In March 2026, the FCA confirmed new rules covering incident reporting and third‑party risk management. These rules are designed to make reporting clearer and more consistent, while strengthening regulatory oversight of the suppliers and service providers banks increasingly rely on. 

Third‑party risk is not new, but the regulatory focus has sharpened. The FCA is now explicitly linking supplier oversight to operational resilience, expecting banks to understand their critical dependencies and show they can identify, assess, and respond quickly when something goes wrong. 

A turning point for how banks define resilience 

The FCA’s announcement signals a shift in how resilience is being defined and tested. Static assessments and periodic reviews are no longer enough, and banks now need to show that resilience is embedded in day‑to‑day operations. 

A good example of this is Incident reporting where banks are expected to recognize material incidents earlier, understand their impact on important business services, and then report them consistently. That requires real visibility into the systems, suppliers, and dependencies that underpin their operations. 

This places supply chain integrity firmly on the executive agenda, cutting across operational resilience, cyber security, fraud, and financial crime. 

Why the FCA is acting now 

Recent findings from the UK Parliament’s Treasury Committee showed that nine major banks and building societies experienced at least 803 hours of unplanned IT and systems outages over the past two years. That equates to more than 33 days of disruption, often impacting customers’ ability to access essential financial services. 

These incidents highlight a recurring problem which is that failures within third‑party ecosystems, particularly technology providers, can cascade quickly across multiple institutions. When visibility is limited and escalation is slow, operational issues become consumer harm and, ultimately, regulatory concern. 

Beneath these changes is a broader shift in how risk is understood across banking. As reliance on third‑party technology and service providers grows, so does the potential for disruption to spread beyond a single institution, affecting customers, markets, and financial stability at scale. 

This is why supply chain resilience has moved beyond traditional third‑party risk. It now cuts across operational resilience, cyber security, fraud, and financial crime, making it a C‑suite issue for COOs, CROs, and CISOs. 

The threat is also changing as organized crime groups are looking for indirect routes into financial institutions, and third‑party ecosystems can provide entry points for fraud, financial crime, insider collusion, and operational disruption.  

A cyber incident affecting a shared technology provider, for example, can have immediate and far-reaching consequences. Customer data may be exposed, fraudulent activity enabled, and services disrupted across multiple institutions simultaneously. In these scenarios, the speed at which issues are identified, understood, and contained determines whether an incident remains manageable or escalates into widespread harm. 

The core challenge: fragmented data and regulatory risk 

For most banks, the biggest obstacle to meeting these expectations is not a lack of intent, but the fragmentation of their data. Supplier information may sit in procurement systems, while ownership data, transactional records, risk indicators, and third-party intelligence are often held across different tools and teams. Without those sources being connected, it becomes difficult to build a single, trusted view of supplier networks. 

As a result, critical questions are difficult to answer quickly: 

• Which suppliers are genuinely critical to service delivery? 

• Where do hidden dependencies or concentration risks exist? 

• How could a cyber incident, sanctions exposure, or instance of fraud spread through the supply chain? 

• Could your teams identify and assess a material incident within hours if required? 

When these questions cannot be answered with confidence, the risk is not just operational disruption but regulatory failure. 

What banks should do now and the timeline involved 

The new rules were published in March 2026 and will take effect on March 18, 2027. In regulatory terms, that is a short runway, especially given long transformation and change cycles in banking. 

In practice, the near‑term priority is not replacing existing systems. It is connecting what you already have. 

Banks need to connect supplier, ownership, and transactional data to build a clearer view of third‑party risk. That connectivity enables faster issue identification, more accurate impact assessment, and timely escalation and reporting. 

Waiting until systems are replaced or perfect data models are built is not realistic. Preparedness depends on using existing data more effectively, sooner rather than later. 

How connected intelligence helps address the challenge 

This is where connected intelligence becomes essential. 

By linking internal and external data, resolving entities consistently, and applying contextual analytics, banks can uncover relationships and dependencies that traditional assessments miss. Continuous monitoring helps teams move away from point‑in‑time reviews and toward ongoing oversight. 

This supports the outcomes the FCA is driving toward: better decisions, clearer reporting, and more confident action when incidents occur. 

This is not about adding another layer of control. Rather, it is about making existing data usable, explainable, and actionable for the teams responsible for resilience and risk. 

Reframing the rules as an opportunity 

It would be easy to view the FCA’s new rules as another compliance burden. Indeed, many banks may feel under pressure given the short implementation window. 

However, this moment also presents an opportunity. Banks that act now can strengthen operational resilience, improve cross‑team collaboration, and gain a far clearer understanding of the supplier networks they depend on every day. 

Supply chain integrity is now firmly on the supervisory agenda. The organizations that succeed will be those that connect fragmented information, improve preparedness, and embed resilience into how third‑party risk is identified, reported, and managed. 

To learn how banks are using connected intelligence to strengthen supply chain integrity and meet evolving regulatory expectations, explore our latest insights and solution resources.