FCA PS26/2: Operational Incident and Third Party Reporting

By the Guardian team Updated November 2026 6 min read

Quick answer. From March 18, 2027, Part 4A firms must report qualifying incidents as soon as practicable; the FCA expects this within 24 hours of deciding one qualifies. Banks and other listed firms also notify and register material third parties.

Watch: FCA PS26/2: Operational Incident and Third Party Reporting 1:46

Video transcript

From March 18, 2027, Part 4A firms must report qualifying incidents as soon as practicable. The FCA expects that within 24 hours of deciding one qualifies.

The FCA, PRA and Bank of England now share one definition, one Connect submission, one timeline and one set of templates.

An incident is reportable when the firm reasonably believes it poses one of three risks: consumer harm, safety and soundness, or market stability. Near misses do not count.

About 90 percent of FCA firms file a short standard report. Banks, payment service providers and other listed firms file an enhanced report, with updates and a final report.

For most firms, the clock starts at the threshold decision, not at detection. Payment service providers keep a four hour deadline from first detection.

Over 40 percent of cyber incidents reported to the FCA in 2025 involved a third party. Banks and other listed firms must also notify and register material third parties.

Crypto businesses are in scope once authorized. From October 25, 2027, authorized cryptoasset firms also join the third party register rule.

The FCA found many firms reported several days after detection. Build onchain and offchain detection, a threshold decision log, a tested Connect submitter, provider telemetry and a 24 hour tabletop.

Guardian's Managed Security monitors contracts and offchain systems, with an engineer responding around the clock. Read the full article, or talk to Guardian.

The FCA, PRA and Bank of England have set one aligned process for operational incident and third party reporting. It applies from March 18, 2027.

To meet the 24-hour expectation, a firm has to detect an incident, scope it and make the threshold call fast. The FCA found many firms reported incidents several days after first detecting them.

For crypto firms, the date falls before the FCA's crypto rules start on October 25, 2027. Our UK crypto deadlines post has the full calendar.

This article explains the technical and security side of the FCA's PS26/2 and the PRA's PS7/26. It is not legal advice; confirm how it applies to you with counsel.

What PS26/2 Changed

The FCA published PS26/2 on March 18, 2026, with two finalized guidance documents: FG26/3 on incidents and FG26/4 on third parties. The PRA published PS7/26 the same day.

The legal text is FCA 2026/6, which adds SUP 15.18, SUP 15.19 and SUP 16.33 to the Handbook. Across the regulators there is now:

one definition of an operational incident
one submission in FCA Connect, shared with the PRA where relevant
one reporting timeline, except for payment service providers
one template each for incident reports, third party notices and the register

Thresholds still follow each regulator's objectives. The separate incident reporting rules for payment service providers and credit rating agencies fold into this one.

Who Is in Scope

Incident reporting

It applies to all firms with a Part 4A permission, payment service providers, UK recognized investment exchanges (RIEs), registered trade repositories and registered credit rating agencies.

About 90% of FCA firms file a standard report. A listed group files an enhanced one:

enhanced scope SM&CR firms, banks and building societies
designated investment firms and Solvency II firms
CASS large firms and payment service providers
UK RIEs, trade repositories and credit rating agencies

Third party reporting

Notices and the register apply to:

enhanced scope SM&CR firms, banks and building societies
designated investment firms, Solvency II firms and CASS large firms
UK RIEs and consolidated tape providers
authorized e-money and payment institutions

Firms with a registered office outside the UK skip notices. Third country branches still submit the register.

Crypto firms

SUP 15.18 applies to every firm with a Part 4A permission, so a crypto business is in scope once authorized. A firm already holding a permission is in scope from March 18, 2027.

PS26/13 adds authorized cryptoasset firms to the register rule, SUP 16.33, from October 25, 2027. It does not amend the notice rule, SUP 15.19.

The Three Reporting Thresholds

An operational incident is a single event, or linked events, that disrupts the firm's operations in one of two ways.

It disrupts a service to an end user external to the firm.
It affects the availability, authenticity, integrity or confidentiality of that user's data.

It is reportable when the firm reasonably believes it poses one of three risks.

Consumer harm: intolerable harm consumers cannot easily recover from.
Safety and soundness: of the firm or other market participants.
Market stability: market stability, market integrity or confidence in the UK financial system.

The PRA's own thresholds are safety and soundness, financial stability and, for insurers, policyholder protection.

An incident need not touch an important business service to be reportable. Where impact tolerances apply, the FCA expects a report before they are breached.

What does not count

Near misses do not count, such as a DDoS attack that was stopped. Nor do planned interruptions that go to plan.

Internal severity scales are fine. But a firm must not skip a report only because an incident misses its own scale.

Standard and Enhanced Reports

	Standard	Enhanced
Who	About 90% of FCA firms	Firms listed in SUP 15.18.3R
Form	One short form, 10 required questions	One form, updated in three phases
Updates	None required	On any significant change
Final report	None	Within 30 working days of resolution

The clocks

Report	Deadline	Basis
Initial	As soon as practicable	Rule, SUP 15.18.6R
Initial	Within 24 hours of determining a threshold is met	FCA expectation, SUP 15.18.7G
Intermediate	After any significant change, including resolution	Rule, enhanced only
Final	30 working days after resolution; 60 at most	Rule, enhanced only
PSPs	Within 4 hours of first detection	Takes precedence over 24 hours

FG26/3 says firms should not wait the full 24 hours. For most firms the clock starts at the threshold decision, not at detection.

What a standard report asks

status, trigger threshold and type: disruption or data loss
title, description and the firm's severity rating
time of detection, and time of resolution once resolved
actions taken and actions planned to recover
the third party's name, if one caused it

Material Third Party Reporting

In 2025, over 40% of cyber incidents reported to the FCA involved a third party. An arrangement is material if its disruption or failure could:

cause intolerable harm to the firm's clients
pose a risk to the soundness, stability, resilience, confidence or integrity of the UK financial system
cast serious doubt on the firm meeting its threshold conditions, the Principles or SYSC 15A

Notices and the register

In-scope firms must notify the FCA when entering into, or significantly changing, a material arrangement. The FCA expects notice early, before any internal or external commitment.

Intragroup arrangements with no external provider behind them are excluded, except for UK RIEs.

Firms keep a register of material arrangements and submit it once a year, when invited. Each window runs 90 calendar days.

FG26/4 says these are normally material:

data centers, cloud, hosting and managed service providers
cybersecurity services a third party builds and monitors, such as DDoS mitigation
services key to an important business service, such as SaaS or payments

Our suggestion for crypto firms: test custody technology, node and RPC providers and signing services against the same definition. Our FG26/6 checklist covers critical providers such as MPC or HSM custody.

What to Build Before March 2027

Detection on every client-facing system, onchain and offchain.
Onchain triggers: unexpected mints, role changes, upgrades, pauses and large outflows.
A threshold decision log: who decided, when, and on what facts.
A named Connect submitter, with access tested before go-live.
Escalation where a low internal severity cannot block a report.
Provider telemetry, so a third party outage is scoped in hours.
A register built from contracts and dependency maps.
A notice step in procurement, before any commitment.
A tabletop that files a mock initial report inside 24 hours.

Custodians should link their key incident runbook to this one. Our CASS 17.4 checklist covers the key side.

Questions to settle with compliance

Are we a standard or an enhanced reporter?
Do we owe third party notices, or only the register?
Which providers meet the material definition?
Who makes the threshold call out of hours?

How Guardian Helps

Guardian's Managed Security monitors contracts on every block: privileged calls, role and ownership changes, upgrades, multisig transactions and large fund movements.

Offchain, it watches domains, DNS, certificates, cloud and code hosts. When something fires, a Guardian engineer responds, around the clock.

Guardian's operational resilience assessment covers incident classification and reporting: your clocks, what starts each one, and a rehearsed path to file on time. It also covers third party registers and exit plans.

Frequently Asked Questions

When do the FCA's PS26/2 rules start?

On March 18, 2027. The FCA published the final rules on March 18, 2026, giving firms 12 months to prepare. It plans to review the policies two years after implementation.

How quickly must a firm report an operational incident?

As soon as practicable after it reasonably believes a threshold is met. FCA guidance expects the initial report within 24 hours of that determination. Payment service providers keep their 4-hour deadline from first detection.

Do crypto firms have to report incidents under PS26/2?

Yes, once authorized. Incident reporting applies to every firm with a Part 4A permission. PS26/13 also adds authorized cryptoasset firms to the material third party register rule from October 25, 2027.

Do firms have to report near misses?

Not under SUP 15.18, which covers only crystallized incidents that meet a threshold. Firms should still consider a notice under Principle 11 or SUP 15.3 through their usual supervisory channel.

Sources

Detect it fast enough to report it

Guardian monitors your contracts and infrastructure around the clock, and a Guardian engineer responds when something fires.

Talk to Guardian Explore Managed Security