Every major ICO fine since early 2025 has been a security-failure case under Article 32, not a privacy-policy case. Capita, Advanced Computer Software, 23andMe, and LastPass — the pattern across all four is specific enough to extract direct, technical lessons, not just a general reminder to take security seriously. Average ICO fine values have risen …
“A tolerance statement that has not been tested is not evidence of resilience. It is a documented aspiration.” That distinction, now being drawn explicitly by supervisors, is the whole story of where operational resilience regulation has moved since the March 2025 transition deadline passed. UK operational resilience policy from the FCA, PRA, and Bank of …
From Monday 13 July 2026, the Bank of England, PRA, and FCA begin direct oversight of the UK’s first four Critical Third Parties — AWS, Google Cloud, Microsoft, and Oracle. What this changes for a regulated firm’s own cloud concentration risk assessment, and — more importantly — what it doesn’t. The legal powers behind the …
A reading of what technology due diligence on a UK fintech target actually examines — written for PE and strategic buyers, where the FCA’s change-in-control timeline and the new safeguarding regime both intersect with the technology estate more than a generic tech DD checklist accounts for. UK fintech M&A runs on a different clock than …
A reading of what SYSC 8 in the FCA Handbook actually demands of a technology function, and how the rule interacts with the wider operational resilience regime. SYSC 8 is the FCA Handbook chapter on outsourcing. It looks, on first reading, like a short and unremarkable section. In practice it is the foundation of how …
A reading of what PRA Supervisory Statement 1/21 actually requires of a technology function, written for the firms now past the March 2025 transition deadline. The PRA’s operational resilience regime — PS6/21 and the supporting Supervisory Statement SS1/21 — completed its three-year transition on 31 March 2025. From that date, PRA-authorised firms have been expected …
A reading of the UK Critical Third Party regime — what it does to designated providers, and the six technology implications for the financial firms that depend on them. The Financial Services and Markets Act 2023 introduced the UK Critical Third Party regime — the UK’s equivalent of DORA’s CTPP framework, with its own designation …