FCA Updates Cyber Incident and Third-Party Reporting Rules
Basically, the FCA made new rules to help financial firms know when to report cyber issues.
The FCA has issued new rules for reporting cyber incidents, aiming to clarify processes for financial firms. This change is crucial as many firms rely on third-party services. Enhanced clarity will help improve overall cyber resilience in the industry.
What Happened
The UK Financial Conduct Authority (FCA) has introduced new rules aimed at clarifying the reporting process for cyber-related incidents. These changes come in response to feedback from the financial sector, indicating that many organizations were confused about what incidents needed to be reported and how to provide the necessary information. FCA director Mark Francis emphasized the growing cyber threats and the increasing reliance on third-party services, which necessitated clearer guidelines to bolster resilience.
The updated rules are designed to streamline the reporting process, making it easier for firms to manage disruptions. This initiative aligns with the FCA's goal of becoming a more effective regulator by enhancing data collection to identify risks and share insights across the sector.
Who's Affected
The new reporting framework impacts all regulated firms within the financial services sector, particularly those that rely heavily on third-party service providers. Recent data indicates that 40% of incidents reported to the FCA in 2025 were related to third-party outages. This trend underscores the importance of robust third-party risk management, especially in light of recent outages at major providers like AWS and Cloudflare.
Firms now have a 12-month preparation period before the new rules take effect on March 18, 2027. This timeframe allows organizations to adapt their reporting practices and ensure compliance with the new regulations.
What Data Was Exposed
The FCA's updated rules encompass both internal cyber incidents and those caused by external suppliers or service providers. The streamlined reporting regime includes a single reporting portal developed in collaboration with the Prudential Regulation Authority (PRA) and the Bank of England. This portal aims to reduce duplicated reporting, particularly for payment service providers and credit rating agencies.
Moreover, the FCA has refined the information required for reporting, allowing most firms to complete a short form. This simplification is intended to encourage timely reporting and improve the overall quality of data collected by the FCA, which can then be used to enhance sector-wide resilience.
What You Should Do
Firms in the financial services sector should begin preparing for the new reporting regime by reviewing their current incident reporting processes. Here are some recommended actions:
- Understand the new rules: Familiarize yourself with the updated guidelines provided by the FCA.
- Assess third-party dependencies: Evaluate the risks associated with third-party service providers and ensure they align with the new reporting requirements.
- Implement training: Conduct training sessions for staff on the new reporting protocols to ensure compliance.
By taking these steps, firms can better position themselves to manage cyber incidents effectively and contribute to the overall resilience of the financial services sector.
Infosecurity Magazine