UK FCA Sets New Cyber Incident Reporting Rules for Firms

The UK's Financial Conduct Authority has introduced new rules requiring financial firms to report cyber incidents and operational disruptions more clearly and promptly, aiming to enhance the sector's resilience against growing threats from hackers and third-party providers.

The regulations, finalized after industry consultation, address feedback that firms often lack guidance on reporting requirements. They will take effect on March 18, 2027, giving companies 12 months to prepare. The changes apply to incidents affecting firms directly or through suppliers, such as outages or cyberattacks, and establish a single reporting portal shared with the Prudential Regulation Authority and the Bank of England.

In 2025, more than 40 percent of cyber incidents reported to the FCA involved third parties, underscoring the sector's increasing dependence on external technology providers. Recent disruptions, including widespread outages at Amazon Web Services and Cloudflare, disrupted financial services and highlighted vulnerabilities in supply chains. These events demonstrated how failures in interconnected systems can cascade into broader market instability.

Under the new framework, firms must...