Is Cyber Essentials required for FCA-regulated mortgage brokers?

Not by the FCA directly. But networks, PI insurers and increasingly lenders require it as part of supplier and AR onboarding.

Does CE cover WhatsApp client conversations?

Only if the channel is managed (e.g. WhatsApp Business with proper retention). Personal WhatsApp for client documents is a fail. Move it or formally scope it out.

Do I need CE if I'm a one-person brokerage?

Often yes – networks ask sole-trader ARs for it. The micro band is the cheapest IASME tier and the prep is realistic for a single adviser.

Can I use my personal laptop for broker work under CE?

Yes, but it needs to be enrolled into MDM or covered by a strict BYOD policy with MFA on every business app and a separate work profile.

How long does CE take for a brokerage?

Two to four weeks from engagement to certificate, assuming you have a clean SaaS audit and your sourcing/CRM accounts are individually-named.

Cyber Essentials for Mortgage Brokers UK

Why brokers are being asked now

Three pressures have converged in the last 24 months. Networks want a defensible position for their appointed representatives. PI insurers have widened their cyber questions. And BSL panels increasingly include CE in supplier-onboarding for paid introducer relationships. Most brokers find the request lands from the network first.

Scope for a typical brokerage

Adviser laptops and mobile phones (work-issued or personal under BYOD).
The sourcing system (Twenty7tec, Trigold, Iress).
The CRM or case-management platform.
Email tenancy (M365 / Google Workspace) and any shared inboxes.
Document storage where applicant ID lives.

Marketing platforms, newsletter tools and any standalone websites can usually sit outside scope with a short written rationale.

The five fail patterns specific to brokers

WhatsApp for client docs. Convenient, but unmanaged. Either move it onto a managed platform or scope-exclude with strict policy.
Personal Gmail forwarding. A surprising number of small brokerages forward work email to a personal Gmail "for convenience". Hard fail.
Shared sourcing logins. One Twenty7tec login shared between two advisers. Each user must have their own account with MFA.
Old leaver still in the CRM. The administrator who left in 2024 still has Salesforce access. Routine to spot, easy to fix.
BYOD laptops with no MDM. If you allow BYOD, you need either MDM coverage or a clear policy excluding business data from those devices.

What CE costs a brokerage

Most brokerages fall in the IASME micro or small band: £320–£440 + VAT for the assessment itself. Add 8–15 hours of internal time for prep, and an MDM tool if you're above 10 devices. See the 2026 cost breakdown.

Practical sequence

Run a SaaS audit – list every cloud tool that holds applicant data.
Turn on MFA across all of them, including sourcing and CRM.
Write a one-page joiners/leavers process.
Move WhatsApp client conversations onto a managed platform or formally scope them out.
Submit CE.

Why brokers benefit beyond compliance

Lower PI premiums on renewal where the cyber section is rated.
A trust mark for client-facing pages – particularly important for first-time buyers.
Easier conversations with introducers who've started filtering on CE.

Want a guided run? See our Fully Managed Cyber Essentials service or jump to CE overview.