FCA Introduce Unified Cyber and Third-Party Reporting Rules

The Financial Conduct Authority (FCA) has officially rolled out new regulations designed to simplify and standardize how financial firms report cyber incidents and third-party disruptions. Prompted by an increasingly hostile digital landscape and significant recent outages - including those involving tech giants like Cloudflare and AWS - the updated framework aims to strengthen the operational resilience of the UK's financial sector, ensure swift regulatory responses, and better protect consumers.

According to the regulator, cyber attacks are not only becoming more frequent but also highly sophisticated, compounding the risks associated with the financial industry's growing reliance on external service providers. In 2025, over 40% of the cyber incidents reported to the FCA involved a third party. Acknowledging that firms previously struggled with inconsistent reporting standards and ambiguity regarding what to report, the FCA launched an industry consultation in December 2024 to design a clearer, more structured approach.

Following feedback from the financial sector, the finalized rules introduce several key operational changes to reduce unnecessary administrative burdens. To achieve this, the FCA, the Prudential Regulation Authority (PRA), and the Bank of England have collaborated to create a single, streamlined reporting regime and a centralized portal. Furthermore, duplicative incident reporting requirements for payment service providers and credit rating agencies have been completely removed. The required information has also been significantly refined, allowing the majority of solo-regulated firms to simply submit a short form to notify regulators of an incident, all supported by clearer guidelines regarding reporting thresholds, definitions, and firm responsibilities.

Mark Francis, the FCA’s director of specialists and wholesale sell-side, emphasized the necessity of these changes. He noted that resilience is being tested like never before, with firms facing growing cyber threats and increasing reliance on third parties to deliver essential financial services. Francis added that the updated rules will give firms practical guidance to manage disruptions while providing the FCA with better data to identify risks and strengthen sector-wide stability.

Looking ahead, the FCA plans to utilize the data gathered under the new regime to share trends and insights with the industry, particularly during widespread market stress. Crucially, the information will also grant the regulator deeper visibility into firms' supply chains, helping to pinpoint vulnerable services and identify critical third parties within the UK financial ecosystem. Ultimately, the FCA hopes this proactive approach to resilience will lay the foundation for sustainable growth and deepen public trust in financial institutions.