Managed IT and cyber security for regulated firms in London
Managed IT and cyber security for regulated firms in London
In the first hour, contain the attack, preserve evidence and call your IT provider and your insurer’s incident line. If money has been sent to a fraudster, call your bank immediately. Within the first day, decide whether the incident must be reported to your regulator: the FCA and PRA expect prompt notice of significant incidents now, and from 18 March 2027 most FCA firms must report within 24 hours of deciding an incident meets the PS26/2 threshold. Report personal data breaches to the ICO within 72 hours of becoming aware where feasible, and report the crime to Report Fraud.
| Who | When | Notes |
|---|---|---|
| Your bank | Immediately, if funds were sent or accounts are at risk | Ask for a recall and for the receiving bank to be contacted. |
| Your insurer | As early as possible, per your policy | Late notice can affect cover. |
| FCA | Promptly for significant incidents (Principle 11, SUP 15.3). From 18 March 2027: within 24 hours of deciding the PS26/2 threshold is met | Payment service providers: within 4 hours of detection under PS26/2. Some firms also send updates and a final report. |
| PRA | Promptly, for dual-regulated firms | The PRA has aligned incident reporting rules for the firms it supervises. |
| SRA | Promptly | Serious breaches under Rule 3.9, and attacks that affect or could affect clients. |
| ICO | Without undue delay and, where feasible, within 72 hours of becoming aware | For personal data breaches likely to risk people’s rights and freedoms. Record your reasoning even if you decide not to report. |
| Affected individuals | Without undue delay | Where a breach is likely to result in a high risk to them. |
| Report Fraud | As soon as practical | The national cyber crime and fraud reporting service run by City of London Police, which replaced Action Fraud in December 2025: reportfraud.police.uk or 0300 123 2040. |
| NCSC | For significant incidents | The National Cyber Security Centre gives confidential support and is not a regulator. |
The clocks run in parallel, not one after another. The 72-hour ICO window and a 24-hour regulatory window can both start on the first day, so have your decision-makers lined up in advance.
Under PS26/2, an operational incident must be reported to the FCA when you reasonably believe it could cause intolerable harm to consumers, threaten the safety and soundness of your firm or others, or affect market integrity or confidence. The 24-hour clock starts when you make that decision, so make it promptly and write down why. For the ICO, the question is whether the breach is likely to result in a risk to individuals’ rights and freedoms. If you are unsure, it is usually safer to make an initial report and update it later. Our FCA cyber security guide covers the thresholds in more detail.
Paying a ransom does not guarantee you get your data back, may mark you as a future target and, if the criminals are subject to sanctions, can be an offence. The government has confirmed it intends to legislate to ban ransom payments by public bodies and critical national infrastructure and to require other organisations to report attacks and tell the authorities before paying. At the time of writing those proposals are not yet law, but regulators, insurers and the NCSC all expect you to involve them before making any decision. The best defence is a backup the attacker cannot reach, tested regularly.
We help clients write and test this plan as part of our cyber security services.