Financial services · FCA · PRA
Operational resilience and cyber for UK financial firms: the 2027 guide
From 18 March 2027, FCA and PRA rules require firms to report operational incidents within 24 hours of meeting the threshold and to keep a register of material third parties. This guide covers those rules, operational resilience, critical third parties, accountability and AI, for payment and e-money firms, building societies, investment and wealth firms, insurers and brokers.
At a glance
Scope
Who this applies to
| Requirement | Who is in scope |
|---|---|
| Operational incident reporting (from 18 March 2027) | All firms with a Part 4A permission, payment service providers, recognised investment exchanges, trade repositories and credit rating agencies. That includes most brokers, advisers and smaller firms. |
| Third-party notification and register (from 18 March 2027) | Enhanced scope SM&CR firms, banks, designated investment firms, building societies, Solvency II insurers, CASS large firms, recognised investment exchanges, authorised payment and e-money institutions, and consolidated tape providers. |
| Operational resilience (in force since 2022) | Banks, building societies, PRA-designated investment firms, insurers, recognised investment exchanges, enhanced scope SM&CR firms, payment and e-money firms, consolidated tape providers and qualifying cryptoasset firms. |
| Outsourcing and third-party risk (PRA SS2/21) | PRA-regulated firms. FCA-only firms follow the FCA’s outsourcing rules in SYSC 8 and related guidance. |
Check your own permissions and categorisation against the rules. The scopes differ, and a firm can be in one and not another.
The foundation
Operational resilience, three years on
Since March 2022, in-scope firms have had to identify their important business services (those whose disruption could cause intolerable harm to consumers or markets), set an impact tolerance for each, map the people, processes, technology and third parties behind them, test against severe but plausible scenarios, and have a communications plan. By 31 March 2025 firms had to be able to stay within those tolerances. That transition is over. Supervisors now test whether it is true.
The FCA’s published observations, including lessons from the July 2024 global IT outage, point to the same weaknesses:
- Testing that is not severe enough to prove you can stay within tolerance.
- Weak oversight of third parties, and no workable manual workaround when a provider fails.
- Slow recovery and communication when core infrastructure goes down.
- Governance gaps: cyber resilience treated as an IT matter rather than a whole-firm, board-level one.
A cyber attack is the scenario most likely to test every one of those at once. If your scenario testing has not included a ransomware attack on a critical provider, it should.
New from March 2027
Incident reporting from 18 March 2027
FCA PS26/2 and PRA PS7/26 define what an operational incident is, set thresholds for reporting, and create a single submission process so a firm regulated by both makes one report, not two.
- Thresholds. For the PRA, incidents that pose a risk to UK financial stability, the firm’s safety and soundness or, for insurers, policyholder protection. The FCA’s thresholds focus on harm to consumers and market integrity. You assess them using your own process, with regulatory guidance.
- Initial report within 24 hours of determining that an incident meets the threshold (PRA wording), with allowance if your people are fully engaged in the response.
- Intermediate updates when something significant changes, such as invoking business continuity plans.
- Final report within 30 working days of resolution, extendable to 60 for complex incidents.
The 24-hour question to ask now
At 2am on a Sunday, with email down, who decides whether an incident has met the threshold, how do they make that decision, and how do they submit the report? If the answer relies on one person or on systems that may be down, it will fail on the night. Write the classification process, name deputies, keep templates offline and rehearse it.
New from March 2027
Third-party reporting and your register
In-scope firms must notify the regulator of new or significantly changed material third-party arrangements, and keep a register of them and submit it annually. The policy statements define “material”.
The register is only as good as the thinking behind it. The firms that find this straightforward already know, for each important business service, which third parties it depends on, including the fourth parties behind them, what the contract allows, how they would exit and how long a manual workaround would last. If you do not know that yet, start with your important business service maps, not with a spreadsheet template.
AI providers belong in this picture. A model or AI platform embedded in onboarding, fraud detection or customer service may be a material third party.
Critical third parties
Critical third parties: what changes for you
On 10 July 2026 HM Treasury designated the first critical third parties to the UK financial sector (AWS, Google Cloud, Microsoft and Oracle), and the Bank of England, PRA and FCA began overseeing them from 13 July 2026.
That oversight is about systemic risk. It does not transfer your responsibility for your own resilience. You still need to understand how you depend on these providers, test what happens if one fails, and have plans that do not assume the regulator will fix it. Firms remain responsible for their outsourced and third-party arrangements under PRA SS2/21 and the FCA’s rules.
Governance
Accountability and the board
Under the Senior Managers and Certification Regime, operational resilience sits with named senior managers, and the board approves the firm’s operational resilience self-assessment. In practice regulators expect the board to be able to explain its important business services, its tolerances, what testing showed and what it is doing about the gaps. Cyber resilience is part of that, not a separate IT topic.
Larger firms may be asked to take part in the Bank of England’s CBEST or the PRA and FCA’s STAR-FS threat-led testing. Every firm in scope of operational resilience needs scenario testing proportionate to its size.
AI
AI and the regulators
The FCA has said it will not write AI-specific rules. It expects firms to meet existing obligations, particularly the Consumer Duty and SM&CR, when they use AI, and it runs an AI Lab and live testing programme. For a firm using AI in customer journeys, underwriting, fraud or operations, the practical questions are the same as for any critical process: who is accountable, how outcomes for customers are monitored, how the supplier is overseen, and what happens when it fails. Our AI deployment review answers those questions and leaves you with the record a supervisor would ask for.
Card payments: if you store, process or transmit card data, PCI DSS v4.0.1 applies, and its future-dated requirements became mandatory on 31 March 2025. We are not a PCI Qualified Security Assessor, but we can help you prepare and get governance right around it.
Planning
Your plan to 18 March 2027
| When | What to do |
|---|---|
| October–November 2026 | Confirm which parts of the new rules apply to you. Name the accountable senior manager. Gap-assess your incident process and third-party records against PS26/2 and PS7/26. |
| December 2026–January 2027 | Write the incident classification and reporting process with thresholds, decision owners, deputies and offline templates. Build the material third-party register from your important business service maps. |
| February 2027 | Rehearse: an incident exercise that runs the 24-hour decision and report end to end, with executives. Fix what it exposes. |
| March 2027 | Board sign-off of the process and register. Live from 18 March 2027. |
| After go-live | Notify new or changed material arrangements as they happen. Submit the register annually. Feed incidents and near misses back into your operational resilience self-assessment. |
Working with us
How we can help
2027 reporting readiness review
An independent review of your incident classification, reporting and third-party processes against PS26/2 and PS7/26, with a prioritised plan to 18 March 2027.
Fixed price, agreed before we start
Material third-party register
Building or testing the register from your important business services, including fourth parties, exit plans and AI providers.
Ask about third-party registers
Fixed price, agreed before we start
Incident exercise: the 24-hour test
A realistic cyber scenario that takes your executives through the threshold decision, the report and the recovery.
From £2,650 + VAT
Operational resilience challenge
Independent challenge of your self-assessment, scenario testing and cyber assumptions before the board signs it.
Fixed price, agreed before we start
Board and senior manager briefing
What the 2027 rules, operational resilience and AI mean for the people who are personally accountable.
Fixed price per session
AI governance and virtual CISO
An AI deployment review for regulated use, or a virtual CISO to own cyber resilience where you have nobody in post.
Fixed price or monthly retainer
Independent by design
We assess and advise. We do not sell the technology or managed services that would close the gaps we find, so our findings are not a sales pitch.
FAQ
Questions we are asked
When do the new incident and third-party reporting rules apply?
From 18 March 2027, under FCA PS26/2 and PRA PS7/26, both published on 18 March 2026.
How quickly must we report an incident?
Under the PRA’s rules, an initial report within 24 hours of determining the incident meets the threshold, updates when things change significantly, and a final report within 30 working days of resolution (up to 60 for complex incidents).
We are a small FCA-only firm. Does this apply to us?
Incident reporting applies to all firms with a Part 4A permission and to payment service providers. The third-party register applies to a narrower group, including enhanced scope SM&CR firms and authorised payment and e-money institutions. Check your own categorisation.
Does critical third party oversight reduce our obligations?
No. Oversight of AWS, Google Cloud, Microsoft and Oracle addresses systemic risk. Your responsibility for your own resilience and third-party risk management is unchanged.
Are there AI-specific rules from the FCA?
No. The FCA expects firms to apply existing rules, especially the Consumer Duty and SM&CR, to their use of AI.
Sources
Primary sources
- PS26/2: Operational incident and third party reporting (FCA, 18 March 2026)
- PS7/26: Operational incident and third-party reporting (PRA, 18 March 2026)
- PS21/3: Building operational resilience and operational resilience hub (FCA)
- SS2/21: Outsourcing and third party risk management (PRA)
- Regulators begin overseeing critical third parties (Bank of England, July 2026)
- PS24/16: Critical third parties to the UK financial sector (FCA)
- Operational resilience of the financial sector, CBEST and STAR-FS (Bank of England)
- FCA AI Lab (FCA)
- PCI DSS v4.x future-dated requirements (PCI Security Standards Council)