Navigating the New Frontier: The 2026 PRA and FCA Material Third-Party Regime
Published on: 27/04/2026 00:00
The regulatory landscape for operational resilience (OR) has undergone a significant upgrade. On 18 March 2026, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) published their final Policy Statements (PS7/26 and PS26/2) on a unified and enhanced framework for reporting operational incidents and Material Third-Party (MTP) arrangements, the latter of which we discuss here.
With the rules set to come into force on 18 March 2027, firms now have a critical twelve-month implementation window to align their Third-Party Risk Management (TPRM) programmes with these heightened expectations. This shift moves beyond traditional “outsourcing” to a broader, more holistic view of the third-party ecosystem, and is in line with our views on more holistic Third Party Management (TPM) – see our TPM whitepaper.
The link with incident reporting is also interesting and is driven by the fact that the largest segment of incidents reported to the regulators related to third party relationships. There is no doubt that the regulators are increasingly concerned about the robustness of TPRM across the industry, both at an individual firm and systemic level.
Download the full Whitepaper below.
