PS7/26 – Operational resilience: Operational incident and third-party reporting
Executive Summary
PS7/26 finalizes PRA rules for standardized reporting of operational incidents and material third-party (MTP) arrangements, responding to CP17/24 consultation feedback by reducing firm burden through simplified templates and exclusions. This matters for compliance professionals as it enhances PRA oversight of operational resilience risks amid rising threats and third-party reliance, aligning with international standards like DORA and FSB FIRE while supporting identification of critical third parties (CTPs). #
What Changed
- - MTP Reporting: Amended notification rule for clarity; scope excludes credit unions with <£50m assets and all third-country branches; separated register and notification templates with reduced data fields; single submission platform (FCA Connect).
- Operational Incident Reporting: Merged three-phased reports (initial, interim, final) into one simplified, aligned template across PRA/FCA/Bank; removed fields, made more optional; clarified thresholds (e.g., safety/soundness, financial stability, po
- Guidance Enhancements: Updated SS2/21 with MTP identification examples; SS1/26 clarifies threshold interpretation, early-stage assessments, and systemic impact expectations.
- Alignment: Full harmonization with FCA/Bank and international standards (DORA, FSB FIRE). | Aspect | CP17/24 Proposal | PS7/26 Final Policy | |--------|------------------|---------------------| | Incident Reporting | Three-phased (initial, interim,
Suggested Considerations
- Identify and notify MTP arrangements via FCA Connect (excluding exemptions); maintain annual register with reduced fields.
- Monitor/assess operational incidents against clarified thresholds (e.g., contagion, reputation); submit single report if met, within specified timelines.
- Update policies per SS1/26 (thresholds) and SS2/21 (MTP identification).
- Align reporting with PRA/FCA/Bank templates; use data for resilience prioritization.
- For insurers: Integrate with ongoing operational resilience post-SS1/21 milestone (31 March 2025).
Key Dates
Compliance Impact
Urgency: High - Mandates new reporting infrastructure and processes amid rising operational threats; non-compliance risks supervisory action on resilience vulnerabilities. Reduced burden from CP mitigates costs, but timely implementation critical for PRA oversight and CTP identification; benefits (e.g., thematic analysis) outweigh costs per PRA.
Who is Affected
References
AI-generated analysis. May contain errors or omissions — verify with the original PRA source before acting. Full disclaimer.
Summary
Policy statement 7/26