Azure for financial services
Azure for financial services: built to the FCA’s expectations, sized for a firm of ten to fifty
Microsoft Azure for financial services firms that are regulated by the FCA and don’t have an IT department: wealth managers, IFAs, mortgage and finance brokers, small lenders and payment firms. Designed by a Microsoft partner who has run cloud infrastructure for regulated organisations a great deal bigger than yours, and delivered as fixed-price projects with the compliance evidence written as we go.
Microsoft partner, independent. Twenty years of cloud and security architecture in regulated environments. UK data regions only. Fixed price, scoped first.
What the FCA expects when a regulated firm uses Azure
The FCA has never said a financial services firm can’t use the cloud. Its guidance on outsourcing to the cloud (FG16/5) and the outsourcing rules in SYSC 8 say the opposite: you can, provided you understand what you’ve outsourced, you can get your data back, you know where it lives, and the regulator can still see what it needs to. The operational resilience rules (PS21/3, in force since March 2022 with the transition finished in March 2025) add the sharper question: if Azure, or your connection to it, went down, how long before clients were harmed, and can you prove you’d be back inside that time?
Consumer Duty makes the same point from the client’s side. An outage that stops advisers seeing a portfolio, or a breach that exposes client files, is a Consumer Duty problem as well as an IT one. And the ICO’s UK GDPR expectations sit over all of it: client data in the UK, access limited to the people who need it, and a record of who saw what.
None of that is beyond a firm of fifteen people. It just has to be designed in rather than bolted on, and written down as it’s built.
Azure compliance for financial services: Microsoft’s job and yours
Microsoft’s side is well covered. Azure holds the certifications FG16/5 asks you to review and publishes its FCA and PRA compliance documentation. It runs two UK regions, UK South and UK West. And it offers regulated customers a Financial Services Amendment to its terms covering audit rights, access and notification, the things the FCA’s outsourcing guidance says your contract must deal with. That’s what people mean when they search for the “Azure financial services addendum”.
Your side is everything Microsoft can’t see. How the subscription is organised. Who can sign in, and from what. Where resources are allowed to be created. Whether backups have ever been restored, whether the logs the FCA might ask for are being kept, and whether anyone has written down how you’d leave. This is the shared responsibility model, and it’s where most small regulated firms are exposed. Not because Azure is insecure, but because the configuration was done by whoever set it up and nobody has looked since.
Azure compliance for a financial services firm is that second half, done properly and documented. It’s the whole of what we do on this page.
Azure services for financial services firms, as fixed-price projects
Each one scoped and quoted first, with the regulatory evidence produced as part of the work rather than as an extra.
Azure landing zone for financial services
The foundation: management groups, UK-only regions enforced by policy, network segmentation, logging switched on and retained, and a naming standard so the outsourcing register writes itself. Everything else sits inside it.
Azure Virtual Desktop for advisers
A Windows desktop in Azure with the portfolio, CRM and back-office systems on it. Client data never lands on a home laptop, sign-in is tied to the person and the device, and every session is logged.
Migration to Azure
The office server, the file store, the line-of-business application. Assessed first, moved inside the landing zone with minimal downtime, and retired where Microsoft 365 already does the job.
Backup and operational resilience
Azure Backup with immutable copies, replication between UK South and UK West where the impact tolerance needs it, and a restore test that produces a recovery time you can put in front of the FCA.
Identity and access
Multi-factor sign-in for everyone, conditional access on the Azure portal and the desktops, privileged access limited and reviewed, leavers removed the day they leave. The controls the FCA’s data security questions assume.
The compliance pack
Outsourcing register entry, data location statement, exit plan, architecture on one page, access review record, test evidence. Written as the build goes, so the SUP 15 notification and the next audit are documents, not projects.
Eight things the FCA’s questions will assume you can show
Use this against your current Azure setup, or the one a previous provider left you. Each is a yes or a no. If you’re at five or fewer, that’s what the first month of work fixes, and it’s worth knowing whether you ever ring us or not.
- An outsourcing register that names Azure, what runs on it, and who owns the relationship.
- A one-line answer to “where is client data physically held”, with the policy that enforces it.
- An exit plan: how you’d get the data out, in what format, and how long it would take.
- Multi-factor sign-in on every account that can reach client data or the Azure portal.
- An impact tolerance for each important business service, and a test result showing you’re inside it.
- A backup that has been restored at least once, with the date and the time it took.
- An access review in the last twelve months, with leavers actually gone.
- Logs of who signed in and what changed, retained long enough for the FCA to ask.
Can’t tick all eight? That’s the usual starting point. Ready to talk? Ring Eric on 0151 452 3060 and he’ll tell you which gaps matter first and what closing them involves.
Who Azure for financial services is for
The firm of ten to fifty people that’s regulated like a bank and staffed like a small business. Wealth managers and discretionary fund managers. Independent financial advisers and networks of appointed representatives. Mortgage, commercial finance and asset finance brokers. Small lenders, payment and e-money firms, claims and debt firms under FCA supervision. The common shape is a compliance officer who’s also a director, a handful of advisers who work from home two days a week, a back-office system the whole firm depends on, and nobody whose job is the IT.
The work is remote first. Azure lives in a browser and so does most of what we do to it. When a migration weekend or a server switch-off needs somebody in the room, the visit is scheduled and it’s in the quote. Firms across the North West and everywhere else in the UK.
What Azure for a financial services firm costs
Projects are fixed price, scoped and quoted before anyone starts, with the scope written down so there’s nothing to argue about later. Azure consumption is billed by Microsoft at Microsoft’s price and we don’t mark it up. If what’s built needs looking after afterwards, that’s priced per box and it’s optional.
Most regulated small firms find the landing zone plus Azure Virtual Desktop is the whole job, and that the compliance pack pays for itself the first time an auditor, an insurer or the FCA asks.
Azure for financial services, priced in the open
Scope written down before anyone starts.
Azure for financial services: the questions regulated firms ask first
Is Microsoft Azure FCA compliant?
No cloud platform is "FCA compliant", because the FCA regulates your firm, not Microsoft. What Microsoft provides is the evidence you need to meet the FCA's outsourcing guidance: its FCA and PRA compliance documentation, UK data centre regions, audit and access rights through its Financial Services Amendment, and the certifications the guidance asks you to review. Compliance is how your Azure environment is configured, documented and run. That part is yours, and it's the part we do.
Do we have to tell the FCA we're moving to Azure?
If Azure will host something the FCA would treat as a material outsourcing, yes: the SUP 15 rules expect you to notify the regulator, and FG16/5 sets out what they expect you to have considered first. Most firms of ten to fifty people find the notification straightforward once the outsourcing register, exit plan and data location are written down. We produce those as part of the build, so the notification is a form rather than a project.
Where does our client data physically sit?
In the UK. Azure has two UK regions, UK South and UK West, and a financial services landing zone pins every resource to them with Azure Policy so nothing can be created elsewhere by accident. That answers the ICO question and the FCA question in one line, and it's written into the documentation you'd show either of them.
What about operational resilience and impact tolerances?
The FCA's operational resilience rules ask you to name your important business services, set an impact tolerance for each (how long an outage is bearable before it harms clients), and prove you can stay inside it. In Azure that becomes a design decision: which services are replicated between UK South and UK West, how fast backup restores, and a test that shows the recovery time rather than asserts it. We build to the tolerance you've set and give you the test evidence.
Can our advisers work from home securely?
Yes. Azure Virtual Desktop gives each adviser a Windows desktop in Azure with the portfolio and back-office systems on it, so client data never lives on a home laptop. Sign-in is tied to the person and the device through conditional access, and sessions are logged. It's the cleanest answer to the FCA's data security expectations for a firm whose people aren't all in one office.
What does Azure for a financial services firm cost?
Fixed price, quoted before anyone starts, with the scope written down. A landing zone build, a migration or an Azure Virtual Desktop deployment is each a fixed-price project. Azure consumption is billed by Microsoft at Microsoft's price, unmarked. Ongoing management of what's built is optional and priced per box.
Does DORA apply to us?
DORA is the EU's Digital Operational Resilience Act and it applies from 17 January 2025 to financial entities in the EU. A UK firm with an EU entity, or serving EU clients through one, may be in scope for that entity. If that's you, the same landing zone, register and testing evidence built for the FCA's rules covers most of what DORA asks for, and we'd say so on the call rather than sell you a second project.
Have a chat with Eric
Fifteen minutes with Eric. Bring the last FCA or insurer questionnaire if that’s what started this.
That didn’t send. Ring 0151 452 3060 and you’ll get me directly, or email [email protected].
Azure for financial services, with the evidence written as it's built
Landing zones, virtual desktops and migrations for FCA-regulated firms of ten to fifty, from a Microsoft partner who's run it at scale. Fixed price, UK regions only, remote first.