Operational Incident and Third Party Reporting: The FCA's new framework under PS26/2

The incident reporting regime will apply to:

• all firms with a Part 4A FSMA permission;
• payment service providers (PSPs);
• UK recognised investment exchanges;
• registered trade repositories; and
• registered credit rating agencies.

Dual regulated firms (FCA and PRA) will only need to make one submission via a shared system using aligned templates.

An operational incident is a single event or a series of linked events that disrupts a firm’s operations and either:

• disrupts the delivery of a service to external end users; or
• impacts the availability, authenticity, integrity or confidentiality of information or data relating or belonging to an external end user.

“Linked events” includes those with a cumulative impact that disrupts a firm’s operations. “External end users” is interpreted broadly and includes customers, market participants, group entities and supervisory authorities.

FG26/3 provides more detailed guidance as to whether an event or series of events meets this definition. 

Firms must report where they reasonably believe an incident meets one or more of the notification thresholds, namely where the incident poses a risk:

• of causing intolerable levels of harm to consumers, from which consumers cannot easily recover;
• to the safety and soundness of the firm and/or other market participants;
• or to market stability, market integrity or confidence in the UK financial system.

Firms should consider a range of factors when assessing whether an incident meets any of these thresholds, details of which can be found in Chapter 4 of FG26/3. Dual-regulated firms should also consider whether an incident meets the PRA’s thresholds. 

Firms should report an incident as soon as practicable via FCA Connect, and no later than 24 hours after determining that it meets one or more of the FCA’s thresholds. PSPs in particular must report incidents within 4 hours of first detection.

Near misses and planned outages will not usually need to be reported. However, firms should consider whether they should notify the FCA under general notification requirements in accordance with Principle 11 of the FCA’s Principles for Businesses. 

Two reporting tiers apply.

• Standard reporting: a single, relatively short submission (for most firms).
• Enhanced reporting: a more detailed, lifecycle-based report with updates and a final submission.

The applicable tier will determine the level of detail and ongoing reporting required, with enhanced reporting firms subject to greater scrutiny and more extensive obligations.

The changes apply to:

• enhanced scope Senior Managers & Certification Regime (SM&CR) firms;
• banks and designated investment firms;
• Solvency II firms and building societies;
• Client Assets Sourcebook (CASS) large firms;
• UK recognised investment exchanges;
• authorised electronic money institutions or authorised payment institutions; and
• consolidated tape providers.

Third-country branches of international firms are excluded from notification requirements but must submit the annual register.

A third party arrangement covers any service or product provided to a firm (including intra-group and subcontracted services). 

A “material third party arrangement” is a third party arrangement which is of such importance that a disruption or failure in the performance of the product or service provided to the firm could:

• cause intolerable levels of harm to the firm’s clients;
• pose a risk to the soundness, stability, resilience, confidence or integrity of the UK financial system; or
• cast serious doubt on the firm’s ability to satisfy the threshold conditions, or meet its obligations under the FCA’s Principles for Businesses, or under SYSC 15A (Operational resilience).

Materiality must be assessed case-by-case, and Firms are expected to embed this assessment within their third-party risk management frameworks. Factors which firms should consider when making such assessments are detailed in FG26/4, Chapter 3. 

Firms must notify the FCA of:

• new material arrangements; and
• material changes to existing arrangements. 

Notifications should be made early in the decision-making process, before the firm becomes contractually or operationally committed. There is no prescribed deadline, but early engagement is expected.

A firm should complete the prescribed template and submit this online via the appropriate system on the FCA’s website. 

There is no prescribed timeline for submitting notifications, or for the FCA to review them. However, the FCA expects firms to notify it at an early stage. 

In addition to notifications, the FCA requires firms to:

• maintain a register of their material third party arrangements which is accurate as of 31 December of the previous year; and
• submit it to the FCA annually within 90 calendar days of the FCA opening the reporting window.

Third country branches are also required to submit this register.