FCA Incident Reporting Puts Operational Resilience to the Test

From Operational Resilience to Incident Reporting

March 2027 marks another significant milestone in the FCA’s resilience agenda, when its new operational incident and third-party reporting rules take effect.

This is distinct from the FCA’s earlier operational resilience rules. Organisations in scope of that framework, including banks and enhanced scope SM&CR firms, were required to identify important business services, set impact tolerances, and complete mapping and testing so that they could remain within those tolerances by 31 March 2025.

In March 2026, the FCA published its final operational incident and third-party reporting rules, effective 18 March 2027. The operational incident reporting requirements apply to firms with a Part 4A permission, payment service providers, UK Recognised Investment Exchanges (RIEs), registered trade repositories, and registered credit rating agencies.

As a data-driven regulator, the FCA is seeking more detailed, accurate, and consistently structured information to help it understand how incidents affect firms and markets. The rules signal a clear shift towards greater regulatory visibility, accountability, and standardised reporting.

Firms that embed operational resilience into their business practices will be better prepared to assess, escalate, and report incidents while continuing to deliver critical services during disruption.

What Would Your Firm Do if It Learned of a Data Breach Five Minutes Before It Became Public?

Following a 2017 cybersecurity breach involving its U.S. parent company, the FCA fined a UK provider of credit-reporting and identity-verification services £11,164,400 in 2023 for failing to manage and monitor the security of UK consumer data it had outsourced to its parent company based in the U.S.

The FCA found risk management failings relating to outsourced data processing arrangements, highlighting that firms remain accountable even where activities are outsourced within a group. For example, the UK provider’s outsourcing policy did not specify whether it applied to intra-group arrangements and did not identify the risks associated with intra-group outsourcing.

The UK provider did not find out that UK consumer data had been accessed until six weeks after its U.S. parent company had discovered the breach. It was informed approximately five minutes before the parent company announced the incident publicly. This left the UK provider unable to cope with the complaints it received and led to delays in contacting UK customers. The parent company made several public statements that gave an inaccurate impression of the number of consumers affected.

Fair complaints handling procedures and communication that is fair, clear, and not misleading are imperative, but they are only one aspect of dealing with an operational incident of this type. Firms should also maintain effective cybersecurity arrangements and oversee outsourced data-processing activities. Internal and external messaging should be aligned, with customer impact remaining a central priority. As the FCA said in its enforcement action, “Regulated firms are on the hook, regardless of whether they outsource or not.”

Prepare Before an Incident Occurs

Operational resilience is a firm’s ability to prevent, adapt to, respond to, recover from, and learn from operational disruptions. It focuses on maintaining important business services when disruption occurs. Plans on paper are not enough. Firms within scope must understand how disruption could affect important business services, test their ability to remain within impact tolerances, and demonstrate operational resilience in severe but plausible scenarios.

Achieving this has become significantly more challenging as firms adopt complex technology ecosystems and rely increasingly on outsourced providers, cloud infrastructure, data vendors, and other third parties. While these arrangements can drive efficiency and innovation, they also create interconnected dependencies and concentration risks. A failure at a single provider may have a substantial effect on the firm.

In practical terms, firms should begin by asking the following questions:

• How are operational incidents identified, assessed, and escalated?
• Is there a documented owner, or owners, for operational resilience who can promptly inform and convene key stakeholders, including compliance, following an incident?
• Which senior manager or managers have responsibility for operational resilience?
• Does our threshold assessment consider the specific circumstances of each incident rather than applying a formulaic approach?
• Are we asking questions like “Was the outage longer than four hours?” instead of using scenario-specific analysis that considers the duration relative to key business processes? A four-hour disruption may be manageable in one scenario but critical in another.
• Is the same formulaic methodology being applied, regardless of the nature, scale, duration and impact of the event (and therefore failing to capture contextual factors)?
• Are individual factors being considered in isolation, rather than in combination, creating a materially inaccurate assessment and causing incidents to be misclassified?
• Have dependencies on third-party providers been mapped, andhas due diligence been conducted to assess their resilience?
• Have we tested our processes through realistic scenarios before 18 March 2027 to uncover vulnerabilities and address weaknesses?
• Do we have the required recordkeeping in place that explains our decisions?