Cyber security for financial services: UK regulatory expectations

In short. UK financial services firms are regulated for cyber security through the FCA and PRA operational resilience rules, with CBEST and STAR-FS for systemically important firms, DORA for those with EU business, and direct oversight of critical third parties since July 2026. This guide sets out what each regime expects and what a proportionate penetration testing programme looks like for a firm that is not a bank.

UK financial services firms are regulated for cyber security through operational resilience rules rather than a single cyber standard. The FCA and PRA require firms to identify their important business services, set impact tolerances for disruption and prove through testing that they can stay within them; the deadline for full compliance was 31 March 2025. Systemically important firms are additionally subject to intelligence-led penetration testing under CBEST and STAR-FS. Firms with EU business fall under the EU’s DORA as well, and since July 2026 the largest cloud providers to the sector are directly overseen by UK regulators as critical third parties. This guide sets out what those regimes expect and what a proportionate testing programme looks like for a firm that is not a bank.

Why the sector is a target

Banks, insurers, wealth managers, payment firms, lenders and advisers hold money, the credentials that move it, and the personal data that makes fraud convincing. UK Finance’s Annual Fraud Report 2026 put fraud losses for 2025 at £1.28 billion, with authorised push payment fraud alone at £576.4 million. Behind a large share of those figures sit compromised email accounts, exposed customer portals and suppliers whose access to a firm’s systems was wider than it needed to be.

The UK operational resilience regime

The FCA’s policy statement PS21/3 and the PRA’s supervisory statement SS1/21 introduced the current framework in 2021. Firms had to identify their important business services, set an impact tolerance for each (the maximum tolerable disruption), map the people, processes, technology, facilities and third parties each service depends on, and test their ability to remain within tolerance. The transition period ended on 31 March 2025. Since then, firms are expected to be able to show, not assert, that they can withstand severe but plausible disruption.

The rules sit in the FCA Handbook at SYSC 15A. Chapter 15A.5 requires scenario testing against disruptions including loss of technology, data corruption and failure of a third party, carried out regularly and after material change, with lessons learned recorded. The Handbook does not use the words penetration testing. In practice, a cyber attack is the most plausible severe scenario for almost every important business service, and the only credible way to test whether the technology underneath a service would withstand one is to attack it under controlled conditions. That is why penetration testing, cloud configuration review and build reviews form the evidential core of most firms’ scenario testing.

In 2026 the FCA added PS26/2 on operational incident and third-party reporting, which formalises what firms must tell the regulator about incidents and material outsourcing arrangements. Reporting well depends on knowing your estate well, which is a further argument for testing that maps what is actually exposed.

CBEST and STAR-FS

For firms whose failure would matter to the financial system, the Bank of England, PRA and FCA run CBEST: threat-intelligence-led penetration testing that simulates the tactics of the real adversaries targeting the firm, against live production systems, with the regulator involved in scoping and review. STAR-FS extends the same model to a wider set of firms with lighter regulatory involvement. Both are supervisory programmes rather than Handbook rules; if you are in scope you will know, because your supervisor will tell you. For everyone else, they are a useful description of what good looks like: testing driven by realistic threat scenarios rather than a generic checklist.

DORA and UK firms

The EU’s Digital Operational Resilience Act has applied since 17 January 2025. It is EU law and does not apply to a firm that operates only in the UK. It does reach UK firms that carry out in-scope financial activity in the EU, UK firms that provide ICT services to EU financial entities (through contractual flow-down of DORA’s requirements), and UK entities that supply ICT services to EU members of their own group. DORA is more prescriptive than the UK regime on testing: it requires a documented digital operational resilience testing programme, with threat-led penetration testing at least every three years for the firms it designates. If any part of your business touches EU financial services, map that exposure now rather than when a counterparty’s procurement team asks.

Critical third parties

Since 13 July 2026 the Bank of England, PRA and FCA have had direct oversight of designated critical third parties to the UK financial sector. The first four designations were Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited. This does not change a firm’s own responsibility for how it configures and uses those services. The regulators oversee the provider; the firm remains accountable for its tenant, its identities, its data and its configuration, which is where most cloud breaches actually happen.

What a proportionate testing programme looks like

For a firm that is not in CBEST scope, the following is a defensible baseline that maps directly onto the operational resilience requirements:

Annual external infrastructure and web application testing of every internet-facing service that an important business service depends on: customer portals, APIs used by partners and apps, remote access and email gateways.
Cloud configuration and identity review of Microsoft 365, Azure, AWS or Google Cloud tenants, because identity is now the perimeter and most sector incidents start with an account, not an exploit.
Internal infrastructure testing at least every two years, or annually where the firm handles client money, to establish what an attacker or a compromised supplier account could reach once inside.
Testing after material change: a new platform, a migration, an acquisition, a new outsourcing arrangement.
Retesting so that remediation is evidenced, not assumed. A finding marked fixed without a retest is an assertion; regulators and auditors know the difference.
Cyber Essentials Plus as an independently audited floor for the five basic controls, which also satisfies a growing number of client and framework requirements.

The output of each of these should feed the firm’s self-assessment document, because that is where the regulator will look for evidence that mapping and testing were real.

Fintech and start-ups

Early-stage firms often sit outside the direct scope of the rules above until they are authorised, but their customers, partners and investors do not. A payments or lending start-up built on public cloud has exactly the exposures that cause incidents: misconfigured storage, over-privileged service accounts, APIs that trust the mobile app, secrets in repositories. The cheapest time to find these is before a due diligence questionnaire does. A web application and API test together with a cloud configuration review is the usual first engagement, scoped to the product rather than to a compliance template.

What we test in the sector

We test customer-facing web applications and APIs, mobile banking and payment apps, the cloud tenants underneath them, external and internal infrastructure, and the builds of the servers and endpoints that staff and administrators use. Every engagement is scoped by an active penetration tester with the relevant skill set, delivered by a named consultant, and reported within 5 working days with a plain-English executive summary that can be put in front of a board or a supervisor. The penetration testing page describes each service and our sample report shows what you receive.

Frequently asked questions

Does the FCA require penetration testing?

Not by name. SYSC 15A requires firms to test their ability to remain within impact tolerance under severe but plausible scenarios, and penetration testing is the accepted way to evidence resilience of the technology behind an important business service. CBEST and STAR-FS require it explicitly for the firms they cover.

Does DORA apply to UK firms?

Only where they have EU exposure: EU financial activity, ICT services provided to EU financial entities, or intra-group ICT services to EU entities. A UK-only firm is outside it.

How often should a financial services firm have a penetration test?

At least annually for internet-facing systems and after material change, with internal testing on a one- to two-year cycle depending on the firm’s risk profile. DORA requires threat-led testing every three years for designated firms; CBEST runs on the regulator’s cycle.

Is Cyber Essentials enough for a regulated firm?

No, but it is a useful floor. Cyber Essentials Plus independently audits the five basic technical controls; the operational resilience regime expects mapping, testing and governance well beyond that. Most regulated firms hold Plus and test on top of it.

What does a first engagement usually look like?

For most firms, an external infrastructure test plus a web application or API test of the primary customer-facing service, with a cloud configuration review of the tenant they run on. That covers the exposures that cause most sector incidents and produces evidence the operational resilience self-assessment can cite. Contact us to scope it.

Cyber security for financial services: what UK regulators expect and how to test against it