The technology problems that actually bite small advice firms

A client is releasing tax-free cash, or funding an ISA, or settling an adviser charge. They get an email that reads exactly like the last dozen — your signature, your turn of phrase, the right reference — telling them the account details have changed. They send it. Nobody notices for a fortnight.

You are not a bank and you may never touch client money at all, which is precisely why this is dangerous: the money moves on your say-so without passing through anything you control. When it goes wrong the client does not say “I was defrauded”, they say “my adviser told me to send it there” — and that is a complaint, a Financial Ombudsman file and a PI notification, whether or not your systems were ever breached. Frequently they were not. The attacker is often sitting in the client’s own webmail reading a thread you are only one participant in. The FCA’s own consumer warnings are dominated by exactly this pattern: cloned firms and impersonated advisers using details that check out against the Register.

One document holds the client’s income, their debts, their bank details, their date of birth, their National Insurance number, their marriage, their children, their will — and, if there is any protection business, their medical history.

Most small businesses hold personal data. You hold the set a fraudster would design if they could. And the moment protection or health-related underwriting is in the file, you are processing special category data under Article 9 of the UK GDPR, which needs a lawful basis of its own and carries a materially higher standard of care. The practical failure I find is not encryption — it is location. The fact-find exists in the back-office system, in an email attachment, in a scan on the office multifunction device, in a folder on the adviser’s laptop, and in the paraplanner’s downloads. Five copies, one of which is protected properly.

The back-office system is somebody else’s cloud. The platform is somebody else’s. The cashflow modeller, the risk profiler, the paraplanner and — if you are appointed representative — most of the compliance stack all belong to other people.

That is a sensible way to run a small firm, and it is not the problem. The problem is the assumption that goes with it: that because the system belongs to someone else, so does the risk. It does not. Under SYSC 8 the firm remains responsible for outsourced functions, and the Consumer Duty makes the point again in plainer language — where you can reasonably foresee harm to a retail client you are expected to act on it, including in arrangements you did not build. In practice that means you are answerable for a provider whose security you have never asked a single question about, reached through a login you cannot see the MFA status of, holding data you could not extract in a hurry if the relationship ended badly.

The PI renewal now asks whether you use MFA. The network’s annual return asks about backups. And there is a new FCA reporting regime coming that your compliance consultant has probably mentioned once.

These used to be questions a director could answer from memory. They are now technical assertions somebody has to be able to evidence, and increasingly they are pass or fail rather than best endeavours. Four dates and scope points worth having straight — including the one that does not apply to you:

• From 18 March 2027, FCA rules on operational incident reporting apply to all firms with a Part 4A permission. There is no small-firm exemption. A reportable incident goes to the FCA via Connect as soon as practicable, and no later than 24 hours after you decide it meets a threshold.
• The material third-party register in that same policy statement does NOT apply to a small advice firm — it is limited to Enhanced-scope SM&CR firms and other larger categories. Anyone telling you a three-adviser practice must file one is selling something.
• Nor do the operational resilience rules (PS21/3), with their important business services and impact tolerances, apply to a Core-scope firm. Your platform and your network are caught. You are almost certainly not.
• Separately and already in force, SUP 15.3 and Principle 11 require you to tell the FCA about significant breaches and about fraud, errors and irregularities — which is where a serious cyber incident lands today, in advance of the 2027 regime.
• From 26 April 2026, Cyber Essentials v3.3 makes missing MFA on cloud services an automatic fail, as is failing to apply critical and high-risk updates within 14 days. Relevant if a client, a network or an insurer asks you to hold it.

A complaint arrives about advice given in 2019. The adviser who gave it has retired. The back-office system has been migrated once since then.

Almost every other business can let old records rot. You cannot. The Financial Ombudsman can consider a complaint referred within six years of the event, or — if later — three years from when the client became aware they had cause to complain, and that second limb is what makes the true tail so much longer than six years. Your defence in every one of those cases is the file: the fact-find, the research, the suitability report, the disclosure, and the emails around them. If any part of that lives only in a former adviser’s deleted mailbox, or in a system you migrated out of without a readable export, then you do not have a defence — you have a recollection. Microsoft 365 will not save you here either: deleted items empty after 30 days by default, and a deleted mailbox is gone in 30.

There is a backup. It runs overnight and emails a report. Nobody has read the report in a year, and nobody has ever restored anything from it.

Two gaps, and the second one surprises people. First, an untested backup is a belief rather than a control. Second, Microsoft does not back up your Microsoft 365 — Microsoft keeps the service running, and keeping your data is your side of the bargain. If an intruder empties a SharePoint library or a leaver clears a mailbox, then past the retention window it is simply gone. And the scale of what a breach of pension and financial records now costs is no longer theoretical: the ICO’s largest recent penalty in this space was against an outsourcer whose stolen data included pension records.

Three people, one shared login for the provider portal everybody needs, and the administrator knows the director’s password because otherwise nothing gets done on a Friday.

You lose attribution. When something goes wrong — an instruction submitted, a document altered, a client record changed — you cannot say who did it, and in a regulated firm that is precisely the answer you most need to have. Shared accounts cannot be properly protected with MFA and are never removed when someone leaves. The route in is rarely dramatic: the ICO fined a small professional firm £60,000 after attackers walked in through an infrequently used administrator account that had no MFA on it. That is not a sophisticated attack. That is a forgotten account.

There is a server, or an old desktop acting as one. It holds the archive from before the current back-office system, the scanned files, and the shared drive everyone maps to.

It is a single point of failure sitting in the same building as any fire, flood or burglary, and if the operating system has gone out of support it will fail Cyber Essentials on its own account. It is also precisely where ransomware wants to land, because every workstation in the office has a drive mapped to it. The particular problem for an advice firm is what is on it: the pre-migration archive is usually the oldest material you hold, which makes it the material most likely to be demanded in a complaint and the least likely to have been looked at this decade.

An adviser has a two-hour client meeting to write up and a review pack to prepare. There is a free tool one click away that will summarise the recording in thirty seconds.

There is no good reason advice firms should not use AI, and plenty of reasons they should. But the firm stays responsible for the output, the Consumer Duty still applies to what the client is eventually told, and the moment a client-identifiable fact-find or meeting recording goes into a consumer service you have engaged a third-party processor with no data processing agreement, no retention position and — if there is any health information in it — special category data in a place you cannot account for. The realistic risk is not a dramatic leak. It is that when a client, your network or your PI insurer asks whether client data has gone into AI tools, nobody in the firm can answer.