FCA and PRA cyber requirements
There is no single FCA or PRA cyber rulebook. Firms must meet operational resilience rules now, with new incident and third party reporting rules applying from 18 March 2027. The Cyber Security and Resilience Bill (CSRB) is separate and does not make banks a new regulated sector, though other activities in a group could be caught.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short version
Financial firms do not have one "cyber law". For most UK firms, the main requirements sit in FCA and PRA rules on operational resilience and outsourcing, alongside UK GDPR. The Cyber Security and Resilience Bill (CSRB) is a separate regime and does not make banks a new regulated sector.
Banking is not a subsector in Schedule 2 of the NIS Regulations 2018, and the Bill as brought from the Commons does not add one. A financial group can still come into scope through a different activity, such as providing a managed service or a cloud computing service.
What applies, and when
| Requirement | Who it reaches | Status |
|---|---|---|
| FCA operational resilience rules (PS21/3) | Certain FCA-regulated firms | In force. The transition period ended on 31 March 2025 |
| PRA operational resilience expectations (SS1/21) | Banks, insurers and certain other PRA-authorised firms | In force. The transition period ended on 31 March 2025 |
| Critical third parties regime (PS16/24, SS6/24) | Third parties designated by HM Treasury | Rules took effect on 1 January 2025. Duties apply only once a designation order is in force |
| Operational incident and third party reporting (FCA PS26/2, PRA PS7/26) | Scope varies, see below | Applies from 18 March 2027 |
| UK GDPR | Anyone handling personal data | In force |
| Cyber Security and Resilience Bill | Regulated persons only, not banks as a class | Not yet law |
Operational resilience: what it asks for
The operational resilience rules are not a list of security controls. They ask firms to identify their important business services, set impact tolerances for how much disruption those services can bear, map what those services depend on, and test whether they can stay within tolerance in severe but plausible scenarios.
A cyber attack is one of the most obvious of those scenarios. Practical work usually includes:
- Mapping each important business service to its technology and suppliers.
- Testing cyber scenarios, including loss of a key third party.
- Taking results to senior management and tracking remediation.
- Checking that recovery plans would actually meet your impact tolerances.
The new incident and third party rules
On 18 March 2026 the FCA, PRA and Bank of England finalised aligned rules that apply from 18 March 2027.
Operational incident reporting applies, for the FCA, to all firms with a Part 4A permission, payment service providers, UK recognised investment exchanges, registered trade repositories and registered credit rating agencies. It defines an operational incident, sets reporting thresholds, and uses one process so a firm makes a single submission. Reports come in standard and enhanced forms.
Third party reporting has a narrower FCA scope, including banks, building societies, enhanced scope SM&CR firms, designated investment firms, Solvency II firms and authorised payment and e-money institutions. In-scope firms must notify new or significantly changed material third party arrangements and submit a register every year.
Timings and thresholds are in the policy statements and in the FCA's FG26/3 and FG26/4 guidance. Check those documents directly, because FCA and PRA thresholds are aligned but not identical.
Critical third parties
HM Treasury can designate a supplier as a critical third party on the regulators' recommendation. Designated firms would face fundamental rules, resilience requirements, testing and incident reporting duties.
The rules exist, but the duties only start for a provider once its designation order is in force. HM Treasury had made no designations when the regulators published the rules in November 2024. We have not confirmed the current position, so check HM Treasury's latest announcements.
How the Bill could still reach a financial firm
Three routes are worth checking:
- You provide a regulated service. A fintech or group IT company could be a relevant digital service provider or relevant managed service provider, if it meets the tests. See OES vs RDSP vs RMSP.
- You buy from regulated suppliers. Your MSP or cloud provider may have new reporting and customer notification duties, and may notify you after an incident.
- You are designated as a critical supplier. Regulators can designate a supplier to a regulated organisation if the tests in regulation 14H are met.
The existence of FCA or PRA supervision does not by itself answer whether another activity in your group is in scope. Assess each regulated activity separately.
What to do now
- List which regimes apply to each legal entity in your group.
- Build a single incident process that can handle FCA, PRA, ICO and, where relevant, Bill notifications.
- Prepare your register of material third parties now if you are in scope of the 2027 rules.
- Ask critical suppliers whether they expect to be regulated under the Bill, and what they will tell you after an incident.
- Treat Cyber Essentials as a useful baseline, not as evidence of compliance with these rules. See Cyber Essentials and the Bill.
Sources
- FCA PS26/2: Operational incident and third party reporting
- Bank of England, PRA and FCA: critical third parties policy statement
- HFW: FCA and PRA incident and third party reporting requirements
- TLT: final rules on operational incident reporting
- Sidley: UK operational resilience rules and the 31 March 2025 deadline
- NIS Regulations 2018, Schedule 2
Frequently asked questions
Cyber risk is mainly dealt with through wider rules on operational resilience, systems and controls, and outsourcing. New operational incident and third party reporting rules apply from 18 March 2027.
Banking is not a subsector in Schedule 2 of the NIS Regulations 2018, and the Bill as brought from the Commons does not add one. A financial group could still be caught through another activity, such as providing a managed or cloud service.
They apply from 18 March 2027, under FCA PS26/2 and PRA PS7/26, which were published on 18 March 2026.
It lets HM Treasury designate third parties that are critical to the financial sector, on the recommendation of regulators. Rules took effect on 1 January 2025, but a provider’s duties only begin once its designation order is in force.