SS1/26 – Operational resilience: Incident reporting
Executive Summary
SS1/26 outlines the PRA's expectations for firms to report operational incidents via a structured three-phase process (initial, intermediate, final) as mandated in the PRA Rulebook's Regulatory Reporting Part, Chapter 24, to enhance UK financial sector resilience by capturing incidents risking firm safety, policyholder protection, or stability. This matters because it standardizes reporting, enabling timely PRA oversight and reducing inconsistencies in incident data collection across regulated entities. #
What Changed
- Introduces clear reporting thresholds in Regulatory Reporting Rule 24.2: Firms must report if an incident poses risks to UK financial stability, firm safety/soundness, or (for insurers) policyholder protection; factors include operational/financial contagion, service disruptions, data loss to external users, or regulatory/media attention. - Mandates a phased reporting approach (Rule 24.1-24.4): Initial report as soon as practicable (expected within 24 hours of threshold determination); intermediate updates for significant changes (e.g., impact escalation, BCP activation, resolution); final report within 30 working days of resolution (or 60 if impracticable). - Excludes near-misses (potential events without disruption/data loss to external users); aligns with but does not replace Fundamen
What You Need To Do
- Assess incidents against PRA thresholds (e
- Submit phased reports using specified fields
- Maintain processes for prompt classification, data gathering, and submission while prioritizing resolution; continue ad-hoc supervisory notifications if needed
- Review internal policies to align severity ratings with PRA thresholds; document assessments
- For critical third-party (CTP) incidents, both firms and CTPs report uniquely
Key Dates
Compliance Impact
Urgency: High – With effectiveness just over one year away (18 March 2027), firms must urgently map incident management frameworks to new thresholds/phases, update policies, train staff, and test reporting (e.g., via simulations), as non-compliance risks enforcement under PRA rules and heightened scrutiny on resilience amid rising cyber/operational threats. This elevates operational resilience fro
Who is Affected
Summary
Supervisory statement 1/26