Does the FCA require Cyber Essentials?

Not directly. But its operational-resilience and SYSC expectations effectively require evidence of technical controls, and CE is the simplest, most recognised evidence base in the UK.

Should an IFA aim for CE or CE Plus?

CE is the right starting point. Move to CE Plus once a network or platform integration handles client money or once a major B2B partner asks for it – which is increasingly soon.

Does my outsourced IT provider need their own CE?

Yes – your CE covers your data and your devices. Their privileged access to your tenant means they should hold their own certificate as part of supplier due diligence.

How does CE help with Consumer Duty?

Consumer Duty asks firms to act in good faith and avoid foreseeable harm. Demonstrable cyber hygiene reduces the most common 'foreseeable harm' from a data breach perspective.

Is CE enough on its own for an FCA firm?

For technical hygiene, yes. It doesn't cover governance, incident response or third-party assurance – those need separate processes, but CE is a strong foundation.

Cyber Essentials for Financial Services Firms

Why CE fits the FCA model

The FCA expects firms to have appropriate technical and organisational measures, defined important business services and known impact tolerances. CE doesn't satisfy all of that – it satisfies the technical hygiene layer, which is where most enforcement actions actually find gaps. It's a small certificate that closes a disproportionately large risk band.

Where CE evidence sits in the regulatory file

SYSC 4.1 (organisation requirements) – CE evidences technical controls.
SYSC 13/15 (operational risk) – CE controls map to common operational-cyber failures.
PS21/3 (operational resilience) – CE underpins the technical-controls leg of impact-tolerance work.
Consumer Duty – CE supports the "act in good faith" expectation around protecting client data.

Recommended scope

For a typical FCA-regulated firm, scope should include:

All staff laptops and phones touching client data.
The CRM (Salesforce, Intelliflo, Plannr, Curo).
The trading or custody platform admin interface.
Client-portal admin and document-storage tenancies.
Email tenant (M365 or Google Workspace) including any shared mailboxes.

Marketing micro-sites and unrelated subsidiaries can typically be excluded with a written rationale.

The four areas regulated firms most often slip on

Third-party SaaS MFA. The CRM has MFA, but the marketing email tool doesn't. Under the Danzell question set, every cloud account needs MFA.
Leavers process. Adviser leaves on Friday, account still active Monday. CE expects same/next-working-day disablement.
Patching cadence. The 14-day high-risk patching rule catches firms that batch updates monthly.
Admin separation. A founding partner using the same account for daily email and platform administration is a common fail.

CE vs CE Plus for FCA firms

Standard CE is sufficient for most appointed representatives and small advice firms. CE Plus is the right level once you hold client money, run a custody platform integration, or operate as a wholesale firm. Insurers and PI underwriters increasingly price CE Plus into renewals.

What this looks like in practice

Year 1: standard CE during the annual operational-resilience review.
Year 2: upgrade to CE Plus 60 days before CE renewal so certificates align.
Year 3+: CE Plus annually, audited alongside the firm's resilience self-assessment.

For an IFA-specific walkthrough, see our IFA cyber-certification page. To start, head to Cyber Essentials.