Operational disruption and reliance on third parties remain key regulatory concerns. As firms become increasingly dependent on technology, cloud services and external providers, disruption can significantly affect firms, customers and the wider financial services sector.
In March 2026, the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) published final rules on operational incident and third-party reporting in PS26/2 and PS7/26 respectively. These come into force on 18 March 2027. They aim to clarify firms’ reporting obligations and give regulators better information about serious incidents and third-party dependencies.
What are the new requirements?
The requirements cover the reporting of operational incidents and the reporting of material third-party arrangements.
- Operational incident reporting
Operational incident reporting applies to brokers and MGAs with a Part 4A permission. Firms will need to report an incident where they reasonably believe it poses a risk of causing intolerable harm to consumers from which they cannot easily recover, the safety and soundness of the firm or other market participants, or to market stability, market integrity or confidence in the UK financial system.
There are two levels of reporting:
- Brokers and MGAs that are enhanced scope SM&CR firms or CASS large firms will be subject to enhanced reporting. This involves an initial report, updates where there are significant changes and a final report, using a single form through FCA Connect.
- Other brokers and MGAs with a Part 4A permission will follow the standard process and submit a single report.
Where an incident meets one or more of the reporting thresholds, firms will be expected to notify the FCA as soon as practicable. The FCA expects a report within 24 hours of determining that an incident meets the relevant threshold, although firms should report sooner where possible.
- Material third-party reporting
For brokers and MGAs, the material third-party reporting requirements are most likely to apply where the firm is an enhanced scope SM&CR firm or a CASS large firm.
In-scope firms must notify the FCA when entering into a new material third-party arrangement or making a significant change to an existing one. They will also need to maintain a register of their material third-party arrangements and submit it to the FCA annually.
Materiality depends on the potential impact of disruption or failure. Firms may use existing operational resilience mapping of important business services to help identify relevant third-party dependencies. When assessing materiality, firms should consider whether disruption or failure of an arrangement could cause intolerable harm to clients, pose a risk to the UK financial system or seriously affect the firm’s ability to meet regulatory obligations.
What will the new rules mean for brokers and MGAs?
The rules should provide clearer expectations and a more consistent reporting process. For brokers and MGAs, an outage affecting their main broking or policy administration platform could prevent staff from arranging cover or processing renewals, illustrating the type of incident firms may need to assess against the new reporting thresholds. Firms will still need to judge the severity and customer impact quickly while managing the incident.
For firms subject to the material third-party requirements, relevant arrangements could include broker management and policy administration systems, cloud hosting and outsourced claims administration. These are not automatically material. Firms should assess the potential impact of disruption or failure for each arrangement.
Larger insurance intermediary groups that acquire and integrate businesses may face particular challenges in maintaining a complete register. Acquired firms may use different systems and suppliers, with contracts and risk assessments held locally. The group will need to apply a consistent approach when assessing these third-party arrangements and assign clear responsibility for updating registers as integration progresses.
Smaller brokers and MGAs may have fewer arrangements to assess, but dependence on one or a small number of providers may still be significant.
What should firms be doing now?
Firms should use the remaining implementation period to:
- Establish clear ownership and accountability for incident reporting. Define who assesses incidents, approves notifications and submits reports.
- Review existing incident management and escalation processes. Confirm incidents can be assessed consistently against the thresholds and escalated promptly.
- Identify and assess material third-party arrangements. Review outsourcing and non-outsourcing arrangements. Non-outsourcing examples may include data and analytics services, pricing comparison platforms and IT systems or software supplied as products rather than activities performed on the firm’s behalf.
- Embed the new requirements into existing processes. Reflect notification requirements within procurement, contracting and change management processes, particularly when appointing new third parties or making significant changes to existing arrangements.
How can PKF help?
PKF can support firms through readiness and gap assessments against the regulators’ final rules and guidance, including reviewing relevant policies, procedures, governance arrangements and reporting processes. PKF can also provide independent assurance over implementation and readiness for 18 March 2027.
Firms should now confirm which requirements apply, assess readiness and address identified gaps.
