If you’re a financial planner or advisory firm, chances are you’ve already got an IT support company. They handle your emails, your computers, maybe your backups, antivirus, and hopefully they’re responsive when something breaks.
So far, so good, right? Well… maybe not. In our experience, most IT providers who support financial firms aren’t actually thinking about your business through the lens of FCA compliance. And that’s where the real risk lies, not in the stuff you know you need to do, but in the gaps you don’t even realise are there.
The hidden risks behind “business as usual”
Before we go any further, we want to make something clear; we still think general IT support is very important. You need someone to fix broken laptops, manage your email accounts, and reset passwords when someone inevitably locks themselves out.
But financial firms operate in a tightly regulated environment. You’re not just any business, you handle very sensitive client data, manage regulated financial products, and are directly accountable to the FCA when things go wrong. That means your cyber resilience needs to meet specific expectations, not just the bare minimum best practices that would be fine for other businesses.
The problem there is that most IT providers don’t specialise in regulated industries. So, while they’re good at tech, they may not be thinking about your business in terms of regulatory obligations, risk frameworks, or FCA reporting timelines. They’re not doing anything wrong; they just might not be doing enough. And often, firms don’t realise it until they’re in the middle of an incident.
It’s not just an IT problem, it’s a governance issue
Here’s what we often find when we speak with advisory firms:
- There’s no formal IT or cyber policy.
- Backups exist, but no one knows how long it would actually take to restore systems after an incident.
- No recent tests of incident response procedures.
- No clarity on what counts as a reportable breach under FCA rules.
- Third-party vendors (including outsourced IT providers) aren’t reviewed from a risk or compliance perspective.
None of this is unusual, but it is super risky. Because if a cyber-attack happens (and it’s increasingly a case of when, not if) the FCA expects you to respond quickly, decisively, and in line with specific regulatory standards. That’s not something you can “wing”, especially when the heat is on.
Don’t just assume your IT company has it covered
Many firms assume, “Our IT companies got this covered.” But when you dig into the detail, there’s often a mismatch between expectations and reality.
For example, if you ask your provider how your current setup aligns with the FCA’s requirements on operational resilience or cyber incident response, will they be able to give you a clear, confident answer? Or will you just hear crickets?
Cyber resilience for financial firms goes way beyond just installing antivirus and hoping for the best. It’s about governance, continuity, risk assessment, staff training, and having clear, tested plans for when things go wrong.
What questions should my financial firm ask an IT company?
What’s truly dangerous isn’t the stuff you know you’re not doing, it’s the stuff you didn’t even know needed to be done. That’s the blind spot.
You could have hardware, regular software updates, and a solid antivirus, and still be unprepared for a targeted phishing attack, a supplier compromise, or a ransomware incident that triggers an FCA reportable event.
So, what can you do? We’ll start by having the right conversations with your IT provider. Here are five key questions that will help uncover where you really stand:
1. How does our current IT setup align with FCA expectations around cyber resilience and operational continuity?
If they can’t explain this in plain English, or even worse, they don’t know what those terms mean, it’s a problem. You’re not a coffee shop or a design studio. You’re a regulated financial firm, and your tech setup needs to reflect that.
2. What’s our process for detecting and reporting a cyber breach, and does it meet FCA reporting timeframes?
The FCA expects timely notification of certain incidents. That means you need both detection and documented procedures to escalate and report within the required time window.
3. Do we have a board-level IT and cyber policy and is it reviewed regularly?
You might think that managing cyber risks is just an IT thing, when actually it’s important for your entire company to be involved in cybersecurity measures. The FCA expects senior management to take ownership of it. That means policies should be reviewed at board level, not gathering (digital!) dust in a folder no one ever opens.
4. Are our backups protected against ransomware and how long would it really take to restore operations?
Just saying “we have backups” isn’t enough. Are they isolated from your main systems? Are they tested regularly? And if something goes down, how long would it really take to restore everything? You need to know the answers to these questions.
5. Do we have up-to-date IT policies covering things like AI, remote work, ransomware, and vendor access?
Your policies need to match how your firm actually operates. That includes acceptable use, passwords, remote work, offboarding, AI usage, and more. And they should be clearly aligned with your risk profile and the FCA’s expectations.
Final thoughts
Cybersecurity for financial firms go way beyond just ticking boxes, you need to have the right conversations with your IT provider. These five questions are a good place to start. If your IT provider can’t give clear, confident answers, it might be time to dig deeper or look elsewhere.
Download our new FCA Cyber Ready checklist
Most financial firms assume their IT company has cyber security under control, but the FCA expects more than antivirus and backups – they want governance, policies and proof you’re in control.
How do you know if your IT provider is meeting FCA expectations?
You can download this completely free FCA Readiness checklist to find out if they really understand the FCA’s cyber resilience expectations – or if there are gaps you need to address
Download here
