meta_id 2979511

On 26 February 2026, the Financial Conduct Authority (FCA) published Policy Statement PS26/2, finalising rules on operational incident reporting and material third party arrangement reporting following consultation on Consultation Paper 24/28. The FCA, Prudential Regulation Authority (PRA), and Bank of England have established a unified regulatory framework for both policies. For operational incident reporting, firms must notify regulators of incidents meeting defined thresholds: causing intolerable consumer harm, posing risks to safety and soundness of firms or market participants, or threatening market stability and confidence in the UK financial system. The framework divides firms into two tiers: standard reporting (approximately 90 percent of FCA solo-regulated firms) requires submission of a single short form with 10 questions, while enhanced reporting applies to systemically important firms and requires more detailed information submitted across initial, intermediate, and final phases. Payment service providers (PSPs) retain their existing 4-hour reporting deadline for initial submissions. The FCA has subsumed existing PSP and registered credit rating agency (CRA) incident reporting regimes into this single framework, eliminating duplication. For material third party arrangements, firms must notify the FCA of new arrangements or significant changes and submit an annual register. The FCA defines material third party arrangements as those whose disruption could cause intolerable consumer harm, threaten UK financial system stability, or cast serious doubt on the firm's ability to meet regulatory obligations. Most firms need only report intragroup arrangements involving external third party dependencies. Third country branches remain in scope for annual register submissions but are excluded from notification requirements for non-outsourcing arrangements. The new rules come into force on 18 March 2027, providing firms 12 months for preparation. The FCA will conduct a two-year post-implementation review. Accompanying finalised guidance documents FG26/3 and FG26/4 provide additional detail on compliance requirements.