Wealth managers, fund managers, family offices
Financial firms
Wealth managers, multi-family offices and fund managers are checked hardest by their investors and clients, and the FCA expects firms to control what they outsource. We run your IT so the answers are on file.
Software we keep running
- Microsoft 365
- Entra ID
- Intune
- SharePoint
- Teams
What’s at stake
Investors set the bar.
Due diligence reaches your suppliers
Investor questionnaires ask how you choose and oversee IT providers, and whether your key suppliers have independent assurance reports.
The FCA expects control of outsourcing
For critical or important functions, its outsourcing rules (SYSC 8, binding on MiFID investment firms and guidance for most fund managers) expect access and audit rights for you, your auditors and the FCA, and your written consent before a provider subcontracts.
Incident reporting starts in March 2027
From 18 March 2027, FCA-authorised firms must report operational incidents that cross the thresholds, with a first report normally within 24 hours of deciding that one does (payment firms: four hours from detection).
What we put in place
What we deliver.
- Contract terms your compliance team can fileAccess and audit rights, your written consent before we subcontract, and an exit plan, written into our agreement in line with SYSC 8.
- Evidence for due diligenceAccess reviews, dated restore tests, incident records and the security baseline in one evidence file for investors’ questionnaires.
- Ready to report an incidentAn incident plan with clear roles, and records kept as things happen, so you can decide fast whether a threshold is crossed.
- Microsoft 365, hardened and documentedMulti-factor sign-in, protected admin accounts, managed devices and a written security baseline, with every change on record.
- A tested exit planHow you would move to another provider, written down and tested, before anyone asks.
- Family offices, same standardMulti-family offices and private-wealth firms get the same controls and evidence, because their clients and banks ask the same questions.
Proof
What we can show today.
- Security practices aligned with ISO/IEC 27001, and we’ll tell you plainly what that covers and what it doesn’t.
- We’ve run IT for fund managers and law firms for years, alongside our engineering and architecture clients.
Start
Where does your firm stand?
In a first call we go through what your investors and the FCA will ask about your IT and your providers, and how we’d meet it. The regulatory assessment stays with you.
- No first level
- No surprises
- Pilot before you buy