UK AR Technology Checklist

HM Treasury's February 2026 consultation proposes that authorised firms must obtain specific FCA permission before appointing ARs. Around 34,000 ARs currently operate under approximately 2,400 principal firms. This regime tightening means hosts will become more selective about which ARs they accept, and technology infrastructure is one of the key differentiators.

Your technology stack demonstrates genuine business substance — not reliance on your host's systems for everything. An AR that uses its own deal analysis platform, document management, and communications infrastructure signals an operation that is building toward direct authorisation, not a mailbox arrangement looking for regulatory cover.

Prepare for SMCR extension to ARs. The proposed reforms would apply Senior Managers and Certification Regime conduct rules to AR personnel (other than ancillary staff). This means your team members may need to meet fitness and propriety requirements, and your technology must support the governance and record-keeping that SMCR demands.

The CTP regime (PS24/16, November 2024) introduces six fundamental rules for designated providers, similar to the high-level principles in the FCA Handbook. HM Treasury will make designation orders specifying which providers are subject to the regime. While specific designations have not yet been announced, the largest cloud providers (AWS, Microsoft Azure, Google Cloud) are widely expected to be in scope.

For fund managers, CTP designation of your cloud provider means additional due diligence obligations, potential regulatory interest in your technology architecture, and the requirement to demonstrate that you have assessed and mitigated concentration risk. The FCA has signalled that final rules on incident reporting and third-party risk management, expected in 2026, will introduce more granular obligations for monitoring cloud provider resilience.

Self-hosted technology infrastructure eliminates CTP designation risk entirely because no third-party cloud provider is involved in processing your fund's data. This is a meaningful differentiator in LP due diligence conversations — particularly with institutional investors who are themselves managing CTP-related compliance burdens.

New third-party reporting rules take effect on 18 March 2027. Firms will be required to report material third-party arrangements to the FCA, enabling the regulator to monitor concentration risk across the sector. Start documenting your third-party arrangements now to be ready.

LP operational due diligence teams specifically assess your investment analysis process. They want to see a systematic workflow: how opportunities are sourced, screened, analysed, presented to the investment committee, and monitored post-investment. A platform that produces auditable, timestamped analysis with source document links satisfies this requirement. A folder of spreadsheets does not.

Adversarial verification is particularly valuable for ARs building track record. When your deal analysis platform flags contradictions and unsubstantiated claims automatically, it demonstrates analytical rigour that differentiates you from other emerging managers. Every verified claim and every flagged contradiction becomes evidence of your investment process quality.

Your regulatory host may require visibility into your deal analysis process as part of their oversight obligations. Ensure your platform supports appropriate access controls that allow host compliance teams to review your analyses without compromising deal confidentiality.

Conduct a Data Protection Impact Assessment (DPIA) for any processing activity that is likely to result in a high risk to individuals. This includes systematic monitoring of publicly accessible areas (deal sourcing), automated decision-making with significant effects, and large-scale processing of special category data. Document the assessment even if you conclude the processing is low risk.

Data processing agreements are legally required under UK GDPR Article 28 for any processor handling personal data on your behalf. This includes your cloud hosting provider, email provider, CRM system, deal analysis platform (if cloud-hosted), and any other SaaS tool that processes personal data. Self-hosted infrastructure reduces the number of processor relationships you need to manage.

Data subject access requests (DSARs) must be responded to within one calendar month. Your technology must support rapid search and retrieval of personal data across all systems. If an investor, portfolio company executive, or counterparty submits a DSAR, you need to identify and produce all personal data you hold about them within the timeframe.

Important business services for a fund manager typically include: investment analysis and decision-making, trade execution, client reporting, NAV calculation (via fund administrator), regulatory reporting, and LP communications. For each, define the maximum tolerable duration of disruption before serious harm to clients or market integrity occurs.

The FCA referenced the CrowdStrike outage (July 2024) as a lesson in operational resilience, noting that firms must understand their technology dependencies and have tested alternatives. A single point of failure in your technology stack that disrupts an important business service is a regulatory deficiency, not just an operational inconvenience.

Operational resilience extends to your third-party dependencies. If your fund administrator's systems go down, can you still produce basic investor reports? If your cloud provider has a region-wide outage, how long before your operations resume? Document these dependencies and have tested alternatives.

Consumer Duty applies to all products and services offered to retail customers. For ARs operating in investment management, this typically covers fund products, advisory services, and portfolio management. Your technology must support evidence generation — demonstrating that fees provide fair value, that communications are clear and not misleading, and that products are designed to meet the target market's needs.

Assessment of value requires ongoing comparison of your fees against outcomes delivered. Your reporting systems should track net-of-fee performance, fee breakdowns by component (management fees, performance fees, fund expenses), and comparisons against appropriate benchmarks. The FCA has indicated that outlier funds offering poor value relative to charges will face supervisory engagement.

Product governance under Consumer Duty requires documented target market definitions, distribution strategy alignment, and ongoing monitoring. Your technology should support tracking of whether your investor base aligns with your target market and flagging any distribution outside that market.

Investor onboarding must include identity verification, source of funds documentation, sanctions screening, and PEP (Politically Exposed Persons) checks. Manual processes using spreadsheets and email create gaps that the FCA will identify during inspection. Implement a structured KYC workflow with audit trail from first LP conversation.

Ongoing monitoring is as important as onboarding. Sanctions lists change daily. Your technology must support regular rescreening of existing investors against updated sanctions lists and adverse media. The frequency should be risk-proportionate — at minimum monthly for standard risk, daily for higher-risk relationships.

Suspicious Activity Reports (SARs) must be filed with the National Crime Agency (NCA) when you have knowledge or suspicion of money laundering or terrorist financing. Your technology should support confidential SAR preparation and filing without alerting the subject (tipping-off is a criminal offence).

NCSC Cyber Essentials certification provides a baseline cybersecurity standard recognised across UK government and financial services. Cyber Essentials Plus includes independent verification of your controls. For an AR building credibility, Cyber Essentials Plus certification is a tangible, verifiable credential to present in LP ODD reviews.

At minimum, implement MFA on all systems, full-disk encryption on all devices, regular patching (within 14 days of release for critical patches per Cyber Essentials), network segmentation between fund operations and general office, and incident response procedures tested annually.

Penetration testing should be conducted annually by an independent assessor. Consider CREST-accredited testers for maximum credibility with institutional LPs and regulatory hosts. Document findings and track remediation actions to demonstrate continuous improvement.

Under the existing regime (SYSC 8.1.12 and SYSC 13.9.2), firms must already notify the FCA of critical, important, or material outsourcing arrangements. The March 2027 rules formalise and expand this into a structured reporting framework. Your third-party register should already be in place.

For each material third-party arrangement, document: what service they provide, what data they access, their geographic location, your contractual protections (SLAs, data processing agreements, liability provisions, exit clauses), your fallback if the provider fails, and when the arrangement was last reviewed. The FCA webinar on 29 April 2026 provided detailed guidance on these requirements.

Incident reporting rules will require timely notification of significant technology incidents to the FCA. Define what constitutes a reportable incident for your firm, establish notification templates, and designate responsible individuals before the rules take effect.

Business continuity planning for an AR covers the same scenarios as any fund manager: loss of office, loss of personnel, technology failure, and service provider failure. Document response procedures, responsible individuals, and recovery timelines for each. Test the plan annually with a tabletop exercise.

Change management is receiving increased FCA attention. With reforms covering the AR regime itself, Consumer Duty evolution, third-party reporting, CTP regime, fund regulatory overhaul, and operational resilience — all active in 2026 — the FCA expects boards to oversee structured change management with clear ownership, appropriate budgeting, and regular progress reporting.

For an AR, demonstrating mature change management signals to your host that you can absorb regulatory change without creating compliance gaps. Document how you identify upcoming regulatory changes, assess their impact on your operations, plan implementation, allocate resources, and verify completion.