Content Gen Dashboard

On 18 March 2026, the Prudential Regulation Authority (PRA) published Supervisory Statement 1/26 (SS1/26) setting out its expectations for how firms should comply with operational incident reporting requirements under the PRA Rulebook. The statement becomes effective from 18 March 2027. The supervisory statement establishes clear and consistent reporting requirements and expectations for firms experiencing operational incidents that pose a risk to the safety and soundness of individual firms, policyholder protection, or UK financial stability. The incident reporting policy aims to support the operational resilience of the UK financial sector by collecting standardised information from firms on operational incidents. The statement applies to a broad range of regulated entities, including UK banks, building societies, PRA-designated investment firms, UK branches of overseas banks, UK Solvency II firms, the Society of Lloyd's, and its managing agents. All these entities must ensure compliance with the reporting requirements outlined in SS1/26. The PRA simultaneously published Policy Statement 7/26 (PS7/26) on 18 March 2026, which addresses operational incident and third-party reporting requirements. Firms should review both documents to understand the full scope of their operational resilience obligations under the updated framework. The 12-month implementation period provides firms with sufficient time to align their incident reporting procedures and systems with the PRA's expectations before the effective date. REFERENCE: Bank of England Prudential Regulation Authority. SS1/26 – Operational resilience: Incident reporting. Published 18 March 2026. https://www.bankofengland.co.uk/prudential-regulation/publication/2026/mar/ss1-26-operational-resilience-incident-reporting

On March 18, 2026, the Prudential Regulation Authority (PRA) published its policy statement (PS7/26) on operational incident reporting and third-party reporting. PS7/26 confirms the follow: Final definition for an “operational incident” that is aligned between the PRA and Financial Conduct Authority (FCA). Final reporting thresholds and relevant factors for consideration for operational incident reports. Amendments to the phased reporting approach, instead of the initial proposal to submit three separate reports, firms are now required to submit a report at the initial phase and update the report across the intermediate and final phases of an incident. Final definitions for “third-party arrangement” and “material third-party arrangement” (MTP) in the PRA Rulebook. Amending the approach to MTP notification rule by aligning with the FCA; requiring firms to submit notifications when entering into or significantly changing an MTP arrangement. Amending the scope of MTP notification requirements to exclude credit unions with less than £50 million in assets and all third country branches. The publication is accompanied by a supervisory statement (SS1/26), which sets further details on the PRA’s expectations of how firms should report an operational incident.

meta_id 2980218

Generated

Bank of England Publishes Operational Resilience Incident Reporting Supervisory Statement

Agent draft

Published

UK's Prudential Regulation Authority Issues Policy Statement on Operational Incident and Third-Party Reporting