The Financial Conduct Authority published Policy Statement PS26/2 on 18 March 2026, establishing final rules for a unified operational incident and third-party reporting regime. The Prudential Regulation Authority issued companion Policy Statement PS7/26 on the same date. The Bank of England published parallel FMI IOREP rules for financial market infrastructures. The coordinated publication creates a single reporting framework across all three regulators for the first time, replacing fragmented sector-specific obligations.
The unified regime introduces standardised thresholds that determine when an incident triggers a reporting obligation. Payment service providers retain their existing four-hour reporting window for qualifying incidents. All other regulated firms must report within 24 hours of determining that an incident meets the threshold. Both categories submit a single report regardless of which regulators supervise them, eliminating duplicate filings.
The rules take effect on 18 March 2027. The Bank of England's Fundamental Rules for financial market infrastructures enter into force separately on 18 July 2026. The FCA has committed to engaging with firms during the 12-month preparation period to support adoption of the new reporting processes.