UK Regulators Publish Unified Operational Incident Reporting Framework for Financial Services and Payment Infrastructure

On March 18, 2026, three UK financial regulators simultaneously published final rules on operational incident and third-party reporting. The PRA issued Policy Statement PS7/26 alongside Supervisory Statement SS1/26, the FCA published PS26/2, and the Bank of England released its framework for financial market infrastructures. The package replaces fragmented notification requirements with a single phased structure and introduces mandatory registers of material third-party arrangements.

The new framework requires firms to submit an initial incident report within 24 hours of determining that a reporting threshold has been met. Payment service providers retain a stricter four-hour deadline for initial notifications, unchanged from existing requirements. Intermediate reports must follow whenever circumstances change materially, such as when root causes are identified or recovery plans are activated. A final report is due within 30 working days of incident resolution, extendable to 60 working days where a shorter deadline is impracticable.

Reporting thresholds center on four criteria: risks to UK financial sector stability, risks to a firm's safety and soundness, consumer harm from which customers cannot easily recover, and threats to market integrity or confidence in the UK financial system. The consolidated approach replaces what was previously three separate reports submitted across different channels.

For payment infrastructure, the implications are direct. Pay.UK, operator of Faster Payments and Bacs, falls under the Bank of England's FMI framework as a Recognised Payment System Operator. The Bank of England itself, as CHAPS operator, is subject to the same requirements. Reportable incidents for payment system operators include distributed denial-of-service attacks causing service disruption, process failures preventing settlement instruction issuance, system update failures that halt transaction processing, and infrastructure damage from extreme weather or power outages.

All bank participants in CHAPS, Faster Payments, and Bacs must comply with the PRA regime under PS7/26. Payment service providers using these systems report through the FCA under PS26/2. This dual coverage means that both operators and their direct participants are now captured within a single, harmonized framework.

Material third-party reporting introduces a parallel obligation. Firms must notify regulators before entering or significantly changing arrangements with material third parties and must maintain and submit annual registers of all such arrangements. The materiality assessment applies to both outsourcing and non-outsourcing arrangements, capturing cloud providers, network operators, and other critical dependencies. Approximately 90 percent of FCA solo-regulated firms qualify for a simplified short-form incident report containing 10 mandatory questions. Enhanced-reporting firms face a more detailed template, reduced by roughly 20 percent from the consultation draft following industry feedback.

The implementation timeline runs through several milestones before the March 18, 2027 compliance date. On June 12, 2026, amendments to the Bank of England's Recognised Payment Systems Code of Practice take effect. On July 18, 2026, the Fundamental Rules for financial market infrastructures enter force, establishing baseline governance and operational resilience standards. The Bank of England intends to remove existing incident reporting requirements from firm-specific Banking Act 2009 notices to eliminate duplicate reporting once the new framework is operational.

The rules draw on international standards, aligning with the EU's Digital Operational Resilience Act and the Financial Stability Board's Format for Incident Reporting Exchange. In January 2026, UK and EU regulators signed a Memorandum of Understanding to strengthen oversight of critical third parties operating across both jurisdictions, a step that may simplify cross-border compliance for firms operating under both IOREP and DORA.

The consultation that preceded these policy statements ran from December 2024 to March 2025 and received 13 responses. All submissions will be made through the FCA Connect platform. An FCA webinar on implementation is scheduled for April 29, 2026.