Regulator Expectations Digest: operational resilience at banks
Bank of England FPC tells firms to prepare for frontier-AI cyber and operational risk
One in-window signal this week, from the Bank of England's Financial Policy Committee (FCA = Financial Conduct Authority; PRA = Prudential Regulation Authority); two dated context items follow. The FCA website returned access errors to us, so FCA material is secondhand, and we found no new PRA or FCA operational resilience rule, notice or consultation in the window.
The 30-second version
Bank of England FPC record (Sep 30): firms should prepare for AI-related cyber and operational risks; a speech-level signal, not a rule.
PRA PS7/26 (Mar 18 context): incident and third-party reporting rules apply from 18 March 2027, with SMF24 accountability expected.
FCA frontier-AI cyber review, reported by Hogan Lovells (secondhand): no new requirement, but governance and resilience are named priorities.
01Bank of England · Sep 30
FPC: frontier AI incidents reinforce calls to prepare for cyber and operational risk
Force: Speech signal (Financial Policy Committee record of its 25 September 2026 meeting, published 30 September; not a rule). The FPC said recent frontier AI test-environment incidents, where autonomous models took unexpected actions, "reinforce the FPC's calls for firms to prepare for AI-related cyber and operational risks", and urged firms to engage with regulators' guidance, the National Cyber Security Centre, and sector groups including the Cross Market Operational Resilience Group.
It also said vulnerability patching had become "critically important, but also a source of risk". It addresses all UK financial firms, so a bank reliant on a cloud core is in scope. Separately, the Bank's Systemic Risk Survey 2026 H2 (also 30 September) found cyberattack cited by 75% of respondents as a top risk, behind geopolitical risk at 91%.
Expect to be asked: how does your cloud core provider's patching and AI-related threat monitoring feed your own vulnerability management and impact-tolerance testing?
PS7/26 reporting rules start 18 March 2027, with an SMF24 owner expected
Force: Binding rule (policy statement with final Rulebook instrument, developed jointly with the FCA and the Bank as FMI supervisor; published 18 March 2026, older than the window). The PRA says implementation is 18 March 2027, firms have until March 2027 to complete the register, and it amended Chapter 5 of SS2/21 on identifying material third-party arrangements.
On governance, the PRA "would expect the Chief Operations SMF24 to hold overall responsibility" for implementing the incident reporting outcomes; it does not expect the SMF24 to approve each report. Notifications and the register go through a single platform, FCA Connect.
Expect to be asked: is your cloud core banking provider on your material third-party register, and who, by name, owns incident reporting before March 2027?
FCA frontier-AI review: no new requirement, but resilience and governance in focus
Force: Guidance-level review findings, not a rule. Secondhand: Hogan Lovells reports (Sep 23) that the FCA published multi-firm review results on 2 September; the FCA page returned a 403 error to us, so we could not open it. Per that alert, the FCA identified five themes, including that vulnerability discovery is accelerating faster than firms' ability to respond and that foundational cyber and operational resilience matters more.
The law firm notes the FCA is not explicitly requiring action but expects firms to take findings seriously. Treat this as a lead to verify against the FCA's own publication; it falls just outside our 30-day lookback.
Expect to be asked: what evidence shows your board has considered the FCA's frontier-AI themes against your remediation speed for vulnerabilities in outsourced cloud services?