Cybersecurity Policy Report, U.K. Financial Regulator Issues Rules on Cyber Incident Reporting, (Mar 23, 2026)

By Tony Foley

The United Kingdom’s Financial Conduct Authority (FCA), the U.K.’s financial services regulator, has issued new rules for reporting cyber incidents and third-party relationships.

Cyber attacks are becoming more frequent and sophisticated, and more than 40% of incidents reported in 2025 involved a third party, the FCA said in a news release.

The new rules will help the FCA respond quickly to cyber attacks and other disruptions, giving firms greater certainty on what to report and when and strengthening firms’ resilience to better protect consumers and markets. The rules were based in large part on a consultation conducted in 2024 exploring clearer, more structured reporting frameworks, reducing unnecessary burdens while making sure that all required information is submitted to facilitate impact assessment and effective response.

Specifically, the final rules create a streamlined reporting regime with the Prudential Regulation Authority (PRA) and the Bank of England, including a single reporting portal. The FCA also has removed duplicative incident reporting for payment service providers and credit reporting agencies; refined the overall information required, allowing most of the firms it regulates to complete a short form about an incident; and added clearer guidance on thresholds, definitions and responsibilities.

Along with the final rules, the FCA has published finalized guidance for both incident reporting and third-party reporting, each of which may be accessed from the news release. The guidance includes clear examples of what firms should report, helpful hints in applying thresholds, and recommendations on completing the necessary forms. The new rules take effect in one year and the FCA will host a webinar on the rules on April 29. The FCA will review the rules two years after their implementation to ensure they are working effectively and delivering expected outcomes.

News: InternationalLegislation DataSecurity DataBreach