PS7/26 – Operational resilience: Operational incident and third-party reporting
Executive Summary
PS7/26 finalizes PRA rules for standardized reporting of operational incidents and material third-party (MTP) arrangements, responding to CP17/24 consultation feedback by reducing firm burden through simplified templates and exclusions. This matters for compliance professionals as it enhances PRA oversight of operational resilience risks amid rising threats and third-party reliance, aligning with international standards like DORA and FSB FIRE while supporting identification of critical third parties (CTPs). #
What Changed
- MTP Reporting: Amended notification rule for clarity; scope excludes credit unions with <£50m assets and all third-country branches; separated register and notification templates with reduced data fields; single submission platform (FCA Connect). - Operational Incident Reporting: Merged three-phased reports (initial, interim, final) into one simplified, aligned template across PRA/FCA/Bank; removed fields, made more optional; clarified thresholds (e.g., safety/soundness, financial stability, policyholder protection for PRA), timing, and factors like contagion/reputation via SS1/26. - Guidance Enhancements: Updated SS2/21 with MTP identification examples; SS1/26 clarifies threshold interpretation, early-stage assessments, and systemic impact expectations. - Alignment: Full harmonization w
What You Need To Do
- Identify and notify MTP arrangements via FCA Connect (excluding exemptions); maintain annual register with reduced fields
- Monitor/assess operational incidents against clarified thresholds (e
- Update policies per SS1/26 (thresholds) and SS2/21 (MTP identification)
- Align reporting with PRA/FCA/Bank templates; use data for resilience prioritization
- For insurers
Key Dates
Compliance Impact
Urgency: High - Mandates new reporting infrastructure and processes amid rising operational threats; non-compliance risks supervisory action on resilience vulnerabilities. Reduced burden from CP mitigates costs, but timely implementation critical for PRA oversight and CTP identification; benefits (e.g., thematic analysis) outweigh costs per PRA.
Who is Affected
Summary
Policy statement 7/26