HaloNinjas

    For FCA-regulated firms

    From everyday tickets to FCA-ready evidence.

    Halo, set up by HaloNinjas so your important business services, impact tolerances, incident clocks and third-party register come out of the work your teams already do.

    Book a 30-minute resilience sessionDownload the PDF walkthrough
    Incident INC-2041Reportable
    • Important business serviceCard payments
    • Impact tolerance1h 42m of 4h
    • FCA reporting clockRunning from detection
    • Third party involvedMaterial supplier
    Product mock-up. Not a final screenshot.
    • 18 Mar 2027PS26/2 applies
    • 24 hto report, from deciding a threshold is met
    • 4 hfor payment firms, from detection
    • Annualregister of material suppliers

    SYSC 15A has been fully in force since 31 March 2025.

    Why now.

    1. 01

      Transition ends

      Firms must remain within impact tolerances.

      31 Mar 2025
    2. 02

      PS26/2 published

      Incident and third-party reporting rules confirmed.

      18 Mar 2026
    3. 03

      Reporting applies

      Incident reports and the material third-party register.

      18 Mar 2027

    Two reporting tiers

    Serious incidents are reported within 24 hours of deciding a threshold is met; payment firms have 4 hours from detection. Material suppliers go on an annual register.

    What a supervisor will ask to see

    • Your important business services and their owners
    • Impact tolerances and evidence you stay within them
    • How you decided whether an incident was reportable
    • Your material third parties and exit plans
    • Scenario tests and what changed afterwards

    The model.

    Once everything links to a service, resilience evidence is a filter, not a project.

    Operational resilience in Halo: services first, two clocks, a recorded decision, the register as a report, and one dashboard for the board

    How it works in Halo.

    Services

    Important business service record, product mock-up
    Product mock-up. Not a final screenshot.
    • Six tolerance fields on every important business service
    • Dependencies linked from the CMDB
    • Owner and review dates on the record

    Incidents

    Incident with regulatory assessment, product mock-up
    Product mock-up. Not a final screenshot.
    • Two clocks: impact tolerance and FCA reporting
    • The reportability decision is recorded, with who made it
    • Your firm decides and submits; Halo holds the record

    Changes and suppliers

    Change and contract records, product mock-upChange and contract records, product mock-up
    Product mock-up. Not a final screenshot.
    • Changes show which important services they touch
    • Contract records carry the FCA register fields
    • The material third-party register is a filtered report

    The board view

    Resilience dashboard, product mock-up
    Product mock-up. Not a final screenshot.
    • One view for Senior Managers and the board
    • Built from the same records the teams work in
    • Evidence for the self-assessment, without a separate project

    What changes for your teams.

    TeamBeforeWith Halo
    Risk and resilienceTolerances in a spreadsheet, evidence assembled before each reviewTolerances on the service record, evidence from live data
    IT operationsIncidents logged without the service or the clockEvery incident linked to a service, with both clocks running
    ComplianceReportability decided by email and chased by phoneA recorded decision with who made it and when
    ProcurementSupplier list held apart from the services it supportsContract records carrying the register fields
    Senior Managers and the boardA quarterly pack, out of date when it landsA live dashboard from the same records

    How we deliver.

    Two phases before March 2027 if you start by December.

    Discovery workshop

    Priority. Important business services, tolerances and owners agreed.

    Service model and CMDB

    Services linked to the systems, people and suppliers they depend on.

    Incident, problem and change

    Priority. Clocks, regulatory assessment and change risk on every record.

    Suppliers, testing and dashboards

    The third-party register, scenario tests and the board view.

    Why HaloNinjas.

    A pure-play Halo partner: Halo is all we implement. Founded in Perth, Scotland, with teams in London, Manchester and Manila, and founders from enterprise service management.

    HaloITSM certified partner badgeSpecialised Halo PartnerHaloITSM certified. Listed in Halo's partner directory.

    Questions we get asked.

    Does Halo submit the report to the FCA?
    No. Halo is the record and the workflow. Your firm decides whether an incident is reportable and submits the report.
    Which tier are we?
    That depends on your firm type and permissions. We set up the clocks for the tier you confirm; we don't make that call for you.
    Can we do this on our existing Halo instance?
    Yes. Most of the work is configuration: service records, tolerance fields, clocks and supplier fields on the instance you already run.
    Does it cover DORA for EU entities?
    The same service, incident and third-party model supports DORA evidence, but the fields and timelines differ. We configure for the regimes you tell us apply.
    How long does it take?
    Two phases before March 2027 if you start by December. The discovery workshop and incident set-up come first.

    See it on your own services.

    A 30-minute session on your important business services, with one of the founders.

    Book a 30-minute resilience sessionDownload the PDF walkthrough

    General information, not legal advice.

    Screens are product mock-ups, not final screenshots.

    HaloITSM is a product of Halo Service Solutions.