#
UK operational resilience rests on the FCA/PRA op-res framework plus the Critical Third Parties (CTP) regime introduced under FSMA 2023 (finalised in PS24/16). A new unified operational-incident and material-third-party reporting regime was finalised in March 2026 (FCA PS26/2, PRA PS7/26, BoE FMI statement) and takes effect 18 March 2027, creating a single cross-regulator submission. For PSPs the existing PSRs 2017 major-incident reporting obligation (with a four-hour first-detection deadline) is largely subsumed into the new regime, removing duplication.
Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →
The bank-facing limb sits with the PRA. PRA PS7/26 introduces SS1/26 on incident reporting and updates SS2/21 on outsourcing and third-party risk, applying to UK banks, building societies, PRA-designated investment firms, overseas-bank branches and Solvency II firms; the third-party reporting policy is relevant to all PRA-regulated firms. Outsourcing and third-party risk expectations bind PRA firms, and this is the bank-PSP-facing limb of the unified regime.
For non-bank PSPs the picture is one of subsumption. The existing PSRs 2017 obligation to report major operational and security incidents is largely subsumed into the new regime, removing duplicative requirements from 18 March 2027, while PSPs retain a four-hour reporting deadline from first detection. This removes duplicative PSP incident reporting while preserving the tight four-hour clock, which remains operationally significant for PSP incident teams.
Outlook
W3 is escalating, with the dominant horizon event being the 18 March 2027 in-force date of the unified incident and third-party reporting regime. Firms have a substantial run-in to build single-submission capability and align internal incident definitions to the cross-regulator threshold. The bank-PSP limb (PRA SS1/26, SS2/21) and the non-bank PSP limb (PSRs subsumption with retained four-hour deadline) advance in parallel under the same effective date.
Operational Resilience & Critical Infrastructure
The Payment Systems Regulator's Specific Direction 3 and Specific Direction 3a have been revoked, with effect from 21 May 2025. The PSR's own publication records the revocation directly, and a companion PSR publication on the Interbank Infrastructure Renewal programme ties the revocation to the cancellation of the New Payments Architecture procurement and to the National Payments Vision's call for a more agile and flexible approach to delivering the UK's payments infrastructure needs. In place of the cancelled NPA procurement, the PSR is now running the Interbank Infrastructure Renewal programme as the vehicle for infrastructure delivery.
This is a structural change to how the UK's interbank payments infrastructure is being renewed, not a continuation of the prior procurement path under a new name. Firms, infrastructure providers and scheme participants that had been planning around the New Payments Architecture procurement and its associated compliance dates should treat that procurement framework as closed, with the Interbank Infrastructure Renewal programme as the operative successor track. No replacement procurement-compliance deadline equivalent to the revoked Specific Direction 3 has been identified as of the research date.
Outlook
The Interbank Infrastructure Renewal programme is the programme to monitor going forward for interbank infrastructure delivery timelines; its more agile and flexible delivery approach, as described by the PSR, has not yet produced a published replacement compliance deadline in the way Specific Direction 3 once did.
3 earlier distinct update(s)
Operational Resilience & Critical Infrastructure
The Bank of England published a consultation on 18 May 2026 proposing a staged extension of RTGS and CHAPS settlement operating hours, including the introduction of weekend operation, with the stated direction of travel being toward near-24/7 settlement availability. This is a significant potential shift in the UK's core settlement infrastructure: RTGS and CHAPS currently operate on a business-day schedule, and extending toward continuous or near-continuous operation would represent a structural change to settlement-timing risk, liquidity management, and operational-resilience planning for the banks and payment service providers that rely on these systems.
The proposal is explicitly staged and subject to industry-readiness feedback gathered through the consultation process; no confirmed effective date for any stage of the extension has yet been set. This reflects the scale of the operational change being proposed: extending settlement windows, particularly to weekend operation, has knock-on implications for staffing, liquidity buffer management, and contingency planning that the Bank of England appears to be treating as a genuine open question for industry input rather than a predetermined timetable.
The bank-versus-non-bank distinction is material here: RTGS and CHAPS access is structured around direct participant banks, with non-bank payment institutions and e-money institutions typically accessing settlement indirectly through sponsor banks. A staged extension of settlement hours would be expected to affect direct participants first and most directly, with indirect-access non-bank PSPs experiencing the operational impact filtered through their sponsor-bank relationships.
Outlook
The critical variable to watch is the substance of industry-readiness feedback gathered through this consultation, since the Bank of England has not committed to a fixed timetable for any stage of the extension. The pace at which direct participant banks signal readiness, particularly for weekend operation, will likely determine how quickly the near-24/7 vision proceeds from consultation to implementation.
Operational Resilience & Critical Infrastructure
The PSR has set complete migration to the New Payments Architecture (NPA) by 1 July 2026 as the deadline for the UK's next-generation retail payments infrastructure, with the existing APP-fraud reimbursement obligation carried forward onto the new rail rather than reset. This is a dated infrastructure milestone rather than a standing explainer item this cycle.
Outlook
The 1 July 2026 deadline is the operative date to track; whether the reimbursement obligation transfers without a coverage gap as systems migrate is the open question for this module heading into the next cycle.
Operational Resilience & Technology Risk
No new structured findings were developed for this module in the current cycle. The source register contains a reference to the FCA's forthcoming DLT operational-resilience guidance consultation, expected in H2 2026, which will be relevant to this module when published. That forward item is noted in the W1b pipeline.
The gaps register records that research surfaced no in-cycle movement on W3 for the UK; module coverage this cycle was concentrated in W1a, W1b, and W2 per the primary regulatory source set.
Outlook
The FCA's DLT operational-resilience guidance consultation, expected in H2 2026, is the primary forward item for this module. No date-certain milestone is currently recorded.
Sources and findings (4)
- T1FCA — PS26/2: Operational incident and third party reporting — Following CP24/28, the FCA created single FCA, PRA and Bank of England regimes for operational incident and third-party reporting applying from 18 March 2027 (PS26/2), defining an operational incident and reporting thresholds and a standardised single-submission process.
- T1FCA — Operational resilience (critical third parties) — The CTP regime stems from FSMA 2023 powers letting regulators oversee critical third parties whose failure could threaten financial stability; the final CTP rules were published in PS24/16.
- T1FCA/PRA/BoE operational resilience policy statements — The PRA's PS7/26 introduces SS1/26 on incident reporting and updates SS2/21 on outsourcing/third-party risk; it applies to UK banks, building societies, PRA-designated investment firms, overseas-bank branches and Solvency II firms, with the third-party reporting policy relevant to all PRA-regulated firms.
- T1FCA/PRA PS26/2 — operational resilience / critical third parties — For PSPs, the existing PSRs 2017 obligation to report major operational/security incidents is largely subsumed into the new regime, removing duplicative requirements from 18 March 2027, while PSPs retain a four-hour reporting deadline from first detection.