The Financial Conduct Authority (FCA) is the regulator for financial services in the UK. Its role includes protecting consumers and keeping the industry stable. They also promote healthy competition between financial service providers.

The FCA expects that all firms should have systems, controls, and processes in place to protect their consumers and the markets they operate in from risk. The FCA separates firms into different types of groups called ‘portfolios’ based on their business models. Each group is supervised and managed according to key drivers of harm. One of those key drivers of harm, which features across all of these portfolio groups, is the potential for fraud. The risk of fraud, both in terms of having inadequate systems and controls and risk management frameworks and firms not being fully aware of the threats from cyber attacks will lead not only to greater client detriment, but the overall loss of integrity of the financial services industry. The FCA expects that firms should be aware and up to date with cybercrime attacks, including the latest scams, and be able to defend themselves effectively by responding proportionately to cyber incidents.

The FCA works on a principle-based approach and have 11 principles for business. Principle 11 is around relations with the Regulator and how a firm needs to be open and cooperative in the way they deal with its regulators. A firm must disclose to the FCA anything relating to the firm of which the Regulator would reasonably expect notice which includes making them aware of any cyber incidents, and where any customer harm occurs as a result of an attack. 

More information on what the Regulator is looking for a firm to do,  can be found by reading the FCA consultation on Operational Resilience and also their cyber insights publications.