FCA operational resilience and incident reporting

The operational resilience rules

The FCA published its operational resilience rules in March 2021 alongside the Bank of England and the Prudential Regulation Authority. They came into force on 31 March 2022, and firms in scope had until 31 March 2025 to have done the mapping and testing needed to stay within impact tolerances. The FCA's rules sit in the SYSC sourcebook (SYSC 15A).

The FCA lists the firms in scope as banks, building societies, PRA-designated investment firms, insurers, recognised investment exchanges, enhanced scope SM&CR firms, payments and e-money firms, consolidated tape providers and qualifying cryptoasset firms. In outline, firms should have:

• Identified important business services whose disruption could cause intolerable harm to consumers or markets
• Set impact tolerances for the maximum tolerable disruption to each of them
• Mapped and tested the people, processes, technology and third parties behind each service, and be on track to fix vulnerabilities
• Run lessons-learned exercises and invested in the ability to respond and recover
• Prepared communications plans for when important business services are disrupted

Cyber attacks are one of the most likely causes of disruption, which is why detection and response sit at the heart of a credible resilience plan.

PS26/2: operational incident and third party reporting

On 18 March 2026 the FCA published PS26/2, its final rules on operational incident and third party reporting, with finalised guidance in FG26/3 (operational incident reporting) and FG26/4 (material third party reporting). The rules create single FCA, PRA and Bank of England regimes and apply from 18 March 2027.

Until then, the FCA's existing requirements for notifying it of operational incidents continue to apply; its operational resilience page links to the current guidance. Whether a particular arrangement, such as a managed security service, counts as material is for your firm to assess under the rules.

Where an MSSP fits

For many firms, the systems behind important business services include endpoints, Microsoft 365, identity and network infrastructure: exactly what a managed detection and response service watches. A vendor SOC helps in three ways:

Staying within impact tolerances. The sooner an attack is detected and contained, the less disruption it causes. Vendor services such as Sophos MDR, Check Point MDR and CrowdStrike Falcon Complete Next-Gen MDR take containment actions, such as isolating a compromised device, within the permissions you agree, rather than waiting for office hours.

Incident reporting. Reporting thresholds depend on facts: what happened, which services are affected, for how long. Vendor case reports and SIEM records give you those facts quickly. An incident response retainer, such as a Cisco Talos Incident Response retainer, adds specialist investigators for serious incidents.

Testing and lessons learned. The FCA expects scenario testing against severe but plausible disruption. Retainers that include proactive services such as tabletop exercises and playbook development help with this, and vendor root cause analysis feeds lessons learned.

Forever Systems does not run its own security operations centre. The 24/7 monitoring and response comes from the vendor services we resell, such as Sophos MDR, Check Point MDR or WatchGuard MDR; we recommend one, set it up, manage it and handle escalation with you.

Your MSSP as a third party

An MSSP is itself a third party in your resilience mapping, and may be a material one. The FCA's critical third parties regime does not change firms' accountability for their own resilience or their outsourcing obligations, and the same principle applies to any provider you use. Questions worth putting to a security provider include:

1. Which parts of the service do you deliver, and which come from a vendor's SOC?
2. Where is our data held and processed, and what retention applies?
3. What actions can the SOC take without asking us, and how are we told?
4. How would you support our incident reporting, and what information would you give us?
5. What happens to our data and logs if we end the service?
6. How do you protect your own access to our systems?

Our guide on how to choose an MSSP expands on these, and the Cyber Security and Resilience Bill would add regulatory duties for medium and large managed service providers themselves.

DORA and UK firms

The Digital Operational Resilience Act (DORA) is EU law, applying to EU financial entities since January 2025. It is not part of UK regulation. A UK firm is affected only through EU operations, EU-regulated group entities or EU clients that pass DORA requirements down through contracts. If that applies to you, take advice on your EU obligations; the monitoring and incident evidence described here supports both regimes.

UK firms also remain subject to UK GDPR: personal data breaches that pose a risk must be reported to the Information Commission (formerly the ICO) within 72 hours where feasible, alongside any FCA notification. For the wider picture of security in the sector, see cyber security for financial services, and for staff, security awareness training for financial services.

Talk to us

We can review how cyber incidents affecting your important business services would be detected, contained and evidenced today, recommend vendor MDR, SIEM and retainer options that fit your tools, set them up and manage them, and prepare reports in a form that supports your resilience testing and incident reporting. We do not give regulatory advice, and responsibilities are confirmed at quote. Pricing depends on users, devices and data volumes, so ask us for a quote.

Contact us to strengthen detection and response ahead of the March 2027 reporting rules.