Sectors · Finance
Financial services
Wealth managers, asset managers and financial companies carry more cyber obligation than almost anyone: FCA and PRA expectations on operational resilience, named accountability under SM&CR, and fraud pressure that never lets up.
The pressure
Regulated, targeted, and watched.
Wealth and asset managers sit under more scrutiny than almost any other kind of business. Where the FCA’s operational resilience rules apply, firms must identify their important business services, set impact tolerances for each one and be able to stay inside them under severe but plausible disruption. Those rules cover enhanced-scope SM&CR firms among others, and many core-scope firms adopt the same method because clients and consultants ask about it. The SYSC sourcebook sets the systems-and-controls expectations behind that, and under the Senior Managers and Certification Regime the accountability has a name against it rather than a department.
The threat side is just as unrelenting. Payment diversion, business email compromise and account takeover are aimed squarely at client money and at the people authorised to move it. Firms with an in-scope EU group entity, or that supply ICT services to EU financial institutions, are also drawn into DORA, every firm handles personal data under UK GDPR, and firms serving retail clients carry Consumer Duty obligations on top. Clients, consultants and insurers then ask for the evidence in their own formats. From 18 March 2027 the FCA, PRA and Bank of England also move to a single regime for reporting operational incidents and material third-party arrangements.
Challenges we hear
The pressures specific to financial companies.
- Evidencing operational resilience, and proving you can stay inside your impact tolerances
- Carrying SM&CR accountability without leaving a senior manager personally exposed
- Payment diversion and business email compromise aimed at client money
- Third-party, outsourcing and ICT concentration risk across platforms, custodians and administrators
- Client and consultant due-diligence questionnaires arriving faster than they can be answered well
- Protecting client and portfolio data under UK GDPR, across staff who work from anywhere
- Standing up to regulatory scrutiny, and to an underwriter at renewal
Rules that apply
The obligations and standards in play.
- FCA operational resilience (SYSC 15A), where your firm is in scope: important business services, impact tolerances and scenario testing
- One incident and third-party reporting regime across the FCA, PRA and Bank of England, in force 18 March 2027
- SYSC: the systems and controls expectations sitting behind your governance
- SM&CR: individual accountability for the controls the firm relies on
- Consumer Duty, where you serve retail clients
- DORA, where you have an in-scope EU group entity or supply ICT services to EU financial institutions
- UK GDPR, plus PCI DSS wherever card data is in scope
- ISO 27001 and SOC 2, usually asked for by clients and consultants rather than by a regulator
Where to start
Four steps before your next supervisory conversation.
- Name your important business services and set an impact tolerance for each
- Map the people, technology and third parties each service depends on
- Put a call-back verification step on every payment instruction and change of bank details
- Build one register of third parties that serves FCA, DORA and client due diligence alike
How we help
Protection and proof, joined up.
- Continuous compliance across the obligations above, kept audit-ready month to month
- 24×7 managed detection and response across the estate
- Email security, payment-verification discipline and identity controls to blunt fraud and account takeover
- DORA gap assessment and the Article 28 third-party register
- A named senior advisor for board papers, regulator questions and client due diligence
Where to start
FAQ
Questions buyers actually ask
- The FCA’s operational resilience rules in SYSC 15A apply to enhanced-scope SM&CR firms, banks, insurers, and payment and e-money firms among others, so most core-scope wealth managers sit outside them. You are still expected to keep resilient systems and controls under SYSC, and many core-scope firms use the same method of important business services and impact tolerances because institutional clients and consultants ask about it.
- Typically the certifications you hold, such as Cyber Essentials Plus or ISO 27001, and SOC 2 where US clients are involved; multi-factor authentication and access controls; encryption; backup and restore testing; incident response and notification; staff training; and how you manage your own suppliers. Dated evidence now carries more weight than yes or no answers.
- Almost all FCA-regulated firms are in scope. Align your incident classification with the single definition of an operational incident, decide who assesses and submits a report, and make sure your register of material third-party arrangements can produce what the regime asks for. The thresholds and worked examples are in the FCA’s guidance FG26/3 and FG26/4.
- Independent confirmation. Any new payee, change of bank details or unusual instruction is checked with the client by phone on a number already on file, and signed off by a second person before money moves. Technical controls reduce how many fraudulent requests arrive; the confirmation step catches the ones that get through.
- They run separately. A material incident is reported to the FCA, today under Principle 11 and SUP 15.3, and through the single reporting regime from 18 March 2027. A personal data breach that meets the threshold goes to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. One incident can trigger both, so decide in advance who assesses each.
Under FCA or DORA pressure?
Tell us your obligations; we’ll map the shortest credible route to meeting and evidencing them.
Book a call