For hedge funds, investment managers and other FCA-regulated firms, technology is no longer simply about keeping the business running. It plays a fundamental role in protecting sensitive information, supporting operational resilience, managing operational risk and enabling secure, efficient business operations.
Understanding the FCA IT requirements is therefore about far more than purchasing the latest software or outsourcing technical support. Firms are expected to establish appropriate systems and controls that help identify, manage and mitigate technology and operational risks in a way that is proportionate to their size, complexity and business model.
Whether you are launching a new hedge fund, reviewing your existing hedge fund IT environment or assessing providers of IT support for investment firms, your technology should support strong governance, resilience and effective risk management from the outset.
Although the FCA does not prescribe a single technology stack or publish a checklist of mandatory IT products, its Handbook and wider publications make clear that firms must maintain appropriate systems and controls, safeguard information, oversee outsourced services and remain operationally resilient. How these outcomes are achieved will depend on each firm’s individual circumstances, but technology is central to delivering them.
For many organisations, this means implementing secure cloud platforms such as Microsoft 365, strengthening identity and access management, improving cybersecurity, maintaining reliable backup and recovery arrangements, managing third-party technology providers and ensuring that operational incidents can be identified, responded to and, where required, reported appropriately.
This guide explains the FCA IT requirements in practical terms and explores what they mean for hedge funds, investment managers and other regulated firms. It also examines how an experienced provider of managed IT services for hedge funds or financial services IT support can help organisations build secure, resilient and well-governed technology environments that support both day-to-day operations and long-term regulatory expectations.
What are the FCA’s IT requirements in practice?
There is no single document that sets out a definitive list of FCA IT requirements or specifies which technologies firms must use. Instead, the FCA adopts a principles-based approach. Firms are expected to establish systems and controls that are appropriate to their size, business model and risk profile, enabling them to identify, manage and mitigate operational and technology risks effectively.
For hedge funds, investment managers and other FCA-regulated firms, this means viewing technology as a critical component of governance rather than simply an operational function. The firm’s IT environment should support secure business operations, protect confidential information, maintain service availability, facilitate effective oversight of outsourced providers and enable the business to respond to operational disruption.
The FCA’s expectations are reflected across several areas of its Handbook and supporting guidance, including:
- Systems and controls (SYSC) – Firms should maintain appropriate governance arrangements and effective systems and controls that support the sound management of their business.
- Operational resilience – Firms should be able to prevent, adapt to, respond to, recover from and learn from operational disruptions that could affect important business services.
- Outsourcing and third-party risk – Firms remain accountable for outsourced activities and should maintain appropriate oversight of technology suppliers, cloud providers and other critical third parties.
- Information security and data protection – Technology controls should help safeguard confidential information against unauthorised access, loss or compromise.
- Recordkeeping – Where applicable, firms should retain records in accordance with regulatory requirements and ensure they can be produced when required.
- Operational incident reporting – Firms should have governance and processes to identify, assess and, where necessary, report significant operational incidents to the FCA.
For organisations seeking IT support for hedge funds or IT support for investment firms, these expectations have practical implications. Technology decisions should not be based solely on convenience or cost; they should also support security, resilience, governance and effective risk management.
This is why many firms invest in secure cloud platforms, identity and access management, Microsoft 365 for hedge funds, cybersecurity controls, backup and disaster recovery, and robust supplier oversight. While these technologies are not prescribed by the FCA, they can help firms implement the systems and controls needed to support their regulatory obligations.
Ultimately, the FCA IT requirements are outcome-focused rather than technology-specific. The regulator expects firms to understand their operational and technology risks, implement appropriate controls, monitor their effectiveness and continually improve their technology environment as the business, threat landscape and regulatory expectations evolve.
Why FCA compliance is not just a legal or compliance issue
Many organisations associate regulatory compliance with legal advice, policies and internal procedures. In reality, meeting the FCA IT requirements depends just as much on the effectiveness of the technology supporting the business.
For hedge funds and investment firms, governance policies alone are not enough. A policy requiring multi-factor authentication provides little value if user accounts are not configured securely. A business continuity plan offers limited assurance if backups have never been tested. Likewise, recordkeeping obligations may be difficult to meet if employees use communication channels that cannot be appropriately retained or supervised.
This is why technology should be viewed as a business enabler rather than simply an operational function. Well-designed hedge fund IT environments help firms manage operational risk, protect commercially sensitive information, support business continuity and demonstrate that governance arrangements are operating as intended.
For firms seeking IT support for hedge funds or financial services IT support, this means choosing a technology partner that understands both regulatory expectations and the practical controls needed to support them. An experienced provider of managed IT services for hedge funds should do more than resolve technical issues. They should help implement, maintain and evidence the technology controls that underpin governance, operational resilience and information security.
This includes areas such as secure Microsoft 365 configuration, identity and access management, cybersecurity, backup and disaster recovery, monitoring, documentation and continuous improvement. Together, these controls help organisations build secure, resilient and well-governed technology environments that support both day-to-day operations and the wider FCA IT requirements.
Ultimately, effective technology management is not simply about keeping systems running. For FCA-regulated firms, it is about creating an environment that supports secure business operations, strengthens operational resilience, protects critical information and enables firms to demonstrate that appropriate systems and controls remain effective as risks continue to evolve.
What are the IT requirements for a new hedge fund?
Launching a hedge fund involves far more than obtaining FCA authorisation and setting up trading systems. From the outset, firms should establish a secure, resilient and well-governed technology environment that supports their business model, protects sensitive information and helps them meet the FCA IT requirements.
Technology should not be treated as a standalone operational function that is addressed after launch. Instead, it should form part of the firm’s wider governance, operational risk and control framework before investor onboarding, regulatory reporting and day-to-day operations begin.
There is no prescribed technology checklist for new hedge funds, and the FCA does not mandate the use of specific software or cloud platforms. However, firms are expected to implement systems and controls that are appropriate to the nature, scale and complexity of their business. For most organisations, this means designing a hedge fund IT environment that supports security, operational resilience, recordkeeping and effective oversight from day one.
Whether a firm builds its internal capability or partners with a provider of managed IT services for hedge funds, the following technology areas are commonly considered when establishing an IT environment for an FCA-regulated investment business.
1. Secure Microsoft 365 and email configuration
For many hedge funds and investment firms, Microsoft 365 is the foundation of the technology environment, supporting email, document management, collaboration, communication and operational records. Because it often contains commercially sensitive information, investor communications, board papers and compliance documentation, it should be configured with governance, security and operational resilience in mind rather than relying on default settings.
Depending on the firm’s business model and risk profile, Microsoft 365 for hedge funds may include:
- Strong authentication controls, including Multi-Factor Authentication (MFA)
- Conditional Access or equivalent risk-based access controls
- Detection and management of high-risk sign-in activity
- Separate administrator accounts with enhanced security controls
- Least-privilege access for users and administrators
- Mobile device management
- Device compliance policies
- Email anti-phishing and anti-malware protection
- Appropriate controls over external file sharing
- Data Loss Prevention (DLP) controls where appropriate
- Retention policies aligned with business and regulatory obligations
- Audit logging and security monitoring
- Assessment of whether Microsoft’s native retention capabilities are sufficient or whether additional backup solutions are appropriate
- Controls restricting access to trusted users, devices or locations where appropriate
2. Identity and access management
Identity and access management is one of the most important components of a secure hedge fund IT environment. Every FCA-regulated firm should understand who has access to business systems, why that access has been granted, how it is authorised and how quickly it can be changed or removed when circumstances change.
For hedge funds and investment firms, access controls help protect sensitive information, reduce operational risk and support the wider FCA IT requirements by ensuring that only authorised individuals can access critical systems and data.
Depending on the firm’s business model and risk profile, appropriate identity and access controls may include:
- Role-based access control (RBAC)
- Joiner, mover and leaver processes
- Privileged Access Management (PAM)
- Strong password and authentication policies
- Multi-Factor Authentication (MFA)
- Risk-based access controls based on user, device, location or sign-in risk
- Regular user access reviews
- Prompt removal or amendment of access when employees leave or responsibilities change
- Segregation of duties where appropriate
- Separate administrator accounts
- Monitoring for unusual or suspicious authentication activity
For many firms, identity has become the new security perimeter. As employees increasingly work remotely and business applications move to the cloud, protecting user identities is just as important as protecting networks and devices. Compromised credentials remain one of the most common ways attackers gain access to business systems.
Organisations investing in IT support for hedge funds or financial services IT support should therefore ensure that identity and access management forms part of their wider cybersecurity strategy rather than being treated as a standalone security control. An experienced provider of managed IT services should help organisations implement, monitor and regularly review identity controls so they continue to reflect changes in users, business operations and emerging threats.
Ultimately, effective identity and access management supports much more than cybersecurity. It strengthens governance, protects commercially sensitive information, supports operational resilience and helps firms demonstrate that appropriate systems and controls remain effective throughout the business.
3. Device security and endpoint management
Every laptop, desktop computer, smartphone and tablet used to access business systems represents a potential entry point into a firm’s technology environment. For hedge funds and investment firms, securing these endpoints is an important part of meeting the FCA IT requirements, protecting sensitive information and reducing operational risk.
As hybrid and remote working continue to shape the financial services sector, firms should ensure that business devices are centrally managed, appropriately secured and monitored throughout their lifecycle. Whether employees are working from the office, home or travelling, the same security standards should apply.
Depending on the firm’s operating model and risk profile, appropriate endpoint security controls may include:
- Business-managed laptops configured to an approved security baseline
- Full disk encryption
- Endpoint Detection and Response (EDR) or equivalent endpoint protection
- Anti-malware protection
- Patch and vulnerability management
- Device compliance monitoring
- Remote lock and wipe capabilities
- Controls over removable media where appropriate
- Secure device configuration standards
- Restrictions on local administrator privileges
- Mobile device management for smartphones and tablets
- An up-to-date inventory of devices used to access business systems
For organisations investing in hedge fund IT or seeking IT support for investment firms, endpoint management should extend beyond deploying antivirus software. Devices should be configured consistently, monitored continuously and updated regularly to reduce vulnerabilities that could expose confidential business or client information.
Modern device management also supports wider governance objectives. Securely managed endpoints help organisations demonstrate that appropriate technology controls are operating effectively, support incident investigations through logging and monitoring, and reduce the likelihood of disruption caused by compromised or unmanaged devices.
An experienced provider of managed IT services for hedge funds should help organisations establish consistent device management standards, automate security updates, monitor endpoint health and ensure devices remain aligned with the firm’s cybersecurity, operational resilience and governance objectives.
Ultimately, device security is about far more than protecting individual laptops. It helps create a secure, resilient and well-managed technology environment that supports day-to-day operations while helping firms satisfy the wider FCA IT requirements through effective systems and controls.
4. Cybersecurity controls
Cybersecurity is a fundamental part of the FCA IT requirements. For hedge funds and investment firms, cyber incidents can disrupt operations, expose confidential information and affect clients, investors and counterparties. Rather than treating cybersecurity as a one-off project, firms should establish security controls that are regularly reviewed and improved as risks evolve.
Depending on the firm’s business and risk profile, appropriate controls may include:
- Multi-Factor Authentication (MFA)
- Risk-based access controls
- Endpoint Detection and Response (EDR)
- Email filtering and anti-phishing protection
- Security awareness training
- Vulnerability scanning
- Patch management
- Secure backup arrangements
- Incident response planning
- Penetration testing where appropriate
- Security monitoring and alerting
- Firewall and network security controls
- Secure remote access
- Supplier security assessments
- Cyber Essentials or equivalent recognised security standards
Firms should also understand how security incidents are detected, investigated and escalated, who is responsible for responding, how evidence is preserved and when regulatory or legal notifications may be required.
For organisations seeking IT support for hedge funds or managed IT services for investment firms, effective cybersecurity is about more than deploying security software. It requires ongoing monitoring, governance and continuous improvement to support operational resilience and the wider FCA IT requirements.
5. Operational resilience
Operational resilience is a key area of regulatory focus and an important part of the FCA IT requirements for hedge funds and investment firms. Firms should be able to prevent, respond to, recover from and learn from operational disruption while continuing to deliver their Important Business Services.
This begins with identifying the people, processes, technology, facilities and third-party providers that support those services.
For many hedge funds and investment firms, Important Business Services may include:
- Portfolio management
- Trading or order management
- Investor reporting
- Client communications
- Regulatory reporting
- Fund accounting
- Payment authorisation
- Access to market data
- Compliance monitoring
- Cyber incident response
- Access to critical business records and documentation
Firms should then assess the impact of disruption by asking questions such as:
- How long could email or Microsoft 365 be unavailable before serious harm occurs?
- What happens if a cloud provider experiences an outage?
- How would the business operate if staff could not access the office?
- What if a privileged user account was compromised?
- How would the firm respond if a critical technology supplier became unavailable?
Operational resilience extends beyond backup and disaster recovery. It requires firms to understand dependencies, test severe but plausible scenarios, identify vulnerabilities and continually improve their ability to deliver important business services during disruption.
6. Backup, disaster recovery and business continuity
Cloud platforms improve resilience, but they do not remove a firm’s responsibility for protecting business-critical data. As part of the FCA IT requirements, firms should understand what data is backed up, how often backups occur, how long they are retained, where they are stored and how quickly systems can be restored following disruption.
Depending on the firm’s business and recovery objectives, appropriate arrangements may include:
- Backup of Microsoft 365 and other business-critical systems
- Defined Recovery Time Objectives (RTOs)
- Defined Recovery Point Objectives (RPOs)
- Encrypted backup storage
- Off-site or cloud replication
- Immutable backups where appropriate
- Regular restore testing
- Documented disaster recovery procedures
- Defined escalation procedures
- Monitoring and reporting of backup success and failures
Business continuity extends beyond protecting data. Firms should understand how they would continue delivering Important Business Services during cyber incidents, cloud outages, power failures, office closures or supplier disruption. Backup, disaster recovery and business continuity plans should be reviewed and tested regularly to ensure they remain aligned with the firm’s operational resilience objectives
7. Data protection, confidentiality and encryption
Protecting confidential information is a fundamental part of the FCA IT requirements. Hedge funds and investment firms routinely process commercially sensitive data, including investor information, trading strategies, financial records, board papers and employee data. Appropriate technical controls help safeguard that information against unauthorised access, loss or disclosure.
Depending on the firm’s business model and risk profile, these controls may include:
- Encryption of data at rest and in transit
- Role-based access controls
- Secure file sharing
- Controls over personal email forwarding
- Managed external sharing
- Data classification where appropriate
- Secure disposal of retired devices
- Retention and deletion policies
- Audit logging
- Data Loss Prevention (DLP) controls where appropriate
- Secure backup and recovery
- Regular staff security awareness training
Good data protection is not solely about complying with data protection legislation. It also supports client confidentiality, investor due diligence, operational resilience and the wider FCA IT requirements by helping firms maintain the integrity and security of their information throughout its lifecycle.
8. Recordkeeping and communication capture
Recordkeeping is an important regulatory requirement for many investment firms and forms part of the FCA IT requirements where communications relate to regulated activities. Depending on the firm’s business, this may include recording and retaining telephone conversations and electronic communications relating to investment decisions, client instructions and transactions.
Firms should consider:
- Which communications are subject to recordkeeping requirements
- Which communication channels are approved for business use
- Whether communications can be captured, retained and retrieved
- Whether the use of unapproved communication channels is restricted or appropriately governed
- Whether recordkeeping policies are clearly documented and understood
- Whether monitoring arrangements are proportionate and documented
- Whether records can be produced promptly during regulatory enquiries, audits or investigations
Platforms such as Microsoft Teams, SMS and WhatsApp are not prohibited by the FCA. However, where communications are subject to regulatory recordkeeping obligations, firms should ensure they can be appropriately retained, supervised and retrieved in accordance with their regulatory responsibilities.
An experienced provider of IT support for hedge funds should help implement the technical controls needed to support the firm’s communication and recordkeeping policies, reducing compliance risk while enabling employees to collaborate securely.
9. Outsourcing and third-party management
Outsourcing technology services does not transfer a firm’s regulatory responsibilities. As part of the FCA IT requirements, hedge funds and investment firms remain accountable for ensuring that outsourced providers support appropriate governance, security and operational resilience.
Before appointing an IT service provider, cloud provider or software vendor, firms should carry out appropriate due diligence and maintain ongoing oversight throughout the relationship.
Areas to assess include:
- Experience supporting FCA-regulated or financial services firms
- Information security certifications and standards
- Data hosting locations
- Backup and disaster recovery capabilities
- Access to audit evidence and reporting
- Incident response arrangements
- Use of subcontractors and supply chain dependencies
- Service levels and escalation procedures
- Exit planning and data portability
- Governance and service review meetings
- Business continuity capabilities
- Cybersecurity standards
- Insurance arrangements
- Staff vetting and privileged access controls
- Ability to support regulatory enquiries, audits and investor due diligence
For organisations looking for managed IT services for hedge funds or IT support for investment firms, technical capability alone should not be the deciding factor. The right provider should understand the regulatory environment and help strengthen the firm’s governance, operational resilience and technology controls throughout the relationship.
10. Incident response and reporting
No firm can eliminate the risk of operational or cyber incidents entirely. As part of the FCA IT requirements, hedge funds and investment firms should have clear procedures for identifying, containing, escalating and recovering from incidents, while meeting any applicable regulatory reporting obligations.
An incident response plan should consider scenarios such as:
- Cyberattacks
- Data breaches
- Ransomware
- Business email compromise
- Lost or stolen devices
- Cloud service outages
- Third-party supplier failures
- Unauthorised access
- Data loss
- System outages
- Communication failures
The plan should clearly define:
- Roles and responsibilities during an incident
- Escalation procedures
- When and how the IT service provider should be engaged
- Senior management reporting arrangements
- Legal, compliance and insurer notification procedures
- Whether an incident meets the FCA’s operational incident reporting thresholds
- Procedures for preserving evidence
- Client and investor communication arrangements where appropriate
- System recovery procedures
- Post-incident reviews and lessons learned
An incident response plan should be tested regularly through tabletop exercises or similar simulations to ensure teams understand their responsibilities and the organisation can respond effectively when an incident occurs.
11. AI and emerging technology
Artificial intelligence (AI) is becoming an increasingly important part of financial services, supporting activities such as research, document drafting, compliance monitoring and operational analysis. While the FCA has not introduced AI-specific rules, firms remain responsible for ensuring that AI is used in a way that supports the FCA IT requirements, including appropriate systems and controls, governance and operational resilience.
When adopting AI technologies, firms should consider:
- Which AI tools employees are authorised to use
- Whether confidential or regulated information can be entered into AI systems
- Whether AI-generated outputs are subject to appropriate human review
- Whether AI-assisted decisions can be explained where necessary
- Whether AI creates additional recordkeeping obligations
- Whether AI providers introduce outsourcing or third-party risks
- Whether AI use is addressed within internal policies and governance frameworks
- How data submitted to AI platforms is stored, retained or used
- Whether employees understand the risks associated with AI
AI should form part of the firm’s wider governance framework rather than being treated as a standalone technology initiative. As AI adoption continues to evolve, firms should regularly review how these tools are used to ensure they remain aligned with security, operational resilience and regulatory expectations.
What should an IT service provider do for an FCA-regulated firm?
For hedge funds and investment firms, an IT service provider should do more than resolve technical issues. The right provider should help build and maintain a secure, resilient and well-governed technology environment that supports the firm’s operational needs and the wider FCA IT requirements.
While responsibility for regulatory compliance always remains with the regulated firm, an experienced provider of IT support for hedge funds or managed IT services for investment firms can help implement and maintain the technology controls that support governance, cybersecurity and operational resilience.
A capable IT provider should typically support the following areas:
Secure technology environment
Designing, implementing and managing secure technology platforms, including Microsoft 365, user identities, managed devices, email security, endpoint protection, secure file sharing and backup solutions.
Cybersecurity
Implementing appropriate security controls, including identity and access management, endpoint protection, vulnerability management, security monitoring, patch management, phishing protection and user awareness training.
Operational resilience
Supporting backup and disaster recovery, business continuity planning, resilience testing and the management of critical technology suppliers to help minimise disruption to Important Business Services.
Documentation and reporting
Providing technical documentation and reporting that supports governance, investor due diligence, cyber insurance applications, internal audits and regulatory enquiries.
This may include:
- Network documentation
- Asset inventories
- Backup and recovery reports
- Security configuration summaries
- Identity and access management records
- Disaster recovery procedures
- Patch management reports
- Device compliance reports
- Service performance reporting
Ongoing support
Providing proactive monitoring, routine maintenance, technical support and continuous improvement to help ensure the technology environment remains secure, resilient and aligned with the firm’s changing business and regulatory requirements.
Strategic technology advice
Supporting technology planning, cloud migrations, cybersecurity improvements, regulatory change and long-term IT strategy rather than simply reacting to day-to-day support requests.
What should you look for in an MSP proposal?
Choosing a provider of managed IT services for hedge funds involves more than comparing pricing or support hours. For FCA-regulated firms, the quality of the provider’s security expertise, governance processes and understanding of financial services can have a direct impact on operational resilience and risk management.
A strong proposal should clearly explain the provider’s approach to the following areas.
1. Financial services experience
The provider should demonstrate experience supporting hedge funds, investment managers and other FCA-regulated firms, with an understanding of operational resilience, information security, outsourcing and investor due diligence.
2. Security by design
The proposal should explain how the provider secures Microsoft 365, identities, endpoints, email, backups and business-critical systems, rather than treating cybersecurity as an optional add-on.
3. Service levels and support
Look for clearly defined support hours, service level agreements (SLAs), response times, escalation procedures and incident management processes.
4. Backup and recovery
The provider should explain its approach to backup, Recovery Time Objectives (RTOs), Recovery Point Objectives (RPOs), restore testing and disaster recovery, together with how these arrangements support operational resilience.
5. Reporting and documentation
The proposal should outline the reporting and technical documentation provided to support governance, audits, regulatory enquiries and investor due diligence.
6. Cybersecurity capability
Look for evidence of vulnerability management, endpoint security, phishing protection, security monitoring, incident response and ongoing security reviews.
7. Cloud expertise
Many firms rely on Microsoft 365 and other cloud platforms. The provider should demonstrate how these environments are configured, secured and managed to support the firm’s operational and regulatory requirements.
8. Outsourcing transparency
The proposal should explain where data is hosted, how third-party suppliers are managed, which subcontractors are involved and how services can be transitioned if the relationship ends.
9. Business continuity and operational resilience
A capable provider should support resilience planning, disaster recovery testing and business continuity, not just day-to-day technical support.
10. Partnership
The best providers of IT support for investment firms act as long-term technology partners, offering proactive advice, regular service reviews and continuous improvement as the firm’s needs evolve.
How Tivarri supports FCA-regulated firms
Tivarri provides managed IT services for hedge funds, investment firms and other FCA-regulated organisations, helping them build secure, resilient and well-governed technology environments that support both business operations and the wider FCA IT requirements.
Rather than focusing solely on day-to-day technical support, we help firms implement practical technology controls that strengthen cybersecurity, improve operational resilience and support long-term business growth.
Our services include:
- Microsoft 365 configuration and management
- Modern Desktop environments
- Hosted Desktop and Virtual Desktop Infrastructure (VDI)
- Windows 365 Enterprise Cloud
- Private cloud and UK-hosted infrastructure
- Cybersecurity services
- Multi-Factor Authentication (MFA) and identity management
- Endpoint protection and device management
- Backup and disaster recovery
- Business continuity planning
- Cyber Essentials readiness and support
- Cybersecurity awareness training
- Fractional CTO services
- Incident response planning
- Compliance-ready technical documentation and reporting
- Support for regulatory reviews and investor due diligence
As a provider of IT support for investment firms, Tivarri combines Microsoft cloud expertise with deep experience supporting regulated organisations. We are ISO 27001:2022 certified and Cyber Essentials certified, helping firms implement technology environments that are secure, scalable and aligned with regulatory expectations.
Whether your team works from the office, remotely or across multiple locations, our approach is to deliver technology that supports security, productivity and operational resilience without adding unnecessary complexity.
Speak to Tivarri
Whether you’re launching a new hedge fund, preparing for FCA authorisation, reviewing your existing technology environment or looking for IT support for hedge funds, Tivarri can help.
We provide managed IT services for hedge funds, investment firms and other FCA-regulated organisations, designing secure, resilient and well-governed technology environments that support both day-to-day operations and the wider FCA IT requirements.
Our team specialises in Microsoft 365, cybersecurity, cloud infrastructure and operational resilience, helping firms strengthen security, improve productivity and prepare for regulatory reviews, investor due diligence and business growth.
If you’re looking for an experienced provider of IT support for investment firms, speak to Tivarri about building a technology environment that supports your business today and as it evolves.