meta_id 2980215

On 18 March 2026, the Prudential Regulation Authority (PRA) published Policy Statement 7/26 (PS7/26), finalising requirements for operational incident reporting and material third-party (MTP) arrangement notifications. The policy follows consultation paper CP17/24 and addresses rising operational resilience threats to financial institutions and their increasing reliance on external service providers. The final policy establishes standardised reporting requirements for operational incidents affecting UK banks, building societies, PRA-designated investment firms, overseas bank branches, UK Solvency II insurers, the Society of Lloyd's and its managing agents, and UK credit unions with assets exceeding £50 million. Firms must report incidents posing risks to financial stability, firm safety and soundness, or policyholder protection. The PRA consolidated three proposed separate reports (initial, intermediate, and final) into a single report updated across phases, reducing compliance burden. Initial reports must be submitted within 24 hours of determining an incident meets reporting thresholds, with intermediate updates required for significant changes and final reports due within 30 working days of incident resolution. For MTP arrangements, firms must notify the PRA upon entering or significantly changing arrangements through FCA Connect, a unified submission platform developed jointly with the Financial Conduct Authority (FCA). Annual MTP registers must be submitted via FCA RegData. The PRA excluded credit unions with less than £50 million in assets and third-country branches from notification requirements to reduce disproportionate burden. The policy incorporates feedback from 35 consultation responses, with the PRA making significant changes to reduce costs while maintaining supervisory oversight. Key amendments include reducing data fields in reporting templates, separating notification and register templates, and providing enhanced guidance on threshold interpretation and MTP identification in updated supervisory statements. The implementation date for all requirements is 18 March 2027.