Third parties are deeply embedded in the delivery of financial services. When they fail, the effects can spread quickly. In 2025, more than 40% of cyber incidents reported to the Financial Conduct Authority (FCA) involved a third party.[1]
Against this backdrop, the FCA, Prudential Regulation Authority (PRA) and Bank of England have introduced an aligned regime for operational incident and material third-party reporting. The new requirements take effect on 18 March 2027.[2]
For firms in scope, this is more than another regulatory return. A serious incident may need to be reported while teams are still trying to contain it. Material third-party information must stay current as arrangements change, rather than being reconstructed for an annual submission.
Protecht has updated its incident and vendor risk management capabilities to support the new requirements. This allows firms to capture the information regulators require through their existing risk processes, then use it when a report or notification is due.
Want to know more about how Protecht’s incident and vendor risk capabilities can support your PS26/2 program? Join our upcoming PS26/2 webinar:
What is changing in March 2027?
There are two related but distinct parts to the new regime.
Operational incident reporting
The FCA is introducing a standardised process for reporting operational incidents that meet defined thresholds.
An incident becomes reportable where a firm reasonably believes it risks causing intolerable harm to consumers, threatens the safety and soundness of the firm or other market participants, or presents a risk to market stability, market integrity or confidence in the UK financial system.[3]
There are two reporting routes. Most FCA firms will use Standard reporting, submitting a single report containing core information about the incident. A defined subset will use Enhanced reporting, which follows the incident through initial, intermediate and final reporting phases.
Firms should report as soon as practicable and within 24 hours of determining that an incident meets the relevant thresholds. Payment service providers face a tighter deadline: their initial report is due within four hours of first detecting the incident.
For Enhanced reporting, firms may then need to update information as circumstances change before submitting a final report once the incident has been resolved.
These deadlines make the quality of the underlying incident process important. Teams should already know where the required information comes from, who owns it and how it will be updated as the incident develops.
Material third-party reporting
The second part of the regime applies to a narrower group of firms.
In-scope firms will need to notify the FCA of new material third-party arrangements and significant changes to existing ones, maintain a register of those arrangements and submit the register annually.
The regime goes beyond traditional outsourcing. For firms within scope, reporting also covers material non-outsourcing third-party arrangements.[4]
A significant change could include a material change in the scope of services provided, how sensitive data is stored or processed, the location of data, the third party's ownership or financial position, or the third party or key subcontractor involved.[5]
The FCA has not prescribed a fixed notification period. It does, however, expect firms to notify it early and before making internal or external commitments. This should leave enough time for regulatory engagement before the firm becomes contractually or operationally committed.
Material third-party reporting therefore reaches into onboarding, contract changes, vendor governance and decisions about whether an arrangement is material. An annual submission is only one part of the process.
Why the challenge starts before a report is due
Regulatory reporting can look like an output problem: understand the form, collect the information and submit it. The new regime puts greater demands on the processes that produce that information.
Take a reportable operational incident. Teams may be restoring services, investigating the cause, assessing customer impact and managing communications at the same time. The regulator may also require information held across technology, operations, risk, compliance and third-party management.
If those records sit in separate spreadsheets, inboxes and systems, a tight reporting deadline becomes a reconciliation exercise when teams have little spare capacity. Enhanced reporting increases the pressure because information may need to be revised as the incident develops.
The practical test is whether the required information is already captured, owned and accessible when reporting begins. A standardised template cannot make up for missing, stale or fragmented data.
Material third-party reporting poses a similar problem over a longer period.
The register needs to reflect current arrangements. Firms must identify new material relationships, recognise significant changes and keep the underlying information accurate enough to support notifications and annual reporting.
The FCA expects to open the first annual register submission window at the end of the implementation period, after which firms will have 90 calendar days to submit their register.
That period will be far easier to manage if the register is already current. Reconstructing the third-party landscape at submission time means finding contracts, confirming services and owners, tracing dependencies and reconciling inconsistent records.
A better approach is to maintain the register as risk information. Relevant details enter the process when a third party is assessed and are updated when the arrangement changes. Regulatory submissions can then draw on records the firm already maintains.
What should firms be doing now?
With the rules taking effect on 18 March 2027, firms can use the implementation period to test both their interpretation of the rules and the processes behind their submissions.
1. Confirm which requirements apply
The scope of operational incident reporting differs from that of material third-party reporting. Firms should establish which parts of the regime apply rather than assume that being subject to one automatically brings them within the other.
Dual-regulated firms should also consider the relevant PRA requirements alongside the FCA regime.
2. Compare existing information with the new requirements
The FCA has published reporting templates and guidance setting out the information firms will need to provide.
Firms can map these requirements against their existing incident and third-party records to identify gaps before March.
The useful questions are practical ones. Is the information already captured? Where is it maintained? Who owns it? How is it kept current? A field that can theoretically be obtained may still create a problem if finding it requires manual investigation.
3. Define how reporting decisions will be made
Teams need clear responsibility for assessing incident thresholds, making reporting decisions and supplying the evidence behind those decisions.
The same applies to deciding whether a third-party arrangement is material and whether a change is significant.
Clear ownership and escalation become particularly important when decisions have to be made quickly.
4. Identify where the data comes from
Incident and third-party reporting often crosses organisational boundaries.
Technology teams may hold information about an outage. Operations may understand its effect on customers. Risk may own the incident record. Procurement or vendor management may own the commercial relationship with an affected provider.
Each reporting field should have an identifiable source and owner. If producing the report requires a search across several teams and systems, the process needs attention before March.
5. Build the requirements into existing workflows
The FCA has encouraged firms to consider the new framework alongside their existing internal processes rather than replace them wholesale.
Firms can use that approach to make reporting part of their normal risk management processes. Incident information can be captured while the incident is being managed. Third-party information can be updated when arrangements are created or changed.
This reduces the need to maintain separate regulatory records alongside the information used to manage the underlying risk.
6. Test the process before March
A simulated reportable incident can expose missing data, unclear ownership and approval bottlenecks. Firms can apply the same approach to a mock material third-party notification or annual register submission.
The test should establish whether the firm can produce the required information, how much manual work is involved, whether responsibilities are clear and how the process handles changing information.
Testing before implementation leaves time to fix weaknesses before a real reporting deadline arrives.
Reporting forms part of the wider resilience regime
The new requirements sit within a broader regulatory focus on operational dependencies.
Financial services firms increasingly rely on interconnected technology and third-party ecosystems. In July 2026, Amazon Web Services, Google Cloud, Microsoft and Oracle became the UK's first designated critical third parties, bringing specified services under direct joint oversight by the FCA, PRA and Bank of England.[6]
That regime is separate from firms' material third-party reporting obligations. Designation also does not transfer responsibility to the provider. The FCA states that firms remain responsible for managing their own third-party risks under existing operational resilience and outsourcing requirements.
Better incident and third-party information therefore serves more than the regulatory return. It can also give firms a clearer view of their dependencies, risks and resilience.
Preparing for March 2027 with Protecht
The most efficient approach is to use the same information to manage the risk and meet the reporting requirement.
Protecht helps firms maintain operational incident and material third-party information within their existing risk workflows.
For operational incidents, firms can capture the information needed for Standard or Enhanced reporting within their incident processes and use it to prepare regulator-aligned reports. For Enhanced reporting, Protecht can also support the initial, intermediate and final reporting lifecycle, including reminders for follow-up activity.
For material third parties, firms can maintain relevant arrangement information within vendor risk management workflows. That information can support notifications for new or significantly changed arrangements as well as the annual material third-party register.
Capturing information as the underlying activity takes place reduces reliance on separate spreadsheets and last-minute data gathering. It also gives firms a more durable way to incorporate the March 2027 requirements into day-to-day risk management.
Preparing for the new UK operational incident and material third-party reporting requirements? Book a demo and see how Protecht can help you bring the required information into your existing incident and vendor risk management workflows.
References
[1] Financial Conduct Authority, FCA confirms new incident and third party rules to bolster resilience, 18 March 2026.
https://www.fca.org.uk/news/news-stories/fca-confirms-new-incident-and-third-party-rules-bolster-resilience
[2] Financial Conduct Authority, PS26/2: Operational incident and third party reporting, 18 March 2026.
https://www.fca.org.uk/publications/policy-statements/ps26-2-operational-incident-third-party-reporting
[3] Financial Conduct Authority, FG26/3: Operational Incident Reporting, March 2026.
https://www.fca.org.uk/publication/finalised-guidance/fg26-3.pdf
[4] Financial Conduct Authority, Reporting material third party arrangements, 18 March 2026.
https://www.fca.org.uk/firms/outsourcing-and-operational-resilience/reporting-material-third-party-arrangements
[5] Financial Conduct Authority, FG26/4: Material Third Party Reporting, March 2026.
https://www.fca.org.uk/publication/finalised-guidance/fg26-4.pdf
[6] Financial Conduct Authority, Critical Third Parties: Strengthening UK Financial Services, updated July 2026; and UK financial regulators to begin overseeing Critical Third Parties announced by Treasury, 10 July 2026.
https://www.fca.org.uk/firms/critical-third-parties-strengthening-uk-financial-services
https://www.fca.org.uk/news/statements/uk-financial-regulators-overseeing-critical-third-parties-announced-treasury