---
title: "GRC, financial services and the UK rulebook: what the FCA, PRA and DORA expect of a smaller regulated firm"
canonical: https://www.grcmana.io/vault/grc/grc-financial-services
published: 2026-10-21
updated: 2026-10-23
author: "Harry West"
framework: "GRC"
control: "Guide GRC, financial services and the UK rulebook: what the FCA, PRA and DORA expect of a smaller regulated firm"
journeyStage: fundamentals
---

# GRC, financial services and the UK rulebook: what the FCA, PRA and DORA expect of a smaller regulated firm

## Key takeaways

GRC in UK financial services means running governance, risk and compliance as one system, proportionate to the firm's size. It meets the FCA and PRA systems and controls rules (SYSC 4.1, PRIN 3), named accountability under SM&CR, operational resilience and outsourcing rules, and DORA only where the firm has an EU entity or provides ICT services to EU financial entities.

- **SYSC 15A scope** — FCA operational resilience rules apply to banks, building societies, Enhanced SM&CR firms, Solvency II firms, payment and e-money institutions and other listed firms, not to every regulated firm.
- **Annual review** — Under SYSC 15A.2, firms review important business services and impact tolerances on any material change, and no later than a year after the last assessment.
- **Critical third parties** — PS16/24 rules took effect on 1 January 2025 and bind only suppliers HM Treasury designates; firms stay accountable for their own arrangements with them.
- **DORA reach** — DORA has applied since 17 January 2025 to EU financial entities; a UK firm is reached through an EU entity it owns or ICT services it provides to EU financial entities.

The supervisor's letter asks how your board knows its important business services can stay within tolerance. The EU parent wants a DORA position by quarter end. Your outsourcing register was last touched for the authorisation application. The GRC financial services firms of 25 to 250 people need answers to the same rules as a bank's, scaled down, yet those rules rarely appear on one page.

This guide is that page for COOs, compliance leads, CROs and managing directors at FCA- and PRA-regulated firms and insurers. It maps each rule that creates a governance, risk or compliance duty. It says plainly where DORA reaches a UK firm, and shows how one system answers all of them. Conduct topics such as Consumer Duty, AML and KYC, and market abuse sit outside its scope.

## What does GRC mean for a UK financial services firm?

GRC in UK financial services means running governance, risk and compliance as one system, proportionate to your size. It meets the FCA and PRA rules on systems and controls (SYSC, PRIN 3) and named accountability under SM&CR. It covers operational resilience and third-party oversight, plus DORA only through an EU entity or ICT services to EU financial entities.

The rules arrived at different times, from different regulators, and each one reads like its own project. It is easy to treat them that way: a resilience workstream, an outsourcing review, an SM&CR refresh, a DORA gap analysis. Each produces its own spreadsheet, its own owner and its own evidence.

The supervisor sees one firm.

## Which rules shape GRC? Financial services obligations in one table

Seven sets of rules shape GRC in a UK financial services firm. SYSC 4.1 and PRIN 3 set the base. SM&CR names who is accountable. Two sets cover resilience and outsourcing, one regulates critical third parties, and DORA applies only through an EU link. The table shows who each one binds and what evidences it.

| Obligation | Who it applies to | What it asks for | GRC capability that evidences it |
| --- | --- | --- | --- |
| FCA SYSC 4.1 | Authorised firms, with provisions varying by firm type | Robust governance, clear lines of responsibility, processes to identify, manage, monitor and report risk, and internal controls | Governance: organisation chart, terms of reference, risk and control framework |
| FCA PRIN 3 | Every authorised firm, in whole or in part | Reasonable care to organise and control affairs responsibly and effectively, with adequate risk management systems | Risk: risk register, risk appetite, management information to the board |
| SM\&CR | All FCA solo-regulated firms and dual-regulated firms, in Enhanced, Core or Limited Scope form | Named Senior Managers, a Statement of Responsibilities for each, and a Duty of Responsibility to take reasonable steps | Governance: responsibilities mapped to named people and to the controls they oversee |
| FCA SYSC 15A and PRA SS1/21 | Banks, building societies, Enhanced SM\&CR firms, Solvency II insurers, payment and e-money institutions, and other listed firms | Important business services, impact tolerances, mapping, scenario testing and a board-approved self-assessment | Risk and engineering: service maps, test results, remediation tracking |
| FCA SYSC 8 and PRA SS2/21 | Firms that outsource critical or important functions; SS2/21 covers PRA-regulated firms | The firm stays fully responsible, with written agreements and rights of access and audit | Compliance: outsourcing register, due diligence, contract reviews, exit plans |
| PS16/24 critical third parties | Third parties designated by HM Treasury, not the firms that use them | Duties on the critical third party itself; firms stay accountable for their own arrangements | Risk: concentration view of your key suppliers |
| DORA (EU) 2022/2554 | EU financial entities, and ICT providers serving them | ICT risk framework, incident reporting, testing, a register of ICT contracts and set contract terms | Engineering and compliance: one ICT control set, one contract register |

The capability column is the point. Each rule asks for evidence that a single, well-run system already produces.

## What do SYSC 4.1 and PRIN 3 ask of a smaller firm?

SYSC 4.1 and PRIN 3 ask every in-scope firm, whatever its size, for governance and risk management that are real, written down and working. SYSC 4.1.1R requires robust governance arrangements and internal controls. Principle 3 requires reasonable care to organise and control your affairs, with adequate risk management systems. Neither one sets a headcount.

[SYSC 4.1.1R](https://www.handbook.fca.org.uk/handbook/SYSC/4/1.html) asks for a clear organisational structure with well-defined, transparent and consistent lines of responsibility. It also asks for effective processes to identify, manage, monitor and report the risks the firm is or might be exposed to, plus internal control mechanisms.

[Principle 3 of the FCA's Principles for Businesses](https://www.handbook.fca.org.uk/handbook/PRIN/2/1.html) puts the same idea in one sentence: organise and control your affairs responsibly and effectively, with adequate risk management systems.

Proportionality is written into the rules. For many firms, SYSC 4.1.4R applies its requirements taking into account the nature, scale and complexity of the business. SYSC 4.1.11G says that, depending on those same factors, it may be appropriate for a firm to form an audit committee. May, not must.

## How does SM&CR change who owns GRC?

SM&CR turns GRC from a function into a set of named people. Every Senior Manager needs a Statement of Responsibilities saying what they are accountable for. Each one carries a Duty of Responsibility. If the firm breaches a rule in their area, they can be held to account unless they took reasonable steps to stop it.

The [FCA's Senior Managers Regime guidance](https://www.fca.org.uk/firms/senior-managers-and-certification-regime/senior-managers-regime) adds Senior Manager Conduct Rules. One requires reasonable steps to ensure that the business you are responsible for complies with the relevant requirements of the regulatory system. Another requires that any delegation goes to an appropriate person, and that you oversee it effectively.

For GRC, that means every obligation in the table above needs a named owner. The compliance lead may run the work, but a Senior Manager answers for the outcome.

The [FCA's SM&CR categorisation](https://www.fca.org.uk/firms/senior-managers-certification-regime/categorisation-solo-regulated-firms) splits solo-regulated firms into Enhanced, Core and Limited Scope. Six thresholds, such as revenue and assets under management, decide who is Enhanced; every other firm is Core, which carries the baseline requirements, or Limited Scope. Responsibilities Maps apply to Enhanced firms. SM&CR is being reformed in stages. The FCA and PRA set out a first round of changes in April 2026, and [further changes](https://www.fca.org.uk/news/press-releases/fca-pra-changes-streamline-senior-manager-accountability-boost-growth), including to certification and pre-approval, depend on new legislation. Check the current rules before you redesign anything.

## What do the operational resilience rules expect?

The operational resilience rules expect firms in scope to name their important business services and set an impact tolerance for each. They must map the people, systems and suppliers behind each service. Then they must test that they can stay within tolerance in a severe but plausible disruption. The deadline was 31 March 2025.

Scope matters here. [SYSC 15A.1](https://www.handbook.fca.org.uk/handbook/SYSC/15A/1.html) applies the chapter to banks, building societies, designated investment firms, Enhanced SM&CR firms, Solvency II firms, UK recognised investment exchanges, e-money and payment institutions, registered account information service providers and consolidated tape providers. A Core SM&CR firm outside those categories is not in scope of SYSC 15A, although Principle 3 and SYSC 4.1 still apply.

For firms in scope, [SYSC 15A.2](https://www.handbook.fca.org.uk/handbook/SYSC/15A/2.html) sets the core duties:

1. Identify your important business services (15A.2.1R).
2. Set an impact tolerance for each one (15A.2.5R).
3. Be able to remain within each impact tolerance in a severe but plausible disruption (15A.2.9R).
4. Review the first two whenever your business or market changes materially, and in any case no later than a year after the last assessment.

The PRA's [SS1/21](https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/operational-resilience-impact-tolerances-for-important-business-services-ss) sets the matching expectations for UK banks, building societies, PRA-designated investment firms, Solvency II firms, the Society of Lloyd's and its managing agents.

Impact tolerances and the method behind them deserve their own guide. Here, the GRC point is simpler. A resilience map is a living record that someone owns, tests and reviews each year. It is not a file put away after the deadline.

## How do outsourcing and critical third party rules affect your firm?

Outsourcing rules keep the responsibility with you. Under SYSC 8, a firm that outsources critical or important functions remains fully responsible for its regulatory obligations. The critical third parties regime is different. It places duties on suppliers that HM Treasury designates, not on the firms that use them. Your own accountability does not change.

[SYSC 8.1](https://www.handbook.fca.org.uk/handbook/SYSC/8/1.html) sets the conditions. For a common platform firm, SYSC 8.1.9R requires a written agreement. The firm must keep its rights to instruct, terminate and get information, and to inspect books and premises. Other firms stay fully responsible under SYSC 8.1.6R.

PRA-regulated firms also follow [SS2/21 on outsourcing and third party risk management](https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss). The current version took effect on 31 December 2024, and a revised version takes effect on 18 March 2027.

The critical third parties regime comes from powers that the [Financial Services and Markets Act 2023](https://www.legislation.gov.uk/ukpga/2023/29/contents) gave HM Treasury and the regulators. The Bank of England, PRA and FCA set the rules in [PS16/24](https://www.bankofengland.co.uk/prudential-regulation/publication/2024/november/operational-resilience-critical-third-parties-to-the-uk-financial-sector-policy-statement), effective from 1 January 2025. They bind a supplier only once HM Treasury designates it. HM Treasury made its [first designations](https://www.legislation.gov.uk/uksi/2026/777/made), four cloud and technology providers, in July 2026, and can add more over time, so check the current list when you review your suppliers.

PS16/24 is explicit that firms remain accountable for managing the risks in their arrangements with a designated critical third party. Your supplier register, due diligence and exit plans stay yours.

## Does DORA apply to UK financial services firms?

DORA does not bind a UK firm simply for being regulated in the UK. The [Digital Operational Resilience Act, Regulation (EU) 2022/2554](https://eur-lex.europa.eu/eli/reg/2022/2554/oj), has applied since 17 January 2025 to the EU financial entities listed in its Article 2. A UK firm feels it through an EU entity it owns, or through ICT services it provides to EU financial entities.

Here is where it reaches a UK firm, and where it does not:

- **An EU-authorised subsidiary.** If your group has an EU credit institution, investment firm, insurer, payment or e-money institution, or another Article 2 entity, that entity is in scope.
- **ICT services to EU financial entities.** If you provide ICT services to EU financial entities, DORA treats you as an ICT third-party service provider. Your clients must keep a register of their ICT contracts under Article 28(3). Article 30 sets the terms those contracts must contain, so the rules arrive in your contracts.
- **Designation as critical.** EU supervisors can designate an ICT provider as critical. If that provider is based outside the EU, Article 31(12) says EU financial entities may only use it if it sets up an EU subsidiary within 12 months.
- **An EU branch.** Article 2 lists EU-authorised entity types and does not list branches of non-EU firms. If you run an EU branch, confirm its position with the host supervisor rather than assuming either way.
- **UK-only firms.** A firm with no EU entity and no ICT services to EU financial entities is outside DORA, even if it has EU clients. The UK rules in the table above still apply in full.

DORA and the UK rules overlap more than they differ. Article 5 makes the management body ultimately responsible for ICT risk, which echoes SM&CR. Article 4 applies proportionality by size and risk profile, and Article 16 gives some smaller entities a simplified ICT risk framework.

## What does proportionality mean for a firm of 25 to 250 people?

Proportionality means a smaller firm needs every element of a GRC system, but not the bank-scale version of each. You still need named owners, a current risk register, a current supplier register and evidence that controls work. You do not need a large second line, a separate committee for every risk type, or tooling built for thousands of controls.

We recommend drawing the line like this:

| Element | What a smaller firm must have | What is bank-scale |
| --- | --- | --- |
| Accountability | A Statement of Responsibilities for each Senior Manager, mapped to the obligations they own | A full Responsibilities Map (required for Enhanced firms) |
| Risk management | One risk register with owners, ratings and a board-approved appetite | Separate registers and committees for each risk type |
| Oversight | Board or management committee oversight, with an audit committee where the business warrants it | A full committee structure with independent chairs |
| Resilience | Important business services, impact tolerances and an annual self-assessment, if you are in SYSC 15A scope | Large-scale scenario programmes run by a dedicated team |
| Third parties | A current outsourcing and supplier register, with exit plans for critical or important services | A separate third-party risk function |
| Evidence | Controls tested on a set cadence, with results kept in one place | Continuous assurance across thousands of controls |

The left column is the floor regulators expect. The right column is what firms build when size and complexity demand it.

## What does an integrated GRC approach look like?

An integrated GRC approach runs one obligations register, one risk register and one control set, with each control mapped to every rule it satisfies and evidence collected once. When the supervisor, the board or an EU client asks a question, you answer from the same records instead of starting a new project for each request.

In practice, it takes five moves:

1. **Build one obligations register.** List each rule in the table above, the provisions that apply to your firm type and the Senior Manager who owns each. Our guide to [ISO 27001 Annex A 5.31](https://www.grcmana.io/vault/iso-27001/annex-a-5-31-legal-statutory-regulatory-and-contractual-requirements) shows how an obligations register works in practice.
2. **Keep one risk register.** Operational, third-party, ICT and compliance risks sit in one place, scored on one scale. A written [risk management policy](https://www.grcmana.io/vault/templates/risk-management-policy) sets the method once.
3. **Map one control set to many rules.** An access review, a supplier assessment or a backup test can evidence SYSC 4.1, SYSC 8 and DORA at the same time.
4. **Run one supplier register.** It serves the outsourcing rules, SS2/21 and any DORA contract requests. The approach in [ISO 27001 Annex A 5.19](https://www.grcmana.io/vault/iso-27001/annex-a-5-19-information-security-in-supplier-relationships) translates directly.
5. **Collect evidence once, continuously.** Automated checks on systems, tickets and logs keep evidence current, so the annual self-assessment draws on records rather than memory. Continuity planning under [ISO 22301](https://www.grcmana.io/vault/iso-22301) feeds the same evidence base for resilience testing.

Seven rules do not need seven projects.

## What are the common GRC gaps in smaller regulated firms?

The common GRC gaps in smaller regulated firms are records that were right once and never refreshed. Think of a resilience map drawn for the deadline and never retested, a supplier register older than your last three suppliers, or a rule no Senior Manager owns. Each one leaves a firm unable to show its system works.

The FCA's [operational resilience insights and observations](https://www.fca.org.uk/firms/operational-resilience/insights-observations) point to the first gap. The FCA expects mapping and scenario testing to mature over time, and it found limited evidence of firms testing their response plans. It also notes that a third party's failure to stay within tolerance remains your firm's responsibility.

We recommend checking three more gaps:

- **A stale supplier register.** New suppliers arrive through procurement or a team's own sign-up, and the register never hears about them.
- **Unowned obligations.** A rule appears in the compliance plan but in no Senior Manager's Statement of Responsibilities.
- **Evidence assembled on request.** If proving a control works takes a week of screenshots, the control may be working, but your system is not.

Each gap closes the same way: one register, one owner and evidence that updates itself.

## Frequently asked questions

### What is the role of GRC in banks?

Banks carry the fullest set of these rules. SM&CR started with banks, building societies and credit unions in 2016, and banks sit in scope of SYSC 15A, PRA SS1/21 and SS2/21. For a bank, GRC is how the board shows the PRA and FCA that accountability, resilience and third-party oversight are one system.

### What compliance requirements apply to financial services firms?

Beyond the governance, resilience and third-party rules on this page, UK financial services firms face conduct rules, such as Consumer Duty, anti-money laundering and market abuse. Many also face prudential rules on capital and liquidity. Your firm type and permissions decide which apply, so build the obligations register from your permissions.

### How often should a firm review its important business services?

At least once a year, and sooner after a material change, under SYSC 15A.2.2R. The FCA's observations ask for more than a date. Record each change to services, tolerances and mapping in your self-assessment with the reason, and consider recording why other services were not judged important, especially when you remove one.

### Does a critical third party designation make a supplier safer to use?

Not on its own. PS16/24 says the regulators do not see a designated critical third party as more resilient by default. Nor is it better suited to your firm than a supplier of similar services that has not been designated. Your due diligence and exit planning still apply.

### Can ISO 27001 help meet FCA and PRA expectations?

None of the FCA, PRA or DORA rules mapped on this page requires ISO 27001 certification, and holding it does not meet any of them by itself. But its risk method, supplier controls and evidence habits can support SYSC 4.1, SYSC 8 and DORA's ICT rules. A firm that holds it starts the mapping with much of the evidence in place.