PS26/2 explained: FCA operational incident and third party reporting from 18 March 2027

Who PS26/2 covers

The incident reporting rules apply to all firms with a Part 4A permission, payment service providers, UK recognised investment exchanges, registered trade repositories and registered credit rating agencies.

The third party rules apply to a narrower set: enhanced scope SM&CR firms, banks, building societies, designated investment firms, Solvency II firms, CASS large firms, authorised e-money and payment institutions, UK recognised investment exchanges and consolidated tape providers.

What counts as a reportable operational incident

An operational incident is reportable when it has happened and meets one of three thresholds:

• A risk of intolerable harm to consumers.
• A risk to the safety and soundness of the firm or other market participants.
• A risk to market stability, integrity or confidence in the UK financial system.

Near misses, such as an attack that was stopped before it did harm, do not need reporting under these rules, although firms will want their own record of them.

The 24-hour and 4-hour deadlines

The initial report is due as soon as practicable, and within 24 hours of the firm deciding that an incident meets a threshold. Payment service providers keep their existing deadline of 4 hours from first detecting the incident. Intermediate and final reports follow as the firm learns more.

The clock starts at the decision, not at the first alert, which puts a premium on being able to reconstruct what happened quickly enough to decide.

Material third party reporting: the register and notifications (FG26/4)

The same policy statement introduces material third party reporting under SUP 15.19. In-scope firms keep a register of their material third-party arrangements and submit it each year when the FCA invites them to. The register is accurate as of 31 December of the previous year and due within 90 calendar days of the submission window opening.

Firms must also notify the FCA of a planned material arrangement, or a significant change to an existing one, at an early stage. A change in how a third party stores, processes or accesses sensitive data, or where it stores it, can be significant. Materiality is the firm's judgement under FG26/4; an AI model provider or a remote MCP server your AI apps depend on can qualify.

Where AI apps come in

When an AI app is involved in an incident, the report needs facts that are hard to recover after the event: what the app did, when, where the calls went and what was stopped. ContextGate records every tool call made through it with the AI app, the user, the tool, the arguments, the redacted result and the policy outcome, timestamped. That gives you a timeline for the incident report, the app or MCP server behind each call for the third party involved, and the calls that policies blocked or warned on, with the policy that fired.

For the register, the list of apps and MCP servers your AI apps actually reach through ContextGate, and how each is used, is a starting point for deciding which arrangements are material. A new connection shows up as soon as someone adds it, so a planned arrangement can be assessed and notified early.

Deciding whether a threshold is met, writing and submitting the report, judging materiality and keeping the register stay with you.