The Personal Investment Management & Financial Advice Association (PIMFA)

Dictionary

Login Home
Filter by Topics

PIMFA responds to FCA’s Targeted Support consultation

29 August 2025

PIMFA, the trade association representing wealth managers and financial advisers across the UK, today issued its response to the Financial Conduct Authority’s (FCA) latest consultation on Targeted Support.

While PIMFA strongly supports the FCA’s proposals, it is also calling for clarity in key areas to ensure the regime delivers on its aims and avoids consumer confusion.

Simon Harrington, Head of Public Affairs at PIMFA, says: “Targeted support has the potential to be one of the most important reforms in a generation. There is a clear support gap which currently exists in the UK with 25 million people never having received professional advice or guidance. Targeted support can go some way to bridging that gap. Whilst we believe that this gap manifests itself across retail investment and pensions, because of the nature in which consumers tend to engage with their personal finances, we still believe that it will be most impactful for consumers making retirement decisions.

“We strongly support the FCA’s ambition to close the UK’s support gap, but to make this work for consumers and firms alike, we think these proposals would benefit from more clarity in a few key areas – specifically around data collection, and the way in which suggestions are communicated to consumers.

“The distinction between targeted support and regulated advice must be made crystal clear – consumers should understand that suggestions are options, not instructions. Ultimately, targeted support should be used to help consumers understand what they could do in certain situations, rather than tell them what they should. Where consumers do want more assertive direction, we believe that simplified advice remains an option the FCA should consider. Provided that it is accompanied with clear rules, focuses on servicing specific transactions and, crucially, is accompanied with a review of the qualification requirements, simplified advice can play a role in helping firms provide much needed certainty to consumers with clear needs at a cost which is affordable to them and to the firm.”

Other key points raised by PIMFA as part of their consultation response include:

· Consumer segmentation: PIMFA considers that a significant challenge for firms in designing targeted support journeys will centre on data – specifically how they collect it and how much they need. According to PIMFA, this has not been addressed comprehensively enough in the proposals or the rules thus far. PIMFA urges the FCA to produce guidance for firms on what data they could collect and how they could go about segmenting their consumers, rather than prescribing this, so the regime is reasonably flexible for firms.

· Better outcomes principle: Supports FCA’s use of “better outcomes” rather than “better position” but calls for clearer wording in the rules to confirm that targeted support should only be provided where it can be expected to deliver a better outcome than doing nothing at all.

· Scope restrictions: PIMFA supports limiting targeted support to pensions and ISAs but opposes inclusion of General Investment Accounts and high-risk products, warning these could undermine policy intent.

· Annuities: PIMFA also supports exclusion of sales of specific annuities from targeted support but opposes FCA’s proposed two-week delay between suggestion and purchase as detrimental, risking confusion or disengagement among consumers.

· Consumer protections: The trade body calls for greater transparency by asking firms to disclose the assumptions underpinning consumer segmentation and suggestions, as well as FCA/FOS joint guidance and case studies to avoid disputes over whether advice has been given, and supports FSCS protection for targeted support.

· Appointed Representatives (ARs): PIMFA urges FCA to allow ARs in consumer investment and retirement markets to deliver targeted support where appropriate controls and oversight are in place rather than a blanket ban.

· Implementation: PIMFA supports targeted support being free at the point of use, no additional record-keeping requirements, and a robust but not rushed authorisation process. However, it also warns that a free model could create unintended commercial incentives for firms as well as favouring firms which operate vertically integrated models.

Simon Harrington adds: “The FCA deserves credit for its collaborative approach and ambition. These proposals represent a major step forward in giving people the tools they need to make better choices and should have a positive impact in helping non-advised consumers make complex investment decisions.

“With some adjustments, the targeted support regime, combined with simplified advice and holistic financial planning, can create a continuum of support that helps consumers at every stage of their financial lives.”

PIMFA’s consultation response is available in full here.

AI for Wealth Management: From Curiosity to Confidence

AI is reshaping wealth management, but many advice firms are stuck at the exploration stage. This one-day in-house training course prepares your leaders, managers, and team members to transition from curiosity to confident adoption, providing practical insights into how AI supports client service, compliance, operations, and investment advice.

Our expert trainer Richard Preece demystifies AI, focusing on real-world use cases from UK advice firms, regulatory implications, and the leadership mindsets required for successful adoption. Whether you’re a senior manager shaping digital strategy or a compliance officer navigating new risks, you’ll gain the insight and language needed to lead informed conversations about AI in your firm.

Course Information:

Delivered in-house, this course is fully flexible to your preferred date and location.

Duration: One Day (9:30am – 4:30pm)
Format: In-person or virtual delivery course that’s tailored to your specific needs
Target Audience: CEOs, Partners, COOs, Investment Managers, Heads of Compliance, and Client Service Directors who want to explore AI confidently and responsibly.
Max # of participants: 15
Fee: Available on request

Enquiries: To find out more about this in house course contact learning@pimfa.co.uk

How D&O insurance can help protect against cyber related liability

The consistent evolution in the risk, breadth, and nature of cyber-attacks has solidified cyber risks as a key topic in many boardrooms. Beyond businesses suffering immediate financial losses and operational disruption, directors and officers may face shareholder litigation alleging negligence – potentially exposing them to personal liability.

Cybersecurity responsibilities of a board

The liabilities and duties regarding a company’s cyber-related protocols are increasingly becoming blurred between those of the company and the board of directors. Regulators are seeking to hold the board accountable for data, privacy, or network security governance failures and, subsequently, cyber events regularly rank highly in board surveys of directors’ risk.

Typically, the board is responsible for overseeing accurate and timely reporting of cyber risks, appropriate cybersecurity policies, and data protection controls. In the event of a cyber-attack, senior management must notify the relevant authorities and people and businesses who may be affected. Under GDPR, for example, organisations must notify a relevant supervisory authority within 72 hours of becoming aware of certain personal data breaches. If the breach poses a high risk to individuals, they must notify those individuals without undue delay.

Potential D&O fallout from a cyber-attack

The consequences of a cyber event could be exacerbated by the following actions from directors:

  • Poor preparation and risk management
  • Slow or ineffective response
  • Legal and regulatory non-compliance
  • Poor stakeholder communication
  • Inadequate recovery planning
  • Cultural and leadership failures

If a cybersecurity event occurs, the board may be scrutinised for failures, errors, or weaknesses in its response, or its assessment of cyber-related risk and insurance purchasing decisions beforehand. This can stem from:

  • Breach of duty
  • Negligence and mismanagement
  • Failure to comply with regulatory requirements
  • Drop in share price and lost revenues
  • Insolvency and financial losses
  • Securing inappropriate cyber insurance or insufficient review

Insurance considerations

A comprehensive insurance programme, addressing both D&O and cyber risks, is crucial for optimal mitigation. Transferring risk via cyber insurance offers an effective tool to safeguard against catastrophic losses, and the costs associated with a cyber event. Policies must be habitually reviewed to ensure coverage meets evolving threats and risk exposure.

Event-driven D&O claims are not new. However, recent high-profile breaches have highlighted the potential for cyber events to result in regulatory actions, civil lawsuits, and criminal proceedings – arguably transforming the scope of D&O-related responsibilities and liabilities.

For mismanagement claims arising out of a cyber incident, D&O insurance may provide coverage for:

  • Costs associated with regulatory investigations
  • Costs associated with shareholder litigation
  • Potential civil fines from regulators

Insurance recommendations

It is critical that organisations pay close attention to how both their D&O and cyber policies are structured and correlate. Both forms of coverage have distinct differences, and terms and wordings need to be carefully reviewed to avoid potential gaps and overlaps.

Cyber risks involve technical complexities that require specialised knowledge and robust controls. In contrast, D&O insurance primarily offers protection for board members from liability related to managerial decisions and should be reflective of the current legal environment. Board members may also face legal challenges alleging their cyber insurance programme is not fit for purpose.

D&O policyholders must gain a clear understanding of how their policy will respond in the event of a cyber incident, as D&O policies can contain cyber exclusions. Both policies should include clear wording, and these should be stress tested in anticipation of an incident.

Taking the following steps can help boards strengthen resilience and turn cybersecurity into a competitive advantage:

  • Make cybersecurity a strategic priority, embedding it within governance structures and routinely assessing security policies and compliance frameworks.
  • For sensitive data, implement robust data loss protection (DLP) and data classification protocols.
  • Regularly refresh employee training and awareness of cyber threats.
  • Allocate sufficient financial and technological resources to cybersecurity initiatives.
  • Highlight the steps that senior management has taken to prevent an attack/data breach.
  • Maintain a centralised register of third parties in the supply chain and partners – ensuring their cybersecurity protocols are continuously vetted.
  • Establish and rehearse thorough contingency, crisis, and business interruption plans.
  • Consider appointing a director with a cyber background or forming a separate committee dedicated to cyber risk management.
  • Liaise with brokers and other insurance professionals regarding cyber and D&O coverage, and how they interact.

For further advice on how we can help your business secure appropriate D&O insurance, visit our Management Liability page. For more information, please contact:

Jo Newman, Senior Vice President, Lockton

E: jo.newman@lockton.com

Lucy Scott, Partner, Lockton

E: Lucy.Scott@lockton.com

Michael Lea, Partner, Head of Management Liability

E: michael.lea@lockton.com

Culture & Inclusion Roundtable Event

PIMFA, as a longtime advocate of DE&I, both for its ethical merits, and a deep seated belief in its importance for a well performing business culture.  We will be hosting a half day roundtable in October, under Chatham house rules, to facilitate a dialogue and through discussions of good practices identify what firms are doing to create inclusive cultures, the impact it is creating and  what companies are doing to remain true to their values and overcome challenges and pushback.

PIMFA CEO Liz Field, and PIMFA Chair, The Rt. Hon John Gummer, Lord Deben, will be speaking to the subject and hosting roundtable discussions on this important topic with additional guest speakers being drawn from previous winners of the PIMFA D&I Awards, to discuss their pragmatic advice on inclusion implementation and the changing landscape. If you have an interest in the subject, we encourage you to book your place sooner rather than later, as ticket numbers will be restricted. This event is free for PIMFA members.

 

Cyber Security: Capture The Flag

Capture the Flag immerses you in a sensory-rich and hands-on learning environment. Guided by our security trainers and penetration testers, you will learn how to attack software applications and networks using the tools and techniques employed by real-life threat actors.

Why Capture the Flag?

Security isn’t always front and centre for engineering teams. Formal training in this space is still the exception, not the rule. But with threats on the rise, that gap can leave your software exposed.

Our hands-on events are built to change that. Tailored for developers, infrastructure engineers, and security professionals alike, these sessions are designed to embed security thinking into everyday engineering practice. You’ll learn how to spot, understand and mitigate vulnerabilities early – long before they make it to production.

This capture the flag event will help you to:

Glimpse into a hacker’s mindset and motivations
Understand common attack vectors and how to mitigate them
Embrace shift-left and secure-by-design principles
Develop confidence in your ability to write, test and ship secure code
Avoid the common security flaws introduced during development cycles

For more information please email MariaF@pimfa.co.uk

SRI Services and Partners Good Money Week event

Join us for a full day’s deep dive into sustainable and responsible investment for financial advisers, planners, wealth managers and fund selectors.

 

For further information on the agenda and how to book please click here

PIMFA Roundtable: AI in Wealth Management 2025

This invite-only event brings together leaders from across the PIMFA membership to discuss practical AI use cases, ethical and compliance considerations and tangible value creation. Expect deep insights from AI software houses, honest conversations between member firms, and thus equipping participants to make better choices about where to take their firm – all under Chatham House rules.

Who Should Attend:

  • COOs and CTOs
  • Compliance & Risk Leaders
  • Heads of Digital & Innovation
  • Senior Wealth Managers and Planners

What’s Included:

  • Breakfast networking
  • Expert panel sessions
  • Interactive roundtables
  • Action-oriented takeaways
  • Complimentary lunch

Please note that places are limited and allocated on a first-come, first-served basis

Avyse and PIMFA Transaction Monitoring Guide

The objective of the Guide is to offer practical, risk-based examples and recommendations tailored to the specific structures, client profiles, and transaction patterns typically found in the investment and wealth management sector.
The objective of the Guide is to offer practical, risk-based examples and recommendations tailored to the specific structures, client profiles, and transaction patterns typically found in the investment and wealth management sector.
Download

You may also be interested in

Financial Crime

Protecting against activities like fraud, money laundering, and market abuse, threatening financial system integrity and consumer protection.
Hear from leading industry experts on the key issues facing compliance professionals in the investment management and financial advice world. Bringing together a high-level audience who can engage with the…
£275.00 – £590.00
Date & Time: 24th Sep 2026 (8:00) - 24th Sep 2026 (17:00)
CPD: TBC Location: Herbert Smith Freehills Kramer
The purpose of the Regulatory Board Sub Committee is to advise PIMFA on all regulatory matters of significance to its...

Getting Financial Promotions Right in a Post Consumer Duty ERA

PIMFA member firms take note.

In 2024, the FCA identified and intervened against around 20,000 non-compliant financial promotions from authorised firms and has recently deployed new technology to shut down or block 1,600 websites promoting financial services without permission taking action against influencers (“finfluencers”) for illegal promotions.

In the Consumer Duty era, the FCA expects your firm to go beyond ensuring that all your promotions are ‘clear, fair and not misleading’ and actively challenging your firm to achieve good outcomes for all customers, especially the vulnerable. But what does that mean in practice?

In this online training session, you will examine good and bad examples of recent promotional campaigns and assess potential non-compliance with your current and future campaigns. By improving your grasp of good practice, you will be better prepared to protect your firm, brand reputation, and competitive advantage and respond rapidly to unexpected, consequential events.

Over two hours, Ocorian’s Abi Reilly will help you:

  • Assess the potential risks of your marketing and financial promotions and strengthen your approach against the latest FCA guidance.
  • Mitigate the threat of non-compliance with current and future changes in financial promotion regulations using a proven process
  • Ensure your approach to social media and customer communications doesn’t attract the wrong kind of attention.
  • Enhance the review and approval process for financial promotions in line with proposed new anti-greenwashing rules.
  • Update your social media and influencer marketing governance, policies, and contracts with ‘finfluencers’ and agencies to stop consumer harm.

Who should attend

  • Compliance and legal
  • Marketing
  • Product Development
  • Senior managers responsible for the marketing activities of the firm

*You may bring along a colleague FREE to this course, please book 2 places and use code 8prbx3da at checkout for 50% off.

The AI Leaders Incubator Programme 2026

2023 woke us up to AI.
2024 got us experimenting with AI.
2025 proved what’s possible.
2026 is when wealth managers scale AI with discipline, confidence and measurable ROI.

Across wealth management, boards are united by a singular ambition: to deliver sustainable, substantially higher performance across every dimension of the business. And that must happen within the boundaries of:

  • Legal and regulatory expectations
  • Ethical and responsible deployment
  • Credible stewardship for clients and markets

In this new operating reality, AI is not a technology choice — it is a strategic imperative. A catalyst to unlock productivity, elevate client service, accelerate compliance accuracy, and build future-proof operating models.

Yet many wealth and advice firms remain stuck in pilot mode: high activity — low impact.

That’s why PIMFA and Publicis Sapient have joined forces as partners to create the AI Leaders Incubator Programme, combining PIMFA’s reach across the UK wealth and advice sector with Publicis Sapient’s real-world transformation and AI delivery expertise. Together, we’ve co-designed the curriculum, bringing practitioner insight, live case studies, and frameworks drawn from projects already shaping digital transformation in wealth management.”

What can you expect from the AI Leaders Incubator Programme?

The AI Leaders Incubator is a focused, hands-on learning experience delivered across two highly immersive days. You’ll cut through the hype and tackle the core strategic questions facing boards today: Where does AI genuinely move the needle? How do we scale it responsibly? And how do we deliver measurable, sustainable performance gains within a regulated environment?

This is not a conference.

There are no panels, no passive sessions, no “AI tourism.”

It is a strategic design environment where leaders work alongside AI practitioners and transformation experts to:

  • Turn industry-relevant AI use cases into real prototypes
  • Build credible business cases with measurable ROI and compliance considerations
  • Design governance frameworks that satisfy regulatory expectations
  • Develop the confidence, capability, and narrative to lead AI adoption at scale

Through live experimentation, design thinking, guided hacks, and board-ready business case work, you’ll graduate with:

  • A validated AI use-case and working prototype
  • A board-ready business case & ROI model
  • A practical 30-day implementation roadmap
  • The confidence and competence to champion responsible AI across your firm

This programme exists to solve the industry’s current friction point: most firms are experimenting with AI — but few are delivering impact at scale. The Incubator gives you the frameworks, tools, and executive confidence to change that — turning intent into traction, and traction into transformational performance.

What challenges will the AI Leaders Incubator support you in overcoming?

  • Tightening Margins? Learn to Automate What Matters. Discover how AI can streamline manual processes, reduce inefficiency, and free up capacity for high-value client work — turning cost pressure into productivity gains.
  • Rising Client Expectations? Redefine Personalisation at Scale. Build and test AI use-cases that deliver smarter insights, hyper-personalised experiences, and faster decision-making — giving your firm a competitive edge in client trust and satisfaction.
  • Regulatory Complexity? Design with Compliance in Mind. Translate complex FCA expectations into AI-ready frameworks that embed accountability, explainability, and governance into every workflow — before the regulator asks.
  • Outdated Playbooks? Reimagine How Your Firm Operates. Break free from siloed business models. Collaborate across functions to design AI solutions that connect compliance, operations, and client experience into one intelligent ecosystem.
  • Manual Processes? Make AI Your New Colleague. Move beyond “pilot paralysis.” In this incubator, you’ll test, refine, and deploy AI tools that turn repetitive tasks into automated intelligence — built responsibly, for real impact.
  • Choosing the Right AI Strategy? Build for Your Reality.
  • Learn how to align AI ambition with your firm’s size, data maturity, and risk appetite — selecting scalable use-cases that deliver measurable, defensible results.
  • Prove the Business Case. Gain the tools to track, quantify, and communicate AI’s impact — from cost savings to client experience — and translate innovation into tangible returns.

The AI Leaders Incubator does more than teach AI — it accelerates intelligent transformation. Here’s how:

  • Elite practitioner mentorship – Work shoulder-to-shoulder with AI strategists who have already delivered real solutions — not theory.
  • Build in the arena – Roll up your sleeves in live labs to design, test, and refine AI workflows and decision-support tools tailored to wealth and advice.
  • Real frameworks, real outcomes – Adopt proven playbooks to spot high-value use cases, manage risk and accountability under UK regulation, and measure commercial ROI from day one.
  • A peer group that pushes you further – Join an action-oriented cohort of COOs, CTOs, transformation leads, and compliance heads shaping the next decade of wealth management.
  • Demo Day — with purpose – Pitch your prototype or live AI use-case to peers, partners, and stakeholders — secure adoption pathways, budget confidence, and executive buy-in.

Who’s the AI Leaders Incubator for?

You’re a senior leader — not a coder. No background in IT or data science required. You’re the decision-maker in your firm, shaping digital strategy, driving innovation, and making the big calls on investment, risk, and transformation. You’re ready to turn data and AI into your next competitive advantage. The AI Leaders Incubator is built for senior executives who want to move beyond experimentation and make AI real — embedding it into operations, culture, and strategy to deliver measurable business results.

Enrolment

Enrolment is now open for cohort one of the AI Leaders Incubator. Places are limited and are offered on a first-come, first-served basis.

Still have questions?

Please contact:
Philip Allen, Head of Learning
learning@pimfa.co.uk

 

Market Abuse 2025 refresher for Wealth Managers

The FCA continues to focus on market abuse, and its messages and publications indicate that it is not looking to turn the heat down anytime soon.

The regulator expects all wealth management firms to have a deep understanding of their market abuse risk and build control frameworks that are both proportionate and effective. However, recent market abuse reviews by Ocorian’s Regulatory & Compliance  practice indicate that they are struggling to properly assess, understand, and articulate the specific market abuse risks inherent in their business.

In this live, two-hour interactive, online training course  Ocorian consultants reveal how wealth firms can effectively meet their obligations to detect and prevent market abuse, from setting adequate surveillance frameworks to ensuring they have appropriate governance arrangements in place.

By attending this two-hour refresher session, you will be able to:

  • Grasp what the FCA expects from you to prevent market abuse in 2025
  • Understand where wealth firms fall short of FCA expectations
  • Recognise and address common market abuse risk areas in your firm
  • Improve your monitoring ongoing compliance risk

As with all our PIMFA live online learning sessions, we provide ‘surgery’ time at the end of this session with the trainer to support you applying what you’ve learnt immediately back into your firm.

*You may bring along a colleague FREE to this course, please book 2 places and use code 9qwytrsu at checkout for 50% off.

The Wealth Management Financial Crime Compliance Learning Programme – Meeting FCA Expectations in 2025 and Beyond

The Challenge 

The fight against financial crime never stops.  

A rapidly changing threat landscape, alongside increasing regulatory demands, challenges all wealth managers and advice firms to craft an effective and efficient anti-financial crime compliance programme that is not only proportionate to their risk environment and commensurate with the size and nature of their operation but also fully compliant with FCA expectations.  

The Solution 

PIMFA’s monthly Wealth Management Financial Crime Compliance Learning Programme ensures senior managers, MLRO/DMLOs, Heads of Compliance, compliance officers and legal professionals don’t just keep up to date with key changes and regulatory deadlines, but develop the clarity, direction and insight they need to design an effective and efficient anti-financial crime control framework that protects their firm, creates value and enhances revenue opportunities. The programme offers examples of industry best practice solutions on issues like firm-wide risk assessments, transaction monitoring, PEPs, sanctions and adverse media.  

Benefits for you 

This monthly CPD-approved programme develops your skills and competencies to: 

  • Effectively implement and respond to FCA requirements 
  • Identify and address vulnerabilities in your approach to financial crime compliance 
  • Thoroughly prepare your firm to respond to key regulatory changes in 2025 and beyond 
  • Ensure your enterprise-wide risk assessment focuses on real risks and drives positive organisational change 
  • Follow industry best practice approaches to KYC, CDD, EDD and ODD
  • Calibrate your financial crime controls, policies and control frameworks to your firm’s risk profile 

Benefits for your firm 

For your firm, this programme: 

  • Delivers clarity, structure, and confidence that your approach to financial crime compliance keeps pace with changing regulatory expectations. 
  • Challenges you to identify and make essential changes to the firm’s approach to financial crime compliance before the FCA does.
  • Optimises your three lines of defence to mitigate financial crime risk management gaps and duplication of unnecessary risk coverage Supports leaders to design and deploy a financial crime compliance strategy that supports business growth.  
  • Provides practical advice on developing an enterprise-wide risk assessment to focus on real risks to drive positive organisational change.

Expert-led learning and support 

Co-created with former regulators and industry experts from advisory firm Avyse Partners, senior legal professionals at Shoosmiths and technologists from Malverde and ID Pal, this programme delivers real-time insights and practical lessons drawn from their direct work with firms and ongoing dialogue with the FCA. Through their collective wisdom and experience, you’ll gain access to proven tools, strategies, and analytical frameworks you can immediately use to manage financial crime risks in your firm proactively.  

Is this programme for you?

Staying ahead of financial crime is essential. Whether you’re managing an incident or meeting regulatory obligations, thinking ahead can make all the difference. This timely and topical programme combines thinking with doing, providing a comprehensive set of strategic and practical skills to ensure your compliance is both resilient and responsive. You’ll learn invaluable tools and tactics that you can implement straight away — whether dealing with internal stakeholders, the board or the regulator.

Individuals who will gain most from this programme include, but are not limited to:

  • Heads of Compliance
  • Money Laundering Reporting Officer (MLRO)
  • Deputy Money Laundering Officer (DMLRO)
  • Heads of Legal and Regulatory Change
  • Managers with responsibility for fraud, financial crime and AML controls
  • Risk Managers
  • Advisory and Investigation roles
  • Internal Audit and Regulatory staff

This programme is for you if you want to:

  • Reduce your risk exposure: Our instructors are ‘in the trenches’ every day identifying and mitigating risks for firms – update your learning to reflect what’s happening now, not last year.
  • Do what matters most: As a financial crime compliance professional you’re up against it, we get it. Each session provides you with clarity and focus to separate the urgent from the important.
  • Spot risks before they become threats: Work hand-in-hand with trusted experts to avoid regulatory misalignment and best meet your financial crime.
  • Become a more effective financial crime compliance leader: A robust blend of presentations, case studies, debates and small group discussions are key programme features that will help you learn to think on your feet, sharpen your analytical skills, and make critical decisions in real-time.
  • Benchmark your compliance efforts: See how your firm’s approach to financial crime stacks up against industry standards and peers across various aspects, including sanctions, money laundering, fraud and cyber crime.
  • Demonstrate your commitment to continuous learning: Knowledge is power with this CISI-approved programme that gives you 12 CPD hours.

The Government Cyber Governance Code of Practice – it’s a question of leadership

The Government Cyber Governance Code of Practice – it’s a question of leadership

The government is continuing to press UK businesses to take a stronger approach to improving cyber resilience and ensure that all organisations of all sizes are prepared for cyber incidents. To this end, the government recently launched the Cyber Governance Code of Practice. The intention is to highlight the fact that cyber risk should have at least the same prominence as financial or legal risks, and the responsibility and ownership of cyber resilience is a board level matter.

 Why is the government doing this?

 This is hardly surprising given the increase in serious disruption to businesses across the country caused by cyber-attacks, largely driven by organised criminal gangs based overseas. Ransomware attacks take businesses down for many weeks or months at a time and can leave them permanently crippled. The average ransom payment in 2024 was £1.5 million (National Crime Agency) but can run into many millions of pounds. Business email compromise is rife (across all sectors), frequently resulting in significant sums being lost by businesses and their clients. Yet despite all this, the 2024 government cyber breach survey found that over 80% of businesses have still not carried out a cyber security vulnerability audit, and over 70% have no formal incident response plan in place. The government believes that many boards and senior leaders have a lack of understanding of cyber issues, with little or no meaningful oversight of this business-critical risk. Indeed, it is often delegated to technical people and not looked at in the context of wider business risk management.

Who is the Code aimed at?

 It is aimed at directors, non-executive directors and other senior leaders. It formalises the government’s expectations regarding an organisation’s governance of cyber security and sets out the clear actions that leaders need to take to meet their responsibilities in managing cyber risk. It will of course be of interest to other stakeholders in a business, including shareholders. It should make for essential reading for all private equity investors. It is designed to have application to businesses of all sizes and in all sectors. The government in particular says that it expects it to be implemented by companies employing 50 or more staff.

Will it be compulsory?

At this stage, adherence to the Code will be voluntary. It will supplement the existing obligations which any business already has under data protection legislation and the relevant regulatory environment. However, given the drastic increase in cyberattacks over the past year, including several headline-making breaches, the ICO will certainly be taking a failure to adhere to the Code into account in the event of a personal data breach. The ICO has already stated that it expects to see clear evidence of management oversight of cyber risk, including regular reviews, with business leadership ensuring appropriate resources are provided to enable a proper information security programme. Interestingly, the government says that it will be exploring how the Code can also be used to support sector regulators to help with regulatory compliance. Additionally, it says that it expects to establish an accompanying assurance scheme to be rolled out at a later date. And finally, whilst the Code will initially be voluntary, depending upon take-up, it could be the subject of future legislation.

What does the Code say?

 There are 5 main themes. Here are some of the actions.

Risk management: This includes identifying important processes and services; conducting regular cyber risk assessments; and implementing the appropriate controls and mitigations. Ownership of risks should be at board level. Supplier and business partner risks should also be routinely assessed.

Cyber strategy: Boards should have a cyber resilience strategy having regard to their level of accepted risk and legal and regulatory obligations. To be monitored and reviewed as the risk environment changes, with sufficient allocation of resources and investment.

People: Boards should ensure the importance of cyber resilience is communicated to all staff with clarity on the cyber security policies supporting the right culture. There should be training for the board itself and the rest of staff and its effectiveness should be measured.

Incident planning and response: The plan to respond to and recover from a cyber incident should be tested at least annually. In the event of an incident, the board should take responsibility for individual regulatory obligations and ensure a post incident review process.

Assurance and oversight: The board should establish a governance structure, to include a regular monitoring process with defined responsibilities and ownership for executive and non-executives. Formal board reporting should take place at least quarterly. Cyber resilience should be integrated across both internal and external assurance mechanisms.

What is the upshot?

 The upshot is that if cyber security is not at or near the top of your register of business risk, then it should be. And it is the board that must accept responsibility for understanding it, managing it, and providing oversight. In other words, a top-down approach.

 

Lindsay Hill – Chief Executive Officer, Mitigo Group

lindsayhill@mitigogroup.com

What Better Data could do for you

When your firm is moving into a new group: navigating your directors’ and SMFs’ responsibilities

CCI Product Summaries: The New KIIDs on the Block

Integration: Where consolidation strategies stand or stall

Exploring the breadth of private assets available to wealth managers

Redefining Risk: Women, AI, and the Democratisation of Investing

Efficiency, Scale, and Growth: The Back-Office as a Strategic Asset

Culture as a risk lens: Evolving the art and science of fund research