Cybersecurity for IFAs: Small Firm Challenges, FCA PROD Rules, and Pension Transfer Fraud

What FCA Rules Apply to IFAs — Regardless of Firm Size

IFAs are FCA-regulated firms subject to the full scope of FCA systems and controls requirements:

• SYSC 13.7: Firms must take reasonable care to establish and maintain effective systems and controls for countering financial crime — which the FCA interprets to include cyber-enabled fraud
• SYSC 6.1.1: Systems and controls must be appropriate to the nature, scale, and complexity of the business — for an IFA, this means controls proportionate to the data held and services provided, not zero controls
• PS21/3 Operational Resilience: IFAs must identify important business services (typically: client advice delivery and communication) and set impact tolerances — even small firms are not exempt
• SMCR: The firm's principal or designated Senior Manager is personally accountable for the adequacy of cybersecurity controls — personal accountability that survives any fine on the firm
• UK GDPR: Client data — financial circumstances, family details, health information relevant to protection advice — requires appropriate technical and organisational security measures

FCA PROD Rules and Client Data Protection

The FCA's Product and Distribution (PROD) sourcebook requires IFAs to maintain records of their target market assessments and distribution arrangements. From a cybersecurity perspective, PROD creates additional data protection obligations:

• Target market records: PROD requires documented target market criteria and client suitability assessments — these records contain sensitive financial and personal information that must be protected
• Suitability reports: Suitability reports are legally significant documents; their integrity and availability must be maintained — ransomware that encrypts them creates both regulatory and legal exposure
• Product governance oversight: IFAs must maintain records of their product governance obligations — data that must be protected against unauthorised access and preserved against loss
• Retention requirements: FCA retention requirements for advice records — typically 5 years, or indefinitely for pension business — require secure long-term storage with appropriate access controls

Pension Transfer Fraud: The Highest-Stakes Attack Vector

Defined benefit pension transfer business carries the highest individual transaction values in the advice sector — and is consequently a prime target for fraud:

• Pension liberation fraud: Scammers target clients who have recently received pension transfer advice, impersonating the adviser to instruct fund movements or invest in fraudulent schemes
• Email compromise enabling pension fraud: An adviser's compromised email account enables attackers to intercept pension transfer communications, impersonate the adviser to the client, or impersonate the client to the pension provider
• Social engineering targeting retirees: IFA clients undertaking pension transfers are often approaching retirement — a demographic that social engineers disproportionately target
• FCA FG22/5: FCA guidance on financial promotions for high-risk investments directly implicates cybersecurity — fraudulent use of an adviser's details or email to promote fraudulent schemes creates regulatory and reputational exposure
• Verification procedures: Pension providers are increasingly requiring out-of-band verification of transfer instructions — IFAs must have verification procedures that work even if their email is compromised

The Practical Security Programme for a Small IFA

The realistic security programme for an IFA of 1–10 people, in implementation order:

• Week 1: Enable MFA on all accounts — Microsoft 365/Google Workspace, back-office system, client portal. This single step addresses the most common attack vector
• Month 1: Deploy Coro — email security, endpoint protection, and MFA management from one platform designed for small teams without IT support
• Month 1: Achieve Cyber Essentials certification — demonstrates baseline compliance to FCA, insurers, and institutional clients. Kyanite Blue manages the certification process
• Month 2: Document your information security policy — one to two pages approved by the principal; updated annually. This is the first document any FCA supervisor will request
• Month 2: Write your incident response plan — who to call, what to do, who to notify. Kyanite Blue provides a template
• Ongoing: Monthly Coro security reports reviewed and signed off by the SMCR-designated Senior Manager — documented evidence of oversight

Frequently Asked Questions