Financial services firms increasingly rely on third parties to provide them with essential resources and services, including AI platforms, cloud services, internet connectivity and IT systems. At the same time, cyberattacks or IT outages can cause data loss, disrupt a firm’s operations and, in severe cases, threaten wider financial stability. Against this backdrop, UK regulators have agreed a new framework requiring firms to report operational incidents and material third party arrangements.

The new framework aims to give UK regulators faster and clearer information about serious threats and sector-wide dependencies. Operational incident reports and material third-party reports are the end products. The real work sits earlier: firms need to identify incidents and dependencies quickly, escalate them to the right people and take remedial action without losing time.

This Guide outlines the new framework and highlights the practical implementation actions firms should