Firms face new reporting rules for operational incidents and third parties
The Bank of England's Prudential Regulation Authority (PRA) has published new rules for operational incident and third-party arrangement reporting. These amendments to the PRA Rulebook will come into force on March 18, 2027.
New definitions for critical arrangements
The Prudential Regulation Authority (PRA) has introduced new definitions to clarify the scope of its operational resilience framework.
A 'material third-party arrangement' is now defined as one where disruption could risk a firm's safety and soundness, policyholder protection, or UK financial system stability, or cast doubt on threshold conditions.
The rules also specify a 'relevant Solvency II firm' as one with annual gross written premium income exceeding £15 billion or total technical provisions exceeding £75 billion, based on a three-year rolling average.
Firms, with some exceptions, must now notify the PRA when entering into or significantly changing a material third-party arrangement by submitting Form M electronically.
This notification is waived if the provider is within the same group and does not subcontract outside the group, with an additional condition for ring-fenced bodies requiring a permitted supplier.
Phased reporting for operational disruptions
The new instrument establishes a structured approach to operational incident reporting, requiring firms to submit reports to the PRA in three phases.
An initial report is due as soon as practicable after an incident that could risk UK financial system stability, firm safety, or policyholder protection.
An intermediate report follows any significant change in circumstances, including resolution.
A final report is required within 30 working days of resolution, or 60 working days if impracticable.
Additionally, most firms must now maintain an annual register of material third-party arrangements and submit this information electronically to the PRA.
Exceptions apply for intra-group arrangements, similar to the notification requirements.