Skip to content 
FCA Operational Incident Reporting Services
Strengthen governance, escalation, and reporting readiness.
The FCA’s new operational incident and third-party reporting requirements take effect on 18 March 2027. Firms in scope will need to assess operational incidents against the reporting thresholds, escalate them when appropriate, and provide timely information to the FCA.
ACA Group helps firms strengthen the governance, processes, and practical response arrangements for operational incident reporting. From readiness reviews and scenario testing to reporting frameworks and response support, we help firms prepare before an incident puts those arrangements under pressure.
Our FCA operational incident reporting services help you:
- Incident decision-making: Clarify how incidents are identified, escalated, and reported
- Cross-functional coordination: Strengthen coordination across key functions, including technology, cybersecurity, compliance, legal, operations, and senior management
- Reporting processes: Align reporting processes with the FCA’s incoming requirements
- Response testing: Test incident response arrangements against realistic cyber, AI, data, and third-party scenarios
Need support preparing for FCA operational incident reporting? Request a strategy session to discuss your priorities and how ACA can help strengthen your approach.
Get more information
Prepare for Operational Incident Reporting
Effective operational incident reporting requires more than a reporting template. Firms need clear thresholds, decision-making processes, escalation routes, and supporting evidence that stand up under pressure.
FCA Reporting Readiness Reviews
Assess incident management and reporting arrangements against the FCA’s new requirements and identify gaps in governance, threshold assessment, escalation, evidence, and third-party oversight.
Escalation and Governance Design
Clarify roles, decision-making responsibilities, and escalation routes across the business, including technology, cybersecurity, compliance, legal, communications, and senior management.
Incident Classification and Reporting Frameworks
Tabletop Exercises and Scenario Testing
Reporting Documentation and Evidence
Post-Incident Review and Remediation
Not Sure What Level of Support You Need?
Speak to an ACA specialist to discuss your firm’s operational incident reporting needs.
FCA Incident Reporting Requires a Coordinated Response
From 18 March 2027, the FCA’s operational incident and third-party reporting requirements will apply. For operational incidents, firms will need to assess whether an incident meets one or more reporting thresholds and follow the standardised reporting process.
Firms need clear processes to identify potential incidents, assess their impact against relevant reporting thresholds, involve the right stakeholders, and provide timely information to support reporting decisions. This can be challenging where incidents involve multiple internal teams, third parties, sensitive data, or artificial intelligence. Firms should be able to:
- Identify and classify incidents consistently
- Assess FCA reporting thresholds and apply escalation routes
- Coordinate decision-making across relevant teams
- Document notifications, decisions, and lessons learned
Build and Test Your Incident Reporting Arrangements
ACA helps firms build and stress-test incident reporting arrangements that work under pressure.
Prepare
Stress-Test
Respond and Improve
ACA Combines Regulatory Expertise with Practical Incident Readiness
Operational incident reporting sits across regulatory compliance, operational resilience, cyber risk, technology, and governance. ACA brings regulatory, cyber, technology, and governance perspectives together to help firms build practical incident reporting arrangements and test how they perform under realistic conditions.
Regulatory Perspective
Cyber and Privacy Risk Expertise
For cyber-related incidents, ACA Aponix brings cyber and privacy risk expertise alongside ACA’s regulatory advisory support. We help firms consider cyber-related reporting issues, develop and stress-test response governance, and strengthen third-party risk arrangements.
Cross-Functional Delivery
Practical, Evidence-Led Support
FCA Operational Incident Reporting Triage Card
Make faster, more structured decisions when an operational incident occurs.
ACA’s practical triage card helps firms structure immediate response and escalation decisions and consider potential FCA reporting implications. It is designed to support cross-functional decision-making when cyber, AI, data, or third-party incidents arise.
FAQs
FCA Operational Incident Reporting Frequently Asked Questions
What is FCA operational incident reporting?
Operational incident reporting involves identifying, assessing, escalating, and documenting operational incidents and, where required, notifying the FCA. It requires firms to assess incidents against applicable reporting thresholds and provide clear, timely information when notification is required.
When does the FCA’s new operational incident reporting regime take effect?
The FCA’s operational incident reporting regime takes effect on 18 March 2027. Firms should use the period before implementation to review their incident management, governance, escalation, and reporting arrangements.
Which incidents may need to be reported to the FCA?
Firms must report an operational incident if they reasonably believe it meets one or more of the FCA’s reporting thresholds. Firms should have clear processes for assessing incidents consistently and escalating decisions appropriately.
How can ACA help firms prepare for FCA operational incident reporting?
ACA can support readiness reviews, incident classification and escalation frameworks, reporting documentation, tabletop exercises, root-cause analysis, and remediation planning. Support can be tailored to a specific priority or delivered as part of a wider programme of work.
Why is cyber and privacy risk expertise important for operational incident reporting?
Cyber incidents, data compromises, technology outages, and third-party failures may trigger operational incident reporting considerations. Firms need to understand the technical and privacy implications of an issue alongside its regulatory and business impact.
ACA combines its compliance team’s FCA regulatory expertise with the specialist cyber and privacy risk capabilities of ACA Aponix. This integrated perspective can help firms test relevant scenarios, strengthen response arrangements, and make more informed incident reporting decisions.
Why should firms run operational incident reporting tabletop exercises?
Tabletop exercises allow firms to test whether their teams can identify an incident, access the right information, make decisions, and coordinate communications under pressure. They can reveal gaps in roles, escalation routes, documentation, and reporting processes before an incident occurs.
Can ACA help after an incident has occurred?
Yes. ACA can support post-incident assessment, documentation, root-cause analysis, remediation planning, and lessons learned to help firms strengthen their arrangements.
What should I do if I need help with FCA operational incident reporting?
Contact ACA to discuss your firm’s operational incident reporting requirements. Our specialists can help you identify the right starting point, whether that is a readiness review, incident reporting framework, tabletop exercise, or support following an incident.
Contact Us
Learn from our experts
