Operational incident reporting: what a cloud outage means for payment firms
In short: A payment firm whose cloud supplier fails must assess the outage under its own operational incident reporting duty to the FCA, whatever the cause. Today a payment firm must report a major incident affecting payment-related services within four hours of first detecting it. From 18 March 2027 the FCA will expect it to assess disruption to any service to an end user against three harm-based thresholds.
A payment firm whose cloud email and file services fail has to decide within hours whether the outage triggers its operational incident reporting duty to the Financial Conduct Authority (FCA). Press reports describe one major cloud provider’s services failing on the evening of 12 November 2026 and still recovering the next morning. Under the rules in force today, a payment firm must notify such an outage under regulation 99 only if it is a major incident measured by its effect on payment-related services, although other duties to tell the FCA can still arise. From 18 March 2027 the FCA will expect the firm to assess any disruption to a service it provides to an end user, or to that user’s data, against three harm-based thresholds. A telecoms provider in the same position must report to Ofcom if the effect on its public network or service is significant.
Key points
- A payment service provider must notify the FCA without undue delay if it becomes aware of a major operational or security incident. Source: Payment Services Regulations 2017, regulation 99(1)
- Until 18 March 2027 the FCA directs payment service providers to follow the European Banking Authority’s 2017 incident reporting guidelines, which require the initial report within four hours of first detecting a major incident and measure an incident by its effect on payment-related services. Source: SUP 15.14.20D
- From 18 March 2027 the FCA will expect a payment service provider to treat as major any operational incident that meets one of three notification thresholds, and the provider will have to report within four hours of first detecting it. Source: FCA PS26/2, SUP 15.14.18B and 15.14.18DD
- The FCA expects each firm to report the impact on its own operations and customers even where a third party service failure is the shared root cause. Source: PS26/2, response to paragraph 2.16
- A designated critical third party must report a CTP operational incident to the regulators and to affected firms, and each affected firm still makes its own report. Source: CTPS 8.1.1R; SUP 15.18
Operational incident reporting by payment firms today
A payment service provider that becomes aware of a major operational or security incident must notify the FCA without undue delay, under regulation 99(1) of the Payment Services Regulations 2017 (PSRs 2017). Regulation 2(1) defines payment service provider to include authorised and small payment institutions, registered account information service providers, e-money institutions and credit institutions, among others. The notification must be in the form and manner the FCA directs (regulation 99(2)).
The FCA’s direction is in SUP 15.14 of its Handbook, which requires payment service providers to comply with the European Banking Authority’s Guidelines on major incident reporting under PSD2 (EBA/GL/2017/10). Under those guidelines a payment service provider sends the initial report within four hours of first detecting a major incident, sends its next update within three business days, and sends a final report within two weeks of business returning to normal. An incident is major if it meets one higher-impact criterion or three lower-impact criteria, and the guidelines measure each criterion by the effect on payment-related services. A cloud outage meets the downtime criterion, for example, only where it makes a payment service unavailable to users or stops payment orders being carried out.
Under regulation 99(3), a payment service provider must also tell its customers without undue delay, with the steps they can take to limit the harm, where the incident has or may have an impact on their financial interests. A bank or other authorised firm must notify the FCA immediately of any matter which could affect its ability to continue to provide adequate services and which could result in serious detriment to a customer (SUP 15.3.1R). Principle 11 requires a payment or e-money institution, as well as an authorised firm, to disclose to the FCA appropriately anything of which the FCA would reasonably expect notice, so a long loss of customer contact can call for a report even where regulation 99 does not.
Cloud supplier failure and operational incident reporting
A payment firm must report a supplier’s outage where the disruption to the firm’s own service meets the reporting test, because the test under both the current and the new rules is the effect on the firm and its customers. From 18 March 2027 the FCA’s definition of an operational incident will be an event that disrupts a firm’s operations so that it disrupts the delivery of a service to an end user outside the firm, or affects the availability, authenticity, integrity or confidentiality of that end user’s data. The cause of the event is not part of the definition, so an event that starts at a supplier can fall within it.
The FCA expects each report to describe the impact on the firm’s operations, customers and market exposure “even where the root cause is shared (for example, a third party service failure)”, and a group must report for each of its firms that meets the thresholds (PS26/2, response to paragraph 2.16). Over 40% of the cyber incidents reported to the FCA in 2025 involved a third party (PS26/2, response to paragraph 2.12).
HM Treasury designated four cloud providers as critical third parties with effect from 13 July 2026, under section 312L of the Financial Services and Markets Act 2000 and the Critical Third Parties (Designation) Regulations 2026. A designated provider must report a CTP operational incident to the regulators and to the firms affected as soon as is practicable (CTPS 8.1.1R). A CTP operational incident is a serious disruption to a systemic third party service, or an impact on the provider’s operations that may seriously affect firms’ assets to which it has access. The Designation Regulations name the providers but not their services, and the regulators notify each provider at designation of which of its services are systemic. A firm cannot assume that an email or collaboration outage falls within the supplier’s duty, and SUP 15.14 and SUP 15.18 contain no relief from the firm’s own operational incident reporting where a critical third party has reported.
Operational incident reporting from 18 March 2027
From 18 March 2027 the FCA will expect a payment service provider to treat as major any operational incident that has met one or more of its notification thresholds (SUP 15.14.18B), and the provider will have to report within four hours of first detecting a major incident (SUP 15.14.18DD, made under PS26/2). The binding test is whether the provider reasonably believes the incident poses a risk “of causing intolerable levels of harm to consumers from which consumers cannot easily recover”, a risk to the safety and soundness of the firm or other market participants, or a risk to market stability, market integrity or confidence in the UK financial system (SUP 15.18.6R(1)). The FCA said in PS26/2 (response to paragraph 2.12) that the thresholds set “a high bar for using this process”, which is intended for serious incidents.
A payment service provider will be an enhanced reporting firm (SUP 15.18.3R) and will update a single report through the life of the incident: an intermediate report as soon as is practicable after any significant change, and a final report within 30 working days of resolution, or 60 where that is impracticable (SUP 15.18.8R and 15.18.9R). Other firms will submit one report, which the FCA expects within 24 hours of the firm determining that a threshold is met (SUP 15.18.7G). For payment service providers the four-hour direction takes precedence over that expectation (SUP 15.18.16G). The FCA’s finalised guidance on operational incident reporting is FG26/3.
| What the payment service provider must do | Until 18 March 2027 (EBA/GL/2017/10) | From 18 March 2027 (SUP 15.14 and 15.18) |
|---|---|---|
| Decide whether the incident is major | One higher-impact or three lower-impact criteria, measured by the effect on payment-related services | Reasonable belief that the incident meets any one of the three FCA notification thresholds |
| Send the initial report | Within 4 hours of first detecting the major incident | Within 4 hours of first detecting the major incident, through the FCA’s online systems |
| Update the report | Next update within 3 business days | As soon as is practicable after any significant change |
| Send the final report | Within 2 weeks of business returning to normal | Within 30 working days of resolution (60 where impracticable) |
| Tell affected customers | Regulation 99(3) PSRs 2017 | Regulation 99(3) PSRs 2017, unchanged |
Authorised payment institutions and authorised e-money institutions will also have to notify the FCA when entering into or significantly changing a material third party arrangement, which may include outsourcing to an AI supplier, and the FCA expects notice before the firm commits (SUP 15.19.6R and 15.19.9G).
Operational incident reporting by telecoms providers to Ofcom
A telecoms provider whose cloud supplier fails must inform Ofcom as soon as reasonably practicable of any security compromise that has a significant effect on the operation of its public electronic communications network or service (section 105K(1)(a) of the Communications Act 2003). A security compromise includes anything that compromises the availability, performance or functionality of the network or service (section 105A(2)(a)), so a supplier failure that disrupts the provider’s service falls within it. If the cloud supplier hosts the service the provider sells to the public, such as hosted voice calling to telephone numbers, the supplier’s outage is an outage of the provider’s own service. Whether the effect is significant depends on how long the disruption lasts, how many users and how wide an area it affects, and how far it affects what users can do (section 105K(2)).
Ofcom expects a provider to notify an urgent security compromise, such as one affecting services to 10 million or more end users, exceeding 3 million user-hours or attracting national media coverage, usually within 3 hours of becoming aware of it, with a full report within 72 hours (general statement of policy under section 105Y). Ofcom expects other reportable compromises above 250,000 user-hours to be reported within 72 hours, and allows smaller ones to be reported in batches (paragraphs 5.23 to 5.27). Ofcom consulted from 12 May to 4 August 2026 on updating the statement. A failure of a telecoms provider’s own email and collaboration tools, with its network and service running normally, is unlikely to be reportable under section 105K(1)(a). Where the cause is unauthorised access that could enable a further compromise of the network or service, section 105K(1)(b) may apply.
Viewpoint
The four-hour reporting limit stays in March 2027. The change is in what a payment firm measures: under the EBA guidelines it counts the effect on payment-related services, and under the new rules it judges whether a disruption to any service it provides to an end user poses a risk of serious harm. A firm whose payments run while its customers cannot reach it by email or message may have nothing to report under regulation 99 today, unless the loss of contact stops customers using a payment service, for example through authentication or payment alerts. From March 2027, under the new operational incident reporting rules, it will have to decide whether losing contact with customers meets any of the three thresholds, starting with harm from which customers cannot easily recover.
SYSC 15A.4.1R already requires a payment firm to identify and document the technology it needs to deliver each of its important business services. A firm that has recorded which cloud services support each of those services can make the four-hour decision on facts it already holds.
Frequently asked questions
Does a payment firm have to report an outage caused by its cloud supplier?
Yes, where the disruption to the firm’s own service meets the operational incident reporting test. Today a payment service provider must notify the FCA of a major incident under regulation 99(1) of the PSRs 2017, within four hours of first detection under the FCA’s direction, and the EBA guidelines measure the effect on payment services. The FCA expects each firm to report its own impact even where a third party failure is the shared root cause.
When do the new FCA operational incident reporting rules apply?
The FCA’s operational incident reporting rules made by PS26/2, published on 18 March 2026, come into force on 18 March 2027. Until then a payment service provider reports under regulation 99 of the PSRs 2017 and the EBA’s 2017 incident reporting guidelines, as directed by SUP 15.14. From 18 March 2027 it will report under SUP 15.18 and the new directions in SUP 15.14.
Does a critical third party’s incident report cover its customers?
No. A designated critical third party must report a CTP operational incident to the regulators and to affected firms under CTPS 8.1.1R, and the FCA’s new rules contain no relief from the firm’s own operational incident reporting duty where the supplier has reported. The regulators notify each provider at designation of which of its services are systemic, so a firm cannot assume that an email or collaboration outage falls within the supplier’s duty.
Does a telecoms provider have to report a cloud supplier outage to Ofcom?
Only if the outage is a security compromise with a significant effect on the operation of its public network or service, or a compromise within section 105K(1)(b), under section 105K of the Communications Act 2003. Ofcom expects an urgent compromise to be notified usually within 3 hours and fully reported within 72 hours. A failure of the provider’s own office systems that leaves its network and service running is unlikely to be reportable, unless the cause is unauthorised access that could enable a further compromise.
For advice on incident reporting, supplier arrangements and other payments product and scheme governance questions under the Payment Services Regulations 2017 and the FCA’s new rules, contact Rob Bratby at Bratby Law.
This post was researched and drafted with the help of Claude, Anthropic’s AI model. Rob Bratby chose the topic and thesis, and reviewed and edited the final post. Rob takes full responsibility for its content.
