When your regulator starts asking about your technology

For a long time, regulators cared about your numbers, your conduct and your processes — and technology was assumed to be working in the background. That has changed. Across regulated sectors, regulators now ask about technology directly: how you manage it, how secure it is, how resilient you are, where your data lives. When your regulator starts asking these questions, it is a signal that technology has become part of how you are judged — and being unable to answer well is now a compliance risk in itself.

Why regulators now look at technology

The reason is simple: technology has become central to how regulated businesses operate and where they fail. Outages, breaches and data losses now cause the kind of harm regulators exist to prevent, so they have extended their scrutiny to the systems underneath the business. In financial services this is now explicit and formalised — the operational-resilience regime of DORA requires firms to manage technology risk, test their resilience, and account for their critical third parties. Other sectors are moving the same way. The expectation is no longer that technology quietly works; it is that you can demonstrate you are managing it.

What they expect to see

Regulatory technology questions cluster around a few themes. Governance: that someone owns technology risk and decisions are made deliberately, not informally. Security: that you protect data and systems with appropriate, evidenced controls. Resilience: that you could keep operating, or recover quickly, if something went wrong. Data: that you know what data you hold and where it lives — the question explored in your regulator asked where your data lives. And third parties: that you understand and manage your dependence on the vendors and services you rely on. Underlying all of them is a demand for evidence — not assurances, but the ability to show your working.

Why “we’re probably fine” is dangerous

The trap is assuming that because nothing has gone wrong, you are compliant. Regulators increasingly want demonstrable governance — documented ownership, assessed risks, tested resilience — not the mere absence of an incident. A business that has been quietly lucky but cannot evidence how it manages technology risk is exposed the moment it is asked. And “we think it’s handled” is precisely the answer that invites a closer look.

How to respond from a position of control

The right response is to get ahead of the questions rather than scrambling to answer them. Establish who owns technology risk. Assess and document your risks honestly. Make sure you can evidence your security, your resilience and your data position. The work is the same work that makes the technology genuinely safer and better governed — it is not compliance theatre, it is the substance regulators are now checking for. Done in advance, a regulator’s question becomes a confident, evidenced answer rather than a panic. This is also frequently what prompts the related conversation when the board starts asking questions about technology the business cannot yet answer.

When a regulator starts asking about your technology, being unable to answer well is itself the risk. We will get you to a position where the answers are ready and evidenced.

Start a Conversation