What is FCA and PRA incident, third-party and operational resilience rules?
The FCA's and the PRA's rules for UK financial firms on reporting operational incidents and material third-party arrangements, and the operational resilience rules behind them. The reporting rules apply from 18 March 2027, and are not in force yet. The FCA's operational resilience rules in SYSC 15A have applied since 31 March 2022.
Incident reporting reaches every firm with a Part 4A permission, and payment service providers, UK recognised investment exchanges, registered trade repositories and registered credit rating agencies, on a short form unless it is one of the types SUP 15.18.3R lists for enhanced reporting, and the PRA's firms (CRR firms, UK Solvency II firms, the Society of Lloyd's and managing agents) on a phased report. Third-party reporting and SYSC 15A each reach their own lists, and the lists differ. Which one a firm is on turns on its permissions, so the firm records it.
The rule is "as soon as practicable". The regulators expect the report within 24 hours of the firm deciding a threshold is met (SUP 15.18.7G; SS1/26 4.5). Expected, not a fixed limit.
Within 4 hours of first detecting a major operational or security incident (SUP 15.14.18DD).
From resolution, for an enhanced firm; if that is impracticable, as soon as practicable and within 60 (SUP 15.18.9R).
Dates that matter
- 18 March 2027The FCA and PRA incident and third-party reporting rules apply. Not yet in force: no reporting clock runs for an incident discovered before this date.
- 31 March 2022SYSC 15A, operational resilience, in force.
- 31 March 2025The SYSC 15A transition ended (FCA PS21/3).
What people get wrong
The thresholds carry no numbers
A firm reports where it reasonably believes an incident poses a risk of intolerable consumer harm, to the safety and soundness of the firm or other participants, or to market stability, integrity or confidence (SUP 15.18.6R(1)). The FCA refused quantitative thresholds and says its factor list is not a tick box. So the decision is the firm's, and Vivid Risk records it rather than making it.
Reporting and operational resilience are separate duties
The FCA did not tie incident reporting to important business services: its reporting rules reach firms for which impact tolerances are not relevant. SYSC 15A has its own list of firms and is in force now: important business services, impact tolerances, mapping, scenario testing and a written self-assessment. The firm sets its own testing frequency; the FCA dropped the proposed annual requirement.
The scored questions are on their own page
Scored questions on SYSC 15A and the PRA's Operational Resilience Parts, asked only if your firm selects them, and an unscored Coverage view of what your firm has recorded here, are on the page headed "UK operational resilience — SYSC 15A and the PRA Operational Resilience Parts". This page covers the records and the reporting rules.
Third-party registers follow the regulators' own templates
Firms notify a new or significantly changed material arrangement and keep a register they submit when invited, on the regulators' Excel templates, through FCA Connect and RegData. The exports here follow those columns and remain a data-preparation aid.
What Vivid Risk does with FCA and PRA incident, third-party and operational resilience rules
A UK financial records area: your firm profile, important business services and impact tolerances, FCA and PRA incident report packs and reporting clocks (which apply from 18 March 2027 and are not in force yet), a material third-party register with Form M and annual register exports, and, under SYSC 15A, mapping, testing, lessons learned, communications and a self-assessment with retained versions.
Vivid Risk files nothing with the FCA or the PRA, and decides nothing: whether an incident is reportable, an arrangement is material or a rule reaches your firm is yours to record. The regulators' Excel templates are the required format, and the exports here are a data-preparation aid. Group-level requirements rest on the firm's own entry: a firm can mark an important group business service and record its own assessment, and nothing consolidates a group. Bank of England rules for financial market infrastructures are not covered.
Questions
Does Vivid Risk file our FCA or PRA reports?
No. Firms file through FCA Connect and RegData. Vivid Risk prepares your incident packs and third-party exports from your own records, for you to check and submit, and each export says it is not a submission. The reporting rules apply from 18 March 2027.
Does it decide whether an incident is reportable, or an arrangement material?
No. Vivid Risk decides neither. You record when your firm decided a threshold was met and whether an arrangement is material, and the internal severity of an incident is never read as the FCA's rating.
Are the PRA's operational resilience rules covered?
Yes, in two ways, and neither tests whether your firm meets them. The operational resilience records here follow SYSC 15A, and the PRA text follows SS1/21 and cites the PRA Rulebook's Operational Resilience Parts where it states what they require. Separately, a firm can select UK operational resilience in its assessment and be asked scored questions cited to SYSC 15A and those Parts, with an unscored Coverage view of what it has recorded; that is on the page headed "UK operational resilience — SYSC 15A and the PRA Operational Resilience Parts". The firm records its own services, tolerances, mapping, tests and self-assessment, and Vivid Risk does not assess whether the firm meets the rules. Bank of England rules for financial market infrastructures are not covered.
Is this the UK version of DORA?
No. DORA is an EU Regulation that binds financial entities authorised in the Union. These are the UK regulators' own rules, with their own thresholds, templates and dates. A group with firms on both sides can have both, each for its own firms.
Alongside your assessment
Your assessment cites scored controls to other frameworks. This one sits beside that, and this page says what we do with it.