The Prudential Regulation Authority (PRA) has published its final policy for standardised reporting of certain operational incidents and for notification and annual register reporting of material third-party (MTP) arrangements, developed jointly with the Financial Conduct Authority (FCA) and the Bank of England in its capacity as a supervisor of financial market infrastructures. The package finalises CP17/24 and pares back aspects of the consultation proposals to reduce firm burden while giving supervisors more consistent data on operational incidents and third-party dependencies. Operational incident reporting will apply to UK banks, building societies, PRA-designated investment firms and branches of overseas banks, and to UK Solvency II firms and the Society of Lloyd’s and its managing agents. Firms must submit a single incident report via FCA Connect, completed and updated across initial, intermediate and final phases, with the initial phase expected within 24 hours of determining the incident meets the PRA’s threshold test and the final phase information due within 30 working days of resolution (extendable by a further 30 working days in specified circumstances). For MTPs, in-scope firms must notify the PRA via FCA Connect when entering into or significantly changing an MTP arrangement and submit an annual MTP register via FCA RegData, using fully aligned templates that have been split into separate notification and register forms and streamlined to reduce data fields. The final rules exclude credit unions with less than GBP 50 million in assets and all third country branches from MTP notification requirements, and generally remove intragroup arrangements from notification and register scope unless an external provider is involved, with a limited exception for ring-fenced bodies. The Reporting and Notifications Rulebook changes, new supervisory statement SS1/26 on incident reporting, and updates to SS2/21 on outsourcing and third-party risk management take effect on 18 March 2027, and the PRA indicated firms have until March 2027 before the register requirements come into force.
Prudential Regulation Authority2026-03-18
United Kingdom's Prudential Regulation Authority finalises operational incident and material third-party reporting rules effective 18 March 2027 and exempts credit unions under GBP 50 million
The Prudential Regulation Authority (PRA), with the Financial Conduct Authority and the Bank of England, has finalized its policy on standardized reporting for operational incidents and material third-party arrangements. Effective March 2027, UK financial institutions must report incidents via FCA Connect and submit annual MTP registers, excluding certain credit unions and third-country branches. The rules aim to streamline data collection, reduce firm burden, and enhance supervisory consistency.