On 18 March 2027, significant new PRA and FCA requirements for operational incident reporting and material third-party (MTP) arrangements come into force.
Introduced through PRA PS7/26 and FCA PS26/2, these reforms represent an important shift towards more consistent regulatory reporting and greater supervisory visibility of operational vulnerabilities and third-party dependencies.
But firms should not mistake these changes for a simple reporting exercise. Successful implementation will require effective integration across operational resilience, third-party risk management, incident management and regulatory governance.
What's changing?
1. Operational incident reporting
The new framework requires firms to assess operational incidents against defined regulatory reporting criteria, including potential consumer harm, threats to safety and soundness, and risks to financial stability or market integrity.
Most FCA solo-regulated firms will follow a simplified standard reporting process. Larger and more complex firms, including PRA-regulated banks and certain investment firms, face more demanding enhanced reporting requirements.
Enhanced reporting involves initial notification, updates following significant developments and final reporting after resolution.
2. Material third-party reporting
The new MTP reporting requirements apply to a significantly narrower population of firms than the operational incident reporting regime, principally PRA-regulated banks, building societies and certain larger investment firms.
For firms within scope, the requirements introduce:
- Notification of new material third-party arrangements and significant changes to existing arrangements.
- An annual regulatory register of material third-party arrangements.
- Broader coverage extending beyond traditional outsourcing to material non-outsourcing arrangements.
While fewer firms are caught by these requirements, the implementation challenges should not be underestimated.
The regulatory register demands an extensive set of prescribed information fields covering the nature of arrangements, third-party providers, services, materiality, contractual characteristics and relevant dependencies. The volume and detail go considerably beyond a traditional outsourcing inventory.
Firms will need reliable, sufficiently granular information across potentially numerous arrangements, supported by effective data ownership, validation and ongoing maintenance processes.
Where are the challenges?
The new requirements present several implementation challenges, including determining regulatory scope, establishing effective governance and escalation processes, integrating reporting with existing risk management frameworks and ensuring reliable management information.
But one challenge deserves particular attention: how should firms determine whether an operational incident is sufficiently serious to report?
The challenge of defining intolerable harm
For firms already subject to the UK's 2021 operational resilience regime, concepts such as important business services, impact tolerances and intolerable harm should be familiar.
However, many firms entering the new incident reporting regime were not subject to those requirements. They may lack an established framework for assessing when operational disruption could result in intolerable harm to consumers or other significant consequences.
How can firms make consistent, proportionate and defensible reporting decisions without reducing the assessment to a mechanical checklist?
At JADEtc Academy, we believe the FCA's Consumer Duty provides a valuable starting point for firms within its scope. Existing assessments of foreseeable consumer harm can help firms develop a more structured understanding of what might constitute intolerable harm in the context of operational disruption.
This requires considering the nature, scale, severity and duration of potential harm, alongside the firm's business model, customers, services and vulnerabilities.
Crucially, the objective should not be to create rigid thresholds that substitute for judgement. Firms need a principles-based decision-making framework combining meaningful indicators, clear escalation criteria and informed management judgement, supported by appropriate governance and documentation.
Intolerable harm is a useful analytical concept, but firms must still assess reportability against the specific regulatory criteria applicable to them.
The MTP register: More than a data collection exercise
For firms subject to the MTP regime, one of the biggest implementation challenges will be developing and maintaining the detailed regulatory register.
The challenge is not simply the number of prescribed fields, but the availability, accuracy and consistency of the information required.
Much of this information may be dispersed across procurement systems, outsourcing registers, contract repositories, operational resilience mapping, risk assessments and business functions. Some may not currently be captured systematically, particularly for material arrangements outside traditional outsourcing definitions.
Firms need to consider whether their inventories capture all relevant arrangements; whether information is complete and reliable; who owns and maintains the data; how changes are reflected; and whether the register supports meaningful management oversight as well as regulatory reporting.
The real opportunity is to turn a demanding regulatory data requirement into a more effective source of third-party risk intelligence.
Integration, not another compliance silo
Incident management, third-party risk assessments, operational resilience testing, business continuity and regulatory reporting are too often managed through separate processes and governance structures.
The new requirements provide an opportunity to improve coordination, establish clearer accountability and develop more consistent assessments of operational vulnerabilities.
Regulatory reporting should be the output of effective risk management, not a standalone compliance process.
How JADEtc Academy can help
JADEtc Academy brings together experienced former regulators, senior banking practitioners and specialist risk consultants to help firms interpret, implement and embed regulatory requirements.
- Regulatory applicability and gap assessments: Identifying applicable requirements, existing capabilities and implementation priorities.
- Incident reporting and intolerable harm frameworks: Building on Consumer Duty assessments of foreseeable harm to develop proportionate, risk-based approaches to assessing harm and determining reportability.
- Material third-party frameworks and registers: Assessing inventories against reporting requirements, identifying information gaps, strengthening data governance and integrating MTP reporting into the third-party lifecycle.
- Governance and reporting: Establishing effective escalation processes, decision-making responsibilities, management information and regulatory reporting controls.
- Practical training and workshops: Equipping risk, resilience, third-party, compliance and senior management teams to apply the requirements.
Our approach goes beyond regulatory compliance. We help firms build proportionate, integrated frameworks that strengthen risk management and operational resilience.
The clock is ticking
With March 2027 approaching, firms should already be assessing readiness, addressing information gaps and testing their reporting and governance arrangements.
For firms unfamiliar with the 2021 operational resilience regime, developing a robust approach to identifying and assessing potentially reportable incidents should be an immediate priority.
The question is not simply whether your firm can produce the required reports. It's whether the underlying risk management framework can reliably support them.
Discuss how we can support your implementation programme through specialist advice, practical frameworks and tailored training.
Get in touch →