FCA Operational Incident Reporting in Practice

From 18 March 2027, firms in scope of the FCA’s new operational incident reporting rules will need to assess incidents against new reporting thresholds and make timely, well-documented decisions as facts emerge. This webcast will explore what the incoming incident and material third-party reporting regime means in practice and how firms can prepare.

The new regime sits alongside existing FCA notification obligations and introduces a more structured approach to operational incident and material third-party reporting.

The challenge will not be simply understanding the rules. Teams will need to identify potentially reportable incidents quickly, establish the facts, assess actual and plausible impact, involve the right people, record the rationale for decisions, and reassess as an incident develops.

In this webcast, we will explore how firms can adapt existing incident-management arrangements to meet the incoming requirements, without creating a parallel process. Through a realistic incident scenario, we will examine the decisions firms need to make potential pressure points as an incident develops, and how to prepare for the 24-hour reporting long-stop once a reporting threshold is reasonably believed to have been met.

Discussion topics include:

• Understanding what changes from 18 March 2027: The new operational incident and third-party reporting regime and how it sits alongside existing FCA notification obligations.
• Identifying a potentially reportable incident: Applying the new thresholds, assessing impact, and deciding when an event needs further escalation.
• Making decisions as facts emerge: Establishing ownership, involving the right stakeholders, documenting rationale, and reassessing an evolving incident.
• Working through a practical incident scenario: Examining key decisions as an incident develops, common pressure points, and effective and ineffective responses.
• Preparing for timely reporting: Building the processes, information flows, governance, and decision records needed to support the 24-hour reporting long-stop.
• Preparing for material third-party reporting: Understanding the new requirements for firms in scope.
• Turning requirements into a workable plan: Practical priorities for incident response, operational resilience, cyber, technology, compliance, and senior management teams.

Who should attend:

CCOs and heads of compliance, COOs and operations directors, chief information security officers, heads of operational resilience, technology and cyber leaders, outsourcing and third-party risk professionals, incident response leads, risk and internal audit professionals, and senior managers with responsibility for operational resilience.

All webcasts are recorded and will be sent to registrants following the live broadcast.