Incident reporting
Also called operational incident reporting, ICT incident reporting
Incident reporting is the duty on regulated firms to notify their supervisors when a serious operational or cyber incident disrupts services, data or customers. Rules set what counts as reportable, how fast the first notice must go in and what follow-up reports must contain. Deadlines range from hours to weeks depending on the regime.
How it works
A firm detects an incident, such as an outage, a cyber attack or a failure at a supplier. It assesses the impact against set thresholds, such as clients affected, duration, data loss and economic impact. If the incident is major, the firm sends an initial notification, then intermediate and final reports with root cause and remediation. The process runs alongside data breach reporting to privacy regulators.
Supervisors use incident reports to spot weak firms and sector-wide threats, such as a failure at a shared cloud provider. Short deadlines mean firms need classification criteria and approvers agreed in advance. Under DORA, the first notice is due within 4 hours of classifying an incident as major. US banks must notify regulators within 36 hours. The UK regime starts on 18 March 2027.
The rules
Major ICT incidents need an initial notice within 4 hours of classification, an intermediate report within 72 hours and a final report within one month.
EU financial entitiesSets thresholds for reporting operational incidents and a standardised process with a single submission to the FCA, PRA and Bank of England.
FCA-authorised firms, payment service providers and certain market infrastructureBanks must notify their primary federal regulator as soon as possible and no later than 36 hours after determining that a notification incident has occurred.
US banks and their bank service providersPublic companies disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality.
SEC-registered public companiesCommon questions
What is a reportable incident?
Each regime sets its own test. Most look at the number of clients affected, how long services were down, data lost or exposed, geographic spread and financial impact. Incidents that cross the thresholds are major or notifiable and must be reported.
How fast must a financial firm report a major incident?
Under DORA the initial notice is due within 4 hours of classifying an incident as major, and no later than 24 hours after detection. US banks have 36 hours. SEC-listed companies have four business days after deciding an incident is material.
Is incident reporting the same as data breach reporting?
No. Data breach reporting under GDPR goes to the data protection authority within 72 hours when personal data is at risk. Operational incident reporting goes to financial supervisors and covers outages and cyber events even when no personal data is involved.
When do the new UK incident reporting rules start?
The FCA published PS26/2 on 18 March 2026. Its rules apply from 18 March 2027, with a single reporting framework shared by the FCA, PRA and Bank of England.
Our coverage
News and analysis on GRC and resilience from RegTech Post.
Read the coverage →RegTech PostDORA: A Complete Overview of Europe’s Digital Operational Resilience ActRead the article →RegTech PostNIS2 Overview: How the EU Is Reshaping Digital SecurityRead the article →
