The 2027 Reporting Rules Will Test More Than Your Incident Plan

The FCA’s new operational incident and material third party reporting rules take effect on 18 March 2027. For affected financial services firms, preparing for them means more than learning a new reporting process. It means being able to build a clear, consistent account of what happened, which services were affected and how the firm responded.

Building that account may involve technology, operations, risk, compliance and suppliers. If ownership and records are unclear, the firm may struggle to assess the event when time matters.

Two related requirements with different scopes

The FCA, PRA and Bank of England have developed a common regime for operational incident and third-party reporting. The operational incident rules apply to all firms with a Part 4A permission, alongside other named categories such as payment service providers and UK recognised investment exchanges. The rules set thresholds for which incidents must be reported, so the change does not mean every IT issue or short service interruption is automatically reportable.

The material third party reporting requirements have a narrower scope. They apply to specified groups, including designated investment firms, enhanced-scope SM&CR firms, banks, building societies, Solvency II firms and large CASS firms, among others. Firms in scope will need to notify the FCA about new material third-party arrangements and significant changes to existing ones, and maintain and submit an annual register of material arrangements.

Investment groups should confirm the position for each regulated entity; permissions and obligations can differ within one group.

The test is wider than a cyber attack

A cyber attack is one example. Operational disruption can also start with a system failure, supplier outage, failed update or process breakdown. The FCA’s definition covers single or linked events that disrupt a firm’s operations, including external services or the availability, authenticity, integrity or confidentiality of related information.

Whether an event meets the reporting thresholds will depend on its impact and the applicable rules. The practical challenge is that a firm needs enough visibility to assess that impact. Which service was disrupted? Were clients or counterparties affected? Did the disruption involve a third party? What has been restored, and what remains uncertain?

A helpdesk ticket may say only that a service was unavailable, while the supplier holds the timeline and explanation. Firms need their own view of the event and a reliable way to gather information from others.

Where firms should begin

With the implementation date less than five months away, leaders can use the remaining preparation time to check three practical areas.

Clarify the decision path. Make sure people know how to escalate a suspected operational incident, who assesses its impact against the relevant thresholds and who coordinates regulatory reporting. The process should work across technology, operations, risk and compliance.
Make incident information useful. Records should help the firm reconstruct the event: when it began, which services and users were affected, how the impact changed, which suppliers were involved, what actions were taken and when recovery was confirmed.
Understand important dependencies. Identify the external services the business relies on and how the firm would obtain timely information if one of them failed. Firms in scope of the material third-party requirements should also confirm how they will assess materiality, capture changes and keep their register current.

Test the process with a realistic scenario, such as a cloud outage affecting a portfolio or investor platform. Who identifies the affected service, assesses client impact, records supplier updates and decides whether a reporting threshold has been met? The exercise should expose gaps while there is time to address them.

Treat reporting readiness as part of resilience

The regime is intended to give regulators more consistent information. For firms, clear ownership, dependable records and visibility of supplier dependencies also support better decisions during recovery.

Start by confirming each entity’s regulatory position and testing whether its incident and supplier information supports a timely assessment. Reporting readiness needs to be in place before an incident occurs.

Couno brings cyber security, technology operations, resilience and governance together through the Couno Managed IT Framework. To review how your environment supports incident readiness, request a Cyber Security Audit.