Meet your cyber resilience duties as a financial services firm

No single cyber rulebook exists for UK financial services. The FCA holds firms to account for cyber security through its operational resilience, systems and controls, outsourcing and notification rules, and through individual accountability under the Senior Managers and Certification Regime (SM&CR). Which rules apply depends on the type of firm.

Check whether the operational resilience rules apply to you

Record and approve your approach

Write up your approach in a self-assessment record. Your governing body must approve and regularly review it, and you must keep every version for at least 6 years.

Give a senior manager accountability

Senior management is accountable for operational resilience, and the board or equivalent body must approve the mapping, which cannot be delegated to someone outside it. The FCA expects the individual performing the Chief Operations function (SMF24) to oversee operational resilience. If you have no SMF24, decide which individual is the most appropriate and record it in their Statement of Responsibilities.

Manage outsourcing and third parties

You stay responsible for every regulatory obligation when you outsource or rely on a third party, including cloud services, and you cannot delegate that responsibility. Principle 3 and SYSC 1.2.1 require reasonable care and adequate risk management systems. SYSC 8 and SYSC 13 add rules for material outsourcing. You must notify the FCA of material, critical or important outsourcing arrangements.

The FCA, the Bank of England and the PRA also jointly oversee critical third parties to the UK financial sector. That regime does not change your accountability for your own resilience.

From 18 March 2027, firms in a defined group must tell the FCA when they enter into or significantly change a material third party arrangement, whether or not it is outsourcing, and must submit an annual register of those arrangements. The group includes enhanced scope SM&CR firms, banks, building societies, designated investment firms, Solvency II firms and authorised electronic money and payment institutions.

Report cyber incidents

Principle 11 and SUP 15.3 require you to tell the FCA about anything it would reasonably expect notice of. Treat an incident as material if it:

• disrupts your financial services in a material way
• affects a large number of customers
• gives unauthorised access to your information systems
• causes a significant loss of data
• takes your IT systems out of your control or leaves them unavailable

If you are dual-regulated, you also inform the Prudential Regulation Authority (PRA) of incidents.

Tell your named FCA supervisor or, if you have none, use the SUP 15 firm notification form. Payment service providers must also notify the FCA of a major operational or security incident under regulation 99 of the Payment Services Regulations 2017.

From 18 March 2027, almost all FCA-regulated firms, and firms regulated by the PRA and the Bank of England, report through one standard form on Connect. You report an incident if it risks intolerable harm to consumers, the safety and soundness of the firm or other market participants, or market stability, integrity or confidence. Most FCA solo-regulated firms submit a short standard report.

If an incident involves personal data, you may also have to report a personal data breach to the Information Commission (formerly the ICO).

For a cyber incident, you may also need to tell the National Cyber Security Centre. If you believe the incident is criminal, report it to Report Fraud.

Put basic technical controls in place

The rules above do not set out specific technical controls. The NCSC Cyber Essentials scheme sets a baseline of five that you can use as a starting point.

Use the regulators' cyber assessments

With the PRA, the FCA offers a cyber self-assessment questionnaire, CQUEST, of 50 multiple-choice questions. They cover whether you have a board-approved cyber security strategy, how you protect critical assets, and how you detect, respond to and recover from an incident. Ask your supervisor to take part. The FCA and PRA also use CBEST, which assesses a firm's cyber resilience by live penetration testing that mimics real attackers.

Enforcement: what the FCA and PRA can do

Breaching the operational resilience or systems-and-controls rules is not a criminal offence, but the FCA (or the PRA, for its own rules) can take disciplinary action under the Financial Services and Markets Act 2000.

The rules most often in play after a cyber incident are:

• FCA Principle 3 (Management and control): every authorised firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems
• FCA SYSC 15A: identify your important business services (SYSC 15A.2.1R), set an impact tolerance for each (SYSC 15A.2.5R) and be able to stay within it in a severe but plausible disruption (SYSC 15A.2.9R). These apply to banks, building societies, insurers, enhanced scope SM&CR firms, payment and e-money firms and some others, not to every firm
• PRA Operational Resilience Part: the same three requirements for CRR firms such as banks and building societies

If a regulator finds a breach, it can:

• publish a statement of public censure (section 205)
• impose a financial penalty of whatever amount it considers appropriate. There is no statutory maximum (section 206)
• suspend or restrict your permission to carry on regulated activities for up to 12 months (section 206A)
• vary or cancel your permission if you are failing the threshold conditions (section 55J)
• act against individual senior managers for misconduct with a penalty, a suspension of their approval for up to 2 years or a public statement (section 66)