GRC, financial services and the UK rulebook: what the FCA, PRA and DORA expect of a smaller regulated firm

The supervisor's letter asks how your board knows its important business services can stay within tolerance. The EU parent wants a DORA position by quarter end. Your outsourcing register was last touched for the authorisation application. The GRC financial services firms of 25 to 250 people need answers to the same rules as a bank's, scaled down, yet those rules rarely appear on one page.

This guide is that page for COOs, compliance leads, CROs and managing directors at FCA- and PRA-regulated firms and insurers. It maps each rule that creates a governance, risk or compliance duty. It says plainly where DORA reaches a UK firm, and shows how one system answers all of them. Conduct topics such as Consumer Duty, AML and KYC, and market abuse sit outside its scope.

What does GRC mean for a UK financial services firm?

GRC in UK financial services means running governance, risk and compliance as one system, proportionate to your size. It meets the FCA and PRA rules on systems and controls (SYSC, PRIN 3) and named accountability under SM&CR. It covers operational resilience and third-party oversight, plus DORA only through an EU entity or ICT services to EU financial entities.

The rules arrived at different times, from different regulators, and each one reads like its own project. It is easy to treat them that way: a resilience workstream, an outsourcing review, an SM&CR refresh, a DORA gap analysis. Each produces its own spreadsheet, its own owner and its own evidence.

The supervisor sees one firm.

Which rules shape GRC? Financial services obligations in one table

Seven sets of rules shape GRC in a UK financial services firm. SYSC 4.1 and PRIN 3 set the base. SM&CR names who is accountable. Two sets cover resilience and outsourcing, one regulates critical third parties, and DORA applies only through an EU link. The table shows who each one binds and what evidences it.

The capability column is the point. Each rule asks for evidence that a single, well-run system already produces.

What do SYSC 4.1 and PRIN 3 ask of a smaller firm?

SYSC 4.1 and PRIN 3 ask every in-scope firm, whatever its size, for governance and risk management that are real, written down and working. SYSC 4.1.1R requires robust governance arrangements and internal controls. Principle 3 requires reasonable care to organise and control your affairs, with adequate risk management systems. Neither one sets a headcount.

SYSC 4.1.1R asks for a clear organisational structure with well-defined, transparent and consistent lines of responsibility. It also asks for effective processes to identify, manage, monitor and report the risks the firm is or might be exposed to, plus internal control mechanisms.

Principle 3 of the FCA's Principles for Businesses puts the same idea in one sentence: organise and control your affairs responsibly and effectively, with adequate risk management systems.

Proportionality is written into the rules. For many firms, SYSC 4.1.4R applies its requirements taking into account the nature, scale and complexity of the business. SYSC 4.1.11G says that, depending on those same factors, it may be appropriate for a firm to form an audit committee. May, not must.

How does SM&CR change who owns GRC?

SM&CR turns GRC from a function into a set of named people. Every Senior Manager needs a Statement of Responsibilities saying what they are accountable for. Each one carries a Duty of Responsibility. If the firm breaches a rule in their area, they can be held to account unless they took reasonable steps to stop it.

The FCA's Senior Managers Regime guidance adds Senior Manager Conduct Rules. One requires reasonable steps to ensure that the business you are responsible for complies with the relevant requirements of the regulatory system. Another requires that any delegation goes to an appropriate person, and that you oversee it effectively.

For GRC, that means every obligation in the table above needs a named owner. The compliance lead may run the work, but a Senior Manager answers for the outcome.

The FCA's SM&CR categorisation splits solo-regulated firms into Enhanced, Core and Limited Scope. Six thresholds, such as revenue and assets under management, decide who is Enhanced; every other firm is Core, which carries the baseline requirements, or Limited Scope. Responsibilities Maps apply to Enhanced firms. SM&CR is being reformed in stages. The FCA and PRA set out a first round of changes in April 2026, and further changes, including to certification and pre-approval, depend on new legislation. Check the current rules before you redesign anything.

What do the operational resilience rules expect?

The operational resilience rules expect firms in scope to name their important business services and set an impact tolerance for each. They must map the people, systems and suppliers behind each service. Then they must test that they can stay within tolerance in a severe but plausible disruption. The deadline was 31 March 2025.

Scope matters here. SYSC 15A.1 applies the chapter to banks, building societies, designated investment firms, Enhanced SM&CR firms, Solvency II firms, UK recognised investment exchanges, e-money and payment institutions, registered account information service providers and consolidated tape providers. A Core SM&CR firm outside those categories is not in scope of SYSC 15A, although Principle 3 and SYSC 4.1 still apply.

For firms in scope, SYSC 15A.2 sets the core duties:

1. Identify your important business services (15A.2.1R).
2. Set an impact tolerance for each one (15A.2.5R).
3. Be able to remain within each impact tolerance in a severe but plausible disruption (15A.2.9R).
4. Review the first two whenever your business or market changes materially, and in any case no later than a year after the last assessment.

The PRA's SS1/21 sets the matching expectations for UK banks, building societies, PRA-designated investment firms, Solvency II firms, the Society of Lloyd's and its managing agents.

Impact tolerances and the method behind them deserve their own guide. Here, the GRC point is simpler. A resilience map is a living record that someone owns, tests and reviews each year. It is not a file put away after the deadline.

How do outsourcing and critical third party rules affect your firm?

Outsourcing rules keep the responsibility with you. Under SYSC 8, a firm that outsources critical or important functions remains fully responsible for its regulatory obligations. The critical third parties regime is different. It places duties on suppliers that HM Treasury designates, not on the firms that use them. Your own accountability does not change.

SYSC 8.1 sets the conditions. For a common platform firm, SYSC 8.1.9R requires a written agreement. The firm must keep its rights to instruct, terminate and get information, and to inspect books and premises. Other firms stay fully responsible under SYSC 8.1.6R.

PRA-regulated firms also follow SS2/21 on outsourcing and third party risk management. The current version took effect on 31 December 2024, and a revised version takes effect on 18 March 2027.

The critical third parties regime comes from powers that the Financial Services and Markets Act 2023 gave HM Treasury and the regulators. The Bank of England, PRA and FCA set the rules in PS16/24, effective from 1 January 2025. They bind a supplier only once HM Treasury designates it. HM Treasury made its first designations, four cloud and technology providers, in July 2026, and can add more over time, so check the current list when you review your suppliers.

PS16/24 is explicit that firms remain accountable for managing the risks in their arrangements with a designated critical third party. Your supplier register, due diligence and exit plans stay yours.

Does DORA apply to UK financial services firms?

DORA does not bind a UK firm simply for being regulated in the UK. The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025 to the EU financial entities listed in its Article 2. A UK firm feels it through an EU entity it owns, or through ICT services it provides to EU financial entities.

Here is where it reaches a UK firm, and where it does not:

• An EU-authorised subsidiary. If your group has an EU credit institution, investment firm, insurer, payment or e-money institution, or another Article 2 entity, that entity is in scope.
• ICT services to EU financial entities. If you provide ICT services to EU financial entities, DORA treats you as an ICT third-party service provider. Your clients must keep a register of their ICT contracts under Article 28(3). Article 30 sets the terms those contracts must contain, so the rules arrive in your contracts.
• Designation as critical. EU supervisors can designate an ICT provider as critical. If that provider is based outside the EU, Article 31(12) says EU financial entities may only use it if it sets up an EU subsidiary within 12 months.
• An EU branch. Article 2 lists EU-authorised entity types and does not list branches of non-EU firms. If you run an EU branch, confirm its position with the host supervisor rather than assuming either way.
• UK-only firms. A firm with no EU entity and no ICT services to EU financial entities is outside DORA, even if it has EU clients. The UK rules in the table above still apply in full.

DORA and the UK rules overlap more than they differ. Article 5 makes the management body ultimately responsible for ICT risk, which echoes SM&CR. Article 4 applies proportionality by size and risk profile, and Article 16 gives some smaller entities a simplified ICT risk framework.

What does proportionality mean for a firm of 25 to 250 people?

Proportionality means a smaller firm needs every element of a GRC system, but not the bank-scale version of each. You still need named owners, a current risk register, a current supplier register and evidence that controls work. You do not need a large second line, a separate committee for every risk type, or tooling built for thousands of controls.

We recommend drawing the line like this:

The left column is the floor regulators expect. The right column is what firms build when size and complexity demand it.

What does an integrated GRC approach look like?

An integrated GRC approach runs one obligations register, one risk register and one control set, with each control mapped to every rule it satisfies and evidence collected once. When the supervisor, the board or an EU client asks a question, you answer from the same records instead of starting a new project for each request.

In practice, it takes five moves:

1. Build one obligations register. List each rule in the table above, the provisions that apply to your firm type and the Senior Manager who owns each. Our guide to ISO 27001 Annex A 5.31 shows how an obligations register works in practice.
2. Keep one risk register. Operational, third-party, ICT and compliance risks sit in one place, scored on one scale. A written risk management policy sets the method once.
3. Map one control set to many rules. An access review, a supplier assessment or a backup test can evidence SYSC 4.1, SYSC 8 and DORA at the same time.
4. Run one supplier register. It serves the outsourcing rules, SS2/21 and any DORA contract requests. The approach in ISO 27001 Annex A 5.19 translates directly.
5. Collect evidence once, continuously. Automated checks on systems, tickets and logs keep evidence current, so the annual self-assessment draws on records rather than memory. Continuity planning under ISO 22301 feeds the same evidence base for resilience testing.

Seven rules do not need seven projects.

What are the common GRC gaps in smaller regulated firms?

The common GRC gaps in smaller regulated firms are records that were right once and never refreshed. Think of a resilience map drawn for the deadline and never retested, a supplier register older than your last three suppliers, or a rule no Senior Manager owns. Each one leaves a firm unable to show its system works.

The FCA's operational resilience insights and observations point to the first gap. The FCA expects mapping and scenario testing to mature over time, and it found limited evidence of firms testing their response plans. It also notes that a third party's failure to stay within tolerance remains your firm's responsibility.

We recommend checking three more gaps:

• A stale supplier register. New suppliers arrive through procurement or a team's own sign-up, and the register never hears about them.
• Unowned obligations. A rule appears in the compliance plan but in no Senior Manager's Statement of Responsibilities.
• Evidence assembled on request. If proving a control works takes a week of screenshots, the control may be working, but your system is not.

Each gap closes the same way: one register, one owner and evidence that updates itself.

Frequently asked questions