The UK's answer to DORA is now live, and the part that lands on firms starts in March

The Decision Focus Team

Oct 16, 2026

People often ask us about “UK DORA”. There isn’t one. The UK has no single act to match the EU’s Digital Operational Resilience Act. Instead it has built the same protection in layers, and in 2026 the last 2 layers arrived. One puts the largest cloud providers under direct supervision. The other tells firms how to report their own incidents and their own critical suppliers. The first gets the headlines. The second is the one that will change how your programme runs, and it takes effect on 18 March 2027.

‍

The cloud providers are now supervised. Your duties have not moved.

‍

The Bank of England, the PRA and the FCA started overseeing the first critical third parties (CTPs) on 13 July 2026, after HM Treasury designated 4 global cloud and technology providers. The rules for the regime had come into effect on 1 January 2025, but they only bite once a provider is designated. For the first time, UK financial regulators can work directly with the companies that host much of the sector’s infrastructure.

‍

It would be easy to read this as the regulators taking concentration risk off firms’ hands. The Bank of England closes that door in its own announcement: the regime “complements, but does not replace” the existing outsourcing and operational resilience rules, and firms remain responsible for their own due diligence, risk management and contingency planning. A designated provider is a better-supervised provider. It is still your provider, and your exit plan for it is still yours to write.

‍

The reporting rules are the part with a deadline

‍

In March 2026 the FCA, PRA and Bank of England published joint rules on operational incident and third-party reporting: the FCA’s PS26/2 and the PRA’s PS7/26. According to the FCA, they come into force on 18 March 2027 and the incident rules apply to almost all FCA-regulated firms as well as firms regulated by the PRA and the Bank of England. The third-party rules reach a narrower group, broadly the enhanced reporting firms described below. This is the closest the UK comes to DORA’s incident and register duties, and it is 5 months away.

‍

The rules have 2 halves.

‍

Incidents:

Under the FCA’s rules, a firm reports an operational incident when it reasonably believes the incident poses a risk to 1 of 3 things. The first is consumers, through intolerable harm they cannot easily recover from. The second is the safety and soundness of the firm or other market participants. The third is market stability, integrity or confidence in the UK financial system. The PRA’s thresholds are keyed to its own objectives: safety and soundness, policyholder protection for insurers, and UK financial stability for O-SIIs and Solvency II firms. Dual-regulated firms assess against both sets and make a single submission. The FCA says about 90% of firms will file a single short form with 10 required questions. Banks, Solvency II insurers, payment service providers, enhanced scope SM&CR firms and a few others are “enhanced reporting firms”. They file 1 form, updated through initial, intermediate and final phases. The initial phase is expected within 24 hours of deciding a threshold is met (payment service providers keep their existing 4-hour deadline from first detection), and the final report within 30 working days of resolution, or 60 where that is impracticable.

‍

Third parties:

Firms in scope must notify the regulators of new material third-party arrangements, and of significant changes to existing ones, and submit an annual register of them. The definition covers outsourcing and non-outsourcing arrangements alike. Third-country branches are excluded from the notification duty but still submit the register. The register keeps the supply chain ranking, which the FCA says lets it identify critical nodes in a firm’s supply chain. Dual-regulated firms make 1 submission, shared between the regulators: notifications go through Connect and the annual register through RegData.

‍

Your DORA work helps, but it will not carry you over the line

‍

Many firms we work with across Europe run DORA and UK programmes side by side, and the instinct is to reuse the DORA register of information and incident classification. Much of the data will transfer. The FCA is clear, though, that while its incident reporting is broadly aligned with DORA, that legislation “has a different scope” and the FCA will not replicate it exactly.

‍

3 points in PS26/2 stand out to us.

‍

- Thresholds are not tied to important business services. The FCA chose not to use the thresholds firms set for important business services and impact tolerances, because an incident that misses an important business service can still harm consumers. A data loss is the FCA’s own example

‍

- Internal severity scales areno defence. Firms need not align their internalseverity levels to the regulators’ thresholds. They must not leave an incidentunreported only because it fell below their own internal threshold

‍

- Notification reaches further than under DORA. The FCA expects firms to notify a new material arrangement before making any internal or external commitment. DORA asks for advance notice too, but only for ICT arrangements supporting critical or important functions. The UK duty is not limited to arrangements that support an important business service, and a UK third-party arrangement can be any product or service, not only ICT

‍

The last point is the one most likely to catch firms out. Under the UK rules, materiality has to be assessed while the deal is still being negotiated, not when it reaches the register. That moves third-party risk from the annual cycle into procurement.

‍

A fair objection, and our answer

‍

A fair objection is that this is more reporting for firms that already completed the operational resilience work by the 31 March 2025 deadline. They mapped and tested their important business services, set impact tolerances and found their key suppliers. Reporting it all again canlook like duplication.

‍

Because the purpose is different. The resilience rules ask whether each firm can stay within tolerance. The reporting rules ask where the sector’s dependencies concentrate. The FCA says register submissions will help it understand systemic third-party risk and see incidents that start at third parties. That data will shape which providers are designated next. A firm whose register is incomplete is not only exposed to a supervisory finding. It is also giving the regulators a less accurate picture of the risks it shares with everyone else.

‍

What to do before 18 March 2027

‍

- Decide which reporting tier y ou are in. Under PS26/2 the enhanced tier changes the people and timings you need for the first 24 hours. Check too whether the third-party duties apply to you at all, since many solo-regulated firms report incidents but sit outside the register and notification duties

‍

- Map your incident classification to the 3 thresholds. Test it against past incidents, including ones that never touched an important business service. If you are dual-regulated, map to the PRA’s thresholds as well

‍

- Build the material third-party register from your supplier records. Include non-outsourcing arrangements, any product or service that meets the materiality test rather than ICT alone, and the supply chain beneath your direct providers

‍

- Put a materiality check into procurement. The notification must go before the contract is signed, so the assessment has to come first

‍

- Reuse your DORA data deliberately. Record where the UK definitions differ, so one supplier record serves both regimes

‍

One supplier record serves both regimes

‍

Firms that hold supplier, contract, service and incident data in separate spreadsheets will feel this deadline most. The register, the notifications and the incident reports draw on the same facts: which supplier, which service, which subcontractors, which important business service. When those facts sit in one place and are linked, a new UK template draws on data the firm already holds instead of starting a new project.

‍

We built our DORA support on that principle, and our Third-Party Risk Management (TPRM) module holds suppliers, services, contracts and nth-party supply chains in one connected record. If the March deadline has you looking again at how your supplier and incident data fit together, we would be glad to walk through it with you. Book a demo to see it live.

‍