2.6 The PRA proposes that firms would be required to report an operational incident when it meets one or more of the thresholds set by the PRA (see Chapter 24 of the Regulatory Reporting Part of the PRA Rulebook and Chapter 2 of the draft new SS in Appendix 2).

2.7 The PRA considers that thresholds must be clear and set to ensure that it only receives incident data relating to operational incidents that pose a risk to its objectives. The PRA proposes to take a proportionate approach to the reporting requirements which does not pose undue burden on firms. The PRA has therefore made a risk appetite decision to link the reporting thresholds to the point where an operational incident poses a risk to its objectives.

2.8 The PRA therefore proposes that firms would be required to submit an operational incident report once an operational incident poses a risk to:

- (where the firm is an O-SII/where the firm is a relevant Solvency II firm (as defined in the PRA Rulebook)) the stability of the UK financial sector;

- the safety and soundness of the firm; and/or

- (for insurers) the appropriate degree of policyholder protection; and/or