How London operations software buyers handle FCA and ICO duties

What to take away

FCA rules London financial firms must check before buying operations software

London has the highest density of FCA-regulated buyers in the UK, so operations software decisions here carry regulatory weight. Before you shortlist a vendor, confirm which FCA rules touch the workflow you are automating.

The Operational resilience | FCA rules require firms to identify important business services, set impact tolerances and test their ability to stay within them during severe but plausible disruption. Operations software that runs client onboarding, payments or reporting sits inside that boundary. Those rules sit in SYSC 15A of the FCA Handbook.

Consumer Duty sets a higher standard for retail customer outcomes. If your software shapes pricing, communications or support journeys, the FCA expects you to show it does not create foreseeable harm. Read the FCA's Consumer Duty | FCA guidance before you write requirements.

Consumer Duty is Principle 12, set out in PRIN 2A, and the client communications your software generates sit under COBS.

SMCR allocates individual accountability. A named senior manager must own the systems and controls that operations software supports, and the certification regime covers staff who use it. The rules sit in SYSC 23 to SYSC 27.

These duties interact with wider UK rules. The UK rules for business productivity software cover data, monitoring and security expectations that apply across regulated and unregulated buyers.

Finally, check procurement routes. Crown Commercial Service frameworks and the Digital Marketplace can shorten due diligence, but they do not transfer your regulatory obligations to the supplier.

What to ask vendors about SYSC and PRIN controls

Ask for evidence, not assurances. Request a control mapping that shows how the software supports each relevant FCA rule, and ask who signs off changes to workflow logic.

Ask how the vendor handles regulatory change. FCA rules evolve, and your contract should say who pays for updates when reporting fields or audit trails need to change.

Ask about module licensing. Audit-trail, long retention and bulk export functions are often priced as separate modules rather than included in the base subscription. The figure that matters is the total cost across the contract term. Ask whether pricing runs per user, per record or per business service, and what triggers a price step.

Worked example: a London wealth manager

A London wealth manager automates client reviews in a new operations platform. The platform sends reminders, stores suitability notes and triggers escalations.

Consumer Duty review: the firm checks that reminder timing does not pressure vulnerable clients and that escalation rules reach a human adviser.

Operational resilience review: the firm sets a four-hour impact tolerance for client review scheduling and tests a manual spreadsheet fallback.

ICO review: the firm records legitimate interests as the lawful basis for client contact data. It sets a retention period for suitability notes and completes a Data Protection Impact Assessment because the processing is large scale and includes financial data.

SMCR review: the head of operations accepts accountability for the platform's controls, and the firm certifies the staff who configure escalation rules.

The firm documents each decision in a single register that links software features to regulatory duties. That register becomes the evidence pack for the next FCA conversation.

Consumer Duty and operational resilience in operations workflows

Consumer Duty asks firms to act in good faith, avoid foreseeable harm and support customers to pursue their financial objectives. Operations software mediates many of those interactions.

Map each workflow to a customer outcome. If a CRM sequence determines when a vulnerable customer receives a call, that sequence is a Consumer Duty control, not just a productivity feature.

Operational resilience is the second lens. The FCA wants firms to stay within impact tolerances during disruption, which means your software must support failover, manual workarounds and clear recovery priorities.

Test the workflow, not the brochure. Run a tabletop exercise where your operations software is unavailable for a business day and record how important business services continue.

Data protection sits alongside these duties. Data protection for productivity software explains purpose by purpose how to document what personal data each tool touches.

Senior Managers and Certification Regime accountability for software

SMCR makes individual accountability explicit. For operations software, that means a senior manager must own the systems and controls the software provides or supports.

Start with a responsibilities map. List each operations tool, the business service it supports and the senior manager accountable for it. Gaps in that map are findings waiting to happen.

Then check the certification regime. Staff who can change workflow logic, credit rules or client communication templates may need certification, because their actions affect regulated outcomes.

The FCA's Senior Managers and Certification Regime | FCA guidance sets out the senior management functions and the conduct rules that apply. Read it before you assign ownership in a vendor contract.

Contract terms matter here. If the vendor controls configuration changes, your senior manager may not have effective control, which weakens your SMCR position.

A decision log an FCA supervisor can follow

Keep a decision log for every material change to operations software. Record who approved the change, what regulatory duty it affects and what testing was done.

Review the log quarterly with the accountable senior manager. A current log is faster to produce than a reconstructed one.

ICO duties: lawful basis, retention and DPIAs in London firms

Operations software almost always processes personal data, so the Lawful basis | ICO rules apply. You need a lawful basis before processing, not after.

The ICO lists six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests. Pick the one that fits each purpose and document it.

Legitimate interests is common in operations software, but it requires a balancing test. Record the test, because the ICO expects you to show your reasoning.

Retention is the next duty. Set retention periods for CRM records, support tickets, call recordings and audit logs, and configure the software to delete or anonymise data when the period ends.

You must carry out a Data Protection Impact Assessment when processing involves high risk. Operations software that profiles customers, monitors staff or processes financial data at scale is likely to need one.

The ICO's list of high risk indicators runs to nine criteria, covering systematic monitoring, large-scale processing, matching datasets and data about vulnerable people. A DPIA is expected where processing meets two or more of them.

Run the DPIA before purchase where possible. It is cheaper to change a configuration than to unwind a live processing activity.

ICO steps to document before go-live

Professional services and Law Society anti-money laundering duties

London's legal sector buys operations software under its own regulatory layer. The Anti-money laundering | The Law Society guidance shapes client onboarding, matter management and document retention.

Law firms must conduct client due diligence, identify beneficial owners and monitor transactions for suspicious activity. Operations software that stores client data or automates onboarding must support those duties.

Check that the software can record verification steps, retain evidence for the required period and produce reports for a money laundering reporting officer. If it cannot, the firm will maintain parallel records, which defeats the purpose.

Confidentiality matters too. Legal professional privilege and client confidentiality constrain how data can be shared with vendors, so review hosting, access and support arrangements.

Accountants, surveyors and other professional services firms face similar duties from their own regulators. The principles of evidence, retention and oversight carry across.

AML features that satisfy Law Society duties

- [ ] Audit logs showing who viewed or changed client records - [ ] Export in a format a regulator or reviewer can read - [ ] Client due diligence records storing the verification method, date and reviewer - [ ] Sanctions and politically exposed person screening with results retained - [ ] A suspicious activity report route that reaches the money laundering reporting officer

A pre-purchase checklist for London operations software buyers

Use this checklist before you sign. It covers FCA, ICO and professional services duties in one pass.

Work through the risk scenarios your team should rehearse, from leaky connectors to trapped capability. The artefact to produce afterwards is a signed control register that links each workflow, its owner and the rule it satisfies.

Use a selection checklist that covers workflow fit, export and exit when you compare vendors. The cheapest licence is expensive if leaving costs a year of data reconstruction.

Score each vendor against the requirements and keep the evidence. Re-test the controls after go-live and review them each quarter.

Common questions