institutions in scope

The operational incident reporting requirements apply to all firms with a Part 4A permission, payment service providers (PSPs), UK recognised investment exchanges (UK RIEs), registered trade repositories and registered credit rating agencies. 

Within this population, firms are divided into two tiers: 

• "standard" reporting firms: all firms with a Part 4A permission other than enhanced reporting firms, and so comprising approximately 90% of FCA-regulated firms; and 
• "enhanced" reporting firms: a smaller subset including, among others, enhanced scope Senior Managers and Certification Regime (SMCR) firms, banks, building societies, Solvency II firms, CASS large firms, PSPs and UK RIEs.

What is an operational incident?

An "operational incident" is defined as either a single event or a series of linked events which disrupts the firm's operations such that it disrupts the delivery of a service to an end user external to the firm, or  impacts the availability, authenticity, integrity or confidentiality of information or data relating or belonging to such an end user. 

End user is a relatively broad concept, and may include consumers, business customers, market participants, other legal entities, supervisory authorities or members of a firm's group.

This definition is shared by the FCA and the Prudential Regulation Authority (PRA). 

Reporting thresholds

A firm must report an operational incident where it reasonably believes the incident meets one or more of three notification thresholds, namely that it poses a risk: 

• of causing intolerable levels of harm to consumers from which consumers cannot easily recover (the "consumer harm" threshold); 
• to the safety and soundness of the firm and/or other market participants (the "safety and soundness" threshold); or 
• to market stability, market integrity or confidence in the UK financial system (the "market stability" threshold). 

The FCA has deliberately adopted qualitative, outcomes-based thresholds rather than prescriptive quantitative metrics, reflecting the diversity of firms in scope. Firms are expected to exercise reasonable judgement based on their circumstances and available information, and may refer to their own internal risk frameworks when making this assessment, provided those frameworks are consistent with the FCA's thresholds.

Only incidents that have crystallised and met one or more of the reporting thresholds need to be reported. Near misses and planned service interruptions are not reportable under this framework (unless a planned interruption does not go to plan and results in a threshold being met), although firms should consider whether separate notification is required under SUP 15.3.1R and Principle 11. 

Dual-regulated firms will also need to consider the PRA's notification thresholds, as the PRA also has a safety and soundness threshold.

How should reports be made?

All incident reports will need to be submitted via the FCA's Connect platform. 

Standard reporting firms submit a single short-form report as soon as practicable, and in any event within 24 hours, providing basic information about the incident, with no obligation to update it after submission.

Enhanced reporting firms report in three phases (initial, intermediate and final) by updating a single form over the lifecycle of the incident. 

Dual-regulated firms submit a single report through Connect, which is shared with both the FCA and the PRA.

Osborne Clarke comment

The two-tier approach (standard and enhanced) is a pragmatic recognition that the majority of firms do not require the same level of reporting granularity as systemically important institutions.

While the deadline for compliance is not until 18 March 2027, firms should start preparing now, focusing on:

• Reviewing existing frameworks. Firms should review their existing incident response processes and internal frameworks for identifying and managing operational risks, and assess any gaps against the new requirements. This includes ensuring that internal incident classification and escalation processes are capable of identifying incidents that meet the FCA's reporting thresholds and triggering a report within the required timeframes.
• Developing assessment methodologies. Firms should ensure their internal incident triage frameworks are aligned to the FCA's qualitative thresholds and that incident management teams understand when an incident must be escalated for regulatory reporting.
• Building reporting infrastructure. Firms should familiarise themselves with the Connect platform, establish clear internal protocols for who is authorised to submit reports, and conduct dry-run exercises to test their ability to report within the required timeframes.

Firms that have already invested in mapping their important business services and setting impact tolerances will be well placed, but should note that the incident reporting thresholds are not aligned with the concept of important business services (IBS). An incident that does not affect an IBS may still be reportable.

We have already been helping clients to navigate the new incident reporting regime, and would be happy to assist with any queries you may have. Please do get in touch if you would like to discuss how to prepare during this transition period to ensure full readiness by 18 March 2027.