IT Support for Financial Advisers

The rules

What the FCA expects of your IT

There’s no separate FCA rulebook for IT. The systems and controls rules set the standard instead. SYSC 4.1.1R requires robust governance arrangements, including “effective control and safeguard arrangements for information processing systems”, and for most advice firms and brokers it applies in proportion to the size and complexity of the business. SYSC 9 adds a duty to keep records good enough for the FCA to check you’ve met your obligations to clients.

Be careful with the phrase “operational resilience”. The FCA’s formal operational resilience rules (SYSC 15A) apply to banks, building societies, insurers, enhanced scope SM&CR firms and a few other groups, so most small advice firms aren’t in scope. Incident reporting reaches further. Principle 11 already expects you to tell the FCA anything it would reasonably expect to know, such as a cyber attack that seriously disrupts your service, and new operational incident reporting rules for every firm with Part 4A permission come into force on 18 March 2027.

If you’re an appointed representative, you work under your principal’s responsibility, and your network may set its own IT standards. We work to them. Either way, your compliance support decides what the rules require; our job is to make your IT meet it.

Platforms and back office

Every login is a way in

An adviser’s day runs through a back-office system, Microsoft 365, investment platforms and provider portals and, for brokers, lender and sourcing systems. Each one holds client data, and each is a target if its password is stolen.

We put multi-factor authentication on every Microsoft 365 account and help you switch it on for every platform and portal that offers it. Cyber Essentials says sign-ins to cloud services must always use MFA, so this matters for certification too. We also help you keep a list of who can get into what, so a leaver’s access is removed everywhere, not just from email, and nobody uses an administrator account for everyday work. More on securing Microsoft 365.

When a platform or back-office system misbehaves, we work out whether the fault is on your side or the supplier’s, and deal with the supplier for you.

Away from the office

Advisers who work on the road

Advisers meet clients at home, in cafés and at kitchen tables. Every laptop and phone that touches client data is part of your firm’s security, and Cyber Essentials counts home-working laptops and personal phones used for work as in scope.

We set laptops up so they’re encrypted, updated automatically, protected by a firewall on public Wi-Fi and able to be locked or wiped remotely if one is left on a train. Client files stay in Microsoft 365 rather than on the laptop, so a lost device is far less likely to become a data breach. Personal phones can be set up so work email stays in a protected app, separate from personal apps.

Certification

Cyber Essentials and Plus

Cyber Essentials is the UK government-backed scheme that shows you have protection against the most common cyber attacks. More insurers and clients now ask for it, and it gives you a clear answer when a compliance review asks about cyber security.

We keep every system we manage to the Cyber Essentials standard, certified or not. Our Cyber Essentials support starts from £295 + VAT plus the IASME assessment fee, and every business we’ve prepared has passed. We also prepare firms for Cyber Essentials Plus, where the certification body tests your systems hands-on, and support you through the audit.