Company: BCS
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0000312069-25-000114
Chunk: 495

Company: BARCLAYS PLC
Filing Date: 2025-02-13
Form: 20-F
Chunk 495
---
, the FCA and the PRA each published a consultation paper (CP24/28 and CP17/24 respectively) on proposals for firms to report operational incidents and their material third party arrangements to enhance the operational resilience framework. The FCA has stated that it expects to publish finalised rules in a policy statement in the second half of 2025, whilst the PRA has stated that the proposed implementation date for its proposals is no earlier than the second half of 2026. FSMA 2023 introduced a new regime for designated critical third party providers (CTPs). In November 2024, the FCA, PRA, and BoE jointly released the final rules and expectations for designated CTPs with the final rules having taken effect from 1 January 2025. Whilst the new rules apply to designated CTPs themselves, there may be additional impact and costs for the Group incurred in connection with updating existing supplier arrangements to reflect the new CTP requirements where suppliers are designated as critical CTPs. The EU’s Digital Operational Resilience Act (DORA) entered into force in January 2023 and has applied from 17 January 2025, introducing comprehensive and sector specific regulation on Information Communication Technologies (ICT) incident reporting, testing and third party risk management, and providing for direct oversight of critical third party providers servicing the EU financial services sector. Firms which do not meet the regulations under DORA can face significant fines and other regulatory measures. The EU’s Network and Information Security (NIS) Directive, which aimed to improve the resilience of network and information systems in the EU against cybersecurity risks, has been updated. The revised version, NIS2, applies from 18 October 2024 and imposes stricter security, governance and incident reporting requirements. Failure to comply can lead to significant fines and senior manager liability among other things. The extraterritorial effect of NIS2 means entities established outside the EU may fall within its ambit if providing certain services in the EU. In the UK, the original NIS Directive was transposed into UK law and still applies but a new Cyber Security and Resilience Bill is planned to be introduced to Parliament in 2025. In 2023, the SEC finalised disclosure rules regarding cybersecurity risk management, governance and incident reporting by US- listed companies, including foreign private issuers such as Barclays PLC and Barclays Bank PLC. The rules require foreign private issuers to annually disclose the policies and procedures relied upon to identify and manage cybersecurity risks, including risk