.png)
FCA Operational Incident Reporting 2027: Beyond the Reporting Decision
Updated: 2 days ago
The Incident Was Identified. Was Its Significance Recognised?
A technology team identifies a service disruption and initiates its incident response procedures. Elsewhere, Operations reports processing delays, while an external service provider notifies the organisation of a technical issue affecting its systems.
Each event is recorded, assessed and managed through established incident management processes. Individually, none initially appears to warrant significant escalation.
As further information emerges, however, connections begin to appear. The processing delays may stem from the technology disruption, while the provider's issue could affect several business activities. What initially appeared to be separate operational incidents may represent a broader disruption with consequences extending beyond individual functions.
The challenge is whether the organisation can recognise these connections, assess their cumulative significance and reach a timely regulatory reporting decision.
An organisation may identify an incident promptly and still take too long to recognise its regulatory significance.
With the FCA's new operational incident reporting requirements taking effect in March 2027, this distinction becomes particularly important. Regulatory readiness depends as much on effective information flows and decision-making as on the reporting process itself.
Executive Takeaways
For senior executives and Board directors, five insights capture the practical implications of the FCA's March 2027 operational incident reporting requirements.
Incident classification and regulatory reportability serve different purposes.
Existing severity ratings and impact tolerances support operational incident management but do not determine whether an incident meets the FCA's reporting thresholds. Firms need a distinct, consistently applied regulatory assessment.
Individually managed incidents can reveal a larger, reportable disruption.
Separate events may share common causes, dependencies or cumulative consequences. Effective reporting depends on the organisation's ability to connect information across functions and reassess significance as incidents develop.
Third-party dependencies can delay recognition of regulatory obligations.
Outsourced providers and international group functions may identify disruptions before their implications for the UK-regulated entity become apparent. Timely information sharing and clear escalation responsibilities are essential to effective reporting decisions.
Documented compliance does not demonstrate operational readiness.
Updated policies, reporting procedures and governance arrangements establish important foundations. Historical incident back-testing and practical validation provide stronger evidence that reporting decisions can be made promptly and supported by reliable information.
Regulatory readiness ultimately depends on the effectiveness of organisational decision-making.
Boards should expect assurance that reporting responsibilities are clear, information flows across organisational boundaries and regulatory judgements are documented and revisited when circumstances change. These capabilities also strengthen wider incident management and operational resilience.
What the FCA's March 2027 Incident Reporting Requirements Mean in Practice
From 18 March 2027, the FCA's Policy Statement PS26/2 introduces standardised operational incident reporting requirements. Firms must establish their obligations at the regulated-entity level, including whether standard or enhanced reporting applies.
An operational incident may involve a single event or a series of linked events that disrupt operations and affect services delivered to external end users or the availability, authenticity, integrity or confidentiality of their information or data.
An incident becomes reportable where the firm reasonably believes it poses a risk of intolerable consumer harm, threats to the safety and soundness of the firm or other market participants, or risks to market stability, integrity or confidence in the UK financial system.
Firms must notify the FCA as soon as practicable after determining that a reporting threshold has been met, taking account of applicable reporting timelines. Standard reporting generally involves a single notification, while enhanced reporting introduces additional updates and final reporting
requirements.
The FCA's PS26/2 operational incident reporting requirements introduce five considerations that firms should address as part of their implementation preparations.
1. Regulatory Applicability: Establishing the Reporting Perimeter
Confirm whether each UK-regulated entity falls within the scope of the requirements and determine whether standard or enhanced reporting obligations apply.
2. Incident Definition: Identifying Relevant Events
Establish whether an individual event or a series of linked events meets the FCA's definition of an operational incident, including relevant disruptions to services or impacts on external end-user information and data.
3. Reporting Thresholds: Assessing Regulatory Significance
Determine whether an incident meets one or more of the FCA's reporting thresholds concerning consumer harm, safety and soundness, or the stability, integrity and confidence of the UK financial system.
4. Reporting Decision: Establishing Accountability
Define who is responsible for determining reportability, how regulatory judgements are documented and when decisions must be reassessed as additional information becomes available.
5. Regulatory Submission: Ensuring Reporting Capability
Confirm that the firm can assemble accurate information, access the required reporting channels and submit notifications promptly once an incident is determined to be reportable.
These requirements place particular importance on how firms identify incidents, assess evolving information and reach timely, defensible reporting decisions.
The Gap Between Incident Classification and Regulatory Reportability
Most organisations already have established processes for classifying operational incidents. Internal severity scales typically consider service disruption, financial losses, customer impact and other operational consequences. These classifications help determine response priorities, escalation requirements and management oversight.
The FCA's PS26/2 requirements introduce a distinct assessment of regulatory reportability, which may not align directly with existing incident classifications.
An incident categorised as low severity under an internal framework may still require regulatory assessment, particularly where it forms part of a series of linked events with cumulative consequences. Equally, an incident does not need to affect an Important Business Service or breach an established impact tolerance to meet the FCA's reporting criteria.
The distinction also extends to the nature of the disruption. An incident affecting the availability, authenticity, integrity or confidentiality of external end-user information or data may qualify for reporting even where service delivery appears unaffected.
These differences require firms to examine how their existing classification processes interact with regulatory reporting criteria. Internal severity ratings, impact tolerances and operational indicators remain valuable inputs, but they cannot substitute for an assessment against the FCA's definition and reporting thresholds.
Internal incident severity helps an organisation manage disruption. Regulatory reportability requires a judgement about the nature and consequences of that disruption.
When Several Incidents Reveal One Larger Problem
Operational incidents do not always develop within clearly defined organisational boundaries. A technology disruption may affect a processing system, while an external service provider experiences delays and another business function identifies errors in its transactions.
Each event may be recorded, classified and managed appropriately by the responsible team. However, their common origin or cumulative consequences may remain unrecognised when information is assessed independently.
This creates a particular challenge under PS26/2, which recognises that an operational incident may comprise a series of linked events. Individually, these events may fall below internal escalation thresholds. Collectively, their consequences could satisfy the FCA's definition and reporting criteria.
Recognising these connections requires organisations to look beyond individual incident records. Common causes, shared dependencies and cascading effects must be identified, with relevant information brought together across functions, group entities and external providers.
Importantly, the assessment must evolve as new information becomes available. An initial decision that an incident is not reportable may be appropriate at the time, but subsequent developments can change its regulatory significance.
The underlying vulnerability may therefore lie in how information is aggregated, communicated and translated into decisions across the organisation, even where individual teams have fulfilled their responsibilities.
The challenge becomes clearer when examining how an incident develops over time. An event occurs and is detected, but further symptoms may emerge across different functions or external providers. As these connections are recognised, the organisation must reassess the incident's significance and determine whether regulatory notification is required.
The six stages illustrated below, from occurrence and detection through to connecting the information, reassessing significance and reaching a reporting decision, highlight where fragmented information or delayed escalation can affect the organisation's response.
As we are now observing through our client engagement, the effectiveness of individual incident management processes does not automatically establish the effectiveness of the organisation's collective response.
Third-Party Dependencies and the Challenge of Timely Information
For many financial services firms, operational incidents originate beyond the boundaries of the UK-regulated entity. Technology platforms, outsourced service providers and international group functions may identify and manage disruptions before their consequences for the UK business become apparent.
While these arrangements can support efficient operations, they introduce dependencies into the incident reporting process. The UK-regulated firm remains responsible for assessing its own regulatory obligations, even when the originating event is managed elsewhere.
The effectiveness of this assessment depends on the timeliness and quality of information received. Service providers and group functions must understand which developments require escalation, including changes affecting services, external end users or information and data. Equally, UK decision-makers need sufficient visibility to assess cumulative impacts, revisit earlier judgements and determine whether reporting thresholds have been met.
Contractual notification periods and established escalation channels provide important safeguards, but their effectiveness ultimately depends on how information moves between organisations and decision-makers.
Importantly, operational incidents originating with third parties must be distinguished from the separate PS26/2 requirements concerning material third-party arrangements, which have their own applicability and reporting obligations.
The practical challenge is ensuring that external dependencies do not become blind spots in the firm's regulatory decision-making.
Testing PS26/2 Readiness: From Regulatory Requirements to Operational Evidence
Preparing for PS26/2 should begin with an understanding of what an organisation already has in place. Many firms operate established incident management, escalation and regulatory notification arrangements. The priority is to determine whether those arrangements meet the new requirements and where targeted improvements are necessary.
Aevitium's approach combines regulatory validation with an assessment of operational effectiveness, building on existing compliance work rather than introducing unnecessary framework redesign.
The assessment begins by confirming the applicable regulatory perimeter, reporting obligations and requirements for the relevant UK-regulated entities. Existing policies, processes and governance arrangements are then reviewed against those requirements to identify genuine gaps.
A central component is historical incident back-testing. By selecting representative incidents across different severity levels, firms can reconstruct how events were detected, classified, escalated and assessed for regulatory significance. The review examines when relevant information became available, whether connected events were recognised, who held decision authority and whether reporting information could have been assembled reliably.
Importantly, the assessment considers what decision-makers knew at each stage. This allows weaknesses in escalation, information quality and regulatory judgement to be distinguished from conclusions reached with the benefit of hindsight.
The resulting findings should translate into a prioritised remediation roadmap, identifying required changes to processes, governance, decision-making, data and controls. Each action should have clear ownership, dependencies and implementation priorities, allowing firms to concentrate resources on improvements that materially strengthen readiness.
Following implementation, targeted validation can establish whether those changes have been embedded and operate effectively.
The objective is to move from understanding regulatory obligations to demonstrating that the organisation can fulfil them in practice.
Discover how organisations can strengthen critical service delivery, manage interconnected vulnerabilities and demonstrate their ability to withstand, recover from and adapt to disruption.
The Board's Role: Setting Expectations and Challenging Assumptions
The Board plays a central role in determining how operational resilience is understood, prioritised and embedded within the organisation. Its responsibility extends beyond approving resilience policies and reviewing management reports. It must establish clear expectations about the organisation's ability to sustain critical services and navigate disruption while pursuing its strategic objectives.
Strategic alignment requires the Board to consider how growth, transformation and business model changes influence operational resilience. Expansion into new markets, technology modernisation or increased reliance on third parties can create opportunities while changing the organisation's exposure to disruption. Resilience considerations should therefore inform strategic decisions from the outset.
Risk appetite and investment trade-offs require equally deliberate judgement. The Board must understand which vulnerabilities the organisation is prepared to accept, where additional investment is justified and how competing commercial priorities influence resilience. These decisions should reflect the potential consequences for customers, operations and long-term organisational performance.
Effective oversight depends on the quality of evidence presented to the Board. Completion of resilience activities, successful exercises and compliance indicators provide useful information, but their value depends on what they demonstrate about actual capabilities. Boards need visibility of material vulnerabilities, unresolved dependencies, plausible disruption scenarios and management's ability to make timely decisions under pressure.
This requires constructive challenge of the assumptions underpinning management's confidence in preparedness, including whether recovery capabilities remain credible as the organisation evolves.
Ultimately, effective Board oversight connects resilience expectations with strategic choices, risk appetite and demonstrated operational capability. It provides assurance grounded in evidence of how the organisation would perform when disruption tests its assumptions.
What Boards and Senior Management Should Expect Before March 2027
For Boards and senior management, PS26/2 readiness requires more than confirmation that policies and reporting procedures have been updated. The priority is obtaining credible assurance that the organisation can identify reportable incidents, assess their significance and fulfil its regulatory obligations within the required timeframe.
This means demonstrating that regulatory requirements have been mapped to the relevant entities, reporting decisions have clear ownership, and escalation arrangements operate effectively across business functions, group entities and external providers. Management should also understand whether the information needed to support regulatory notifications can be assembled reliably, including during periods of operational disruption.
A credible readiness programme should distinguish between three stages, each providing a different level of assurance.
1. Regulatory Gap Assessment: Understanding the Gaps
Establishes whether the firm understands its applicable regulatory obligations and has identified weaknesses in existing policies, processes, governance and reporting arrangements.
2. Remediation Implementation: Addressing the Weaknesses
Demonstrates that necessary improvements have been introduced into operational processes, governance arrangements and supporting systems, with clear accountability for implementation.
3. Readiness Validation: Demonstrating Effectiveness
Provides evidence, through practical testing, that the revised arrangements operate effectively and support timely, informed regulatory reporting decisions.
These stages provide different levels of confidence. Completing a regulatory assessment or implementing remediation does not, by itself, demonstrate that the organisation is ready.
For senior management, the ultimate measure of readiness is whether reporting decisions can be made consistently, promptly and on the basis of reliable information when an incident occurs.
Strengthen Your Operational Resilience Capability
Explore how Aevitium's Operational Resilience Pathway™ helps organisations assess operational resilience maturity, strengthen incident management and response capabilities, and improve their ability to withstand, respond to and recover from disruption.
Five Questions Board Directors Should Ask
Effective Board oversight of FCA PS26/2 readiness requires confidence that incident reporting arrangements operate effectively across the organisation, including where incidents involve multiple functions, group entities or external providers. Five questions can help directors assess whether the organisation is prepared for the March 2027 requirements.
1. Can we identify incidents that meet the FCA's reporting criteria, even when internally classified as low severity?
Tests whether existing incident classification processes recognise regulatory significance independently of internal severity ratings and Important Business Service impact tolerances.
2. Can we recognise when separate incidents form part of a larger, connected disruption?
Examines whether information from different functions, systems and third parties is aggregated to identify common causes, cumulative impacts and emerging reporting obligations.
3. How quickly does relevant information reach those responsible for regulatory reporting decisions?
Assesses the effectiveness of escalation arrangements, particularly where incidents originate with external providers or international group entities.
4. Who is accountable for determining reportability, and how are those decisions evidenced and reassessed?
Establishes clear decision ownership, appropriate regulatory judgement and documented reasoning, including when new information changes the significance of an incident.
5. What evidence demonstrates that our incident reporting arrangements will work in practice?
Challenges management to provide assurance through historical incident back-testing, remediation and readiness validation, rather than relying solely on updated policies and procedures.
Conclusion: Reporting Readiness Is a Test of Operational Effectiveness
The FCA's March 2027 incident reporting requirements provide an opportunity for firms to examine how effectively their existing incident management arrangements operate across organisational boundaries.
Regulatory readiness depends on more than the ability to submit a notification. It requires reliable information flows, clear decision ownership and escalation arrangements that enable organisations to recognise connected events, assess evolving consequences and respond appropriately.
These capabilities also contribute to broader operational resilience, although incident reporting and operational resilience remain distinct regulatory obligations. Strengthening their practical integration can improve both regulatory compliance and organisational decision-making.
The March 2027 requirements establish a clear regulatory milestone. The more enduring test is whether organisations can recognise material disruption, understand its consequences and make informed decisions while events are still developing.
About the Author: Julien Haye
Julien Haye is Managing Director of Aevitium LTD and a former Chief Risk Officer with over 26 years of experience across global financial services and non-profit organisations. Known for his pragmatic, people-first approach, he helps organisations strengthen risk management, governance and resilience to support better strategic decisions.
He is the author of The Risk Within: Cultivating Psychological Safety for Strategic Decision-Making and Resilient Risk Management (Kogan Page, 2026). He also hosts the RiskMasters podcast, where he explores risk, leadership and organisational resilience with industry leaders and change makers.
Frequently Asked Questions: FCA Operational Incident Reporting 2027
1. When do the FCA PS26/2 incident reporting requirements take effect?
The requirements take effect on 18 March 2027. Firms should complete their applicability assessments, establish reporting responsibilities and validate submission arrangements before implementation. The deadline applies to the regulatory requirements, making advance testing particularly important where remediation involves multiple business functions or external service providers.
2. Does every operational incident need to be reported to the FCA?
No. Reporting depends on whether an incident satisfies the applicable regulatory definition and at least one reporting threshold. Firms should retain evidence supporting their determination, including decisions not to report. Other FCA notification obligations, including those under Principle 11 and SUP 15.3, may still apply.
3. Does an incident need to affect an Important Business Service to be reportable?
No. The reporting perimeter extends beyond Important Business Services. An incident affecting other services delivered to external end users, or the availability, authenticity, integrity or confidentiality of their information or data, may qualify where the relevant reporting thresholds are met.
4. Can several low-severity incidents become a reportable operational incident?
Yes. Where events are linked, their combined consequences may satisfy the FCA's reporting criteria even if individual incidents appear relatively minor. Firms should therefore reassess reportability when new connections, shared dependencies or cumulative impacts become apparent, rather than treating the initial classification as definitive.
5. How can firms assess their readiness for the March 2027 requirements?
Firms can combine regulatory applicability reviews with historical incident back-testing, escalation walkthroughs and reporting simulations. Testing should include incomplete information, out-of-hours incidents and third-party dependencies. The resulting evidence can help management distinguish documented compliance arrangements from demonstrated operational readiness.