Reference Case Number: FOI2026_01302
Freedom of Information: Right to know request:
1. How many operational incidents have been reported to the FCA by individual firms / financial market infrastructure under SUP 15.3 and Principle 11 in the years 2021-2026 inclusive?
2. Of (1), how many related to third party failures?
3. Of (2), how many of these arose from a cyber-attack?
4. Of (2), how many of these third parties were cloud service providers?
5. Of (4) how many were
a) general cloud service providers (e.g. Amazon AWS, Google GCS, Microsoft Azure)
b) application oriented cloud service providers / SaaS providers
c) AI service / application related (e.g. Amazon, Google, Microsoft AI platforms, Anthropic, ChatGPT, etc)
d) underlying infrastructure providers supporting generic cloud providers and/or SaaS providers (e.g. CrowdStrike, Cloudflare)
FCA response:
We can confirm that we hold some of the requested information, which is set out below.
| Question 1 | 5313 |
| Question 2 | 1421 |
| Question 3 | 391 |
| Question 4 | 64 |
We do not hold the information you requested for Question 5. This is because we do not record information to this level of granularity. Attempts to determine a response would require manual review of records and potentially liaising with the firms that reported the data. The amount of analysis that would be needed to undertake the exercise would be tantamount to creating new information, which we are not required to do under FOIA.